Show Notes
Hey friends! This is a tough one to write. My dad passed away on Friday, and instead of the hacker-y tech episode I had planned, I pivoted to something more personal — another installment of our "Securing Your Family During and After a Disaster" series. I talk pretty raw and transparently today about loss, grief, and the practical stuff that makes a hard situation just a little less hard. Fair warning: it's about death and dying, so if that's not where your head is today, it's totally okay to duck out – we'll catch you next week. Here's what I cover: My dad's last day — He spent Thursday doing all his favorite things: chainsaws, ATVs, trap-shooting, mowing, and weed-whipping. Then Chinese food with the family and marveling at modern video games for the first time since the Atari 5200. It was, by all accounts, a perfect day for him. How we found out — My son Cameron, who's finishing up paramedic school, was visiting and sprung into EMT mode when my dad was found unresponsive Friday morning. He did CPR for 10 straight minutes — on his grandpa, who was his favorite person in the world. That's the stuff that's going to stay with Cam (and me) for a long time. Getting some closure — Cameron had the presence of mind to ask the paramedics to leave my dad in place so I could have a few minutes with him when we arrived. That was both devastating and, in its own way, healing. Why pre-planning your funeral is a gift to your family — My parents had nearly everything already picked out: the pastor, Bible verses, music, the military honors ceremony, photos for the display board, and even a time limit on service length (45 minutes and no more!). My dad had pre-written his own obituary. When we sat down with the funeral home, the heavy lifting was already done — and that was a genuine gift to all of us in an incredibly hard moment. Storyworth — seriously, do this — Years ago we signed my dad up for Storyworth, a service that sends your loved one a weekly question via email (things like "What's your earliest childhood memory?" or "Do you have any regrets?") and compiles their answers into a hardcover book. It runs about $100. Reading that book the last few nights has been incredibly comforting — including finding out my dad started smoking at age 8 using used cigarette butts rolled in toilet paper. Gross! Get your end-of-life wishes in writing — My wife's mom had verbally told us she wanted to be cremated, but it wasn't documented, and other family members made a different call. My dad put "cremation" right in his paperwork, no ambiguity. My recommendation: have this conversation with your loved ones, write their wishes down and make them official. Funeral home "upsell" moment — I had no idea there were apparently 627 ways to incorporate your loved one's remains into keepsakes — pendants, rings, necklaces with fingerprints, biodegradable urns for water scattering, etc. Some family members were very into this. I was not quite ready to turn my dad into an Atari cartridge, but your mileage may vary. On grief itself — Everybody handles it differently, at different speeds and intensities. My approach is to head straight into it rather than put on a happy face and deal with unprocessed grief years later. I encourage everyone — especially the kids — to not hold back. Ask the questions. Tell the stories. Cry if you need to. Give each other grace. Coming up next week — Back to pentesting content! I'll share details on a new lab from the folks who brought us Game of Active Directory, and I'm getting back on the CARTP (Certified Azure Red Team Professional) horse. I'm also tentatively eyeing the third Thursday of July for an unedited livestream of owning Ninja Hacker Academy from start to finish — Kali setup, tools, Mythic C2, BallisKit obfuscation, the whole thing. More details to come. If you're the thoughts, prayers, and/or good vibes type, I'd really appreciate you sending some my family's way over the next few weeks.
More from 7 Minute Security
This episode is a downer, but asks some important topics related to losing a loved one: Do you know what their wishes are for their funeral, their money, cremation vs. burial vs. other? Do you know all the places they do business so you can adjust/takeover/cancel services as necessary? Do you know all the places the have checking/saving/investment accounts? Can you access all the important accounts this person used to manage?
Hey friends! Today I'm mashing two of our mini-series — eating the security dog food and my new obsession with n8n — into one big automation sandwich. I'll walk you through how Claude and a bunch of JSON files helped me build a self-updating asset inventory in Notion, firewall rule reviews, patch-ticket automation, and a push-button external pentesting and OSINT sweep. Basically, imagine I've cornered you at a party and won't stop talking about n8n.
Hey friends, it has been a long time since we talked about eating our own security dog food. However, I couldn't be more excited about some big ways we've moved the 7MinSec security program forward, including the release of our shiny new trust center. Enjoy!
Hey friends! I've got some personal and work travel this week, so I'm skipping the tangents (mostly) and jumping straight into something I'm nerdily excited about: Baby's First n8n. If you're not familiar, n8n is a platform for chaining together and automating just about anything your heart desires – and naturally, my heart desires automating away the boring parts of pentesting. In this episode I cover how I finally got hip to n8n (late to the party, as always), the Black Hills webcast that nudged me into it, how I fed Claude my Frankenstein "Swiss Army" pentest script and asked it to turn push-lots-of-buttons into push-one-button, the clever workaround for firing nmap, EyeWitness, and other tools like it (plus the safety gate I built so my automation can't go rogue and get me in trouble), a full OSINT recon fork powered by Project Discovery Neo that lands report-ready in SysReptor, and the many minutes of my life I get back from each OSINT run – and why that's the whole point. By the way, n8n is not a sponsor or partner – just something I like in case you like it too. Got cool n8n workflows of your own? I'd love to hear 'em!
Hey friends! Today's tale of pentest pwnage is brought to you by four hours of sleep, a large mint hot cocoa, and unhealthy levels of giggity. There's a very good reason for all three, but you'll have to hang out to the end of the episode to hear it. First, let's talk about an escalation path I've never walked before: A really tight network is a beautiful and terrible thing — this client went from a C-minus-ish environment in past years to one where I could find basically nothing. No local admin creds laying around, no poisonable protocols, no juicy file shares. Straight into "well, try harder" mode I went. Two new-to-me tools join the arsenal — one that gives you a second opinion on a big pile of pilfered files (Titus), and a one-shot PowerShell command (GPOZaurr) that hands you a report card for everything that's wrong with your GPOs (plus how to fix it). The finding I almost walked right past — an ADCS issue where only a tiny handful of objects could enroll. I said "all right, I'll move on." Then I came back to it, and saw I had missed the (kind of) obvious attack path. A certificate I couldn't authenticate with — and the 0xdf write-up that rescued me from my own gap in knowledge. Machine account quota was set to zero — so of course I tried to add a computer object anyway. Spoiler: it worked like a dirty shirt. The scheduled task trick rides again — my favorite "this is not going to get fixed" Windows behavior. I had a client push back on this one hard: "You had to know the password of the DA you abused, right? You stole the TGT, right?" Nope and nope. How to actually defend against all of this — some ADCS tightening, a checkbox on your high-privilege accounts that a lot of folks don't have ticked, and my new mantra: RDP with purpose. And then it's personal time — my oldest son Cam passed his national paramedic exam, and I am busting my buttons. Stick around for the whole story, including the 4 a.m. potty break that changed everything, the two health care professionals I'd like to hand a party invitation to in person (and why my wife says "I don't know about that, dude").