Show Notes
Hey friends! Today's episode comes to you from a parking lot in the rain, with a mint hot cocoa in hand and your host absolutely dragging his butt (D-R-A-G-G-I-N-G, not D-R-A-G-O-N – I've never seen a dragon's butt and can't speak to how mine compares). I've had a bunch of internals back to back lately and I'm basically a drooling dog who found a frisbee and refuses to put it down. Sleep be darned. So instead of walking through one test start to finish, I want to share a few things that have helped me claw out a foothold in environments that are otherwise really locked down: The "good problem" of a mature client – several of these engagements are third- or fourth-year tests, and the clients actually clear findings off the board. Which is great for them and rough for me, because this year's test shouldn't look anything like last year's. All my favorite go-tos came up empty – machine account quota set to zero, no broadcast traffic tomfoolery (Responder and mitm6 got me nothing), SMB signing on everywhere, ADCS either absent or buttoned up, and a low-priv account that BloodHound says has zero interesting permissions and zero local admin anywhere. Cool cool cool. When the network's clean, go file-hunting – which means firing up Snaffler and letting it comb the shares. Normally that wraps up in about an hour. On these engagements it was running three and four hours. Then Windows told me I was out of disk – I like having Snaffler pull down copies of interesting files so I can review them locally instead of authenticating to each share. Turns out it had grabbed 50-60 gigs and left me with about eight gigs of breathing room. Tip #1: put a 1 TB drive in your drop boxes – I ran with tiny drives for years early in the 7MS days and it was always a pinch. Beyond situations like this one, sometimes you find a giant backup file or VMDK on a share and you need somewhere to put it so you can crack it open and go shopping. Tip #2: you can grow a VM disk on the fly – in Proxmox you can resize the disk on a running VM, then hop into Disk Management inside Windows and extend the C drive. Instant elbow room, no downtime. Death by a million tiny files – the real culprit was one file extension I should have excluded, and the client had hundreds of thousands of them. Rather than restart a run I was already hours into, I had AI whip up a little PowerShell loop that swept the Snaffler dump folder every 10 minutes and deleted the extensions I didn't care about. Woke up the next morning to a finished run and plenty of free space. Making a gig-sized log file readable – I fed the log into Chimas, a slick web interface for Snaffler output that lets you filter down to just the red stuff or just the likely-credential files, and sort by modified date. Watch those timestamps – I kept finding AD creds in documents, then comparing the doc's date against the account's last password reset in BloodHound and discovering the file was a year stale. Son of a biscuit. The tool that actually cracked it open: Copernic Desktop Search – my pal Jeff McJunkin recommended this to me years ago, I talked about it on the show once, and then inexplicably forgot about it. Not a sponsor, no kickbacks, just a paid tool that's earned its keep. It's basically Google for your hard drive. How I use it – install it on the Windows VM, clear out the default indexing scope entirely, and point it only at the Snaffler dump folder. The top tier (about a hundred bucks a year) will chew through PSTs, DWGs, Office docs, PDFs and more, and it OCRs images too. Indexing took the better part of a day on these engagements, but then search is instant, and it previews basically every file type without Office installed. Years ago this same tool surfaced a photo on a file share of a piece of printer paper where a sysadmin had handwritten a 40-character admin password in Bic pen. OCR for the win. What I search for – the obvious stuff like "password," plus the domain name, "plain text," and things
More from 7 Minute Security
This episode is a downer, but asks some important topics related to losing a loved one: Do you know what their wishes are for their funeral, their money, cremation vs. burial vs. other? Do you know all the places they do business so you can adjust/takeover/cancel services as necessary? Do you know all the places the have checking/saving/investment accounts? Can you access all the important accounts this person used to manage?
Hey friends! Today I'm mashing two of our mini-series — eating the security dog food and my new obsession with n8n — into one big automation sandwich. I'll walk you through how Claude and a bunch of JSON files helped me build a self-updating asset inventory in Notion, firewall rule reviews, patch-ticket automation, and a push-button external pentesting and OSINT sweep. Basically, imagine I've cornered you at a party and won't stop talking about n8n.
Hey friends, it has been a long time since we talked about eating our own security dog food. However, I couldn't be more excited about some big ways we've moved the 7MinSec security program forward, including the release of our shiny new trust center. Enjoy!
Hey friends! I've got some personal and work travel this week, so I'm skipping the tangents (mostly) and jumping straight into something I'm nerdily excited about: Baby's First n8n. If you're not familiar, n8n is a platform for chaining together and automating just about anything your heart desires – and naturally, my heart desires automating away the boring parts of pentesting. In this episode I cover how I finally got hip to n8n (late to the party, as always), the Black Hills webcast that nudged me into it, how I fed Claude my Frankenstein "Swiss Army" pentest script and asked it to turn push-lots-of-buttons into push-one-button, the clever workaround for firing nmap, EyeWitness, and other tools like it (plus the safety gate I built so my automation can't go rogue and get me in trouble), a full OSINT recon fork powered by Project Discovery Neo that lands report-ready in SysReptor, and the many minutes of my life I get back from each OSINT run – and why that's the whole point. By the way, n8n is not a sponsor or partner – just something I like in case you like it too. Got cool n8n workflows of your own? I'd love to hear 'em!
Hey friends! Today's tale of pentest pwnage is brought to you by four hours of sleep, a large mint hot cocoa, and unhealthy levels of giggity. There's a very good reason for all three, but you'll have to hang out to the end of the episode to hear it. First, let's talk about an escalation path I've never walked before: A really tight network is a beautiful and terrible thing — this client went from a C-minus-ish environment in past years to one where I could find basically nothing. No local admin creds laying around, no poisonable protocols, no juicy file shares. Straight into "well, try harder" mode I went. Two new-to-me tools join the arsenal — one that gives you a second opinion on a big pile of pilfered files (Titus), and a one-shot PowerShell command (GPOZaurr) that hands you a report card for everything that's wrong with your GPOs (plus how to fix it). The finding I almost walked right past — an ADCS issue where only a tiny handful of objects could enroll. I said "all right, I'll move on." Then I came back to it, and saw I had missed the (kind of) obvious attack path. A certificate I couldn't authenticate with — and the 0xdf write-up that rescued me from my own gap in knowledge. Machine account quota was set to zero — so of course I tried to add a computer object anyway. Spoiler: it worked like a dirty shirt. The scheduled task trick rides again — my favorite "this is not going to get fixed" Windows behavior. I had a client push back on this one hard: "You had to know the password of the DA you abused, right? You stole the TGT, right?" Nope and nope. How to actually defend against all of this — some ADCS tightening, a checkbox on your high-privilege accounts that a lot of folks don't have ticked, and my new mantra: RDP with purpose. And then it's personal time — my oldest son Cam passed his national paramedic exam, and I am busting my buttons. Stick around for the whole story, including the 4 a.m. potty break that changed everything, the two health care professionals I'd like to hand a party invitation to in person (and why my wife says "I don't know about that, dude").