• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
  • Skip to footer

War Room

Shells from above

RSM logo

  • Home
  • About
  • Blog
  • Talks/Whitepapers
  • Tools
  • Recreation

Development

Enumerating Emails via Office.com

May 18, 2020 By Cameron Geehr

On a recent penetration test, I discovered that manually attempting to log into Office.com would give an indication as to whether an email address exists or not. Both of the techniques I was familiar with for Office365 username enumeration, using the Autodiscover API and ActiveSync, have both been fixed so this was definitely something worth exploring. I captured a few ... READ MORE

Crimson Forge

December 12, 2019 By Spencer

Today RSM US has released a new research project dubbed Crimson Forge. The project originated from the desire to add evasion capabilities to existing, native payloads. The intention is to target x86 and AMD64 shellcode and automatically rewrite it to evade signature based detections. The issue with many existing implementations are that they rely on "encoding" the payload and ... READ MORE

King Phisher Release Version 1.15

September 24, 2019 By Erik

King Phisher v1.15 is here! With this release you can now choose what columns are visible while viewing campaign messages, visits and credentials. Additionally, if you are having issues with King Phisher configuring its pipenv environment, you can now provide the --env-verbose flag on ./KingPhisher --env-install or ./KingPhisher --env-install. This will provide more ... READ MORE

King Phisher Release v1.14

August 1, 2019 By Erik

It is time for the next release of King Phisher! Continuing down the path of making it easier to set your Web Server URL, the campaign editor now features an interactive URL builder component. This allows users to easily select the scheme, hostname and landing page as suggested by the server making it easier to select a proper URL. In addition, King Phisher now integrats ... READ MORE

GTP Scanning

May 7, 2019 By Spencer

A while ago I was working on an assessment where I was exposed to General Packet Radio Service (GPRS) servers. Having not been familiar with this particular technology, I started to read about the details of the protocol and it's implementation. One of the best resources I found was the presentation "Practical security research on 3G and 4G mobile telecommunications networks", ... READ MORE

King Phisher Release v1.13

April 4, 2019 By Erik

King Fisher

With the version 1.13 release, we have added several goodies. First is a long requested feature! The ability to store MFA tokens submitted from a login page. Now you can grab username, password, and the MFA field . If you are using this feature as part of penetration test you will have to stay on top of the password submission field and use the data quickly as they often have a ... READ MORE

King Phisher Release 1.12

November 7, 2018 By Erik

King Fisher

King Phisher version 1.12 is finally here. One improvement that we are most excited about is King Phisher now utilizes Pipenv to manage it's dependencies. This will greatly improve the stability of the platform moving forward as there won't be any dependency conflicts or bugs from upstream changes. After doing a git fetch and git pull to update King Phisher, you now runsudo ... READ MORE

King Phisher Release 1.10

March 16, 2018 By Spencer

King Fisher

Today we're proud to announce the next release of King Phisher, version 1.10. This release saw extensive changes under the hood to improve the long term experience. One of the notable changes that users will directly benefit from are multiple tweaks to the email messages sent by King Phisher resulting in lower scores when rated with the popular SpamAssassin engine. This means ... READ MORE

Termineter 1.0

January 18, 2018 By Spencer

Termineter Version 1: Come With Me If You Want To Pwn... Almost six years after its initial release, RSM has published version 1.0 (and shortly thereafter a couple of bug fixes) of its Open Source Smart Meter Penetration Testing Framework dubbed "Termineter". The framework has been an integral part of the Smart Meter assessment portion of the RSM AMI testing methodology and ... READ MORE

2017 FOSS Contributions

January 16, 2018 By Spencer

We here at RSM heavily rely on the Open Source tools that are available from the information security community. Like many penetration testing and research teams we rely on gems such as the Metasploit Framework, Responder, and Empire. We like to support to give back to the community and help others like us by contributing to these projects as well as by releasing and ... READ MORE

  • Go to page 1
  • Go to page 2
  • Go to page 3
  • Go to Next Page »

Primary Sidebar

Categories

  • Defense
  • Forensics
  • Offense
  • Physical
  • R&D

Most Viewed Posts

  • DLL Injection Part 1: SetWindowsHookEx 10.8k views
  • Sophos UTM Home Edition – 3 – The Setup 10.8k views
  • Leveraging MS16-032 with PowerShell Empire 10k views
  • Bypassing Gmail’s Malicious Macro Signatures 9.8k views
  • How to Bypass SEP with Admin Access 8.9k views

Footer

  • RSS
  • Twitter
  • Tools
  • About
  • RSM US LLP

+1 800 903 6264

1 S Wacker Dr Suite 800
Chicago, IL 60606

Copyright © 2023 RSM US LLP. All rights reserved. RSM US LLP is a limited liability partnership and the U.S. member firm of RSM International, a global network of independent audit, tax and consulting firms. The member firms of RSM International collaborate to provide services to global clients, but are separate and distinct legal entities that cannot obligate each other. Each member firm is responsible only for its own acts and omissions, and not those of any other party. Visit for more information regarding RSM US LLP and RSM International.