Resources
BHIS Blog
Current cybersecurity commentary and technical guidance.
Service Recovery Hijacking
Service Recovery Hijacking When a Windows service crashes, the OS does not just sit there - it follows a set of recovery instructions you can configure. Those instructions can tell Windows to restart…
Malicious Email Rules
Malicious Email Rules When an attacker gets into someone's email account, the first thing they usually do is not read the emails. They set up rules. Email rules are a built-in feature of almost every…
Dormant Malware
Dormant Malware Dormant malware is malicious code that sits quietly on a system and does nothing - until something wakes it up. That trigger could be a specific date, a user logging in, the system…
SNAC Attack
Stale Network Address Configurations (SNAC) Attack Networks change all the time - servers get decommissioned, IPs get reassigned, services move around. The problem is that the old records pointing to…
SMB Abuse
Server Message Block (SMB) Abuse Server Message Block (SMB) is a network protocol used by Windows machines to share files, printers, and other resources across a local network. It is deeply integrated…
responder
This is a lab from John Strand 's Information Security Core Skills Course: https://www.antisyphontraining.com/product/information-security-core-skills-tm/ Responder Both VMs In this lab we are going…
Internal Spearphishing
Internal Spearphishing Most phishing attacks come from outside - random emails, fake domains, obvious scams. Internal spearphishing is different. Here, the attacker already has a foot in the door.…
Cleartext Passwords in Files
Cleartext Passwords in Files When passwords are stored as plain text inside files on a system - no hashing, no encryption, nothing - they become a free gift to any attacker who manages to get a…
Access Token Manipulation
Access Token Manipulation When you log into a system, it does not keep asking for your password on every request. Instead, it gives you a token - a small piece of data that says "this person is…
Supply Chain Attack
Supply Chain Attack A supply chain attack happens when an attacker does not target your systems directly - they go after the software or tools you already trust. Instead of breaking down your front…
Physical Access
Physical Access Physical access attacks happen when an attacker gets into a place they should not be - a server room, an office, a data center, or anywhere they can touch hardware directly. Unlike…
Exploitation Of Missing HSTS
Exploitation of Missing HTTP Strict Transport Security (HSTS) When you visit a website over HTTPS, your browser and the server agree to keep the connection encrypted. HSTS is a security header that…