Throughout the past year I have been conducting routine phishing assessments for a client. For their final test of the year, our point of contact wanted something consequential for those who fell for this phish... Something 'kinetic' if you will. They requested a 'Blue Screen of Death' approach, to which I ultimately opted for a less potentially destructive method. I would send ... READ MORE
Blog
CSRF on Anonymous Forms
Using CSRF on Anonymous Forms This article will focus on linking CSRF vulnerabilities with phishing attacks to extend the lifetime of your captured credentials. Cross Site Request Forgery (CSRF) vulnerabilities on anonymous forms are often ignored or overlooked, but when combined with a credential-harvesting phishing campaign it extends the life of your captured credentials. ... READ MORE
Termineter 1.0
Termineter Version 1: Come With Me If You Want To Pwn... Almost six years after its initial release, RSM has published version 1.0 (and shortly thereafter a couple of bug fixes) of its Open Source Smart Meter Penetration Testing Framework dubbed "Termineter". The framework has been an integral part of the Smart Meter assessment portion of the RSM AMI testing methodology and ... READ MORE
2017 FOSS Contributions
We here at RSM heavily rely on the Open Source tools that are available from the information security community. Like many penetration testing and research teams we rely on gems such as the Metasploit Framework, Responder, and Empire. We like to support to give back to the community and help others like us by contributing to these projects as well as by releasing and ... READ MORE
Quick Reference: Empire Persistence Modules
During a penetration test you may find yourself in a situation where your foothold in the network is tenuous and you need to establish persistence. Such as when your only foothold is on a workstation, the end of day is quickly approaching, and the user may shutdown their system. In these cases you'll likely have to save something to the hard disk, but what type of persistence ... READ MORE
King Phisher Release 1.9
Today RSM is proud to announce the latest release of our open source Phishing tool King Phisher. This release brings many new features that we hope offer users a much more pleasant experience and facilitate tapping into some of the more customizable potential of King Phisher. The biggest upgrade with King Phisher version 1.9 is that the client's plugin manager got a huge ... READ MORE
Physical Penetration Testing Basics – A Primer
Physical Penetration Testing is an assessment that involves testing physical security controls to see where they might fail. While this can include a number of different activities, including social engineering, many doors and locks are designed to simply slow down an attacker, not completely protect against one. At RSM, we constructed a sample door for demonstration and ... READ MORE
Pentesting Restrictive Environments – Part 2
Putting it all together Note: This blog is part 1/2 of Pentesting Restrictive Environments. I highly recommend reading part 1 if you have not! All of the equipment (and context) mentioned below is outlined in the first blog. After getting all of my Amazon packages, I flashed Kali Linux onto the MicroSD card and plugged it into the ODROID-C2. After getting the OS ... READ MORE
Pentesting Restrictive Environments – Part 1
The Scenario On a recent engagement, the client was focused on testing the controls that were in place within the environment. The client wanted a penetration test conducted as a malicious employee using a heavily restricted, domain joined Windows host. The other caveat is that the client would be actively looking for me and works under a 3 strike system. I want to be clear ... READ MORE
Updating Anti-CSRF Tokens in Burp Suite
Updating Anti-CSRF Tokens in Burp Suite Burp Suite developed by Portswigger, is the leading software for web application penetration testing. This application is a wonderful tool for fuzzing and automatically scanning HTTP requests to identify application-level vulnerabilities. Performing a web application penetration test against a target application that has developed a ... READ MORE