FortyNorth Security Blog (Page 2)

04 May 2020 Quick Guide to Security Headers - Part One

A month ago, we finished a series of six web application assessments for local and regional banks. In addition to common web vulnerabilities, like SQLi, we

27 April 2020 Remotely Host MSBuild Payloads

tl;dr Separate your C# payload from a MSBuild XML file and host it remotely on a WebDav server. Red teams and attackers frequently repurpose MSBuild,

20 April 2020 EyeWitness - Potential Modifications

This is the second post in relation to the new .Net implementation of EyeWitness and it will cover a few things that you should possibly do

14 April 2020 Ngrok for Local Infrastructure

IntroductionHello, meet ngrok (https://ngrok.com/), an easy way to tunnel traffic from a local machine (i.e. VM) to an external address. With ngrok, you

06 April 2020 MiddleOut: a C# Compression Tool

MiddleOut (a salute to Silicon Valley) is a tool written in C# that compresses any number of files passed to it. I wanted to learn .Net

01 April 2020 EyeWitness - Looking Sharp

Ever since its initial release, EyeWitness has only had a Linux version (originally in Python 2, and now in Python 3). This has proven very useful

23 March 2020 Introducing C2concealer: a C2 Malleable Profile Generator for Cobalt Strike

C2concealer is a python3 command-line tool that generates c2 malleable profiles for use with Cobalt Strike. Looking to get up and running quick? Code is available

12 March 2020 Azure Functions - Functional Redirection

A few months ago, we decided to look into additional options that exist for command and control (C2), specifically what we can use for "redirectors". We

24 February 2020 Another MSBuild Invocation (February 2020 Edition)

TL;DR: Use MSBuild’s UnregisterAssembly task to execute arbitrary code in a .NET assembly. A few weeks ago, Casey Smith (@SubTee) tweeted this out: Followed

10 February 2020 Intro To The Proxmark3 RDV4: Part 2 - First Run on Kali

In this post we'll go through connecting the proxmark (and fixing any issues) on a fresh Kali 2019.4 install, and updating all aspects of the

27 January 2020 Intro To The Proxmark3 RDV4: Part 1 - BT/Battery Module Installation

In this post, we'll go over installing the bluetooth/battery module on a brand new Proxmark3 RDV4. The optional module is a great addition to the

13 January 2020 The Security of DevSecOps - Jenkins

Jenkins is an open source application which is nearly always targeted by attackers, but is also incredibly useful when used legitimately. It can help automate test

31 December 2019 Cobalt Strike 4.0 - HTTP Variants

We can all celebrate that the 4.0 release of Cobalt Strike has happened before the holidays, and with it comes some really useful changes! One

16 December 2019 The Security Of DevSecOps - Terraform Authentication

In the first blog post of our DevSecOps series, we talked about looking at security considerations for the Terraform code and the data within it. For

04 December 2019 The Security of DevSecOps - Terraform Code

This past October, I had the opportunity to speak with Robin Wood (@digininja) about “The Security of DevSecOps” at Wild West Hackin Fest in Deadwood, South

09 October 2019 Python3 EyeWitness

EyeWitness is a tool that has been around for many years and has seen many updates (huge shout out to Rohan (@cptjesus) for all of his

03 September 2019 PowerShell, Azure, and Password Hashes in 4 steps

In our previous blog post, we talked about how you can obtain the password hashes from a Domain Controller within Azure without ever needing to interact

19 August 2019 Obtain D.C. Hashes within Azure in 4 Easy Steps

Extraction without InteractionA while back, I read this article from @_StaticFlow_ about a tool release for stealing hashes from a domain controller running in AWS. I

08 August 2019 How to Bypass WDAC with dbgsrv.exe

Microsoft Applications and BlocklistNote: This blog post contains the details from Casey Smith and Ross Wolf’s BlackHat USA 2019 presentation Most application whitelisting bypasses that

24 June 2019 Aggressive MSBuild - Bypass Detection

It’s no secret that Casey Smith’s research into bypasses has changed how nearly everyone in the industry approaches testing and circumventing application whitelisting solutions.

22 April 2019 Under-the-hood: WMImplant Invoking PowerShell

WMImplant is a powerful PowerShell based tool that enables its users to conduct nearly any post-exploitation action and exclusively using WMI to do so. We’ve

18 March 2019 Jenkins - More than Just Target Practice

Jenkins Header ImageWhy JenkinsFor a while, FortyNorth Security has been exploring different options that will automate building internal tools and running tests against code as it

06 March 2019 Red Team Training - BlackHat USA 2019

Intrusion OperationsLearn About Advanced Red Teaming And Malware CustomizationHave you ever struggled conducting a red team assessment against an organization with mature security programs? Or, maybe,

25 February 2019 Apache Guacamole: How To Install and Configure

A few months ago, we had a need for an easy Remote Desktop Protocol gateway (RDP gateway), and we weren’t sure what would be best

23 February 2019 Egress-Assess: 3 Updates That You'll Love

It’s been quite some time since there’s been an Egress-Assess update and multiple developers have contributed code that helped expand its capabilities. We use