Upload File

bsidessf 2019 san francisco, usa - vulnex · 1. red team win – blue team win red team blue team...

  • Home
  • Documents
  • BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks
35
BsidesSF 2019 San Francisco, USA

Upload: others

Post on 12-May-2020

6 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

BsidesSF 2019 San Francisco, USA

Page 2: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

ME & VULNEX

Simon Roses Femerling

• Founder & CEO, VULNEX www.vulnex.com

• @simonroses

• Former Microsoft, PwC, @Stake

• US DARPA award to research on software security

• Speaker: Black Hat, DEF CON, RSA, HITB, OWASP, SOURCE, AppSec, DeepSec, TECHNET

• Blog: http://www.simonroses.com/

• Youtube: https://www.youtube.com/channel/UC8KUXxTSEdWfpFzAydjEzyQ

• CyberSecurity Startup

• @vulnexsl

• Professional Services & Training

• Products: BinSecSweeper (The File Threat Intelligence Platform) http://www.vulnex.com/en/binsecsweeper.html

VULNEX

http://www.vulnex.com
http://www.simonroses.com/
http://www.simonroses.com/
https://www.youtube.com/channel/UC8KUXxTSEdWfpFzAydjEzyQ
https://www.youtube.com/channel/UC8KUXxTSEdWfpFzAydjEzyQ
http://www.vulnex.com/en/binsecsweeper.html
http://www.vulnex.com/en/binsecsweeper.html
Page 3: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

NOT THE DROPBOX YOU’RE LOOKING FOR…

Page 4: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

OBJETIVES

• Pentesting Dropbox overview

• Tips from the field

Page 5: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

AGENDA

1. Introduction

2. Pentesting Dropboxes

3. Weaponizing Pentesting Dropboxes

4. Demos

5. Conclusions

Page 6: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

1. INTRODUCTION

Page 7: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

1. OUR APPROACH

• Covert vs. Transparent

• Build trust & follow rules

• Many ways…

Page 8: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

1. RED TEAM WIN – BLUE TEAM WIN

RED TEAM BLUE TEAM

Remote testing from inside Continuous improving detection skills

Wider range of attacks * Effective defense testing

Less travel High budget

Lower cost

Page 9: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

1. ASSUME BREACH

• Pentesting Dropboxes fits perfectly with Assume Breach

Page 10: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

1. DROPBOXES IN THE WILD I

• “My roommate found a bunch of these hidden behind desks, vending machines, and trashcans in our main college library. Thoughts on what these are?”

• https://www.reddit.com/r/hacking/comments/9rm9r6/my_roommate_found_a_bunch_of_these_hidden_behind/

