[Music]
so
[Music]
hello everybody thank you and welcome
back
so um with me i actually have a few
of my colleagues and a colleague from
the retin village
first of all is savannah live from vegas
and barrett and also desync
or danielle she is actually handling
most of the discord
operations for us and has been
instrumental not only during
yesterday but throughout the the life of
the retin village so
thank you thank you for your support so
with that i'll pass it to barrett to
do the first announcements of today sure
uh we are
finishing up the qualifiers we ran that
for a bit uh
yesterday a lot of high scores i think
that ai generated was in the lead
we're gonna get the score board up here
in a sec in about
13 minutes we're gonna open it back up
for two hours we have a few more
challenges to throw up there
and uh and then unlike uh in the
previous year we're gonna go ahead and
close out qualifiers right in the middle
of the day here
and then transition into finals announce
who uh who made the cup
yeah no we're looking forward to
everyone uh competing in the finals so
it'll be the top 20 teams
and they're the ones that will go on to
compete today
we uh what we definitely want to ask so
when we make that transition to finals
if you have anybody if you're in the top
20 teams if anybody on site
uh come down to the contest area at def
con and meet up with us
so that we can make sure that we get
some face-to-face interaction we can uh
we can assign a face to uh all the
different usernames we keep track of
and uh you know we have some swag to
give out we want to thank our sponsors
for
really making this possible uh we've got
a a lot of things to help
educate the folks who follow the red
team village today we've got
quite a few interviews we're just going
to talk about you know some some
different red teaming things talk about
how to get into red teaming
and that we've got a full schedule today
yeah no we're looking forward
to everyone joining today to see all the
interviews that we're doing so you can
see the schedule right there that omar
is sharing so we have a few interviews
that we're gonna be doing today
awesome and then danielle if you don't
mind actually giving us a little bit
behind the scenes so what's actually
happening in discord
uh what are some of the top you know
questions that you're getting
and a lot of the activity there sure
yeah uh so i want to throw out a
reminder that uh
all the communication about this etf
needs to happen on the official
defcon discord and that's going to be in
the ce
dash red team dash ctf dash text
channel and if you don't see that make
sure you go into the roles channel and
subscribe to the context
and contents contests and events
uh emoji there when you click that
you'll see a bunch of new channels open
up for the
the contests and events and you'll
you'll find our channel there
um so to reduce the clutter in the
official discord this year they've
they've made it so you can sign up for
particular pieces
so you're not constantly getting
inundated with alerts so
um all the questions are going to be
flowing in there from the participants
um shout out to johnny c and a couple of
the other rtv folks that we've got
um keeping a watch in there helping some
of the newer people
um they're always instrumental in uh in
walking through some some people who
have never done a ctf
through a lot of the intro some of the
trainer boxes getting you started
um our ctf is very nude friendly so if
you've never done one don't be
intimidated jump on in there's plenty of
things that you can do
um yeah we encourage you to ask
questions if you're actually competing
for one of the top spots
you may not get the hints that you're
wanting remember to try harder
but we encourage you to participate and
we look forward to hearing from you
awesome thank you so much and back to
barrett when are we expecting to have
the new challenges open
you mentioned in 10 minutes or so 10
minutes 10 minutes we're going to open a
new challenges we're going to get the
qualifiers back up so anything that you
were working on yesterday you can pick
up today
i also want to put a plug out for uh
what we did yesterday and today with
some of the giveaways
we gave away three awa um uh
test attempts as well as 60 days of lab
today we're giving away three oscps
thanks for uh thanks to offset for that
um the way we're going to do it is we're
going to put a link on this stream
that'll take you to a survey
and then we'll do a random drawing we
also have
a sans course for the first place
finalist
tomorrow as well as three osep
certification attempts with 60 days left
so stay tuned um we've got a lot of
stuff to give out please help take this
off our hands
and uh and just watch the stream to know
when to enter
awesome and once again thank you to all
our sponsors i'm actually just sharing
them real quick
here without you you know this event
will not be possible
especially yesterday you know giving
away those three big courses um
i had a lot of follow-ups from the
winners yesterday so they are also
saying dino thank you
um and it was a really cool thing that
we actually had a video from one of the
official people from offensive security
so savannah tell me more about her
uh yes so we had she'd come up to our
booth at
defcon in person and she's she's one of
the co-authors
of the course so she recorded a video
with us i think omar shared it on
social media and then also on the stream
yesterday so
she's awesome and really cool and we're
looking forward to
having her around this week awesome and
thank you to offensive security for that
and with that um let's go in a quick
break
and then we'll come back with a couple
of members of from our team to
to do you know some of the interviews
are coming up um especially
matt tyler's is actually coming in the
in the next few minutes
so let's take a quick break and we'll be
right back
[Music]
knock knock who's there this guy what's
up red teamers what's up def con it's
your favorite fake brilliant billionaire
investor
my little birdies cheap cheap cheap
cheap cheap cheap cheap cheap i like
cheap things that's why i'm rich they
let me know
that lunar fire is under fire but that
is a thres gomes company
and that's got so much smart [ __ ]
in it and so it's unhackable or is it
no it isn't not even you boy and girl
geniuses can do it you would have to be
the human equivalent of cars with doors
that open like this
or like this are you can you
will you don't
[Music]
so
[Music]
me
[Music]
hi everyone village my name aspire for
weapons of security hello
some of the awa winners absolutely so
shout out to all the away winners
we'd love to have you thank you so much
for taking our courses
and getting the vouchers whatever it may
be congratulations
uh we always encourage you to come back
and uh we have many more certifications
uh offensive security we just launched
365.
so that's year round for many many
things get a 20
discount so by all means swing by the
website check it out and congratulations
to each and every one of you who
actually got it
thumbs up
[Music]
right we're back live so um
back to you hi everyone uh so we are
releasing
uh more challenges for the quals right
now so we have until 12 p.m
pacific time and then once uh that ends
we'll
choose the top 20 teams that will go on
to the finals and then i'll pass over to
barrett who wants to add anything else
yeah looking at the scoreboard it's a
lot of fun uh checking out some of the
uh
teams we've seen before in other other
events we've held
uh this is truly worldwide it's it's
great that we can do this live right now
um you know we can enter interact with
some of the students on the floor
but we know these teams are all over
we've got folks from from poland all
over europe
uh we know that there's a uh there's a
couple teams from africa a lot of teams
from south america
and so it's it's really great that even
with the current situation and
international
international travel being stunted that
we can still kind of get together and uh
you know kind of plan an event like this
and meet up with some folks
i think it's been i think it's been
fairly challenging some of the
challenges that we have we try to do a
a wide breadth of different things i
want to make sure there's a lot of a lot
of web content out there
we've got a few ponables um you know
some some forensics a couple things from
the
blue team perspective going through some
packet captures
and um we will
we'll we'll go on in a little bit with
our with our first interview we'll take
a break
we would love some feedback from every
player out there so there is going to be
a survey link
uh we can't do a cheesy thing where you
get points for filling out the survey
that is that is an opportunity for us to
always improve what we do
so please uh take the time to to go to
that survey
give some really good feedback if
there's anything about a certain
challenge that
that you thought was was confusing that
always helps us revisit the way that
we're presenting the questions and
presenting the challenges
um anything you want to see in the
future i had someone reach out and said
hey i'd really like to see more uh
android apps that we can attack
we've done those in the past i don't
think we had any in calls this time
but that's the kind of feed that that
feedback that really guides our next ctf
all right perfect and um throughout the
day we're gonna be making a lot of more
announcements for giveaways
as barrett mentioned before i'm gonna
take a quick break but a few things that
i want to highlight
um as danielle mentioned you know all
communications is actually happening in
the
defcon discord server in the bottom of
your screen you actually see the
actual channel that we're congregating
on
and then the second thing you see this
schedule a link which is
redtinvillage.io
schedule and the scoreboard is also very
easy
just our website scoreboard so that will
take you to the scoreboard that you will
just watch or just watch it a few
minutes ago
so once again the qualifiers part two
is actually now live and we see ai
generator still on the top
but that may change so so stay tuned
we're gonna go in a quick break now
[Music]
[Applause]
welcome everyone i'm barrett darnell
with the red team village and i'm here
today with
ryan dory and matt eidelberg from optiv
hey everybody how's it going ryan and
matt uh thank you so much for being here
today and i want to uh
thank optic for being a sponsor for the
red team village ctf this year
your support really helps and it goes a
long way
at uh allowing us to provide a big event
both in person
and virtually can you tell me a little
bit more about optiv
yeah absolutely so to put it very simply
optiv is a pure play
cyber security partner and what does
that mean we aim to do
security all security all the time right
we can help in ways of advisory
deployment and even manage operations
right so ultimately our goal is very
simply to
help organize organizations realize a
more effective security program
and posture
and uh for for both of you specifically
what what do you do at optiv
so i'm a senior director inside of
threat management which is a larger
umbrella
but i specifically have the privilege of
leading our attack and pen team
so my focus is on the direction of
success of that team and i achieved this
largely by enabling
the great folks around me such as mr
eidelberg here
and i'm a technical manager under uh
attacking pen my primary role is leading
the adversarial simulation services
this is our branch that focuses
primarily on red and purple team
operations
my role in there is not only executing
these types of engagements but also
focusing on
helping to innovate the team and grow
more operators to perform these types of
engagements
all right and uh and for the for that uh
attack and pen
practice uh why do you like working
there yeah so for me
uh first and foremost uh it's it's the
close family atmosphere that we have on
the team
uh and what i mean by that is i've been
on the team for almost nine years now
i've been an attack and pen the entire
time
and i'm not alone in that there's
several other individuals on the team
that have been here for a similar amount
of time such a such as matt
himself so what that shield is a really
good dynamic
of folks to work well together while we
uh simultaneously you know pursue our
passion about offensive security
and just add on to that i would say in a
single word the community
uh the team itself uh honestly strives
constantly to push the boundaries to
teach each other
new things whether or not it's a you
know failures from previous engagements
to help educate
for future uh tests or even success
stories
it's all about sharing and kind of
bolstering each other and through
knowledge sharing
absolutely and uh you know and a plug
for that that giving back to the
community aspect you know i was on your
github the other day
and uh i was looking into scarecrow and
i know i've got that on my list to do a
deep dive on after after defcon
you know love love the fact that uh you
know a lot of big players in
information security share that research
share that tooling that they create
yep that's what we strive to do here
and for your team um you know what types
of people work there
what are their backgrounds so it's a
good variety of backgrounds right so we
have folks
uh some from being a good part of us
being veterans
uh to business-minded folks to
engineering folks etc right
but like i mentioned earlier there's the
ultimate uh
commonality right of a shared objective
of offense
and passion for offensive security
testing and then what we qualify that
success really is helping leave our
clients better than we found them at the
end of the day
and of course you know folks have a very
specific or can have a specific subset
of interest
inside the team uh that could be of iot
to embedded to
wireless to low-level window stuff to
evasion etc right so
there's definitely some sub-pockets for
people to really go a mile deep on
great and with such a diverse group what
makes somebody a success in amp
so aside from a technical acumen which
obviously is held you know it's an
important quality on this specific
role right uh is the ability to show
ownership
and leadership and give back to the team
um really you know owning a specific
service
or an offering uh helping others
mentoring et cetera we hold that in
incredibly high value
and then as we mentioned earlier with
regard to um like source zero and
scarecrow right
is the the public thought leadership to
help the team immediately and then also
give back to the community as well
yep and just to add on to that i would
say the eagerness to learn and improve
your tradecraft
um honestly the ones we see that excel
the most are the ones that not only
focus on themselves
but also make sure that they help their
fellow teammates or co-workers whether
or not they're struggling with something
or helping to help them
also pursue and grow their talents those
are the ones that i
see often have the basic success here
that's great uh absolutely i mean this
is this is a team sport uh doing what we
do
for the for the red team village one
thing that we we uh really love to do
is is offer a lot of uh environments for
training we do workshops we we
we participate in a lot of different
cons um and one thing
you know we want to do is bring as many
people into this community as possible
and so
i'd like to ask for both of you you know
what is your advice for people who are
interested
in cyber security as a profession
yeah absolutely so i mean i'll speak to
you know the path that i took to get
here and i think it holds true to the
to the question right but i think it's
very important or imperative for folks
to have a
a deep foundational understanding as to
how uh
things work right so what i mean by that
is how does active directory work how
does networking
function how can you manipulate these
things to maybe work outside the bounds
it was intended to right so that can
apply to even development web
applications etc
um oftentimes i get asked by people that
are a bit younger and stay in college or
whatever and they're like hey should i
take this security class and become a
pen tester well
i would really encourage folks to get a
lot of those more foundational
understandings
just how things work before they move to
the stage of trying to you know
move to that adversarial emulation types
part
yeah and i would just add uh to not just
focus when you're learning on red team
tactics
it's incredibly valuable in the current
landscape to uh
focus on both blue and red team having
that ability to
speak both can really augment your skill
set and
you know this is very much a cat and
mouse game based industry
and just knowing both sides their
playbooks can really help you understand
the strengths and weaknesses
of both sides so when you're coming up
against a red team or a blue
team you know what they are great at
what their weaknesses are to really help
plan out those attacks
or even your knowledge set to improve on
those that is phenomenal advice uh this
industry
is is a challenge because there's so
much breath
and depth that you can take uh not to
mention that it's evolving every single
day
it's impossible to keep up so you've got
to have that thirst for knowledge
and and without that foundation it is
quite difficult i mean you might throw
that exploit and get that get that shell
back
but then the question is what do you do
next right and so
uh great advice i want to thank both of
you for being here today uh
thank you again for the sponsorship
looking forward to
meeting you in person and and also with
uh with defcon right around the corner
you know uh looking to
engage with old friends and and make
some new ones so so thank you again
absolutely thank you for the opportunity
and uh we're looking forward to seeing
some folks out at defcon
[Music]
[Applause]
hi everyone my name is savanna alazera
and i am the co-lead of red team village
and today we have barrett darnell and
caitlin o'neill with us from bishop fox
and they're going to be one of our
sponsors and we're really thankful for
them being a sponsor
