penetration-testing – Noise

Under The Hoodie: The Pen Test Diaries

Emma Burdett — Mon, 24 Feb 2025 19:06:09 +0000

Welcome to Under the Hoodie, where we share stories straight from the frontlines of ethical hacking. Below are real accounts from our testers, revealing just how easy it can be to break into supposedly secure environments.

Keys to the Kingdom – Gaining access to the Physical Facility through Internal Access

Anna Katarina Quinn — Wed, 07 Aug 2024 14:37:18 +0000

This is a story of network segmentation and the impact that seemingly trivial misconfigurations can have for your organization.

Details Matter: Pentesting a single device to guarantee security

Ryan Smith — Tue, 06 Aug 2024 17:00:00 +0000

Rapid7’s penetration testing services regularly assess internal networks of various sizes. For this particular engagement, however, Rapid7 was tasked with performing a penetration test of just one device on an internal network.

Buying Stuff For Free From Shopping Websites

Marcus Chang — Thu, 25 Jul 2024 13:30:00 +0000

Rapid7 is often tasked with evaluating the security of e-commerce sites. When dealing directly with customer financials, the security of these transactions is a top concern. Fortunately, there are ample pre-built e-commerce platforms one can simply purchase or install.

Metasploit Weekly Wrap-Up 7/19/2024

Christophe De La Fuente — Fri, 19 Jul 2024 16:46:06 +0000

A new unauthenticated RCE exploit for GeoServer, plus library and Meterpreter updates and enhancements.

Metasploit Wrap-Up 12/8/2023

Brendan Watters — Fri, 08 Dec 2023 19:15:04 +0000

New this week: An OwnCloud gather module and a Docker cgroups container escape. Plus, an early feature that allows users to search module actions, targets, and aliases.

PenTales: What It’s Like on the Red Team

Aaron Herndon — Thu, 31 Aug 2023 13:16:42 +0000

In this series, we’re sharing some of our favorite tales from the pen test desk and hopefully highlight some ways you can improve your own organization’s security.

PenTales: A Badge, a Tag, and a Bunch of Unattended Chemicals; Why Physical Social Engineering Engagements are an Important Part of Security

Bennett Gogarty — Thu, 03 Aug 2023 18:38:58 +0000

In this series, we’re going to share some of our favorite tales from the pen test desk and hopefully highlight some ways you can improve your own organization’s security.

PenTales: There Are Many Ways to Infiltrate the Cloud

Arvind Vishwakarma — Thu, 27 Jul 2023 20:29:22 +0000

At Rapid7 we love a good pen test story. So often they show the cleverness, skill, resilience, and dedication to our customer’s security that can only come from actively trying to break it! In this series, we’re going to share some of our favorite tales from the pen

PenTales: Testing Security Health for a Healthcare Company

Aaron Tennison — Thu, 20 Jul 2023 15:01:34 +0000

Pentales: Old Vulns, New Tricks

Austin Guidry — Thu, 13 Jul 2023 18:15:30 +0000

At Rapid7 we love a good pentest story. So often they show the cleverness, skill, resilience, and dedication to our customer’s security that can only come from actively trying to break it! In this series, we’re going to share some of our favorite tales from the pen test

Fetch Payloads: A Shorter Path from Command Injection to Metasploit Session

Brendan Watters — Thu, 25 May 2023 16:21:57 +0000

Rapid7 is pleased to announce the availability of Metasploit fetch payloads, which increase efficiency and user control over the commands executed.

AppDomain Manager Injection: New Techniques For Red Teams

Nicholas Spagnola — Fri, 05 May 2023 16:39:10 +0000

This article details a variety of ways to perform and utilize AppDomain Manager Injection during red team operations.

DataSurgeon – Extract Sensitive Information (PII) From Logs

Mon, 20 Mar 2023 16:19:22 +0000

DataSurgeon (ds) is a versatile tool designed to Extract Sensitive Information (PII) From Logs, it's intended to be used for incident response, penetration testing, and CTF challenges.

Metasploit Framework 6.3 Released

Alan David Foster — Mon, 30 Jan 2023 14:00:00 +0000

Metasploit Framework 6.3 is now available. New features include native Kerberos authentication support, streamlined Active Directory attack workflows (AD CS, AD DS), and new modules that request, forge, and convert tickets between formats.

2022 Annual Metasploit Wrap-Up

Spencer McIntyre — Fri, 30 Dec 2022 15:00:00 +0000

It's been another gangbusters year for Metasploit, and the holidays are a time to give thanks to all the people that help make our load a little bit lighter. So, while this end-of-year wrap-up is a highlight reel of the headline features and extensions that landed in Metasploit-land in 2022,

Metasploit Wrap-Up

Zachary Goldman — Fri, 09 Dec 2022 20:36:45 +0000

Login brute-force utility

Jan Rude added a new module that gives users the ability to brute-force login for Linux Syncovery. This expands Framework's capability to scan logins to Syncovery, a popular web GUI for backups.

WordPress extension SQL injection module

Cydave, destr4ct, and jheysel-r7 contributed a new module that takes

Metasploit Wrap-Up

Christophe De La Fuente — Fri, 14 Oct 2022 17:03:46 +0000

Remote code execution modules for Spring Cloud Function and pfSense, plus bug fixes for the Windows secrets dump module.

A SIEM With a Pen Tester’s Eye: How Offensive Security Helps Shape InsightIDR

Rapid7 — Fri, 14 Oct 2022 13:02:28 +0000

At Rapid7, our laser-focus has always been trained on one thing: helping digital defenders spot and stop bad actors. From the start of our story, penetration testing — or pen testing, for short — has been one of the cornerstones of that obsession.

High-School Graduation Prank Hack

Bruce Schneier — Wed, 31 Aug 2022 14:33:41 +0000

This is a fun story, detailing the hack a group of high school students perpetrated against an Illinois school district, hacking 500 screens across a bunch of schools.

During the process, the group broke into the school’s IT systems; repurposed software used to monitor students’ computers; discovered a new vulnerability (and reported it); wrote their own scripts; secretly tested their system at night; and managed to avoid detection in the school’s network. Many of the techniques were not sophisticated, but they were pretty much all illegal...