• https://www.youtube.com/watch?v=UeAKTjx_eKA

https://www.reddit.com/r/hacking/comments/9rm9r6/my_roommate_found_a_bunch_of_these_hidden_behind/
https://www.reddit.com/r/hacking/comments/9rm9r6/my_roommate_found_a_bunch_of_these_hidden_behind/
https://www.reddit.com/r/hacking/comments/9rm9r6/my_roommate_found_a_bunch_of_these_hidden_behind/
https://www.reddit.com/r/hacking/comments/9rm9r6/my_roommate_found_a_bunch_of_these_hidden_behind/
https://www.reddit.com/r/hacking/comments/9rm9r6/my_roommate_found_a_bunch_of_these_hidden_behind/
https://www.reddit.com/r/hacking/comments/9rm9r6/my_roommate_found_a_bunch_of_these_hidden_behind/
https://www.reddit.com/r/hacking/comments/9rm9r6/my_roommate_found_a_bunch_of_these_hidden_behind/
https://www.reddit.com/r/hacking/comments/9rm9r6/my_roommate_found_a_bunch_of_these_hidden_behind/
https://www.reddit.com/r/hacking/comments/9rm9r6/my_roommate_found_a_bunch_of_these_hidden_behind/
https://www.reddit.com/r/hacking/comments/9rm9r6/my_roommate_found_a_bunch_of_these_hidden_behind/
https://www.reddit.com/r/hacking/comments/9rm9r6/my_roommate_found_a_bunch_of_these_hidden_behind/
https://www.reddit.com/r/hacking/comments/9rm9r6/my_roommate_found_a_bunch_of_these_hidden_behind/
https://www.reddit.com/r/hacking/comments/9rm9r6/my_roommate_found_a_bunch_of_these_hidden_behind/
https://www.reddit.com/r/hacking/comments/9rm9r6/my_roommate_found_a_bunch_of_these_hidden_behind/
https://www.reddit.com/r/hacking/comments/9rm9r6/my_roommate_found_a_bunch_of_these_hidden_behind/
https://www.reddit.com/r/hacking/comments/9rm9r6/my_roommate_found_a_bunch_of_these_hidden_behind/
https://www.youtube.com/watch?v=UeAKTjx_eKA
https://www.youtube.com/watch?v=UeAKTjx_eKA
https://www.youtube.com/watch?v=UeAKTjx_eKA
https://www.youtube.com/watch?v=UeAKTjx_eKA
https://www.youtube.com/watch?v=UeAKTjx_eKA
https://www.youtube.com/watch?v=UeAKTjx_eKA
https://www.youtube.com/watch?v=UeAKTjx_eKA
https://www.youtube.com/watch?v=UeAKTjx_eKA
https://www.youtube.com/watch?v=UeAKTjx_eKA
Page 11: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

1. DROPBOXES IN THE WILD II

• https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html

https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-network.html
Page 12: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

1. DROPBOXES IN THE WILD III

• “Eastern European banks lose tens of millions of dollars in Hollywood-style

hacks”

• https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/

– Cheap laptops

– Raspberry PI

– Bash Bunny

https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
https://www.zdnet.com/article/eastern-european-banks-lose-tens-of-millions-of-dollars-in-hollywood-style-hacks/
Page 13: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

2. PENTESTING DROPBOXES

Page 14: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

2. NANO FACTOR PENTESTING DROPBOXES

Page 15: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

2. NANO FACTOR PENTESTING DROPBOXES

PI ZERO Raspberry

PI 3

Odroid C2

Page 16: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

2. HAK5 PENTESTING DROPBOXES

Page 17: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

2. HAK5 PENTESTING DROPBOXES

Pineapple Nano

Packet Squirrel

LAN Turtle

Page 18: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

2. FIREPOWER PENTESTING DROPBOXES

Page 19: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

2. FIREPOWER PENTESTING DROPBOXES

Intel NUC Zotac Nano

Page 20: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

2. OPERATING SYSTEM OPTIONS

• ARM Support

– Kali Linux

https://www.kali.org/

– Parrot Security https://www.parrotsec.org/

– Ubuntu https://www.ubuntu.com

https://www.kali.org/
https://www.kali.org/
https://www.kali.org/
https://www.kali.org/
https://www.kali.org/
https://www.kali.org/
https://www.kali.org/
https://www.kali.org/
https://www.parrotsec.org/
https://www.parrotsec.org/
https://www.parrotsec.org/
https://www.parrotsec.org/
https://www.parrotsec.org/
https://www.parrotsec.org/
https://www.parrotsec.org/
https://www.parrotsec.org/
https://www.ubuntu.com
https://www.ubuntu.com
https://www.ubuntu.com
https://www.ubuntu.com
https://www.ubuntu.com
https://www.ubuntu.com
https://www.ubuntu.com
https://www.ubuntu.com
Page 21: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