for our ctf event at defcon and i'll go
ahead and let them
enter themselves and we're going to get
them to know them a little bit better
today
hi i'm caitlin i'm with recruitment team
here at bishop fox
i came over here about three years ago
because
of our reputation as one of the largest
professional services firms
focused on offensive security and
security as a service
it's been a wild ride but part of i
stick around is because i love
working with such brilliant people i
love
that we go out there and break things
build new things
break more things and and always working
with
the latest technologies to keep people
safe so it was a really exciting
opportunity for us to sponsor the red
team village capture the flag this year
at defcon
uh where we can't wait to meet people
virtually
and on site and uh to hopefully find
some new ways to grow our team
hi savannah nice to see you i'm barrett
darnell managing senior operator at
bishop fox i'm part of the continuous
attack surface testing team also known
as cast
well we're really excited to have you
guys on this call today and
i would say the first question that we
kind of want to start off with is kind
of seeing what you guys would say is the
best part of being a sponsor for an
event like this
well for bishop fox we're avid
participants of the greater infosec
community and we feel that sponsorship
of conferences and efforts like this
provide a real tangible value to the
community this ctf in particular
provides a tremendous amount of
realistic hands-on
experiences for those in the offensive
security particularly red teamers
yeah no that's that's awesome and i mean
i'm sure you know this barrett
uh with so many reasons that resources
out there uh why do you think kind of
sponsoring something like this is so
important
well for one uh this resource is free so
that barrier of entry is out of the way
anybody can participate secondly it's
realistic
it mimics real life scenarios that we've
seen on our customer engagements
and so it's not very esoteric it's you
know real tools
real uh situations you might be in and
it's also beginner friendly
um it starts off where everybody can
join and get something out of it
but the difficulty ramps up so there's a
lot for experienced red teamers
to hone their skills on awesome uh i
know we've kind of just talked about
the benefits that people who are joining
the ctf would get out of it
but can you kind of talk about the
benefits bishop fox receives out of
being a sponsor for the red team village
ctf event at defcon yeah well you know
first and foremost we always want to
give back to the security community
and uh this is a great way uh for us to
interact with the hundreds maybe even
thousands of attendees
and participants uh whether they're
there in person
or virtually um it's great um from where
i sit as a recruiter because it gives us
a chance
to um meet new talent and people who we
maybe haven't engaged with before
and that's really important especially
as we continue to grow
our two new service lines the continuing
continuous attack service
testing team that barrett is on and our
red team
yeah no i mean everybody knows in the
security community who bishop fox is
and i'm sure they would love to know
about the recruitment
so i guess what types of people do you
guys typically
look for for the team yeah so you know
what we need
and what we're hiring for can kind of
shift month to month so
in the past if you engaged with us and
it wasn't a fit um that might be
changing so you know always stay in
touch
um first and foremost we look for people
who are really passionate about security
because that's definitely who
uh we are and you know we're always
looking for um a diversity of thoughts a
diversity of backgrounds
so uh you know we have a lot of people
who came from a pretty like traditional
career paths you know school
work but we definitely have folks who
are self-taught who are coming from
non-traditional backgrounds um you know
we we love our folks from the military
as well
so there's a lot of different paths that
can lead you to working at bishop fox
and we're really open to exploring all
of them
uh you know you can always find me on
linkedin caitlin o'neill
but you can also engage with bishopfox
on twitter uh
we have an awesome social media gal we
have a really fun twitter account
um we're going to be on site in las
vegas and we're going to be using
twitter to kind of help people find us
and and also find us for some cool uh
giveaways as well
so definitely check us out there yeah no
that's awesome i'm sure everyone's
looking forward to kind of seeing bishop
fox
um at def con did you guys have anything
else that you kind of wanted to mention
on this call uh before we end it today
yeah i mean i'm lucky i just get to show
up as a recruiter and a sponsor i know
that
all of you guys with the ctf have done
so much work
so you know thank you for everything you
did i'm really excited to see it all
come together
and thanks to the red team village for
this opportunity we're really excited to
meet everyone
and i just want to say uh you know after
months of being on lockdown i think
everyone's itching to get out this might
be the first in person conference
for a lot of people and if you haven't
registered yet for defcon i highly
recommend it uh the staff at defcon is
really going above and beyond to make
sure that it's a safe environment for
all attendees
uh especially with you know the the um
the latest developments
and so vaccinations will be required and
so will mask for everybody at that
conference and so
i think it'll be a pretty safe event uh
we're looking forward to uh seeing old
friends and making new ones so we hope
to see everybody at def con this year
yeah no i'm really excited for the event
as well so thank you guys so much for
hopping on the call today
and thank you again for bishop fox being
a sponsor and we just really appreciate
all the help
thank you savannah thank you savannah
appreciate it
[Music]
so
[Music]
knock knock who's there this guy what's
up red teamers what's up def con it's
your favorite fake brilliant billionaire
investor
my little birdies cheap cheap cheap
cheap cheap cheap cheap i like cheap
things that's why i'm rich they let me
know
that lunar fire is under fire but that
is a thres gomes company
and that's got so much smart [ __ ]
in it and so it's unhackable or is it no
it isn't
not even you boy and girl geniuses can
do it you would have to be the human
equivalent of cars with doors that open
like this
or like this are you can you
will you don't
[Music]
[Applause]
[Music]
hello everyone i'm barry darnell from
the red team village and today we are
here with omar santos from the red team
village as well as our guest ipsec from
hack the box
hey guys what's going on hello
uh ipsec hack the box has been a long
time supporter of the village
can you tell me more about the company
yeah um
hack the box is a hands-on security
training platform and our main goal is
to make good training
readily available to anyone in the world
if you're new to a topic or just the
field in general we have
hack the box academy and it's a guided
learning experience which just means we
have written material in hands-on labs
and again when building this
accessibility was our number one desire
so we created the phone box which allows
you to have a
whole operating system in your browser
so the machine you're doing this
learning on doesn't even have to be
powerful you can do it on like a
chromebook
if for some reason you want to do it on
a phone you can i wouldn't recommend
that
but everything's done within a web
browser if you want to bring your own os
we also provide a vpn pack for you so
you can join your os to the vpn
and go on learning in addition to the
academy we have unguided learning which
is what we're most famous for
this is the weekly challenges machines
or entire like networks we put out on
the platform
and that we ask people not to publicly
talk about these challenges until they
retire
which is typically 20 weeks this is my
favorite and what i credit most of my
success to because it really enforces
building good social relationships
that not only help get you the help when
you need it but also
when teaching it often validates your
understanding of it and it's proven to
help memory retention
so i have a lot of friends from my in my
social network that include barry i met
him
through another friend who met him at
derby con which is
a similar event of red team village and
the funny thing is
both my other friend kyle and barry all
lived within like
30 miles of each other but we met like
hundreds of miles away so definitely
like
important to go view and travel and
experience the community because you'll
never know who you find
and how close people may be it's a small
world
absolutely i think we've all been cooped
up these last few months here i think a
lot of people are excited to go in
person to las vegas to attend defcon and
so
we're really excited to see some of our
old friends and make some new ones
speaking of of that community you know
hack the box is a very vibrant community
both on their discord
as well as all over twitter can you tell
me a little bit more about the people
behind hack the box maybe some projects
that you might be working on
yeah we have a innovation team that's
designed at like
pushing what we think is the limit so
typically most of our stuff is either a
docker or a vmware image
and the innovation team is looking into
google cloud aws
and azure to provide a pro lab called
black
sky which is just based upon those types
of features
so if you want to exploit im or do a lot
of those unique cloud things black sky
lab
is going to be that we also have as you
said the discord community we have
roadrunner who runs that
and they help provide a lot of good
support and just learning to anyone
in addition to a bunch of ctfs i think
we run the ctf like every other month or
something it's insane
well talking about the ctf and talking
about all the activities you know
throughout the years you guys have
supported the red team village
tremendously so first of all thank you
and thank you hack the box so
one of i got a couple of questions right
so one of the questions is you know
what would you say that is the best part
about sponsoring
community efforts like the red team
village ctf this year
i mean obviously it helps the community
grow and most of my like
relationships i can credit almost all my
professional success
as to leeching off my friend's knowledge
because no one can know everything
and i can't speak for anyone i hack the
box but i know
a bunch of my friends at hack the box
are super excited to play a ctf built by
other people and we've played the red
team village cts for
quite a while um i vaguely remember one
i think two years ago
that involved exploiting a printer which
was new to all of us
we were all like big um binary exploit
people and then it threw a different
architecture at us that we never really
experimented with and it was just a lot
of fun to play
so super excited to sponsor an event
that we can participate in
and learn new things to hopefully put
out on our platform in the future
thank you appreciate that i think that
you're hitting
my next question which is why do you
think sponsoring the
the wrething village this year is so
important for the community
yeah um number one it's important to
like with covet and all we want to
increase our socialization and
everything we've been all cooped up
and the red team village incorporates
all of hack the boxes
things the main thing was being
accessible um if you can't travel you
can do it online and form a team
and additionally if you want it's
available for the high cost of zero
dollars which
aligns with kind of our methodology and
what we want
all our machines are available for free
for a time and then once they retire
then you have to pay
a small fee to gain access to it because
hosting 150
images permanently would just be
expensive can't do that for free
additionally i believe infosec is a
unique profession where team building
activities have
immeasurable impact if you look at the
non-intersect teams
they still do team building activities
like you have that gimmicky trust fall
and escape room etc
and they're doing them just to help
build that social bond between
co-workers so you know it's valuable
since that's the only thing they care
about
in the infosec world we have ctfs that
is just like that on steroids
it has all that same social bonding
benefits like i mentioned earlier
i play cts with barry i've played cts
with oxdf mr ben
john hammond a bunch of people i just
have a lot of fun with playing these
ctfs along with coworkers
and in addition to that social bond that
you build
it also gives you a lot of techniques
that you may be able to immediately
provide your work value because
you're joining hands with a bunch of
other companies to learn things
it wouldn't surprise me if you do the
ctf and then
find something you can immediately turn
around to do on your job
i remember doing almost any pro lab i'll
use offer as an example where the
foothold involves exploiting splunk
and i had a pen test that i kept missing
this vector on because i just didn't
know it and mr ben put it in that prolab
so when i did that it was just like an
eye-opening thing of oh god what have i
been missing
so definitely the big social aspect is
huge here
awesome and and i couldn't agree more
and once again you know thank you i have
one more last question
when it's around the benefits that your
team actually will receive
by participating at the you know that
con red team village ctf this year
yeah um hack the box and red team
village are almost anonymous and what we
provide
and our methodologies so the only
unfortunate thing is the red team
village ctf is a yearly thing while hack
the box produces new things on a weekly
basis
it's probably not to the scale that red
team village will be doing just because
it's constant
but if you're itching to do more after
doing the ctf definitely check out the
platform if you haven't
and go over to hack the box because i'm
sure you'll love the challenges we put
on the site
awesome so once again thank you so much
for supporting us thank you hack the box
you know for
sponsoring the red team village and i
hope to see you at defcon
yeah take care
all right we're back live so um
with me i have a few more guests and
savannah what i'm going to do is i'm
going to pass it back to you so you can
introduce our
guest okay hi everyone my name is
savannah and today we have
matthew eidelberg and also milos and
then
jean as well so we're going to be doing
a red team interview today
we're going to be asking a few questions
them very casual
uh so i can go ahead and get started if
everybody was ready
yeah sure okay um so i guess i'll start
with matt
first and then i'll have uh milos and
then jean go next kind of like answer
the question to give some background
but i guess how did you get started in
your career matt
so i was a help desk analyst that was
slowly trying to move
up towards i.t and everything like that
i had a bit of a background in security
based from college and ironically
at the time when i was transitioning uh
the company
was working for got hit with some
ransomware and because you know
very few people had a bit of a
background in that i was kind of tasked
and realized you know things are going
on
and just started doing mitigation and
everything like that and then
it was like this layer effect of as we
were pulling things apart like we didn't
have an ir
procedure anything like that basic
things and i started having these
conversations with
people way way above my pay grade that
we need to have this stuff
and the kind of a thing was like oh you
you sound smart like you sound like you
know what you're doing with this so i
started getting some support there
and then eventually as i was learning
more and more
um i felt like you know the you know the
policy-based earth sort of things that i
was used to reading out of a textbook in
college
wasn't really the thing i really liked
like you know the ctfs that we used to
do and all
the hands-on stuff so i really started
getting into looking at
pen testing now there was no there was
no like free service back then
everything was vuln images or anything
like that
it's really practice so in my evenings
and stuff i was teaching myself real
life practical cases using
those vulnerable isos sql injection or
anything like that
and then eventually i got my off an
offer to go
work from a first pen testing firm a
consulting firm up here
in canada and at that point i just you
know kind of went from there to meeting
a bunch of people
local people where uh we were all kind
of focused on
you know growing our skill trade and you
know we all studied together
we eventually did the oscp and at that
point we just kept on going and going
that's how i got started is a very
long-winded way of going
that's awesome i'll go ahead and pass it
over to milas now
sure thanks so much and uh hopefully
folks can hear me okay i'll apologize
for uh for having to take this call
uh on on the road uh unfortunately so
um security for me was always kind of a
passion um i almost
went into physics and then i met with
the head professor of physics at my
local university
um who steered me into another another
career direction
if i kind of wanted to look at something
that was relatively profitable but
i really was kind of interested in
security in my early teens
kind of a lot of people you know i just
missed the bbs era so it was a lot of
kind of like finding like websites
finding irc servers hanging out with
people
and i just kind of started building on
my knowledge set that way i ended up
doing
in undergrad and information security as
well which
i did here locally in canada which was
really good to reinforce
skill set capabilities and to kind of
put myself on the map and
started working kind of full-time in the
industry as uh
as i was still finishing my undergrad
and the rest is history just kind of
getting more and more into the security
space always had a passion for offense
