Recently I was given the task of performing command execution on a compromised MSSQL server with the following restrictions: No use of the xp_cmdshell stored procedure. No writing anything to disk. These restrictions matched those of a recent pentest that a member of my team, Lee Christensen (@tifkin_), was involved in. Through my research I […]
Securing computers has never been easy. It’s especially hard in hospitals. A heart patient undergoing a medical procedure earlier this year was put at risk when misconfigured antivirus software caused a crucial lab device to hang and require a reboot before doctors could continue. The incident, described in an alert issued by the Food and Drug Administration, […]
Penetration testing (otherwise known as pentesting, or the more general security testing) is the process of testing your applications for vulnerabilities, and answering a simple question: “What could a hacker do to harm my application, or organization, out in the real world?”. An effective penetration test will usually involve a skilled hacker, or team of […]