The document discusses lessons learned from failures and mistakes. It provides quotes about failure from notable figures like Thomas Edison, Henry Ford, Johnny Cash, Winston Churchill, Albert Einstein, and Oprah Winfrey. The key lessons mentioned are to always double check everything, follow your instincts if something doesn't feel right, and to never rely on just one method of accessing a system. Contact information is provided at the end.
2. Me Me Me…
•Who/What am I?
•Simple answer:
•Father/Husband/Son/Brother
• Programmer/Pentester/Researcher
• Hillbilly
3. “I have not failed. I've just found
10,000 ways that won't work.”
- Thomas Edison
4. “The only real mistake is the one
from which we learn nothing.”
- Henry Ford
5. Watch those octets….
•/bin/sh used to truncate commands at a certain
point.
•AAA.BBB.237.0/24 != AAA.BBB.2
•Nmap used to auto appent implied CIDR notation
• AAA.BBB.2 => AAA.BBB.2.0/24
• AAA.BBB.2.0/24 != AAA.BBB.237.0/24
6. “You build on failure. You use it as a stepping stone.
Close the door on the past. You don't try to forget the
mistakes, but you don't dwell on it. You don't let it
have any of your energy, or any of your time, or any
of your space.”
- Johnny Cash
7. “Success is not final, failure is not
fatal: it is the courage to continue
that counts.”
- Winston Churchill
8. “A person who never made a mistake never
tried anything new.”
- Albert Einstein
9. “Mistakes are a part of being
human. Appreciate your mistakes for
what they are: precious life lessons
that can only be learned the hard
way.
“Unless it's a fatal mistake, which, at
least, others can learn from.”
- Al Franken
10. “Think like a queen. A queen is not
afraid to fail. Failure is another
steppingstone to greatness.
- Oprah Winfrey
11. Lessons Learned
• Always Double Check Everything
• If Something Does Not Feel Right, It Probably Isn’t
• Never Rely On Just One Access Vector
12. “Our greatest glory is not in never
failing, but in rising every time we
fail.”
- Confucius
Welcome to Hillbilly Storytime, Pentest Fails…. LIVE Edition at BsidesNashville.
I hope everyone is ready to hear a few painful stories of how I ... and others have made humorous mistakes on pentests and learned something along the way.
Me? I have been around for a while…
Somewhere around 18 years or so in the InfoSec field.
Over that time, I have been a programmer, researcher, and pentester (currently for Rapid7).
But most of all, I am a father, husband, son, and brother.
As I am sure you know, especially as I placed it on the first slide, today I will be talking about mistakes, FAILS, and lessons learned.
What? I am not going to talk about some new exploit or some awesome new tool or something like that? Not this time.
In InfoSec, via social media, conference talks, colleagues, and the news, we hear a lot about new discoveries, new exploits, and new data leaks on a regular basis. But we typically do not hear about all the failed attempts and all the long hours that went into producing those awesome WINs.
Obviously, it is always fun to hear about those things, but at the same time it can be very discouraging, especially if you are one of the people who is not making the new discoveries or is simply prone to making lots of mistakes like I do.
My hope is that by bring stories of these difficulties and failures out into the open, it may help a few people learn that it is okay to make mistakes.
When I first started in InfoSec, I had no idea of what I was doing.
1st day - build a lab
2nd week - go on an engagement (make mistakes)
Usually paired with mentor
took many months to feel competent
Over the years, I kept making mistakes and learning from them to become more proficient. Did I every stop making mistakes, of course not.
...
After it was all said and done, my boss and peers of course laughed about it a bit but no one tried to make me feel bad about it. The general response was that, we all make mistakes and it is fine. Just try to learn for them as to not make the same one again if possible. That stuck with me and has become a sort of life motto for me.
Enough of my life story, let’s laugh at and learn from some other people’s fails now shall we.
Network based web cameras…
I have some friends which work at another company,
One on particular internal engagement, they were targeting a university. --LEON
On a different engagement, they were targeting a legal office’s Internet facing systems. --SCHOOL
Let’s get Physical
pen testing the wrong building
locking ourselves out of the building on a physical
No one answers the phone on get out of jail card
Pentesting when tired
listening to the intern and closing out the only access we had
Being forgetful…
Forgot network cables
Forgot power cord
Broke laptop/harddrive
Forgot screenshots
On a different engagement, the team was contracted to perform an electronic Social Engineering engagement consisting of just phishing emails.
copy-n-paste campaign
scenario 1 - no success (servers not turned on)
scenario 2 - limited success (wrong company name and logo)
Complaining when the customer can over hear
Always Double Check Everything
If Something Does Not Feel Right, It Probably Isn’t
Never Rely On Just One Access Vector
As anyone who knows me can attest to, I have made more mistakes than can easily be counted.
Luckily I have slowly been learning from my mistakes and gradually I have been improving. I have made it a point to never let a mistake derail me.
Most mistakes I can shrug off and continue as normal. However, every once in a while, I will encounter a mistake/failure that it is so profound that it does stop me for me a bit. At those times, I stop, regroup, take it a step at a time and before I know it, I am back to fighting shape and on my way and hopefully a bit wiser and more careful.
If you let them, fails and such will have a profoundly negative impact on you. Just remember that everyone makes mistakes. Just learn from them and try not to dwell too long on them.
In closing, I would just like to repeat that mistakes do happen and that is ok.
It is a matter of how you deal with them and what you can learn from them that will determine how they affect you in the long run.
And if you are so inclined, please share your hard-earned lessons with others so that you can possibly help other to not make the same mistakes.
And Thank you.
Now, any questions?