A quick and dirty guide on how to rapidly deploy a fully autonomous conversational AI agent for voice-based social engineering
Read more…
Revisiting PowerShell Profile Tricks in Entra Environments
Read more…
Older versions of the IBM Sterling B2B Integrator solution were affected by an exploitable RCE vulnerability (CVE-2024-31903) and a command injection weakness if authentication was disabled.
Read more…
A security vulnerability in AWS CloudWatch dashboard sharing allowed unauthorized viewers to access EC2 tags.
Read more…
While scrolling my timeline on some social medium one day quite some time ago, I bumped into a post by (then) Offensive Security advertising a new version of Kali called 'Kali Purple'. I watched the linked video and realised it was actually a plug for their new course, 'SOC-200' targeting... blue teamers! OffSec doing DefSec?, I thought, that would be interesting...
Many moons later, when the itch for a new challenge reemerged, I came to the conclusion that some technical upskilling in defensive ops would probably be more beneficial than an offensive one (you're next, CRTO) given the amount of time I was now spending with client SOCs. After some discussions with the bosses, I was given the thumbs up for this new and unknown OffSec offering, along with an extra request to note down some thoughts if I were to take it, in case others would be interested in the future but wanted an extra view.
So in May 2023, when the first gap in schedule appeared, I activated my 3-month lab access immediately. A large-scale Windows-focused Purple team had just been scheduled for late July and in the back of my mind this posed as a deadline, as it would require all the prep and upskilling I could get.
And so the adventure began. After exactly 2 months and 2 days, I passed the exam and got my third shiny OffSec cert (figuratively, as they sadly no longer do paper certs). Once the obligatory celebrations were out' the way, it was time to write it all down.
Read more…