1. 

2.  User groups o Cisco, SQL, Virtualization  Conferences o GrrCON, SQL Saturday  Hands-On o Capture the Flag o Forensics  RSS  Exploit-DB updates  SecurityFocus Vuln..  Content on Security Street  Twitter  @markrussinovich  @Wh1t3Rabbit  @EggDropX  @msftsecurity

3.  Network communication vital Proxies Corporate/Windows Firewalls

4. Problem: Hackers don’t care about Authorization

5.  BackTrack (bt) Bootable, vm, phone o Zenmap o Metasploit framework 927+ exploits 251+ payloads Meterpreter o Social Engineering Toolkit o Netdiscover o Fasttrack & autopwn

6.  Kali Linux Bootable, vm, phone o Metasploit framework 927+ exploits 251+ payloads Meterpreter o Social Engineering Toolkit o nmap o BBQSQL (sql injection) o Hydra o Top 10 List o AND MORE!

7.  Interesting Commands o Getuid o GetSystem o Ps o kill o Migrate o Shell o Hashdump o Webcam_snap o clearev

16.  If you are not patching, no reason for pen testing  Don’t forget 3 rd party utilities  Peer review servers  Cleanup!

17.  Reversing patches is common practice o Midi file buffer overflow exploited in wild 16 days after the patch  Common msf exploits used MSYY- naming convention  CVE – common vulnerabilities and exposures  Know unsupported dates  WSUS  SCCM  Orchestrator  WMI qfe

18. True or False: When using SQL Server Authentication in version 11 (2012), the password is encrypted over the network.

19. True or False: When using SQL Server Authentication in version 11 (2012), the password is encrypted over the network. IT DEPENDS

21.  Default of 0 allows for brute force  10 proves to be sufficient in this case

26. Bonus!

27.  Default 3 rd party passwords  Accidental administrators(Dev)  Extra un-used services(Writer)  Weak DBA Windows passwords

28.  Layers that still work o Firewalls o Strong Passwords o Antivirus o Patches o Group Policy o Log Monitoring o Least privilege o Audits and Testing  DR o Did someone say zombies?

29.  Don’t be a disabler for business.

31.  Other hacks? o ‘ OR 1=1; -- Create table, insert web.config o Browser based attacks o The next MS08_067  Review whiteboarding

33.  https://www.owasp.org/index.php/Top_10_2010-Main https://www.owasp.org/index.php/Top_10_2010-Main  http://msdn.microsoft.com/en-us/library/ms189067.aspx http://msdn.microsoft.com/en-us/library/ms189067.aspx  https://community.rapid7.com/welcome https://community.rapid7.com/welcome  http://www.kali.org/ http://www.kali.org/  http://www.metasploit.com/modules/ http://www.metasploit.com/modules/  http://www.youtube.com/ http://www.youtube.com/  http://grrcon.org/ http://grrcon.org/  http://nujakcities.wordpress.com http://nujakcities.wordpress.com  nujak3000@yahoo.com nujak3000@yahoo.com