Orion's Quest: Modern Pentesting
summary
Real pentest stories with concrete results: URL parameter tampering lets an account reviewer ID enumerate and download 9 million records in an hour; a guest Wi‑Fi captive portal contains command execution in captive portal that leads to domain controller takeover on day one; physical tests use ladders, door‑pullers and drop‑ceiling access to reach data centers and vaults—about 100 bank vaults have been entered; automated scanners (Nessus/Rapid7) miss these logic flaws and supplied scanner credentials routinely get abused for domain pivots.
AI-written summary · about
chapters (11)
- 0:00Introduction and personal anecdotes
- 6:45Industry focus on wrong risks
- 12:00Attacking applications and systems
- 20:10Physical security breaches
- 29:26Targeting security teams
- 38:19Shifting security mindset
- 44:21Q&A on pentesting hiring
- 46:08Q&A on pivoting thinking
- 47:34Q&A on starting a company
- 49:01Q&A on compliance vs security
- 50:47Closing remarks and Q&A
related talks
32mPicking the Low-Hanging Fruit – Easy Pentest Wins
59m50 Shades of AppSec
30mTales of Red Teaming
01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection
47mPenetration Testing & Red Teaming for Healthcare
47mLive Hacking: Breaking into Your Web App
38mHackers Gonna Hack: Identifying and Fixing Vulnerabilities Proactively
46mThe Art of Cyber Espionage: Unleashing the Power of SCADA and ICS Hacking