um here we are today
gene do you want to go ahead and uh
sure so uh it all started for me
basically
when i was uh leaving school i got hired
in a belgian service provider and i
started out as a system engineer
so yeah basically i i did networking
stuff
but uh my my primary duty basically was
was accepting tickets so it was also
like kind of a service desk role
but i got quite tedious for me and it
was a lot of repetition as well
which i um started noticing as time went
on
so i started automating a lot of stuff
in my job because well
it's you see the same things coming over
and over again and you start
making them automatically so you do save
a lot of time
which gave me two options either uh
do nothing all day get paid and and be
happy and just move on with my life
or level up my own skills and that's
what i did
so i already had that system engineering
background
and i started learning about pen testing
and network
attacks and then basically i got hired
by a consulting firm here in belgium
called inviso
and because i was already a system
engineer and had that networking
experience
it kind of makes sense for me to to do
the network infrastructure engagements
um based on my experience so i started
as a network fan tester basically so
i could blouse bloodhound and just scan
networks for for exploits and
start pruning stuff but then as time
went on and customers got more and more
mature i started
going and transitioning into red teaming
and purple teaming as well so that's
how it went for me that's awesome
uh and then i guess it would be awful
helpful to have each of you guys
introduce yourself so i'm sorry for
skipping that question
um i'll have matt go ahead and injure
yourself and then milos and then g
next to kind of give everyone an idea of
where you guys are at now versus how you
kind of got started
sure so my name is matthew edelberg i am
a technical manager
at optiv my primary role is leading our
red
and purple team under the advisory
services uh
in this role i you know not only just
leading and executing on projects but
also
innovating in research uh and that is a
big part of
the role but also the culture that i try
to kind of instill is to not just
uh do these crazy gigs but also kind of
give back to communities
articling research anything like that
i'm going to turn it over to milosh now
to introduce himself
hey folks my name is mueller's i am
currently theatre director of adversary
emulation threat hunting at a dedicated
digital development team
at royal mango canada so responsible for
red team our threat hunting team as well
as a digital development team that
develops custom solutions for
our cyber analytics team which is
largely grounded in machine learning and
data science as well as our threat
hunting and
sharing deletion tubes
yeah so my name is sean francois um yeah
basically i'm the technical red team
lead at inviso
which means that i'm not doing the
business side of things but i'm more
of the guy that does the the malware
developments and do the buy versus
builds kind of thing to
to figure out whether or not we should
buy tools or build tours ourselves
uh so yeah i i lead red teams from a
technical point of view
and i'm also a sans instructor so i also
teach a sans course
699 which is the purple theming one so
yeah that's a bit about me
yeah those are awesome jobs uh the next
question that i have for you guys
is to kind of see what kind of tools you
guys like the most
in your tool set so what are your goals
go-to tools on any engagements you guys
are doing
or anything along those lines
oh thank you uh so i as much as i like
to say i have a tool set and stuff i
really do try to keep
the mindset of you know there's no such
thing as a one tool that fits every you
know
solution uh every time you go up against
any type of environment or situation
you're always gonna have to be very
fluid
uh so the ones that with that in that
mind the ones that i normally go to you
know obviously
i mean for command and control i'm a
huge uh
cobalt strike um user as well as
you know a lot of the open source tools
i've developed such as scarecrow
um and a few others from that type of
perspective of going back around
the ones i say i commonly use uh
anything where between something like uh
say a version of safety cats or
something that dumps uh lsas like sharp
dump
ranging towards some more stuff about
you know uh recon
such as tools like you know bloodhound
is great uh vibe
if you're not familiar with that one um
personally my favorite when it comes
down to domain reconnaissance
um but once again like i said i really
am someone that
believes that customization is the best
thing to do it so i'll often take some
tools down and kind of
re-modify them and change them up so
they're very different
just for a high level success and
everything like that so i you know i
might take some standard tools or you
know the latest
techniques or ttps that have come out
i'll try to modify them so they really
are different than what everyone else is
using
i hope i mean and that didn't really
answer the question but that's just my
personal belief around tooling
yeah i got i'm going to echo a lot of
the same of what matthew's saying
uh there's definitely like stable tools
that i think any kind of
offensive team will probably leverage
but the tools that you leverage and the
tactics and the techniques and
procedures are informed by um
the situation that you're in right so
what's the environment that you're
targeting what kind of trade craft does
it warrant for utilization so
i mean yeah from a c2 perspective on
windows side uh cobalt strike is
is a pretty standard stable for for a
lot of folks
over on mac and linux you've got kind of
some other open source options that you
can do custom development on top of
um outside of that it is a lot of really
kind of adapting to
to the environment that you're targeting
and developing custom tooling
to evade modern tech stacks or modern
security controls
depending upon what crosses your path
right so if you're navigating an
organization that uses one or multiple
edr's
maybe you're looking at techniques to
get into kernel mode load your own
drivers you know kill some kernel
callbacks that are happening
it really just kind of depends on what
you see ahead of you and of course
there's always the notion of kind of
tempering tradecraft to the defensive
team
um that you were going up against as
well
ideally red teaming should be a process
of kind of sparring between offensive
and defense and not necessarily
um just a process of sort of red team
kind of coming through like a
steamroller
um and targeting targeting objectives
with kind of leaving the blue team
entirely behind so i would say
tradecraft depends on
what you're trying to do and also the
the level of capability for the existing
blue team in the organization that
you're working within
[Music]
yeah i think from my side i very much
resonate with what
what has already been said right it all
depends on the organization you're
facing
uh if you're facing a mature client
you're probably
not wanting to blast bloodhounds all
over the place
because that will probably get you
caught so it really all depends
on on your maturity level and what
you're facing
uh i do hear cobalt strikes
being mentioned a lot it's exactly the
same for me we use global strike as well
just because a lot of
adversaries like real life adversaries
use it so it makes sense that we kind of
emulate that
but we also look into some more uh quote
unquote obscure
c2 frameworks that are not that well
known yet such as for example a brute
rato from paranoid ninja
and i heard that mdsec is probably on
the verge of launching their uh
their own c2 implant as well so we're
probably going to
start looking into that when that
releases just to see
what it's all about uh and yeah it's
very much as
has already been mentioned it's about
modifying the already existing tooling
out there
you don't necessarily have to reinvent
the wheel if you just know your way a
bit around
obfuscation and just replacing certain
strings you can break a lot of
detections already
so yeah it comes down to what you're
facing and it comes down to your own
skills as well
whether or not you're able to create
your own tooling uh
how much time you have and yeah whether
or not you can obfuscate or
just stringly place basically uh stuff
to to just break signatures
that's awesome and i know jean that you
said that you have a workshop coming up
in just a few minutes so i know you have
to drop earlier
so do you want to go ahead and kind of
tell everyone about the workshop before
you do have to drop
and speak yeah sure so uh i'll be i'll
be doing
a live workshop at the the adversary
emulation village so
it's uh like the the friend the friendly
village that is just uh nearby
so i'll be doing a live workshop there
about c sharp basically
it's a very accessible workshop so i
tried to make it as accessible as
possible so even if you
have never played around with c sharp
before you should probably be able to
at least understand what the what's
going on there
and it's also it also has its own
workbook where you can do some exercises
as well
and it's about reflection basically so
we're leveraging the uh
dc sharp or the net frameworks built-in
reflection capabilities
to create some loaders and basically
expand upon them
so we start with a very very simple one
that is just loading another
c-sharp assembly from disk and then we
expand that to also be able to fetch it
from the internet do some amsean etw
bypasses and all that good stuff
wow that's that's awesome i'd recommend
anyone who's watching right now
definitely go to that workshop
definitely get some good information out
of that obviously sharp
uh with c-sharp sorry um
gene if you need to drop you're welcome
to drop it i will be uh i will be
dropping now so uh
thanks for having me so much for coming
on today as well see you around
bye bye uh so uh milos and matt the next
question
i have for you guys is kind of what do
you recommend for anyone who's
interested
and i know obviously like you can't just
like jump into red teaming but if
somebody
wanted to kind of go towards that path
what would you recommend
for them to kind of get started and what
should they do to kind of work towards
up to that path so pass it to matt first
sure so um i would say um
and i i think it's pretty much the best
way to describe the difference first
uh between pen testing and red teaming
you know pen testing is you're pulling
every trick out of trade and kind of
throwing it at the wall and seeing what
sticks whereas with red teaming it's
more of a surgical
knife cutting through and it's very
focused on stealth
so um trying to get into pen testing i
would say the first thing you got to
learn is the core found
foundations understanding having a good
solid background into you know
active directory windows environments um
is pretty much a critical i would say
scripting next
um different languages can be very
useful
but really having those is a big
foundation and as you transition
as you kind of mention from you know
it's not just you know a direct
bee line to read to me but as you go
down that path
you'll start to get really passionate
about things and also
trying to improve your trade craft uh
one of the best and the biggest things
when people ask me about red teaming is
is that you know if you're a solid pen
tester for x amount of years
the next step is challenge yourself take
your same techniques
the same way you're executing things but
see how you can improve upon them
we kind of mentioned a lot here about
customization and you know
removing strings and stuff but taking
the challenge to say that
i want to rebuild you know if i rely on
say tool
x a lot and it does something well what
are the artifacts
or something like that how can i improve
on it so that way i'm more invasive
that i'm not i'm being more i'm still
having that same high level of success
but now
i'm focusing not just on that success
vector but on that invisibility vector
when we start
adding those two it's almost a blended
approach you get this very very
strong background and you start to learn
and it just kind of opens up doors
and knowledge um that kind of just
springboards you once you start down
that path
you kind of go into a different whole
other gear the best way i can describe
what to recommend is just constantly
learn and try to improve on your trade
craft
starting with the fundamentals and then
adding on complexity
yeah so i think i think from my
perspective a lot of the same
i mean there's a couple of factors right
so if you're kind of already
in security um then maybe maybe your
road to moving towards red team or
towards the offensive space would be a
little bit different
i would say if you're someone who isn't
in security at all and you're looking to
kind of reach into
that environment i think defcon has a
lot of really good local communities
where you can start bridging connections
with people who are in the industry a
lot of fairly large cities have their
own sort of user groups or interest
groups that are focused on security
you can kind of start getting your feet
wet outside of that there's plenty of
free online material that you can learn
from to give you some sort of basis and
understanding like
um to really just calibrate your compass
and set your bearings in terms of what
direction you want to go in or to learn
for cyber security
um if you're if you're already in
offense and or you're in cyber security
you want to kind of move into the
direction of red teaming
it's kind of an interesting question i
mean i think certain certain skill sets
within red teaming are conducive to
bringing someone in who
who doesn't necessarily have an
offensive background and kind of
allowing them to work with it and they
can
custom implants loaders malware or
whatever it may be
and then at the same time upskilling
them with red team skill sets and better
understanding of target environments
that people come across invariably
that you need to intersect i think most
people
who are in red keeping and kind of been
in this field or
doing this type of offensive security
for some time have done your typical
kind of
you know vulnerability assessment to
penetration testing to penetration
testing with social engineering
so then eventually doing something
called called red teaming
you know while the trade craft may be
similar the goals objectives
and purpose of those two exercises are
entirely different and they don't
necessarily intersect
um as much as people might think but i i
think that the past really kind of
depends on where someone's starting from
um in terms of bettering yourself and
preparing yourselves to become
a more effective red team it is really
about this this ability to
assimilate information quickly and then
adapt to
unexpected obstacles right so matthew
talks about this notion of like
upscaling your tradecraft like there are
stable tools that we use but you know
peel those covers back start to
understand how they operate
um when you begin to understand the
fundamentals of
you know operating systems that most
retainers are targeting these days it
really starts to level
your horizon and allows you to better
understand where is the current trade
craft developed where are things
focusing why are they focusing in that
direction
and that really kind of allows you to
get a better idea of where things may go
in the future
and also to better understand you know
what kind of ioc's
um or indicators does your tradecraft
leave behind
really allowing you to be more
comprehensive from both offensive and
independent detection or detective
perspective so
i know it's not really an answer to the
question because it's a difficult
question to answer i would say it
depends where you're starting from
um but if you're starting from ground
zero you don't have you're not in this
industry at all
um you want to kind of start to meet
some people almost
um twitter is another good place to
start getting some decent information
through a little bit of unnecessary data
but it is a good place to get some good
information and then if you're in the
industry it's really just about
you know constantly pushing and learning
and going deeper and understanding
more fundamentals around the operating
systems that you're targeting how they
function why do they function that
and way and that in and of itself will
bring ideas to you in terms of future
tradecraft development
better understanding tradecraft um so
both of you guys what you just kind of
went through i think that was honestly
like really good information for anyone
who's watching to kind of like take away
uh because you can't stress enough that
you can't just kind of like jump into
red teaming or pen testing
you kind of have to build and have a
foundation and
kind of build your way up to that kind
of path uh it's not just something that
you just jump right into so both milos
and matt's advice
is definitely a good advice to kind of
take from um so we're kind of wrapping
up with the questions now and i just
kind of wanted to ask milos and matt if
there's anything else
that you guys kind of wanted to bring up
before we end the interview
um we do appreciate having you guys on
so i'll kind of pass it back to see if
you guys have anything else that you
want to mention
i mean you want to go first
if you're new to this industry
cyber security 24 hours a day
you know you can't succeed in this
industry and i don't think that's true i
made that mistake actually
i you know did the whole level cyber
security you know 24 hours a day
go to work do research for eight hours a
day passed out do it again
don't let kind of this industry sort of
ease
um i know that's not really kind of
maybe in the same vein but i think it's
an important topic to mention
for people that are coming into this
industry because it
can be a little bit daunting
yeah and just to echo that um i will say
definitely i'm a big believer in
research and as i've
you know been mentioning a lot about is
tradecraft but you have to keep that in
a bubble
and keep your life in that equal bubble
