MacOS – WiFi Pineapple Internet sharing

The WiFi Pineapple is a nice little tool from Hak5 which assists in wireless networks assessments. It has many functionalities that i will not cover in this post as i usually only use it during the recon phase of a project because i like the web interface and ease on setting up SSID/client filtering, logging and reporting. My usual setup is to have it connected to my Kali Nethunter and use the Internet or data connection of the mobile device to provide Internet access to the Pineapple Nano.      When it comes to setting it up for a laptop […]

Card cloning/emulating with the Chameleon Mini

The Chameleon mini is smartcard emulator working in the 13.56Mhz frequency which is HF and has 8 virtual card slots of 8KB per slot. In the HF space we often find hotel cards, Mifare cards, iClass etc etc. DISCLAIMER: Obtaining access to areas that you are not authorised is illegal! As it is a very small piece of hardware it is convenient to carry during traveling and to test out hotel key cards. I can’t see myself using this in a professional environment (i.e physical security assessments) but it appeals more to the hobby side of things. I’ve had the […]

Incapacitating Windows Defender

Dan Tentler aka @viss is definitely one of the people that i make sure i follow on Twitter because he is a fun guy and he knows his stuff. Hak5 recently did a couple of episodes with @viss where he showed a couple of tricks. Nothing too major and nothing foolproof but they can still come in handy at certain environments. The idea behind this approach is that if we have a defending team monitoring that Defender is running on all endpoints as expected, we can slip right through the crack by removing all the signatures that Defender relies upon […]

Introducing A.R.M.A

If you have been following me over the past couple of years you will know that i have been testing various devices that can be used as network implants. Some of them came with their pros and their cons but ultimately couldn’t find exactly what i was looking for. The requirements i had came from the limitations i saw when actively testing the devices in the field. At the end of the day, you get one shot to plug a rogue device in a network and cannot risk that with preconfigured scripts and hardware failing on you. My requirements where […]

WarBerryPi – The Revival

So we are releasing a new version of the WarBerryPi going from version 5.1c straight to version 6. We decided to skip all the in-betweens as this is a complete code overhaul including the new and updated reporting module. If you don’t care about my rumblings just scroll to the end to get the link to the repo. Background info Before going into the WarBerryPi specifics i want to give you a bit of a background on how this project started and where it has gotten me with the hope of helping people that feel that their stuff are not […]

Empire, Kaspersky & Obfuscation oh my!

Guest post by team member @taso_x After posting here some people on Twitter reported that they couldn’t replicate the functionality with Empire and Kaspersky. The current lab workstation i am testing on is a Windows 10 with Windows Defender and Kaspersky Endpoint Security 10. Since the release of the new Empire a few days ago, getting call backs from hosts with Windows Defender is not a problem as the payload doesn’t get blocked. Things get interesting when we encounter hosts that have both Windows Defender and Kaspersky Endpoint Security as this was the case during a recent engagement. Kaspersky will […]

Cobalt Strike – Bypassing Windows Defender with Obfuscation

Guest post by team member @taso_x For all red teamers delivering payloads while not kicking off all the bells and whistles of the organization is always a challenge. Just like all other security solutions Windows Defender has become better at detecting generic payloads generated with tools such as Cobalt Strike. In this example we will go through the generation of a PowerShell payload with Cobalt Strike and see how we can manipulate it in a way that it will execute bypassing Windows Defender on a Windows 10 PC. This is not the most elegant or easier solution to hide your […]

BYOS – Build your own sniffer – Python Tutorial

Lat post of 2017 and its going to be a long one. Before proceeding take into consideration the following: 1) I am not a developer and everything shown below is my own trip on understanding some principles 2) If there are mistakes or incorrect understanding let me know on Twitter. During an assessment you will most probably end up running Responder. If you read about Responder you will see that it is a LLMNR, NBT-NS and MDNS poisoner meaning that in order to for the tool to work it will need to first capture multicast packets of any of those […]

Hackbox – Kismet with GPS

This is a follow up post on my original writeup which can be found here. Since one of the purposes of this “thing” is have some fun while wardriving i wanted to be able to plot my route and capture APs on Google Earth. In order to do so i needed to configure a GPS dongle to work with Kismet. I am a big fan of using and re-using old hardware i have stored in boxed here and there i just found the only GPS dongle i bought about 5 years ago for no specific reason which is the BlueNext […]

HackBox Writeup

So it seems that my 2 day project got some attention on Twitter and a few people asked for a writeup on the setup. Although it may seem complicated it was really a very simple build. The complete setup looks like this. First of the purpose of the hackbox or whatever you want to call it its not to replace my hacking laptop. The purpose of this project is to be used as a companion to perform tasks like war driving, wifi attacking and Bluetooth assessments. Hardware Used Pelican case The pelican case is 8 inches which is enough for […]