3. WEAPONIZING PENTESTING DROPBOXES

Page 22: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

3. WIFI & BT

Page 23: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

3. WIFI & BT

Alfa 36H

Alfa 36NEH

CSL

SENA UD100

Ubertooth One

BT

Page 24: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

3. SOFTWARE-DEFINED RADIO (SDR)

Page 25: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

3. SOFTWARE-DEFINED RADIO (SDR)

RTL-SDRv

Crazyradio PA

BladeRF

LimeSDR Mine

Page 26: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

ATTACK CAPABILITIES * I

Page 27: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

ATTACK CAPABILITIES * II

• Network – All your classics…

• RF

Page 28: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

ATTACK CAPABILITIES * II

• Network – All your classics…

• RF

Page 29: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

4. DEMOS

Page 30: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

4. SOCIAL NETWORKS C&C

Page 31: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

4. RF MONITORING

Page 32: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

4. MOUSEJACKING

Page 33: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

5. CONCLUSIONS

• It’s affordable

• Improves security defenses

• Not just one way

Page 34: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

RESOURCES

• https://www.vdalabs.com/2018/02/06/penetration-testing-dropboxes/

• https://www.blackhillsinfosec.com/pentesting-dropbox-on-steroids/

• https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/

https://www.vdalabs.com/2018/02/06/penetration-testing-dropboxes/
https://www.vdalabs.com/2018/02/06/penetration-testing-dropboxes/
https://www.vdalabs.com/2018/02/06/penetration-testing-dropboxes/
https://www.vdalabs.com/2018/02/06/penetration-testing-dropboxes/
https://www.vdalabs.com/2018/02/06/penetration-testing-dropboxes/
https://www.vdalabs.com/2018/02/06/penetration-testing-dropboxes/
https://www.vdalabs.com/2018/02/06/penetration-testing-dropboxes/
https://www.vdalabs.com/2018/02/06/penetration-testing-dropboxes/
https://www.vdalabs.com/2018/02/06/penetration-testing-dropboxes/
https://www.vdalabs.com/2018/02/06/penetration-testing-dropboxes/
https://www.vdalabs.com/2018/02/06/penetration-testing-dropboxes/
https://www.vdalabs.com/2018/02/06/penetration-testing-dropboxes/
https://www.vdalabs.com/2018/02/06/penetration-testing-dropboxes/
https://www.vdalabs.com/2018/02/06/penetration-testing-dropboxes/
https://www.vdalabs.com/2018/02/06/penetration-testing-dropboxes/
https://www.vdalabs.com/2018/02/06/penetration-testing-dropboxes/
https://www.vdalabs.com/2018/02/06/penetration-testing-dropboxes/
https://www.vdalabs.com/2018/02/06/penetration-testing-dropboxes/
https://www.vdalabs.com/2018/02/06/penetration-testing-dropboxes/
https://www.blackhillsinfosec.com/pentesting-dropbox-on-steroids/
https://www.blackhillsinfosec.com/pentesting-dropbox-on-steroids/
https://www.blackhillsinfosec.com/pentesting-dropbox-on-steroids/
https://www.blackhillsinfosec.com/pentesting-dropbox-on-steroids/
https://www.blackhillsinfosec.com/pentesting-dropbox-on-steroids/
https://www.blackhillsinfosec.com/pentesting-dropbox-on-steroids/
https://www.blackhillsinfosec.com/pentesting-dropbox-on-steroids/
https://www.blackhillsinfosec.com/pentesting-dropbox-on-steroids/
https://www.blackhillsinfosec.com/pentesting-dropbox-on-steroids/
https://www.blackhillsinfosec.com/pentesting-dropbox-on-steroids/
https://www.blackhillsinfosec.com/pentesting-dropbox-on-steroids/
https://www.blackhillsinfosec.com/pentesting-dropbox-on-steroids/
https://www.blackhillsinfosec.com/pentesting-dropbox-on-steroids/
https://www.blackhillsinfosec.com/pentesting-dropbox-on-steroids/
https://www.blackhillsinfosec.com/pentesting-dropbox-on-steroids/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/
Page 35: BsidesSF 2019 San Francisco, USA - VULNEX · 1. RED TEAM WIN – BLUE TEAM WIN RED TEAM BLUE TEAM Remote testing from inside Continuous improving detection skills Wider range of attacks

5. Q&A

• Thanks!

• Beer appreciated!!!