as you're moving forward don't
look over and see oh my god look at what
everyone else is publishing all this
crazy stuff i gotta better myself i
gotta push myself three times harder
no don't don't look at it like that you
should look at it as like look at what's
the great stuff coming out of this
community
and i'm contributing uh i see a lot of
people who are starting out who are
great honestly brilliant researchers
who do amazing stuff but they get so
burnt out or they get
so upset that they don't even ever
publish their own content because
they're afraid of what happens when it
comes out
just do it for yourself like this
industry is hugely about
sharing open source in the community you
know anything like as milo's going to
mention
discord twitter everything like that uh
i know that there has been some kind of
things that you know has you kind of
mentioned but
where i would say that is do it for
yourself
and at the end of the day make sure you
know that okay i'm stepping away
i'm gonna go do something else work life
balance is very important
um and i mean i even myself you know
18 hour work days where i finish work
and i just start researching
i'm very passionate about developing and
research a lot of people who know me
know that's pretty much true i
you know live and breathe the monitor of
security and stuff but like
recently if i can say one bit of advice
you know more than technological advice
if you walk out of here is
balance your life there's always gonna
be a new expert there's always me
something new
but your family is the one thing that
should be always in the forefront is the
most important thing
or your personal health so i mean i
guess that wasn't
probably the answer you were expecting
from both of us but i think that's the
most important thing i can
pass on to anyone that's new starting
out in this industry or anything like
that is don't
don't look at everyone else's work focus
on yourself and know when
it's time to go walk away from the
computer and you know have other things
important in your life
can i add one more thing that i think is
worth mentioning as well
um you may find that like
if you're coming into this industry it's
certainly valuable to have someone that
can mentor you if you kind of have the
ability
to have someone that can do that you may
also find that this industry is very
much so like well you need to learn
things on your own and
no one helps each other right especially
in the offensive space i noticed this to
be like a consistent trend
there is help but there isn't kind of
like as much typical mentorship as you
might see in other areas so i would just
say like look
if you want help right shout out to
people and if and if a couple people
snub you don't
don't don't beat yourself up about it
like some people are going to be jerks
in any industry
right they don't want to help people
they want to put themselves on a
pedestal
just we wanted the next person right
like the world is big enough there's
enough people working in this industry
now that you're you'll eventually come
across someone who's a decent human
being who's
willing to help you out who's willing to
give you some pointers and lead you in a
direction
everyone was always there right no one
was born knowing all of the stuff
that he wants so everyone's kind of gone
down at least a very similar topic
couldn't agree more yeah i mean i'm
gonna say like that was
awesome advice i don't think that that
was bad advice at all because matt
stresses to me all the time like
savannah like don't burn yourself out
i'm like okay matt but like the advice
is
truly really important because once you
burn yourself out it's really hard to
kind of like bounce back
um so i mean i just want to thank both
you matt and uh
milos for coming on today and kind of
giving some advice to people that are
watching
and we look forward to having you guys
in the future if you want to mention
your handles for anyone to follow you or
to reach out or anything
feel free to do that now but we're going
to go ahead and kind of wrap things up
sure so um my handle is right now right
beside my message but the one thing i'll
maybe
mention is much like jean i am doing a
talk today
at 115 pdt at the adversarial
village check it out it's all about uh
tradecraft and adversarial bypassing of
edrs for payloads the title of the talk
is operation bypass
catch my payload if you can if you're
interested in anything
along the line i think you know there's
it'll be a lot of great stuff and
there's going to be some releases
attached to that so definitely check it
out if you're interested in this type of
stuff
i'm good on my end i don't generally
associate
my online actual person so
um i'll see you around i guess
thanks for listening thank you guys so
much for joining today
we're gonna go ahead and cut it to a
break now awesome thank you we're going
on a break real quick
and um before we go into the break let
me share the
statistics right now on the the
scoreboard ai generator is still in the
first place ept is the second and
neutrino cannon actually moved from
fourth to third and if you don't know
what we're talking about of course you
know the
qualifiers part two are now live
you can see the scoreboard at the link
that i'm showing at the bottom of the
screen
and you can also see the schedule of all
the interviews and all the panels that
we're
here they're taking place today in the
bottom of the screen as well so
with that thank you again guys i really
appreciate it and we're going to break
thanks again
[Music]
so
[Music]
so
[Music]
knock knock who's there this guy what's
up red teamers what's up def con it's
your favorite fake brilliant billionaire
investor
my little birdies cheap cheap cheap
cheap cheap cheap cheap cheap i like
cheap things that's why i'm rich they
let me know
that lunar fire is under fire but that
is a threshomos company
and that's got so much smart [ __ ]
in it and so it's unhackable or
is it no it isn't not even you boy and
girl geniuses can do it you would have
to be the human equivalent of cars with
doors that open like this
or like this are you can you
will you don't
all right we're back and just going back
to the
art ctf quals scoreboard in first place
we still have a
generated a second ept and actually
neutrino cannon just went down to fourth
so hackstreet's boys just took the lead
but not by much
now with that said what i'm going to do
is i'm going to pass it back to barrett
even though he's not in the camera
i'm going to let him introduce our next
guest and take it away
all right everyone we have an exciting
interview next we've got
three people that i think most folks on
the stream are familiar with uh
with their tools and some of the work
that they've done i'll let them
introduce themselves
starting with you mom cool how's it
going i'm matthew bryan or my handle is
mandatory online
um i currently leave the red team at
snap and write a lot of uh tooling in my
spare time stuff like that
so hey i'm nero i'm like a technique
manager on the google red team so
i lead manage and work on red team
exercises and help the program as well
my name is joe dimacey i'm the red team
lead at bishop fox which is a consulting
firm
uh we do a variety of security testing
but
uh recently yeah i lead the red team and
we do
basically the full gamut of uh red team
operations
so thank you so much for taking some
time out of defcon i know there's a lot
to pack in
for our stream especially with a lot of
our viewers people are part of the
village
we love to provide a lot of advice for
folks
that are building their offensive
security skills
and especially as they're kind of
elevating through that a lot of folks
have aspirations of being on a red team
and so i'd like to start off just just
by asking each of you uh how did you get
started in this career
yeah so i guess my start was definitely
um probably
i mean the start to start was probably
just me you know taking a lot of my
personal time to sort of read about like
all the security stuff online
lots and lots of like blog posts and you
know random books that i could find
um but i think you're probably one of
the biggest um in terms of knowledge
shift it was like probably being a
consultant actually
fox just and just taking every time
anybody said anything i didn't know i'd
like write it down and go and cram it um
and so that really really ups the amount
i was able to know and understand
um and then you know after that ended up
doing like private security stuff and
sort of moved more into like the red
teaming side of things so
we hired him off of reddit like yeah
yeah
real transition yeah you want to go to
next year
yeah um i've always so i've always been
into computers in general
uh i grew up like going to lan parties
um
and my parents like never allowed me to
have an internet connection at home so i
actually got into security
uh through like building wi-fi antennas
to steal my neighbors like internet
connection so i could play video games
online
uh at home and then it kind of it really
snowballed from there
um i started getting into programming
and uh yeah the rest is kind of history
so um i guess i kind of stumbled into
security
and like both of them they kind of
started security early for me was more
like i just stumbled into it
um i graduated from undergrad doing
computer science and i was hired into a
role to do
testing and then on the first day of my
internship i find out that it's more
security
than testing um so just like start from
there did web application fan testing
really enjoyed it uh back then the term
red team was new to me and i wanted to
get into it but i didn't really
understand what it was
i did my master's in security i tried
consulting for a vet
and then entered into google did a lot
of like assessment oriented reviews like
design reviews code reviews and stuff
and then um started working on red team
exercises alongside really smart people
and just picked it up from there
uh but yeah kind of stumbled into it and
things worked out as i started like
working towards it
i think that's that's one of the cool
things about uh like the security
infosec
as it exists today is there's a very
wide variety of backgrounds like
you have a master's degree uh matt and i
dropped out of college
so uh but it's you know you know there's
no like one background that people
really come from uh
into the industry it's it's really open
to
and anybody's background like uh at our
firm like we had somebody who's like a
medical doctor and just like got bored
with medicine and came and became
like a hacker uh for a little while so
um
yeah it's it's one of the very unique
things i think about security right now
absolutely you don't have to have a
pedigree to to get here yeah that's
great just a passion
speaking of much great segue uh you know
what makes you really passionate about
what you're doing right now
yeah so i i mean i think the biggest
thing is just like it's always like
completely new challenges and like the
problem space is like never like
um like you always come in with like
previous experiences of just like in the
sense that you've had a bunch of stuff
before but like oftentimes you'll just
be handed a completely new system that
may be written completely in-house you
know don't know anything about it you
have to like just be like all right
today i'm going to like learn this thing
and like figure it out
so it's like never boring and like
boring is always what i've disliked
the most so i think it's probably my
favorite part about it yeah
it's like solving puzzles like every day
someone gives you something new
um it's also one thing that people don't
talk about often is like you bang your
head against the problem for a long
long time and then finally it it like
gives way
um it's both the most satisfying feeling
when it gives way but it's also like
frustrating to get there but uh the
journey of like
figuring out how something works taking
it apart uh finding the fastest way to
get to what you need
i think that keeps things new every
single time
yeah i think the i'm i'm in a similar
boat so
and i think there's there's a slight
difference between uh
like being on an internal red team
versus a consulting red team
um you know we being a consultancy we
work for a variety of different clients
in different industries there's always a
different tech stack
uh you know you might be hacking you
know uh
some type of manufacturing facility one
week and a couple weeks later you'll be
uh you know going after something you
know some tech company
or something and so you know one and one
will have like a windows domain and the
other
there's no windows machines it's all
macbooks uh or like chromebooks or
something
and so just the in consulting you just
get this like really fun variety
um and you kind of you kind of get
exposed to just just everything
from you know systems that have been
laying around for 10 years to things
that are
sort of in the hit you know serverless
like application stacks and
uh more sort of hipster tech as i like
to call it
uh so i think there's also the
capabilities of the blue teams will
probably vary a lot
yeah as well as like how you approach
like detection
in in environments and from a red team
perspective the way you approach you
know persistence very
significantly as well in sort of the
beyond corp zero core
uh environments you don't even
necessarily need like code running on
machines like when people think about
persistence
they think about code running on
machines somewhere but
in in the sort of beyond corp world it's
more about like credentials
because you the attacker you as the
attacker always have access to like the
authentication plane
um and it can be oftentimes much more
difficult to revoke credentials versus
like killing a process on a machine
so one of the things we try to do in is
you know try to
vary our approaches to different um you
know ttps depending on
the target environment we always try to
sort of uh
push the boundaries in in those
different environments so that's a good
example of just like the fact that
nothing's ever the same
like different stuff like even something
that you would always take for granted
where it's just like okay well at least
in every engagement like i'm gonna have
like you know
implant or something it's to be like a
first compromise and then some network
but then there's like yeah there's stuff
like this where it's like oh actually
none of that is you know applies in this
one you have to completely rethink how
you do it
so i think and mass presentation which
she's giving later today
i think is a really good example of some
of this stuff i don't know if you want
to
yeah yeah just give a quick pitch for
that but uh please do
yeah yeah so i'm doing a talk later
today at def con um these the the
pre-recorded video actually is already
online the slides are but it's you know
about you know g suite uh
google workspace and apps script and
sort of the security model behind these
things and
you know it talks about some really
interesting topics like you can make an
implant in apps script and have it be
completely you know separate from your
device you know you can have an implant
that persists past wiping your laptop
all sorts of stuff like this so really
delves into this sort of weirder world
where it's like okay well
you know we have a a company that really
takes this to heart the zero trust sort
of thing how can we still survive and
like
you know get access and you know do
lateral movement stuff like that
one of the other things i really liked
was like it's not necessarily about
exploiting vulnerabilities so much as
like
design flaws and like misconceptions
about how things are kind of supposed to
work
um and that's one thing that i think i
find often on
on red teams is like not necessarily
exploiting vulnerabilities but
misconceptions about how certain pieces
of technology work often
uh bears very good fruit uh for the red
team so
yeah that's very good yeah i think
that's kind of a distinction that the
team has between
fantastic and red teaming is like you're
not trying to find all the bugs you're
trying to find the fastest way to get to
something
and you don't actually just look at the
systems you look at the people and
processes that support the systems as
well
and a lot of times the processes or the
people kind of give way before the
systems themselves
yeah so with such a dynamic environment
um you know i think there's no end to
the amount of tools and the amount of
platforms you can study the different
technologies what are some of the tool
sets that that the three of you uh
uh like to use um i can probably give a
plug to theirs
because like we use a bunch of open
source tools as well and
we've used sliver uh joe's c2 implant
stuff as well as curse chrome which is
like the chrome extension plan so
we use yeah so uh i'm i'm the co-author
of
open source c2 framework called sliver
uh we use that pretty extensively
internally we have some internal
sort of extensions on top of it but i
also am a
user of the cursed chrome extension that
matt wrote we use that pretty
extensively again in sort of like these
beyond corp situations
it's particularly good for getting
around u2f which is becoming
which is a really difficult security
control to get around and i see it
becoming more and more popular
because it kind of takes like credential
phishing off the table in password
spraying and some of these
like very effective sort of low risk
from detection early on in engagement uh
approaches to getting
initial access so but yeah we used curse
chrome quite a bit
um as well as like some of the
techniques you developed for
injecting it into the runtime of
existing extensions uh we wrote some
some stuff around that as well uh but
yeah sliver is sort of our go-to if we
want native code
running on a machine uh it's
cross-platform runs on mac os windows
uh linux as well as like freebsd
uh and basically anything go can
cross-compile to sliver can probably run
on
in some capacity you know there's
certain features that are platform
specific
uh but uh yeah we use it quite a bit so
yeah we use sliver as well
super super useful especially for the
