by Editor | Sep 28, 2021 | CarveFacts, News, Strategy, Web
Keeping track of your company’s public IP space is always a good idea. This means maintaining a centralized up-to-date list of: All static IP blocks allocated to you (by an ISP)All VPS instances operated by you in the cloud This makes your life easier by:...
by Jeff Ake | Sep 21, 2021 | CarveFacts, IOT, Strategy
Author: Carve Systems If your user base is primarily IoT devices and your organization doesn’t want to manage passwords for each device, then it seems like a series of unguessable passwords such as “d3v1ce [serial-number]” is the only solution. While that technically...
by Jeff Ake | Jul 30, 2021 | CarveFacts, News, Uncategorized
Author: Austin Ralls One of the easiest ways Carve consultants escalate privilege is reusing a password from a low-privilege account to authenticate to a high-privilege account. It doesn’t happen all that often, but when it does, it’s a quick compromise....
by Austin Ralls | Jun 30, 2021 | CarveFacts, News
When performing internal tests on a company’s network, one of the top priorities is compromising Windows workstations and servers. This is made much easier when local administrator accounts have the same password on multiple machines. Sharing local account...
by Ángel Suárez-Bárcena Martín | Apr 19, 2021 | CarveFacts, Featured, News, Uncategorized
Some organizations may believe that they are enforcing a second authorization factor when using Microsoft Single-Sign On on Azure Active Directory, but their configuration might have an easy way to bypass it. When configuring Conditional Access policies to enforce...
by Brad Dixon | Apr 6, 2021 | CarveFacts, Featured, News
You can view decrypted TLS connections in Wireshark by creating a key log file using mitmproxy: Set an environment variable to point to the desired location to record the TLS encryption keys: export SSLKEYLOGFILE=$PWD/keylogfile.txt.Then start mitmproxy and proxy your...