• @simonroses • @vulnexsl

• www.vulnex.com • www.simonroses.com

http://www.vulnex.com/
http://www.simonroses.com/

Vaikundarajan Congratulates Team India For Their Win Over Sri Lanka

Who Wants to Win a Free Lunch??? WHO WANTS TO WIN A FREE LUNCH??? Participants: The IIT Team Your Host: Jasmin

Linkedin final report team link2 win

BSidesSF 02/12/2017 - Make Alerts Great Again

Find out which team has 21.27% chances to win Bisnode Cup 2016

A big win for the HMH team. An even bigger win for Central

1-2 · Presentatie modus Mobl teltscentrum WIN + WIN + WIN + WIN + WIN + WIN + WIN + WIN + WIN + WIN + WIN + WIN + WIN + WIN + WIN + WIN + 1/2/3etc. Pijltjes HOM c Ll s RAT I E ESC

Orange team for the win!

IN HOCKEY: REBELS WIN TOURNEY Varsity Team Finds Winning

TEAM UP AND WIN - cofcu.org · individual’s name and resume to: CommonWealth One Federal Credit Union ATTN: Nominating Committee PO Box 9997 Alexandria, VA 22304 TEAM UP AND WIN

Got Culture? - Finance · Got Culture? WHAT’S OUR AFS CULTURE? AFS CORE VALUES: Own It Stay Curious Win as a Team . AFS CORE VALUES: Make Their Day Stay Curious Win as a Team

Dammit Dolls - Win Dammit Team Affiliations

Hoe win je in 2K Team Racing?

She notes that teamwork helped the Washington team win the competition

Minute to Win It - Team Building Adelaide Hutt Street Center - Beyond the Boardroom

Team Training - How To Build Powerful Corporate Teams That Win

BsidesSF 2014 Fix What Matters

Win A Team Trip to Disneyland - POWer PLAY'te · Win A Team Trip to DisneylandWin A Team Trip to Disneyland ®!! Run, Pass, Kick, SMILE! Starts January 1, 2016! Recharge with healthy

Inspiring Team Building through Community Volunteering ... · projects within your locality and timeframe, working with sector or charity of your choice. Win Win Win ! Win instant

What the Sales Team Looks Like for the Futuresnpa.static2.adqic.com/static/What-the-Sales-Team... · back to work. It helps the community, the individual and your company. A WIN WIN!

Effects of Travel Distance on Away Team Win Percentage in the NFL

Next Practices Branding Strategy- Mobilizing Your Team to Win … · 2015-09-30 · Next Practices Branding Strategy- Mobilizing Your Team to Win Company, Employer and Personal Branding

Win, Lose or Draw - Amazon Web Serviceskotinos-uploads.s3.amazonaws.com/1569322430-Win-Lose-or... · 2019. 9. 24. · WIN, LOSE OR DRAW HOW TO USE FEEDBACK TO MAKE YOUR TEAM PERFORM

Helping Your Team Win By Having An Effective Field Presence

1-2 - staff.science.uu.nlkuipe103/sneltoetsen.pdf · Presentatie modus Mobl teltscentrum WIN + WIN + WIN + WIN + WIN + WIN + WIN + WIN + WIN + WIN + WIN + WIN + WIN + WIN + WIN +

Will the England football team win the world cup in my lifetime?

Improvement in Persistency: A win-win for All · Improvement in Persistency: A win-win for All Presentation on 9th April 2014 by HDFC Life Team 1

BluSky Strategy TEAM WIN Introduction 2010

THE PERFECT PLAYERS WHO’LL HELP THE FRENCH TEAM WIN THE CUP

CMAX Minute to Win It Team Building in Adelaide

Team Epic Win

Camp WIN for KC Team Captains Prep Meeting (June 2011)

Kohala High Electric Car Team 2002 Recipe for Roping in the Win

TO WIN - Clarkston Consulting | Global Business … · product’s differentiation ... how Cialis overcame fierce competition through clever ... to win in today’s market. The team

Wage dispersion and team performance: a theoretical model and … · wage disparity does notresultindecreased team performance. Theyregressed annual team win percentage on Gini coefficient