Show Notes
Hey friends! Still your grieving pal over here, but also your swarming friend and Protecting My Network Edge host — because this week I've been tinkering with something called Project Swarm and I've got my diapers on regarding it, but I really, really like what I see so far. Then, fair warning, I flip on the tangent light and verbally barf up some personal stuff at the end. I'll make the hand-off super clear, so if you want your free security podcast to do exactly what you want and nothing else — totally fair, and you won't offend me by hopping off. Here's what we cover: What is Project Swarm? This comes to us from our friends over at GreyNoise. It centers around little sensors you deploy to the edges of your network that you can dress up to look like just about anything — attracting flies to the honey, if you catch my drift. You get more enumeration, insight, and logging into whatever shenanigans those flies are using to poke at your edge. Setup was refreshingly easy: You need a very low-powered VM or hardware device (my understanding is it even works on a Raspberry Pi) mapped to a public IP, plus a free GreyNoise account. You generate an API key, copy-paste a one-line install, and off it goes. I threw mine on a tiny Ubuntu VM. The part where I didn't read the flipping manual: Mid-install my SSH connection dropped and I'm going "what the heck?!" Turns out the installer intentionally moves your real SSH to some arbitrary high port — so you can run a fake SSH honeypot on 22 while your legit connection lives elsewhere. Once I spotted the new port in the console, a quick firewall tweak and I was back in. Profiles give me level 14 giggidies: Once your sensor checks in, you assign it a profile. Vulnerable WordPress, Tomcat, a Cisco AnyConnect VPN, FTP honeypot, SSH honeypot — kind of all the honeypots. I went with a vulnerable WordPress instance. My one complaint: you can only assign one profile per sensor. My dream scenario of an SSH honeypot AND an FTP AND a vulnerable Tomcat all on one box will have to wait (or maybe that'd look too suspicious and scare the baddies off — who knows). The results were wild: Within a couple days I had thousands of connections, several flagged as malicious and tied to known botnets. I could see source IPs, malicious labels, whether they were residential or company or Google, and even download raw packet captures. There's clearly more telemetry to dig into (what people tried to spray into the login portal, etc.) — I meant to go deeper before recording and didn't, so consider this a "to be continued." Why do I care, since I'm not defending some huge infrastructure? Honestly it started as a brain break. But I've been testing a ton of external networks lately and nearly every company site is WordPress — which now powers around 43% of the internet. Running my own WordPress honeypot gives real oomph to those "your out-of-date WordPress is a big deal" conversations, where I can say "I run a WordPress honeypot and here's the aggressive password spraying and plugin/theme enumeration I'm seeing right now." See it, don't just hear it: I show the actual portal, sensor config pages, and more over on 7MinSec.club this week. Why not both, right? It's like that meme. GreyNoise also has a Project Swarm user webinar coming up — check their events page. And to be crystal clear: they are not a sponsor, this is all free, and I just think it's clever. Life update (the tangent portion): About the time you hear this, I'll be on my way to my dad's funeral, where I'm sharing some words and singing a song. I've been practicing like a madman per advice from my music director friend and guitar teacher — including a little brain hack of focusing hard on my fingers to stay a half-step removed from the emotion. And if I cry my face off up there? Who cares. This isn't America's Got Talent; it's the gesture. I'll be honest, 2026 has been a rough one, but I promised two bright spots and here they are: my son Cam (about to fin
More from 7 Minute Security
Hey friends! Today I'm mashing two of our mini-series — eating the security dog food and my new obsession with n8n — into one big automation sandwich. I'll walk you through how Claude and a bunch of JSON files helped me build a self-updating asset inventory in Notion, firewall rule reviews, patch-ticket automation, and a push-button external pentesting and OSINT sweep. Basically, imagine I've cornered you at a party and won't stop talking about n8n.
Hey friends, it has been a long time since we talked about eating our own security dog food. However, I couldn't be more excited about some big ways we've moved the 7MinSec security program forward, including the release of our shiny new trust center. Enjoy!
