001spartan

Vaccines work. Vaccinated people are far less likely to contract COVID, and when they do they are far less likely to require healthcare resources beyond the standard treatments for someone who has the flu (stay home, rest, treat symptoms as needed).

Social distancing and masking work. They reduce the possibilities for spread between people -- not perfectly, but enough to reduce it to a manageable level for our current healthcare resources.

Saying that our current measures to combat the virus don't work is disingenuous at best, and a blatant disregard for everything we've learned from the past year and a half at worst.

I agree! But the issue is that where these processes exist they are not designed for the scale of the current pandemic, are too inconsistent when implemented, and rely on spare personnel that do not currently exist.

Building more hospitals is a long-term process. Training medical personnel is a long-term process. Emergency measures intended to bridge the gap are untenable politically, and people are dying because of it. Thousands of them per day.

The answer to this is not to say 'we can't fix the underlying issues right now, so we're not going to do anything'. The answer is to take measures that we _can_ implement until those longer-term solutions can come into play.

Returning to normal is a terrible idea when COVID patients are overwhelming hospitals across the world. How can things be normal if our healthcare systems are nearing collapse?

You might be willing to accept the risk of getting sick on your behalf, but by advocating a return to 'normal' before we have the capabilities to deal with this virus, you are advocating for putting even more stress on healthcare systems across the globe already on the verge of failure. There are patients in heavily-impacted areas who cannot access healthcare for other life-or-death concerns because hospitals are crumbling under the workload of COVID cases.

The article even states this; COVID is likely to reach endemic status eventually, but we are still nowhere near that. Ignoring it will have enormous costs on vulnerable populations -- even more than it already has.

That's why those of us in the security industry have to say "compliance is not security" whenever PCI is brought up.

Even Windows gets this wrong at times, with several UAC bypass techniques exposed by auto-elevating binaries. Still, Microsoft has done a great deal of work with the Windows privilege model to prevent things like this, and these issues are steadily being resolved.

1. Dozens (if not hundreds) of tools are used. It's all about personal preference, and what you're used to. Personally, I don't often use most of the tools you mentioned except Mimikatz; I use a commercial framework paired with many open source or private PowerShell scripts and .NET tools.

2. Something like evilginx2 can provide man in the middle functionality for stealing MFA tokens, or I try to find endpoints that have misconfigured or absent MFA.

3. It depends on the engagement. We like assumed breach scenarios because they're more effective for the time and money involved, but clients want entirely black-box engagements fairly often as well. Otherwise, I'll focus on using OSINT to develop a phishing target list, assuming I do basic scans against the organization's external network footprint and don't find anything egregious.

4. It's all about experience. You have to come up against the tools, and then see what works. It's really a lot of trial and error, though a lot of common bypass techniques will work against multiple products. There's no one-size-fits-all bypass.

5. Twitter, public Slack channels, and research performed by myself and my coworkers.

6. Learn soft skills. It's easy to teach someone how to do the technical part of the job, but you have to be able to communicate it to stakeholders. Technically, you should focus on the areas that interest you, but ensure that it's something used by the types of clients you're doing work for. It doesn't help to know the latest and greatest Linux attacks if none of your clients even know what Linux is. It doesn't help to be a badass web application pentester if you're expected to be able to move through a large Active Directory environment. Personally, I focus on Windows and Active Directory environments.

It is sexual assault to expose someone to unwanted sexual advances. It's the same thing as flashing. Why should someone be exposed to a picture of another's genitals when it's unwanted? It's forcing someone else to engage in a sexual way without consent, even if the only reaction is to block the sender, or look away.

The Amazon Prime Visa gives 5% back on Amazon purchases.

Automated tools can only discover so much, because there are always edge cases that tools won't be able to analyze or exploit. Human creativity is a big part of penetration testing, whether it's web application assessments or other types of penetration testing, because tools have false positives, and can't come up with creative bypasses for security measures in the way a human can.

You can definitely automate many parts of testing, especially enumeration steps, but any security professional knows that a tool is no substitute for a knowledgeable hacker.

I can't speak for DNSDumpster, but a common technique I use to do subdomain enumeration is just brute forcing with a wordlist. By enumerating with a large enough wordlist, you can discover matching subdomains for a target domain.

I think it's about on par with what developers earn for the same skill bracket and location. As a pentester, I don't think it's necessarily about having _more_ skill than developers, it's just a different set of skills.

When we use this technique (known as "tailgating") to break into client sites, we always recommend that the organization try to foster a culture of "trust, but verify". This means employees stopping people if they don't have their badges displayed, or showing unrecognized people to the reception desk, or closing the door behind you to make sure the next person has to badge in, even if they have a badge that looks plausible.

It's not an easy thing to learn to challenge people, but it's vital to maintain a good physical security posture. Employees need to feel comfortable challenging those who they don't recognize, and making sure that employees are part of an organization's security team is important.