Offensive Security announced a new, free Kali Linux Certified Professional Course and Certification Have you been looking to learn how to Penetration Test? Muts and crew have announced a new, free course and certification called Kali Linux Certified Professional [https://www.kali.org/news/introducing-kali-linux-certified-professional/]. [https://www.kali.org/news/

Brian Krebs breaks story that Avanti, a self-service food kiosk vendor, was hacked. Avanti Markets, a vendor with "micro markets" in many corporate offices throughout the United States, has had a data breach believed to involve credit card and biometric data. See more from Brian's article [https://krebsonsecurity.com/2017/

One of my esteemed colleagues was familiar with the popular open source web application scanning tools, Nikto, but was unaware of the origin of the name. As I mentioned, Nikto [https://github.com/sullo/nikto] is a popular web application scanning tool. It's built into Kali Linux [https://www.kali.

In case you weren't aware of it, your computer can become infected with malware by visiting an infected site, even if you don't click on anything upon hitting the site. It is called a drive by attack [https://news.sophos.com/en-us/2014/03/26/how-malware-works-anatomy-of-a-drive-by-download-web-attack-infographic/] . If you want to

Here are a few things I learned when upgrading my Ghost server. I tried first simply installing with the instructions provided on ghosts site [https://docs.ghost.org/v0.11.9/docs/how-to-upgrade-ghost]. I started troubleshooting, and it went downhill fast, so I restored the server from backup so I

Ransomware uses PsExec to infect target systems Researchers at Trend Micro have identified some new ransomware [http://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-fileless-code-injecting-sorebrect-ransomware/] that can bypass antivirus because it is fileless and relies on injecting code into a legitimate system process. The Hacker News [http://thehackernews.com/2017/06/fileless-ransomware-code-injection.html]

Patrick, @pathetiq [https://twitter.com/pathetiq], co-founder of Hackfest.ca [https://hackfest.ca/], has an update to a cool tool he created called BurpSmartBuster. The update will be announced at BlackHat USA [https://www.blackhat.com/us-17/], scheduled for 26 and 27 July, 2017. I just learned of the tools

Digital Ocean now offers free firewall for customers Many cloud providers offer free or paid firewalls to help customers protect their virtual infrastructures. Now Digital Ocean does too. [https://blog.digitalocean.com/cloud-firewalls-secure-droplets-by-default/] There are two relevant posts on Digital Ocean that will tell you what you want to know

Streamline your Penetration Testing with Yasuo 0xsauby [https://twitter.com/0xsauby] saw that he was repeating many common steps for detecting vulnerable web applications during penetration tests and decided to create a tool to automate that process. He later enlisted the help of logicalsec [https://twitter.com/logicalsec] to enhance

Tony Robinson, a.k.a. da_667 [https://twitter.com/da_667] has created a guide you can use to set up your own Security Lab [https://blindseeker.com/blahg/?p=898]. He guides you through the setup with several different hypervisors. This is another post Kurt (kph) put me

Set up SSL on your server quickly and easily LetsEncrypt Configuring SSL on your server(s) can be tedious and can cost you money if you don't know about free, intuitive alternatives to the 'normal way' like LetsEncrypt. This is another cool utility Kurt (kph) told me about. Why use

What you'll see when running a server and sensors In previous posts, I covered creating an MHN Server [https://infosec.theos-blog.com/deploying-a-modern-honeynet-mhn-server/] and deploying MHN Sensors [https://infosec.theos-blog.com/deploying-modern-honeynet-mhn-sensors/]. This post shows you some of MHN's capabilities. Server Side On the server, you can observe the following

My last post [https://infosec.theos-blog.com/deploying-a-modern-honeynet-mhn-server/] was about deploying a MHN Server. This one is about deploying MHN Sensors which feed their data on real-time attacks to the server. To deploy a sensor, spin up an Ubuntu 16.04 reasonably secure [https://infosec.theos-blog.com/create-a-reasonably-secure-ubuntu-base-build/] Droplet. This

Watch real-time attacks with a Modern Honeynet (MHN) Server and MHN sensors Honeypots are servers specifically designed to catch malicious traffic and users in action. Honeynets are networks for catching them. The Modern Honeynet project's goal is to make honeynets accessible to anyone willing to give them a try. Once

WannaCry or WannaCrypt is encrypting many systems. Don't be a victim. Patch your systems WannaCry [https://blog.comae.io/wannacry-the-largest-ransom-ware-infection-in-history-f37da8e30a58] is ransomware [https://heimdalsecurity.com/blog/what-is-ransomware-protection/#] that infects systems via a vulnerability that was patched in March, 2017, MS17-010 [https://technet.microsoft.com/en-us/library/security/ms17-010.aspx]. To

Generate a fairly secure Ubuntu virtual machine Many of my posts present things you may want to practice or do yourself. This article is about creating a reasonably secure Ubuntu base build on DigitalOcean. Once generated, you can save a snapshot you can then use over and over anytime you

Audit your Linux Security with Lynis A friend of mine, Kurt (kph), recently brought an open source Linux security auditing tool called "Lynis" to my attention. Lynis is no doubt a play on Linus Torvalds' [https://en.wikipedia.org/wiki/Linus_Torvalds] first name. Linus is the creator and maintainer