crosscompile thing it's very useful
because trying to find something that
works on like you know
osx and like has like reasonable
functionality it's like nazis it sounds
so
um yeah actually in addition to like all
the open source
projects a lot of things that i find i
use is um actually just like when people
do
research or they write a blog post and
they kind of describe like different
attacks um like that actually something
that i use quite a bit like there's um
like i remember doing some you know
research into like okay well like how
can we exploit the osx platform what
does that look like
and just reading like blog posts that
even just broke down existing malware
and like tricks that they used and like
stuff like new attacks that people
discussed um
that uh while not directly like code it
was like taking those snippets and like
working those and using them as a
starting point to build you know our own
payload that's something that i use
quite a bit as well
so yeah yeah i think that's uh in my
experience uh training sort of junior
red teamers that's often like the
steepest learning curve
is sort of being able you know in pen
testing you deal a lot with like
proofs of concept and i i was in
application security before
sort of switching to red teaming um in
there you know it's it's generally
enough to kind of just do a poc
sometimes you'll you know you'll add
some flavor and and like
uh you know to just show impact but i
think one of the
uh learning curves that people
experience when coming over to red
teaming
is you actually have to like weaponize
the stuff and deploy it and actually get
it all to work and you need it to work
like
fairly reliably in an environment that
you don't necessarily have
like it's it it's generally not
realistic to have a perfect lab
environment that you're uh
for your target so you have to do like a
lot of guesswork uh you have to have a
lot of contingencies
uh and you have to bake that into your
code into your payloads
uh into your operating procedures like
into everything so
as well as just being able to take those
because oftentimes you'll you'll just
research on a target you'll find like
a poc that was published but you know it
won't work in the it's you know it's a
little broken or it doesn't work in the
way that you
need it to and so you'll have to take
that and modify and integrate
into your existing tools and so that's
that's an extremely valuable skill set
and i think it's
uh it's one that juniors have a hard
time acquiring sometimes
yeah i will say that i think that um one
of the one things that
i really encourage people to get in the
habit of is even if you're in apps and
you're not doing red teaming like taking
the time to write proof of concepts like
the full thing
uh it's not just like even if it's yeah
it's proof of concept it's not actually
gonna get used
um just like weaponize a cross-site
scripting vulnerability uh it'll take
your understanding of what's going on
from like oh cool i mean alert box
happened
something uh to like oh i like i
understand all the things i can actually
do with this and like the real danger
and so when people ask you things like
what's the impact you
are like because there are terribly
speak right so
yeah i banned alert boxes for cross-site
scripting examples of
bishop boxes you have to write a real
payload
this uh this is a question that i think
a lot of folks
interpret differently in terms of like
their answer but uh there's a lot of
misnomers out there and in our industry
we're always trying to get to a common
language
how would you define you know like what
is a red team or a red team or what
what makes that you unique from other
types of uh
of uh titles so we would say like red
teaming
is where you're simulating an adversary
uh so you're trying to copy their actual
tdps you're trying to work towards an
objective and you're trying to show
how they would get to that objective and
how they would achieve their goals so
it's very carried around
one who are you simulating what is the
attack of a failure picked
what are the objectives you're trying to
achieve and how do you get there so it's
not so much as like find every issue in
a system
it's like get to that point the fastest
way possible in a way that it makes
sense for that attacker profile
that you picked um so that is the main
distinction i would say between a red
team and
between like a pen test or an assessment
that's great
yeah the way i think about it is you
know it's all offensive security testing
so like there's a lot of overlap but
to me the primary distinctions are you
know a pen test is really is
generally you're trying to find as many
vulnerabilities as possible
in the in a target with it within a
certain time frame
stealth is usually not a concern and the
primary objective of a pen test is to
uh reduce the attack surface of the
target whether that's a network or an
application
a red team is more goal oriented and
you're generally actually trying to use
the fewest number of vulnerabilities to
achieve a goal
because that will more or less translate
into your exposure to detection
like if you find one way to get domain
admin on a red team you're probably not
going to go back and try to find another
path to domain admin
but you probably would do that in a pen
test right because in a pen test again
you're trying to reduce attack surface
you want to find as much stuff as
possible
red team is just like can a goal be
achieved and often you're trying to
emulate specific adversaries
because the outcome that you want from a
red team is to sort of increase the
organization's detection and response
capabilities
or to exercise them you know a lot of
organizations
uh have you know procedures and stuff
written down on paper
but if you never exercise those you know
you may
you may run into problems uh so um
for you know you really want uh muscle
memory when it comes to responding to
incidences
and the red team can sort of help build
that muscle memory within an
organization
uh versus again like and red teams sort
of are
generally more broadly scoped it's about
people uh you know social engineering is
often involved it's not necessarily just
about technical vulnerabilities
and a pen test is generally always
focused on uh technical vulnerabilities
so yeah i think they describe like the
meat of it um i
think the one thing that for people who
are you know very very good on the just
like the hacking side of things that
people are like whip and explode really
easily you know they know all that
the biggest thing that i think for them
that for me to like basically convey to
them is like you know
i'm always spraying stuff as in like
okay i am the person we're emulating
i thought you know my bosses don't care
if i find 10 exploits in this thing they
only care if i get the data i'm looking
for when i give it back right
like um or if it's like i'm a
disgruntled employee or whatever the you
know whatever i'm simulating
it's like i'm trying to i'm trying to
put myself in that person's shoes and
say what do what would i actually do
here right like not like when i do
something as crazy as like what we're
pulling off does that make sense like
because
you know you can always do crazy attacks
but when you're you're really trying to
emulate like what you know what joe
mentioned like the detection
response side of things you wanna make
sure you're actually doing a real
simulation that's helpful there
and to add to that like it's about
adding value is it like you're actually
testing the controls in place you're
testing the detection and response
capabilities be it
what can they actually see in terms of
like detection signals but also what do
they do once they see it to joe's point
so the value added is more for the
organization
that kind of has some security
capabilities already
so if it is an organization that's newer
in terms of security building on
security
red teaming is a little bit like jumping
the gun in it's always yeah we
certainly see a lot of that in
consulting and usually what i'll tell
clients is like
if you haven't done a lot of pen tests
you definitely don't want a red team
like you kind of want to start with pen
tests and work your way up towards
red team as you mature your security
program uh within
the organization so yeah you could have
i especially find that you could run
into situations where like
you know if you have a bunch of issues
that you know are broken you're like oh
this is broken this is broken if you go
to my team a lot of times you're just
gonna
it's the longest taking fruit right
you're gonna go for what's easiest
you're not gonna waste time
uh so you might end up with something
that's just like here's the problems you
already knew about
like go fix them so what about a nice
story and like clearly articulating the
risk as well yeah
yeah but there'd be better roi with you
know attack surface reduction versus
yeah versus that exactly
so yeah um pen tests are very useful
tool within
you know these are all components within
a mature security program
at an organization it's not a you don't
want to do just red teams you don't want
to do just pen tests you know
that's great advice and that i think
that the definitions you provided that
should be the standard because i think
you hit on all those important points
and and i think there is a strong
distinction uh when you look at the
different
uh you know areas of offensive security
and so thank you for
providing that um you know as we're
nearing the end here you know i'd like
to
again i mentioned that we have a lot of
folks who are either getting into
offensive security or
they're kind of leveling up their skills
uh what what you know personal advice or
recommendations would you have for those
folks that uh
that are learning um a couple of things
actually like
this is true for anything in security
understand the what what
uh what why how like don't just try to
see that things break and and go with it
like understand how the tool works
understand why something broke
understand how to fix it i think that
will be valuable in any phase of
security but especially in red teaming
because
it's not just about breaking something
it's about like weaponizing it like what
uh joe and man if you said uh the other
aspect i would say is like learn to code
i think this is like a super underrated
scale in our industry scripting and
coding super essential
so understanding how the system works
and then augmenting your skill set to
actually write tools
for the use case you're in is very
valuable
yeah i i generally learn things by
writing a tool to do it
like that's even if it's i think there's
there can be a lot of value in
reinventing
wheels uh if it's like an educational
thing um so
definitely i i agree wholeheartedly with
everything you said
um i also read a lot like i uh i'm a
prolific reader
i have a lot i read almost every
security book that comes out
um and so i think that's a lot about
like i've
at least i find a lot of value in that i
know every everyone like learns
differently
so you also kind of have to learn you
kind of have to understand how you you
learn but
uh for me like uh reading is is a huge
part of how i
uh learn things so i definitely
recommend
reading as much as possible so yeah um
so some of this is it's i think the
security environment today is a little
different from when like i was sort of
learning stuff because like there's more
information more readily accessible
um one of the things i've i've always
learned is like especially when you sort
of get your first you know job in the
space you work with people it's like
uh don't be afraid to like as much as
possible when somebody sees something
new where they
present something like really learn from
it and like extract that technique and
use it yourself
um because a lot of times you know
security at least in my experience
there's like a lot of like hidden
knowledge that's just like oh some
random person does some trick and you
you may you could easily just like not
notice it and not pay attention but
this could be something really useful
later on so like i always try to like
especially like the more you know it can
be easier to say like i know all the
stuff i won't listen
for new stuff but really always keep an
open mind and be like
okay so that actually this person was
able to get this working so what did
what are you doing that i didn't do that
like i can absorb and like learn from
and the other thing i'll say is like you
don't have to be born a genius to do
this job uh i definitely am not like a
um i wasn't born an extremely smart
person it's like i said it took a lot of
like me banging my head against the same
things before i'm like
i get it now so if you're you know if
you're running into stuff and you don't
get it
that's 100 exactly what i ran into and
it's completely fine like
you know there's no there's no magical
like only these people can do it
everybody just takes time
you know learn learn your own pace like
keep trying so
but yeah definitely understanding like
how like one of my favorite security
books in matt knows this
is the the tangled web which is it's a
little dated at this point
but um it's it's it's it's uh the title
is like you know how to secure modern
web applications
but the book is actually just about like
how browsers work
it doesn't teach you like there's
nothing in there about like burp
or you know sql injection or anything
like that
um that's often you know there's other
great books on those topics like uh the
web hackers handbook
but tangled web is just about like how
browsers work and like the different
quirks and like the different rfcs and
like
how different urls are parsed between
different browsers and all the nuances
with that
and i found that to be like one of the
best like security books i've ever read
because
even though it's not about
vulnerabilities and stuff
necessarily so yeah i think one last
thing to wrap that up is
um actually to measure yourself against
your own progress don't measure yourself
against like
if i measured myself against these two i
would have a big conflicts
um and then the other one i would say is
um
learn to write well i think red teaming
that's one skill that people don't
highlight now
a lot of reports you need to articulate
why something broke and how
and when you start doing that you
understand the concepts behind it
because if you can't explain it
that means you go back read understand
come back and do it better
so writing is a super valuable scheme
that's the fine technique but yeah
uh yeah i can certainly say it from uh
from a consultancy
bishop fox is uh pretty heavy on the
writing skills um
to the point where like we often or i
think we still do this we give like
writing challenges to applicants while
they're going through the application
process to see
because we want to gauge how good they
are at writing um and like that's that's
definitely an underrated skill i
definitely created so yeah i've even
taken like
going out like leaving consulting going
to the private security world like it
still is super useful just in the fact
that you like if you're going to write
it for a report like
it it looks so much better and like such
a better quality of work when you can
like you know
send an email that like looks really
good and you can like write a report
that looks like very formal and like
easy to navigate like that skill is like
super transferable
so absolutely thank you again so much
for uh taking some time out of this
short period where we get to all get
together and see our old friends
um we've got uh we've got some more on
the agenda
again uh you know can't thank you enough
we're gonna kick it back over to omar in
the studio
and we'll go on break awesome and i like
that i like the studio
part so thank you again guys i really
appreciate your your help and
collaboration here
amazing thoughts in there now i want to
announce something that i'm going to put
barrett on the spot
but we stay tuned for some upcoming
giveaways
we're going to be announcing a few
throughout the days yesterday we
gave three awa courses
with 60 day labs from offensive security
today stay tuned we're going to be
announcing several forms where you can
participate
and basically you will just provide your
ctf
handle and your discord handle and we'll
we'll of course you know look for you
but yesterday we actually had three
winners and as a matter of fact that's
what i'm gonna do uh in a few seconds
i'm gonna go into a break and i'm gonna
show you a quick video from offensive
security congratulating those winners so
once again thank you so much for sharing
your knowledge today
and with that let's go in a break thanks
for having us
[Music]
hi everyone my name is
absolutely so shout out to all the awa
eight winners
we'd love to have you thank you so much
for taking our courses
and getting the vouchers whatever it may
be congratulations
uh we always encourage you to come back
and uh we have many more certifications
in offensive security we just launched
365 so that's year round
for many many things and a 20 discount
so
by all means swing by the website check
it out and congratulations to each and
every one of you who actually got it
thumbs up
[Music]
so
[Music]
so
[Music]
so
[Music]
so
[Music]
knock knock who's there this guy what's
up red teamers what's up def con it's
your favorite fake brilliant billionaire
investor
my little birdies cheap cheap cheap
cheap cheap cheap cheap cheap i like
cheap things that's why i'm rich they
let me know
that lunar fire is under fire but that
is a threshomos company
and that's got so much smart [ __ ]
in it and so it's unhackable or is it
no it isn't not even you boy and girl
geniuses can do it you would have to be
the human equivalent of cars with doors
that open like this or like this
are you can you will you don't
[Music]
[Applause]
[Music]
hello everyone i'm barry darnell from
the red team village and today we are
here with omar santos from the red team
village as well as our guest ipsec from
hack the box
hey guys what's going on hello
uh ipsec hack the box has been a long
time supporter of the village
can you tell me more about the company
