<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet type="text/xsl" media="screen" href="/~d/styles/rss2full.xsl"?><?xml-stylesheet type="text/css" media="screen" href="http://feeds.feedburner.com/~d/styles/itemcontent.css"?><rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:sy="http://purl.org/rss/1.0/modules/syndication/" xmlns:slash="http://purl.org/rss/1.0/modules/slash/" version="2.0">
<channel>
    <title>SANS Penetration Testing</title>
    
    <link>http://pen-testing.sans.org/blog</link>
    <description>SANS Penatration Testing Blog</description>
    <lastBuildDate>Sat, 26 May 2012 11:54:34 +0000</lastBuildDate>
    <language>en</language><atom10:link xmlns:atom10="http://www.w3.org/2005/Atom" rel="self" type="application/rss+xml" href="http://feeds.feedburner.com/SANSPenTesting" /><feedburner:info xmlns:feedburner="http://rssnamespace.org/feedburner/ext/1.0" uri="sanspentesting" /><atom10:link xmlns:atom10="http://www.w3.org/2005/Atom" rel="hub" href="http://pubsubhubbub.appspot.com/" /><item><title>"Presentation: PowerShell for Pen Testers"</title><link>http://pen-testing.sans.org/blog/2012/04/27/presentation-powershell-for-pen-testers</link><comments>http://pen-testing.sans.org/blog/2012/04/27/presentation-powershell-for-pen-testers/#comments</comments><pubDate>Fri, 27 Apr 2012 3:38:43 +0000</pubDate><dc:creator>eskoudis</dc:creator><dc:category><![CDATA[PowerShell]]></dc:category><dc:category><![CDATA[Presentations]]></dc:category><description><![CDATA[[Editor's Note: Tim "My Shell Makes Your Shell Cry Like a Little Baby" Medin did a presentation at SANS Orlando called "PowerShell for Pen Testers". It's really good. It starts out with an overview of PowerShell for the uninitiated, and then quickly jumps to some really effective use cases of PowerShell for penetration testers and ethical hackers. Wanna know how to do a port scan, ping sweep, and file transfer, using only PowerShell with no extra installs? Tim covers it. He also provides tips for post-exploitation on Windows boxes, and goes further by addressing PowerCLI for VMware as well as some tricks for Exchange servers. He's even sprinkled in some tips and techniques that are useful in incident handling and digital forensics. Well played, Jake! --Ed.]By Tim Medin]]></description><wfw:commentRss>http://pen-testing.sans.org/blog/2012/04/27/presentation-powershell-for-pen-testers/feed</wfw:commentRss><comments>0</comments></item><item><title>"Got Meterpreter?  Pivot!"</title><link>http://pen-testing.sans.org/blog/2012/04/26/got-meterpreter-pivot</link><comments>http://pen-testing.sans.org/blog/2012/04/26/got-meterpreter-pivot/#comments</comments><pubDate>Thu, 26 Apr 2012 1:43:56 +0000</pubDate><dc:creator>eskoudis</dc:creator><dc:category><![CDATA[Uncategorized]]></dc:category><description><![CDATA[[Editor's note: Cliff Janzen wrote this nice article highlighting some of the pivoting options available to penetration testers who have exploited a target box. Metasploit supports a variety of ways to attack targets through an already-exploited system, and Cliff's summarizes of some of the most valuable ways of doing this. What's more, for each Metasploit technique he discusses, Cliff also offers alternative tools and techniques if you aren't using Metasploit. By pivoting, we can get a much better understanding of the security risk of a target organization based on the vulnerabilities we discover and successfully exploit -- a critical aspect of high-value penetration testing. Thanks, Cliff! --Ed.]Got Meterpreter? Pivot!by Cliff JanzenSo you did it.you got a Metasploit Meterpreter prompt on an in-scope target Windows box in the DMZ or internal network. You did your root dance and pillaged the heck out of it. Now what?]]