Blog – Red Siege Information Security

by Stuart Rorer Most weeks, the tests I run are fairly routine: web applications, externals, and internals with a tight scope. But mobile application assessments have a way of getting […]

by Mike Saunders The AWS ReadOnlyAccess policy might be providing more access than you’re intending to grant. On a recent assessment, we observed widespread use of IAM roles with the […]

As proud sponsors of Wild West Hackin’ Fest, Red Siege is heading back to Deadwood! WWHF is always a big one for us, and this year we’re bringing training, talks, […]

by Justin Palk A couple of years ago, I put together a series on standing up a simple Windows AD domain in a lab environment. This article is part of […]

by Justin Palk A couple of years ago, I put together a series on standing up a simple Windows AD domain in a lab environment. This article is part of […]

 by Justin Palk A couple of years ago, I put together a series on standing up a simple Windows AD domain in a lab environment. This is the start of […]

EDD: PowerView’s .NET Cousin By Jason Downey If you’ve done any Active Directory enumeration, you’ve probably used PowerView. It for a bunch of years was the gold standard, so much […]

by Ian Briley Sometimes an older trick is the only trick that will work for you on an engagement. Case in point, recently I was on an engagement, where if […]

by Jason Downey EyeWitness: Because Nobody Has Time to Visit 500 URLs Every pentest has that moment during recon where you’ve got a list of web servers a mile long […]

by Ian Briley An IDN homograph attack is just the super ivory-tower way of saying typosquatting using characters not typically found in American English but look close to existing American […]

by Jason Downey Encryption feels like the obvious move against shellcode detection, but it really just trades one problem for another. Sure, the recognizable patterns disappear. But now you’ve got […]

As proud sponsors of Wild West Hackin’ Fest, Red Siege is thrilled to return to Denver for another year of cutting-edge training, insightful talks, and unforgettable experiences. This event is […]

by Stuart Rorer What is SSL Certificate Pinning SSL certificate pinning (HTTPS pinning/TLS pinning) is a security technique that is more often seen applied to mobile applications. However, over the […]

by Stuart Rorer The Q*Bert Effect As a kid I loved playing a game called Q*Bert. You would control this alien-like creature with a long nose like an ant eater […]

by Ian Briley Introduction to buckets: Hello and welcome to the first blog in my series about AWS and being secure while in the cloud. In this blog post we’re […]

by Stuart Rorer A Comedy of Errors It has been said “to err is human, and to forgive divine”. However, I think sometimes it can be said errors come from […]

As proud sponsors of Wild West Hackin’ Fest, Red Siege is excited to return to Deadwood for another year of cutting-edge training, engaging talks, and unique experiences. The event is […]

by Ian Briley Let’s be honest, when starting a new skill or interest, one of the largest hurdles is setting up an environment//playground//attack range for your learning activities. Sometimes it […]

Kerberoasting, Microsoft, and a Senator When I came up with Kerberoasting in 2014, I never thought it would live for more than a year or two. I (erroneously) thought that […]

by Ian Briley To get around a DLP (Data Loss Prevention) implementation, you don’t need a fancy C2 setup to exfil your treasures. In fact, it’s incredibly easy using native […]