yeah um
hack the box is a hands-on security
training platform and our main goal is
to make good training
readily available to anyone in the world
if you're new to a topic or
just the field in general we have hack
the box academy
and it's a guided learning experience
which just means we have written
material in hands-on labs
and again when building this
accessibility was our number one desire
so we created the prone box which allows
you to have a
whole operating system in your browser
so the machine you're doing this
learning on doesn't even have to be
powerful you can do it on like a
chromebook
if for some reason you want to do it on
a phone you can i wouldn't recommend
that
but everything's done within a web
browser if you want to bring your own os
we also provide a vpn pack for you so
you can join your os to the vpn
and go on learning in addition to the
academy we have unguided learning which
is what we're most famous for
this is the weekly challenges machines
or entire like networks we put out on
the platform
and that we ask people not to publicly
talk about these challenges until they
retire
which is typically 20 weeks this is my
favorite and what i credit most of my
success to because it really enforces
building good social relationships
that not only help get you the help when
you need it but also
when teaching it often validates your
understanding of it and it's proven to
help memory retention
so i have a lot of friends from my in my
social network that include barry i met
him
through another friend who met him at
derbycon which is
a similar event of red team village and
the funny thing is
both my other friend kyle and barry all
lived within like
30 miles of each other but we met like
hundreds of miles away so definitely
like
important to go view and travel and
experience the community because you'll
never know who you find
and how close people may be it's a small
world
absolutely i think we've all been cooped
up these last few months here i think a
lot of people are excited to go in
person to las vegas
to attend def con and so we're really
excited to see some of our old friends
and make some new ones
um speaking of of that community you
know hack the box is a very
vibrant community both on their discord
as well as all over twitter can you tell
me a little bit more
about the people behind hack the box
maybe some projects that you might be
working on
yeah we have a innovation team that's
designed
at like pushing what we think is the
limit
so typically most of our stuff is either
a docker or a vmware image
and the innovation team is looking into
google cloud aws
and azure to provide a pro lab called
black sky which is just based upon
those types of features so if you want
to exploit im or do a lot of those
unique cloud things black sky
lab is going to be that we also have as
you said the discord community we have
roadrunner who runs that
and they help provide a lot of good
support and just learning to anyone
in addition to a bunch of ctfs i think
we run the ctf like every other month or
something it's insane
well talking about the ctf and talking
about all the activities you know
throughout the years you guys
have supported the red team village
tremendously
so first of all thank you and thank you
hack the box
so one of i got a couple of questions
right so one of the questions is you
know
what would you say that is the best part
about sponsoring
community efforts like the red team
village ctf this year
i mean obviously it helps the community
grow and most of my like
relationships i can credit almost all my
professional success
as to leeching off my friends knowledge
because no one can know everything
and i can't speak for anyone i hack the
box but i know
a bunch of my friends at hack the box
are super excited to play a ctf built by
other people
and we've played the red team village
cts for quite a while um
i vaguely remember one i think two years
ago that involved exploiting a printer
which was new to all of us
we were all like big binary exploit
people and then threw a different
architecture at us that we never really
experimented with and it was just a lot
of fun to play
so super excited to sponsor an event
that we can participate in
and learn new things to hopefully put
out on our platform in the future
thank you appreciate that and i think
that you're hitting
my next question which is why do you
think sponsoring the
the retin village this year is so
important for the community
yeah um number one it's important to
like with covet and all we want to
increase the socialization and
everything we've been all cooped up
and the red team village incorporates
all of hack the boxes
things the main thing was being
accessible um if you can't travel you
can do it online and form a team
and additionally if you want it's
available for the high cost of zero
dollars which
aligns with kind of our methodology and
what we want
all our machines are available for free
for a time and then once they retire
then you have to pay
a small fee to gain access to it because
hosting 150
images permanently would just be
expensive can't do that for
free um additionally i believe infosec
is a unique profession
where team building activities have
immeasurable impact
if you look at the non-infrastruct teams
they still do team building activities
like you have that gimmicky trust fall
and escape room etc
and they're doing them just to help
build that social bond between
co-workers so you know it's valuable
since that's the only thing they care
about
in the infosec world we have ctfs that
is just like that on steroids
it has all that same social bonding
benefits like i mentioned earlier
i play cts with barry i've played cts
with oxdf mr ben
john hammond a bunch of people i just
have a lot of fun with playing these
ctfs along with coworkers
and in addition to that social bond that
you build
it also gives you a lot of techniques
that you may be able to immediately
provide your work value because
you're joining hands with a bunch of
other companies to learn things
it wouldn't surprise me if you do the
ctf and then
find something you can immediately turn
around to do on your job
i remember doing almost any pro lab i'll
use offer as an example where the fret
hold involves exploiting splunk
and i had a pen test that i kept missing
this vector on
because i just didn't know it and mr ben
put it in that pro lab
so when i did that it was just like an
eye-opening thing of oh god what have i
been missing
so definitely the big social aspect is
huge here
awesome and and uh i couldn't agree more
and
and once again you know thank you i have
one more last question when
it's around the benefits that your team
actually will receive
by participating at the you know that
con written village ctf this year
yeah um hack the box and red team
village are almost anonymous and what we
provide
and our methodologies so the only
unfortunate thing is the red team
village ctf is a yearly thing while hack
the box produces new things on a weekly
basis
it's probably not to the scale that red
team village will be doing just because
it's constant
but if you're itching to do more after
doing the ctf definitely check out the
platform if you haven't
and go over to hack the box because i'm
sure you'll love the challenges we put
on the site
awesome so once again thank you so much
for supporting us thank you hack the box
you know for
sponsoring the red team village and i
hope to see you at defcon
yeah take care
all right welcome back everybody is so
we
are on time right now i think that uh
just in a few
more minutes the finals will start
and the qualifiers will end so with that
i'll pass it back to their
barrett and savannah hi everyone so
before we kind of get started with
announcing the winners at noon pacific
time uh we are going to be doing a
giveaway for an oscp voucher
so omar is going to be sharing the oscp
survey uh it's a google form so you can
submit it and we're going to choose
someone at random to win the actual osp
voucher
for 60 days um so you'll be able to play
in the lab for six days and then also
take the exam
so it's a really good opportunity if you
want to get the sap
and then uh the remainder of the day
we're gonna have at 2 p.m
uh henry from stands and then at 3 p.m
we're gonna have
bruce schneier and then at 4pm we're
gonna have andy uh
doing keyboard building so we're really
looking forward to that so once
um omar yep yes he has it linked right
there to enter the win the oscp giveaway
so once we get all the submissions from
there we'll announce the winner later on
um omar was anything else that you kind
of wanted to add before
we're kind of like waiting until noon
too
no i think that from my site you know
quick reminder all the conversation of
course is happening at the defcon
discord server on the the channel the
specific channels in the bottom of the
screen
um just just amazing how many flags
actually you know people were submitting
in the ctf and the participation so i
cannot wait until you guys share
you know some of the statistics a little
bit later and of course announce the
winners
and once again you know the the link to
enter
the giveaway is in the bottom of the
screen we're going to have two more
giveaways later so if you
are not the lucky person you still have
two more chances later
today so with that i'll pass it back to
you
yeah we are just five minutes away from
closing uh the quals
we've had a lot of really really
impressive scores it's great to see
all these teams i was told that hack
street boys are going to do a song
after uh after we close out uh son of
anton is doing great in fourth place
our friends over at neutrino cannon are
trying to get back
up higher on the scoreboard but yeah
we've got a lot of familiar names here
it's great to see that uh that these
teams come back and play the ctf
we are going to finish out this jeopardy
board style and we're going to go into
finals
we've got we've got a really impressive
uh network that we want to share with
everyone and so
once we get to um the once we get to
noon and we close everything out
we're going to take the top 20 teams and
that's who's going to move the finals
we're going to have an hour break
between when we close out quals and when
we kick off finals
i will make another announcement when we
get there
let me go check discord
i did want to talk about how many how
many flags we had
which i did not get dm to me
and while you do that let me share this
schedule
for today basically let me shift my
screen
real quick um as savannah mentioned you
know
we are now about to kick off the the
finals in a few
minutes at 1 p.m pacific time we're
closing
the calls right now in the next four
minutes
and then we have a few interviews you
know coming up
and we have a combined effort within the
the community especially in
participation with the ai village
at 4 pm so that's actually a panel that
i will be participating with bruce
schneider and a few others
so stay tuned there's a lot of other you
know activities actually happening
and with that let me share the screen
again for the
scoreboard ai generated you know they're
kicking behind you know
kicking butt and behind them there is
ept
so in just three more minutes three more
minutes
some overall stats we had 645 registered
teams
a total of 2127
different players our overall like our
capped out score
is 11 970 total possible
points and that is across 124 different
challenges
so we had a lot there on the scoreboard
and i love to see just the submission
numbers
since we've been doing this uh just for
this last day and a half
we've had 10 000 correct black
submissions
and 10 000 incorrect black submissions
so that's quite a bit a lot of activity
there
yeah and as a matter of fact i'm
actually trying to create banners as we
speak to actually share those numbers so
10 850 correct submissions even though i
put right in there but you know they're
correct
and then uh that's an impressive number
uh you know even if you actually
submitted a wrong submission that's okay
they're all the accounts actually you're
playing you're learning hopefully you're
having fun
um and with that let me actually share
also again the scoreboard side by side
um so back to you
yeah i know if you just keep on
submitting the i could
maybe just be the correct one and uh and
please don't submit to the
ocp course giveaway eight thousand times
uh i think somebody put it in
burpa in burping we got a ton of
submissions same person so
let's uh just keep that down the one
we've got three more uh we have three
total that we're going to give out today
feel free to just you know send them to
various dm's on twitter
and then another thing is if you
actually submit multiple of them you
will be
disqualified so we'll just ignore you
you know
so um just make sure that you don't
vomit because
you know i will do the same
don't do that now
we are have less than a minute left
so if you're holding flags you better
submit them
yeah yeah and look at that look at this
fourth and
fifth place neutrino cannon is trying
he's trying to go to fourth
30 seconds left
all right actually i can do a countdown
of that so let's start
30 seconds do a 30 second countdown from
[Music]
now
[Music]
all right those 30 seconds going pretty
fast
all right so we are closed out
oh nope i was just going to pass it over
hey scroll down a little bit omar let's
see let's see where we're on the cut
here
um right there so unfortunately
uh dark wolf solutions it looks like you
you were just shy of the points to make
it into finals
we've got cia and above all of those
teams are now in the finals
what i'm asking is for just the team
lead the team captain
please dm nop researcher on discord
uh let them know uh what team you're on
as well as what email was used to
register that team
so we can validate that information
we've got an hour now where we're going
to transition we're going to get you a
package that has your vpn
uh your vpn configuration for your own
private network
so for everyone who's watching so uh
what the finalists get to do now
is we're going to move into our scenario
where we have
two uh windows networks that will be uh
will be stood up
in a cloud environment uh for safety
we're gonna keep everything contained
within a vpn so it's a little bit
gamified just keep that in mind
but you'll be able to have your whole
team connect to that vpn one thing that
we always recommend is especially if you
have a big team because we know those
top
five ten uh those those top five ten
teams are really huge teams
we try to do things to kind of slow down
a huge team the uh the infrastructure
itself
the instances that we're using you can't
have you know 45 shells on so you're
going to have to work together
there's going to be little pieces of
intel here and there that you want to
share across
and and just in general you you want to
work together as a team on this next
part
it's going to be it's going to be fairly
immersive the scenario that we talked
about uh we called this thing lunar fire
kind of a play on words for the for the
solar winds uh when we started designing
this that was that was one of the top
stories we thought that uh
we thought that that would be the
sensational thing that would still be
holding true today
little did we know that 400 other things
were just just huge news
uh in this industry with all the
ransomware especially the things that
have
affected a lot in the physical realm so
so lunar fire is our theme
um that should key you in that there's a
there's a supply chain attack involved
in our scenario
you've got two networks one of them has
a very small attack surface well another
one has something that you can go after
and your your whole point is to get
through that first network
and pivot into the next one by hijacking
that supply chain
and um and uh and getting you know and
and getting into the next one
i think i want to stop talking so i
don't give any more hints
um good luck everyone take a break uh
yeah no good luck everyone like uh
barrett said
and there's there's anything else you
want to mention omar feel free to add it
i'm just gonna
drop a little hint for one of my boxes
i'm just gonna say i like notes
that's the the hint for mine uh so good
luck and i'll pass it back to omar
i've got i've got one more thing to say
so for folks because a lot of these
teams we saw last year
so um one thing i will say is that the
os
intelligence aspect of this is not as
heavy as it was last year i know that we
had a lot of flags
with that i just don't want you to spend
a whole lot of cycles there we had a
whole 24-hour period
where we had flags everywhere we had
them on myspace linkedin
i think i think like we made a fake
geocities website and put it up there
so this one it's fairly light but there
is some um it's going to be spawned off
of
that one website that we shared earlier
the lunarfire dot dev
um keep in touch on dm with knob
research we want to make sure we get
contact with all the teams
and uh and what we've tried to do is put
some minor hints
in those personas we created that'll
help you out in the finals
so uh you know if you have a big team go
ahead and set some people
focused on that to make sure you grab
those hints
awesome and once again congratulations
to the 20
teams that we we have in the screen
right now so
um as barrett mentioned some of these
are not new to the red team village so
thank you again for supporting the red
team village and playing
along and i know that neutrino cannon
actually is pretty much in every single
ctf out there for the red team village
so
so good to see you here and with that
let's go actually go in a quick break
and we'll be announcing the winners of
the oscp course so as a matter of fact
if you just join
the giveaway link is in the bottom of
the screen
and i'm i'll leave it there during the
break for you to participate and we'll
announce
the winners at 1 pm east
pacific time all right so with that
let's go in a break
[Music]
so
[Music]
so
[Music]
knock who's there this guy what's up red
teamers what's up def con it's your
favorite fake brilliant billionaire
investor
my little birdies cheap cheap cheap