Hey friends! I've got some personal and work travel this week, so I'm skipping the tangents (mostly) and jumping straight into something I'm nerdily excited about: Baby's First n8n. If you're not familiar, n8n is a platform for chaining together and automating just about anything your heart desires – and naturally, my heart desires automating away the boring parts of pentesting. In this episode I cover how I finally got hip to n8n (late to the party, as always), the Black Hills webcast that nudged me into it, how I fed Claude my Frankenstein "Swiss Army" pentest script and asked it to turn push-lots-of-buttons into push-one-button, the clever workaround for firing nmap, EyeWitness, and other tools like it (plus the safety gate I built so my automation can't go rogue and get me in trouble), a full OSINT recon fork powered by Project Discovery Neo that lands report-ready in SysReptor, and the many minutes of my life I get back from each OSINT run – and why that's the whole point. By the way, n8n is not a sponsor or partner – just something I like in case you like it too. Got cool n8n workflows of your own? I'd love to hear 'em!
Hey friends! Today's tale of pentest pwnage is brought to you by four hours of sleep, a large mint hot cocoa, and unhealthy levels of giggity. There's a very good reason for all three, but you'll have to hang out to the end of the episode to hear it. First, let's talk about an escalation path I've never walked before: A really tight network is a beautiful and terrible thing — this client went from a C-minus-ish environment in past years to one where I could find basically nothing. No local admin creds laying around, no poisonable protocols, no juicy file shares. Straight into "well, try harder" mode I went. Two new-to-me tools join the arsenal — one that gives you a second opinion on a big pile of pilfered files (Titus), and a one-shot PowerShell command (GPOZaurr) that hands you a report card for everything that's wrong with your GPOs (plus how to fix it). The finding I almost walked right past — an ADCS issue where only a tiny handful of objects could enroll. I said "all right, I'll move on." Then I came back to it, and saw I had missed the (kind of) obvious attack path. A certificate I couldn't authenticate with — and the 0xdf write-up that rescued me from my own gap in knowledge. Machine account quota was set to zero — so of course I tried to add a computer object anyway. Spoiler: it worked like a dirty shirt. The scheduled task trick rides again — my favorite "this is not going to get fixed" Windows behavior. I had a client push back on this one hard: "You had to know the password of the DA you abused, right? You stole the TGT, right?" Nope and nope. How to actually defend against all of this — some ADCS tightening, a checkbox on your high-privilege accounts that a lot of folks don't have ticked, and my new mantra: RDP with purpose. And then it's personal time — my oldest son Cam passed his national paramedic exam, and I am busting my buttons. Stick around for the whole story, including the 4 a.m. potty break that changed everything, the two health care professionals I'd like to hand a party invitation to in person (and why my wife says "I don't know about that, dude").
Hey friends! We've been on a bit of a Tales of Pentest Pwnage bender lately, so let's keep it rolling with Part 90. (And Mom, relax — this is not one pentest story chopped into 90 parts.) Today is less of an A-to-Z story and more a pile of tips and tricks pulled from a recent string of SCCM-flavored internals — plus a tangent about a video game and a little robot Claude and I built to get my life back. Multi-tier SCCM is having a moment — I've never administered SCCM a day in my life, but 2026 keeps dropping me into these split-role environments. Here's where I go to figure out my attack surface when all I've got is a low-priv cred. SMB signing on? Cool, I'll go around it — relaying from one SCCM box to the one with SQL on it, and the easy-button tool that vacuums the good stuff out of the database once you're there. (NAA creds, clear-text local admin passwords, install scripts with creds baked in…yes please.) Then relay the other direction — when the loot came back stale, a nudge from a Slack channel had me pointing the relay backwards, and I giggled like a little schoolboy at what popped out. Adding yourself to the local admin group: still weirdly undetected — an old episode of ours reminded me of an Impacket tool I don't see written up on many pentest blogs, and it slipped right by. My favorite cheat code hit a snag — the evil-scheduled-task-under-a-logged-in-DA trick kept coughing up permission errors, so I had to get creative. Plus the defensive recs I'm still trying to sharpen up — if you've got a better way to close this loophole, I'm all ears! Tangent: Halloween (the video game) and the lobby watcher — a million players and I'm still staring into the lobby abyss for 10 minutes at a time. So Claude and I built something that watches the screen and texts me when it's time to sprint back to the keyboard. It's not cheating. It's not! (The Texas Chainsaw crowd disagreed, loudly.)