></description><wfw:commentRss>http://pen-testing.sans.org/blog/2012/04/26/got-meterpreter-pivot/feed</wfw:commentRss><comments>5</comments></item><item><title>"Updated Gamification of InfoSec Learning Talk"</title><link>http://pen-testing.sans.org/blog/2012/03/29/updated-gamification-of-infosec-learning-talk</link><comments>http://pen-testing.sans.org/blog/2012/03/29/updated-gamification-of-infosec-learning-talk/#comments</comments><pubDate>Thu, 29 Mar 2012 10:34:07 +0000</pubDate><dc:creator>eskoudis</dc:creator><dc:category><![CDATA[Uncategorized]]></dc:category><description><![CDATA[At the SANS Orlando conference on Sunday night, March 25, 2012, I presented an updated version of my talk "Put Your Game Face On" about gamification and how people can use infosec challenges to develop their skills. We got some great questions during the session, and turnout was wonderful. Thanks to all who were involved!The updated version of the talk is downloadable here. My primary updates focused on the new announcements for the schedule for Cyber Foundations competitions for high schoolers and Cyber Quests for college students. I also made a bunch of small tweaks throughout. I hope you enjoy the talk.Thank   ...]]></description><wfw:commentRss>http://pen-testing.sans.org/blog/2012/03/29/updated-gamification-of-infosec-learning-talk/feed</wfw:commentRss><comments>2</comments></item><item><title>"RSA Flash Talk: Top 5 Reasons It's GREAT To Be a Pen Tester..."</title><link>http://pen-testing.sans.org/blog/2012/03/09/rsa-flash-talk-top-5-reasons-its-great-to-be-a-pen-tester</link><comments>http://pen-testing.sans.org/blog/2012/03/09/rsa-flash-talk-top-5-reasons-its-great-to-be-a-pen-tester/#comments</comments><pubDate>Fri, 09 Mar 2012 3:01:38 +0000</pubDate><dc:creator>eskoudis</dc:creator><dc:category><![CDATA[Uncategorized]]></dc:category><description><![CDATA[By Ed SkoudisLast week at RSA, I presented a Flash talk called "The Top 5 Reasons It's Great To Be a Pen Tester... And How You Can Help Fix That Problem." For those unfamiliar with the Flash talk format, presenters are required to have exactly 20 slides, and they get exactly 20 seconds per slide, auto-advanced. As a presenter, it's not for the feint of heart, as that 20-second timer is a ruthless mistress. Additionally, the fine folks at RSA also asked for our talks to be fun, engaging, and to... you know... have a point. Always a glutton for punishment, I gladly accepted their invite.The resulting slides are available ]]></description><wfw:commentRss>http://pen-testing.sans.org/blog/2012/03/09/rsa-flash-talk-top-5-reasons-its-great-to-be-a-pen-tester/feed</wfw:commentRss><comments>0</comments></item><item><title>"Emerging Attack Vectors - RSA Slide Deck"</title><link>http://pen-testing.sans.org/blog/2012/03/07/emerging-attack-vectors-rsa-slide-deck</link><comments>http://pen-testing.sans.org/blog/2012/03/07/emerging-attack-vectors-rsa-slide-deck/#comments</comments><pubDate>Wed, 07 Mar 2012 1:21:20 +0000</pubDate><dc:creator>eskoudis</dc:creator><dc:category><![CDATA[Uncategorized]]></dc:category><description><![CDATA[By Ed SkoudisLast week, I had the honor of presenting at the RSA conference in a session with Dr. Johannes Ullrich and Alan Paller. We presented on six major attack vectors, a theme we have revisited each year for the past 6 or so years, as we watch the bad guys' tactics evolve. I base my analysis on what I'm seeing in the breach cases I work on, while Dr. J gets his data from the activities of the Internet Storm Center.In the RSA session, Dr. J and I each talk for 15 minutes to set the tone of the conversation and explore some issues, and then we open it up for questions and answers from the audience, panel style. Our slides are available here.]]></description><wfw:commentRss>http://pen-testing.sans.org/blog/2012/03/07/emerging-attack-vectors-rsa-slide-deck/feed</wfw:commentRss><comments>0</comments></item></channel></rss>