cheap cheap cheap cheap cheap i like
cheap things that's why i'm rich they
let me know
that lunar fire is under fire but that
is a tres gomas company
and that's got so much smart [ __ ]
in it and so it's unhackable or is it
no it isn't not even you boy and girl
geniuses can do it you would have to be
the human equivalent of cars with doors
that open like this
or like this are you can you
will you don't
[Music]
so
[Music]
so
[Music]
[Applause]
hi everyone my name is savannahzara and
i am the co-lead of red team village
and today we have barrett darnell and
caitlin o'neill with us from bishop fox
and they're going to be one of our
sponsors and we're really thankful for
them being a sponsor for our ctf event
at defcon and i'll go ahead and let them
enter themselves and we're going to get
them
to know them a little bit better today
hi i'm caitlin i'm with recruitment team
here at bishop fox
i came over here about three years ago
because
of our reputation as one of the largest
professional services firms
focused on offensive security and
security as a service
it's been a wild ride but part of i
stick around is because i love
working with such brilliant people i
love
that we go out there and break things
build new things
break more things uh and and always
working with the latest technologies to
keep people safe
so it was a really exciting opportunity
for us to sponsor the red team village
capture the flag this year at defcon
where we can't wait to meet people
virtually and
on site and uh to hopefully find some
new ways to grow our team
hi savannah nice to see you i'm barrett
garnell managing senior operator at
bishop fox i'm part of the continuous
attack surface testing team also known
as cast
well we're really excited to have you
guys on this call today and
i would say the first question that we
kind of want to start off with is kind
of seeing what you guys would say is the
best part of being a sponsor for
an event like this well for bishop fox
we're avid participants of the greater
infosec community and we feel that
sponsorship of conferences and efforts
like this
provide a real tangible value to the
community this ctf in particular
provides a tremendous amount of
realistic hands-on
experiences for those in the offensive
security particularly red teamers
yeah no that's that's awesome and i mean
i'm sure you know this barrett
with so many reasons that resources out
there why do you think
kind of sponsoring something like this
is so important
well for one uh this resource is free so
that barrier of entry is out of the way
anybody can participate secondly it's
realistic it mimics real life
scenarios that we've seen on our
customer engagements and so it's not
very esoteric
it's you know real tools real uh
situations you might be in
and it's also beginner friendly it
starts off where everybody can join and
get something out of it
but the difficulty ramps up so there's a
lot for
experienced red teamers to hone their
skills on
awesome i know we've kind of just talked
about the benefits that
people who are joining the ctf get out
of it but can you kind of talk about the
benefits bishop fox receives out of
being a sponsor for the red team village
ctf event at defcon yeah well
you know first and foremost we always
want to give back to the security
community
and this is a great way for us to
interact with the hundreds maybe even
thousands of
attendees and participants whether
they're
there in person or virtually um it's
great
um from where i sit as a recruiter
because it gives us a chance to
meet new talent and people who we maybe
haven't engaged with before
and that's really important especially
as we continue to grow
our two new service lines the continuing
continuous attack service
testing team uh that barrett is on and
our red team
yeah no i mean everybody knows in the
security community who bishop fox is
and i'm sure they would love to know
about the recruitment
so i guess what types of people do you
guys typically
look for for the team yeah so you know
what we need
and what we're hiring for can kind of
shift month to month so
in the past if you engage with us and it
wasn't a fit um that might be changing
so you know always stay in touch um
first and foremost we look for people
who are really passionate about security
because that's definitely who we are and
you know we're always looking for
um a diversity of thoughts a diversity
of backgrounds so
uh you know we have a lot of people who
came from a pretty like traditional
career paths
you know school work but we definitely
have folks who are self-taught
who are coming from non-traditional
backgrounds
um you know we we love our folks from
the military as well
so there's a lot of different paths that
can lead you to working at bishop fox
and we're really open
to exploring all of them uh you know you
can always find me
on linkedin caitlin o'neil but you can
also engage with bishopfox on twitter
we have an awesome social media gal we
have a really fun twitter account
um we're going to be on site in las
vegas and we're going to be using
twitter to kind of help people find us
and and also find us for some cool
giveaways as well so definitely check us
out there
yeah no that's awesome i'm sure
everyone's looking forward to kind of
seeing bishop fox
at defcon did you guys have anything
else that you kind of wanted to mention
on this call
uh before we end it today yeah i mean
i'm lucky i just get to show up as a
recruiter and a sponsor i know that
all of you guys with the ctf have done
so much work
so you know thank you for everything you
did i'm really excited to see it all
come together
and thanks to the red team village for
this opportunity we're really excited to
meet everyone
and i just want to say uh you know after
months of being on lockdown i think
everyone's itching to get out this might
be the first in-person conference for a
lot of people
and if you haven't registered yet for
defcon i highly recommend it uh the
staff at defcon is really going above
and beyond to make sure that it's a safe
environment for all attendees
especially with you know the the um the
latest developments
and so vaccinations will be required and
so will mask for everybody at that
conference and so
i think it'll be a pretty safe event
we're looking forward to
seeing old friends and making new ones
so we hope to see everybody at def con
this year
yeah no i'm really excited for the event
as well so thank you guys so much for
hopping on the call today
and thank you again for bishop fox being
a sponsor and we just really appreciate
all the help
thank you savannah thank you savannah
appreciate it
[Music]
so
[Music]
so
[Music]
[Applause]
welcome everyone i'm barrett darnell
with the red team village and i'm here
today with ryan dory and matt eidelberg
from optiv
hey everybody how's it going ryan and
matt uh thank you so much for being here
today and i want to uh
thank optic for being a sponsor for the
red team village ctf this year
your support really helps uh and it goes
a long way
at uh allowing us to provide a big event
both in person and virtually
can you tell me a little bit more about
optiv
yeah absolutely so to put it very simply
optiv is a pure play cyber security
partner
and what does that mean we aim to do
secure
all security all the time right we can
help in ways of advisory
deployment and even manage operations
right so ultimately our goal is very
simply to
help organize organizations realize a
more effective security program
and posture
and uh for for both of you specifically
what do you do at optiv
so i'm a senior director inside of
threat management which is a larger
umbrella but i specifically have the
privilege of leading our attack and pen
team so my focus is on the direction of
success of that team
and i achieved this largely by enabling
the great folks around me such as
mr eidelberg here and i'm a technical
manager
under uh attacking pen my primary role
is leading the adversarial simulation
services
this is our branch that focuses
primarily on red
and purple team operations my role in
there is not only
executing these types of engagements but
also focusing on helping to innovate the
team and
grow more operators to perform these
types of engagements
all right and uh and for the for that uh
attack and pen
practice uh why do you like working
there
yeah so for me uh first and foremost uh
it's it's the close family atmosphere
that we have on the team
and what i mean by that is i've been on
the team for almost nine years now been
an attack and pen
the entire time and i'm not alone in
that there are several other individuals
on the team
that have been here for a similar amount
of time such a such as matt
himself so what that yield is a really
good dynamic
of folks to work well together while we
simultaneously you know pursue our
passion about offensive security
and just to add on to that i would say
in a single word the community
uh the team itself honestly strives
constantly to push the boundaries to
teach each other
new things whether or not it's a you
know failures from previous engagements
to help educate
for future tests or even success stories
it's all about sharing and kind of
bolstering each other and through
knowledge sharing
absolutely and uh you know and the plug
for that that giving back to the
community aspect you know i was on your
github the other
day and uh i was looking into scarecrow
and i know i've got that on my list to
do a deep dive on after
after defcon you know love love the fact
that uh you know a lot of big players in
information security share that research
share that tooling that they create
yep that's what we strive to do here
and for your team um you know what types
of people work there
what are their backgrounds so it's a
good variety of backgrounds right so we
have folks uh
some from being a good part of us being
veterans uh
to business-minded folks to engineering
folks et cetera right
but like i mentioned earlier there's the
ultimate uh
commonality right of a shared objective
of offense
and passion for offensive security
testing and then what we qualify that
success really is helping leave our
clients better than we found them at the
end of the day
and of course you know folks have a very
specific or can have a specific subset
of interest
inside the team that could be of iot to
embedded to wireless to low level window
stuff to evasion
et cetera right so there's definitely
some sub pockets for people to really go
a mile deep on
great and with such a diverse group what
makes somebody a success
in amp so aside from
technical acumen which obviously is held
you know it's an important quality on
this specific
role right uh is the ability to show
ownership
in leadership and give back to the team
um really you know owning a specific
service
or an offering helping others mentoring
et cetera we hold that in
incredibly high value and then as we
mentioned earlier with regard to
like source zero scarecrow right is the
the public thought leadership to help
the team immediately and then also give
back to the community as well
yep and just to add on to that i would
say the eagerness to learn and improve
your tradecraft
um honestly the ones we see that excel
the most are the ones that not only
focus on themselves
but also make sure that they help their
fellow teammates or co-workers whether
or not they're struggling with something
or helping to help them
also pursue and grow their talents those
are the ones that i
see often have the basic success here
that's great uh absolutely i mean this
is this is a team sport uh doing what we
do
yep uh for the for the red team village
one thing that we we uh
really love to do is is offer a lot of
uh environments for training we do
workshops we
we uh participate in a lot of different
cons um and one thing
you know we want to do is bring as many
people into this community as possible
and so
i'd i'd like to ask for both of you you
know what is your advice for people who
are interested in cyber security as a
profession yeah absolutely so i mean
i'll speak to
you know the path that i took to get
here and i think it holds true to the
to the question right but i think it's
very important or imperative for folks
to have a
a deep foundational understanding as to
how uh
things work right so what i mean by that
is how does active directory work how
does networking
function how can you manipulate these
things to maybe work outside the bounds
it was intended to right so that can
apply to even development web
applications etc
oftentimes i get asked by people that
are a bit younger and stay in college or
whatever and they're like hey should i
take this security class and become a
pen tester well
i would really encourage folks to get a
lot of those more foundational
understandings
just how things work before they move to
the stage of trying to you know
move to the adversarial emulation types
part
yeah and i would just add to not just
focus when you're learning on red team
tactics
it's incredibly valuable in the current
landscape to
focus on both blue and red team having
that ability to
speak both can really augment your skill
set and
you know this is very much a cat and
mouse game based industry
and just knowing both sides their
playbooks can really help you understand
the strengths and weaknesses
of both sides so when you're coming up
against a red team or a blue team you
know
what they are great at what their
weaknesses are to really help plan out
those attacks
or even your knowledge set to improve on
those that is phenomenal advice uh this
industry
is is a challenge because there's so
much breadth
and depth that you can take uh not to
mention that it's evolving every single
day
it's impossible to keep up so you've got
to have that thirst for knowledge
and and without that foundation it is
quite difficult i mean you might throw
that exploit
and get that get that shell back but
then the question is what do you do next
right and so uh great advice i want to
thank both of you for being here today
uh
thank you again for the sponsorship
looking forward to
meeting you in person and uh and also
with with defcon right around the corner
you know uh looking to
to engage with old friends and and and
make some new ones so so thank you again
absolutely thank you for the opportunity
and uh we're looking forward to seeing
some folks out at defcon
yep
[Music]
so
[Music]
do
[Music]
do
[Music]
[Applause]
welcome everyone i'm barrett darnell
with the red team village and i'm here
today
with ryan dory and matt eidelberg from
optiv
hey everybody how's it going ryan and
matt uh thank you so much for being here
today and i want to uh
thank optic for being a sponsor for the
red team village ctf this year
your support really helps uh and it goes
a long way
at uh allowing us to provide a big event
both in person and
virtually can you tell me a little bit
more about optiv
yeah absolutely so to put it very simply
optiv is a pure play cyber security
partner
and what does that mean uh we aim to do
security
all security all the time right we can
help in ways of advisory
deployment and even manage operations
right so ultimately our goal is very
simply
to help organize organizations realize a
more effective
security program and posture
and uh for for both of you specifically
what what do you do at
so i am a senior director inside of
threat management which is a larger
umbrella but i specifically have the
privilege of leading our attack and pen
team so my focus is on the direction of
success of that team
and i achieve this largely by enabling
the great folks around me such as uh mr
reidelberg here
and i'm a technical manager under uh
attacking pen my primary role is leading
the adversarial simulation services
this is our branch that focuses
primarily on red and purple team
operations
my role in there is not only executing
these types of engagements but also
focusing on
helping to innovate the team and grow
more operators to perform these types of
engagements
all right and uh and for the for that uh
attack and pen
practice uh why do you like working
there
yeah so for me uh first and foremost uh
it's it's the close family atmosphere
that we have on the team
uh and what i mean by that is i've been
on the team for almost nine years now
i've been an attack and pen the entire
time
and i'm not alone in that there's
several other individuals on the team
that have been here for a simple amount
of time such a such as matt
himself so what that yield is a really
good dynamic
of folks to work well together while we
simultaneously you know pursue our
passion about offensive security
and just add on to that i would say in a
single word the community
uh the team itself honestly strives
constantly to push the boundaries to
teach each other
new things whether or not it's a you
know failures from previous engagements
to help educate
for future uh tests or even success
stories
it's all about sharing and kind of
bolstering each other and through
knowledge sharing
absolutely and uh you know and a plug
for that that giving back to the
community aspect you know i was on your
github the other day
and uh i was looking into scarecrow and
i know i've got that on my list to do a
deep dive on after
after defcon you know love love the fact
that uh you know a lot of big players in
information security share that research
share that tooling that they create
yep that's what we strive to do here
and for your team um you know what types
of people work there
what are their backgrounds so it's a
good variety of backgrounds right
so we have folks uh some from being a
good part of us being veterans
uh to business-minded folks to
engineering folks et cetera right
uh but like i mentioned earlier there's
the ultimate uh
commonality right of a shared objective
of offensive and passion for offensive
security testing
and then what we qualify that success
really is helping leave our clients
better than we found them at the end of
the day
and of course you know folks have a very
specific uh or can have a specific
subset of interest
inside the team that could be of iot to
embedded to wireless to low-level
windows stuff to evasion
et cetera right so there's definitely
some sub-pockets for people to really go
mile deep on
great and with such a diverse group what
makes somebody a success
in a p so aside from
a technical acumen which obviously is
held you know it's an important quality
on this specific
role right is the ability to show
ownership
in leadership and give back to the team
um really you know owning a specific
service or an offering
uh helping others mentoring etc we hold
that in incredibly high value
um and then as we mentioned earlier with
regard to um like source zero and
scarecrow right
is the the public thought leadership to
help the team immediately and then also
give back to the community as well
yep and just to add on to that i would
say the eagerness to learn and improve
your tradecraft
um honestly the ones we see that excel
the most are the ones that not only
focus
on themselves but also make sure that
they help their
fellow teammates or co-workers whether
or not they're struggling with something
or helping to help them
also pursue and grow their talents those
are the ones that i
see often have the base success here
that's great uh absolutely i mean this
is this is a team sport doing what we do
for the for the red team village one
thing that we we really love to do
is is offer a lot of environments for
training we do workshops
we we participate in a lot of different
cons
um and one thing you know we want to do
is bring as many people into this
community as possible and so
i'd i'd like to ask for both of you you
know what is your advice for people who
are interested in cyber security
as a profession yeah absolutely so i
mean i'll speak to
you know the path that i took to get
here and i think it holds true to the
to the question right but i think it's
very important or imperative for folks
to have a
deep foundational understanding as to
how uh
things work right so what i mean by that
is how does active directory work how
does networking
function how can you manipulate these
things to maybe work outside the bounds
it was intended to right so that can
apply to even development web
applications etc
um oftentimes i get asked by people that
are a bit younger and stay in college or
whatever and they're like hey should i
take this security class and become a
pen tester well
i would really encourage folks to get a
lot of those more foundational
understandings
just how things work before they move to
the stage of trying to you know
move to the adversarial emulation types
part
yeah and i would just add uh to not just
focus when you're learning on red team
tactics
it's incredibly valuable in the current
landscape to uh
focus on both blue and red team having
that ability to
speak both can really augment your skill
set and
you know this is very much a cat and
mouse game based industry
and just knowing both sides their
playbooks can really help you understand
the strengths and weaknesses
of both sides so when you're coming up
against a red team or a blue team you
know
what they are great at what their
weaknesses are to really help plan out
those attacks
or even your knowledge set to improve on
those that is phenomenal advice uh this
industry
is is a challenge because there's so
much breadth
and depth that you can take uh not to
mention that it's evolving every single
day
it's impossible to keep up so you've got
to have that thirst for knowledge
and and without that foundation it is
quite difficult i mean you might throw
that exploit and get that get that shell
back
but then the question is what do you do
next right and so
uh great advice i want to thank both of
you for being here today
uh thank you again for the sponsorship
looking forward to
meeting you in person and and also with
uh with defcon right around the corner
you know uh looking to
to engage with old friends and and make
some new ones so so thank you again
absolutely thank you for the opportunity
and uh we're looking forward to seeing
some folks out at defcon
[Music]
so
[Music]
so
[Music]
right welcome back everybody and with me
i have not researcher
and savannah um but before we get
started and announced the winner of the
oscp
course let's go over some of the
statistics uh
about the ctf that we shared earlier but
you know we have it
a little bit better formatted now so
with that
i'll pass it back to a to savannah and
up
oh great uh thanks a lot omar and uh
definitely appreciate all the teams you
know that played in the qual
uh qualification round it was really
great a lot of you know great
interaction in the channel and
everything like that
a lot of movement on the scoreboard even
all the way up you know until last you
know a few minutes of it so it was great
to see
all that and uh you know there's
definitely some teams that were in that
top 20 that kind of got knocked out that
last minute you know
so it was awesome competition i really
enjoyed it but as you can see there
you know 1 360 users you know 645 teams
so
really awesome um you know almost
uh 12 000 points available there and
then you know kind of like what we
talked about earlier
uh there's about 20 000 flag submissions
total you know half them right half them
wrong but it was a you know great
competition a lot going on there
yeah no we're excited to finally
actually get to start the
uh finals so in the next few minutes if
you haven't received the email yet you
will
in the next few minutes with the
connection pack for the vpn to be able
to play in the finals
so if you have not uh sent the email for
your captain then you need to send it to
knock researcher
right here to make sure he can get that
information to you so you can start the
finals with your team
and then we can go ahead and announce
the winner for the oscp voucher do you
want to
yep so it's good speed uh so
congratulations good speed for winning
that uh we'll go ahead and get the
voucher over to you
and then we're actually going to be
doing another um
survey so we will be announcing that
soon
and then that will be the next voucher
that we'll be giving out for the oscp
so i know everyone's really eager to
start these final rounds uh
just give us a moment here as we kind of
finish up this stream as well
as uh getting the uh emails sent out so
in each one of those emails we're going
to have a connection pack so we have an
open vpn connection
uh as well as a welcome message which
you know has a few hints
also kind of suggestions uh please read
that it's a very uh imperative that you
read that otherwise
you will not be successful uh so with
that
um once we get that sent out uh you'll
be able to go to the scoreboard
hopefully everyone's
logged in on that so uh i've dmd
everyone the scoreboard for their team
to register at
uh obviously if you haven't dm me uh
after this stream is over i'll be able
to get back to you and send you
everything to log in there uh but you
will definitely get the connection pack
uh via whatever email you registered
with or that i confirmed so
with that we'll be starting to kick that
off hey barrett how are we doing on the
email all right it's only two minutes so
in two minutes here you'll be actually
getting that back so uh
definitely you know kind of like what
barry was talking about earlier you know
maybe not as uh full on the ocean on
some of the socials but there definitely
is information out there
uh so you know just keep on digging
look around see what we have out there a
lot of good information
uh so with that though i'm trying to
think here
we can uh let's see here
there we go
so while you pull this up i want to
thank the sponsors again
you know without you this event will not
be happening at all
so thank you thank you thank you you
have been seeing some of the
pre-recorded
interviews with some of the sponsors in
in there so especially bishop shop
bishop fox that's great
and then optive as well so so thank you
yeah thank you all right so
definitely here in a couple minutes
you'll get that it'll actually be
you sense it all right so right now you
should be receiving an email
with the open vpn configs we have 10
or sorry 18 teams registered so far so
definitely hit me up in a dm
after this make sure that i'll get you
registered uh but all the teams
that at least we have emails for we'll
get a connection pack at this time
and all the challenges should be visible
at this time
so with that for the challenges uh the
flag submission will be based on
hostname
so hostname and then the flag and then
you'll be able to kind of go through
there
and hopefully find each one so it's more
of a scenario so it's not very you know
necessarily as like linear you know
challenge a
or whatever as you go through the
environment you'll come across the
different flags and you'll be able to
kind of correlate each one of those
flags with the host name
as well as you know whether it's a file
name or something else it'll be
indicative of which flag it is
uh you know there's no no issues
submitting that flag multiple times
uh just to ensure you know you're on the
right uh
the right challenge so with that
everyone should have
an email at this time as well as
logged in on the scoreboard everything
is visible so
good luck to all contestants out there
good luck
omar do you wanna
oh i think you're muted omar i am muted
i am not trying to all right
so they don't hear me typing
so the third thing is of course go ahead
omar we'll get you the uh the
updated scoreboard for the new teams uh
everyone's just getting logged in right
now
but that is their top 20 teams so each
one of those are you know
getting their connection they're getting
connected right now uh starting to log
into the environment and obviously it'll
be a kind of a slow start as they figure
out exactly
you know what the scenario that
beginning of the scenario and what it
kind of looks like so
a lot of clues that are out there uh
both within the welcome message
as well as mosin and then if you might
have seen some things publicly before
please go back and check them again you
know some of them might have been
updated
with some new information that you
didn't see before
awesome so if you just join us or at
least if good speed
just join us you know congratulations
you're the winner of the first
oscp course of the day we have two more
so stay tuned
we're going to be actually you know
providing the the form where you can
sign up
in the next few minutes and one quick
reminder if you actually submit
more than one submission you're
automatically disqualified
so just submit once if you actually want
to win if not you will be automatically
disqualified
so with that let's go in a quick break
and
we'll be back in the next few minutes
thanks again
[Music]
so
[Music]
so
[Music]
so
[Music]
so
[Music]
so
[Music]
knock who's there this guy what's up red
teamers what's up def con it's your
favorite fake brilliant billionaire
investor
my little birdies cheap cheap cheap
cheap cheap cheap cheap cheap i like
cheap things that's why i'm rich they
let me know
that lunar fire is under fire but that
is a thres gomes company
and that's got so much smart [ __ ] in it
and so it's unhackable or is it no it
isn't
not even you boy and girl geniuses can
do it you would have to be the human
equivalent of cars with doors that open
like this
or like this are you can you
will you don't
[Music]
so
[Music]
so
[Music]
so
[Music]
[Applause]
welcome everyone i'm barrett darnell
with the red team village and i'm here
today with
ryan dory and matt eidelberg from optiv
hey everybody how's it going ryan and
matt uh thank you so much for being here
today and i want to uh
thank optic for being a sponsor for the
red team village ctf this year
your support really helps uh and it goes
a long way
at uh allowing us to provide a big event
both in person
and virtually can you tell me a little
bit more about optiv
yeah absolutely so to put it very simply
optiv is a pure play
cyber security partner and what does
that mean we aim to do
secure all security all the time right
we can help in
ways of advisory deployment and even
manage operations right so ultimately
our goal is very simply to
help organize organizations realize a
more effective security program
and posture
and uh for for both of you specifically
what what do you do at optiv
so i'm a senior director inside of
threat management which is a larger
umbrella but i specifically have the
privilege of leading our attack and pen
team so my focus is on the direction of
success of that team
and i achieved this largely by enabling
uh the great folks around me such as
mr eidelberg here and i'm a technical
manager
under attacking pen my primary role is
leading the adversarial simulation
services
this is our branch that focuses
primarily on red and purple team
operations
my role in there is not only executing
these types of engagements but also
focusing on
helping to innovate the team and grow
more operators to perform these types of
engagements
all right and uh and for the for that uh
attack and pen
practice uh why do you like working
there
yeah so for me uh first and foremost uh
it's it's the close family atmosphere
that we have on the team
uh and what i mean by that is i've been
on the team for almost nine years now
i've been an attack and pen the entire
time
and i'm not alone in that there are
several other individuals on the team
that have been here for a certain amount
of time such a such as matt
himself so what that shield is a really
good dynamic
of folks to work well together while we
uh simultaneously you know pursue our
passion about offensive security
and just to add on to that i would say
in a single word the community
uh the team itself honestly strives
constantly to push the boundaries to
teach each other
new things whether or not it's a you
know failures from previous engagements
to help educate
for future tests or even success stories
it's all about sharing and kind of
bolstering each other through knowledge
sharing
absolutely and uh you know and a plug
for that that giving back to the
community aspect you know i was on your
github the other day
and uh i was looking into scarecrow and
i know i've got that on my list to do a
deep dive on after after defcon
you know love love the fact that uh you
know a lot of big players in
information security share that research
share that tooling that they create
yep that's what we strive to do here
and for your team um you know what types
of people work there
what are their backgrounds so it's a
good variety of backgrounds right so we
have folks
uh some from being a good part of us
being veterans
uh to business-minded folks to
engineering folks et cetera right
but like i mentioned earlier there's the
ultimate uh
commonality right of a shared objective
of offense
and passion for offensive security
testing and then what we qualify that
success really is helping leave our
clients better than we found them at the
end of the day
and of course you know folks have a very
specific or can have a specific subset
of interest
inside the team that could be of iot to
embedded to
wireless to low level window stuff to
evasion etc right so
there's definitely some some sub pockets
for people to really go a mile deep on
great and with such a diverse group uh
what makes somebody a success in amp
so aside from a technical acumen which
obviously is held you know it's an
important quality on this specific
role right uh is the ability to show
ownership
and leadership and give back to the team
um really you know owning a specific
service or an offering
uh helping others mentoring et cetera we
hold that in incredibly high value
and then as we mentioned earlier with
regard to um like source zero and
scarecrow right
is the the public thought leadership to
help the team immediately and then also
give back to the community as well
yep and just to add on to that i would
say the eagerness to learn and improve
your tradecraft
um honestly the ones we see that excel
the most are the ones that not only
focus on themselves
but also make sure that they help their
fellow teammates or co-workers whether
or not they're struggling with something
or helping to help them
also pursue and grow their talents those
are the ones that i
see often have the basic success here
that's great uh absolutely i mean this
is this is a team sport doing what we do
yep for the red team village one thing
that we we
uh really love to do is is offer a lot
of it uh environments for training we do
workshops we
we uh participate in a lot of different
cons um and one thing
you know we want to do is bring as many
people into this community as possible
and so
i'd i'd like to ask for both of you you
know what is your advice for people who
are interested
in cyber security as a profession
yeah absolutely so i mean i'll speak to
you know the path that i took to get
here and i think it holds true to the
to the question right but i think it's
very important or imperative for folks
to have a
a deep foundational understanding as to
how uh
things work right so what i mean by that
is how does active directory work how
does networking
function how can you manipulate these
things to maybe work outside the bounds
it was intended to right so that can
apply
to even development web applications etc
um
often times i get asked by people that
are a bit younger and stay in college or
whatever and they're
like hey should i take this security
class and become a pen tester well
i would really encourage folks to get a
lot of those more foundational
understandings
just how things work before they move to
the stage of trying to you know
move to the adversarial emulation types
part
yep and i would just add uh to not just
focus when you're learning on red team
tactics
it's incredibly valuable in the current
landscape to uh
focus on both blue and red team having
that ability to
speak both can really augment your skill
set and
you know this is very much a cat and
mouse game based industry
and just knowing both sides their
playbooks can really help you understand
the strengths and weaknesses
of both sides so when you're coming up
against say a red team or a blue team
you know
what they are great at what their
weaknesses are to really help plan out
those attacks
or even your knowledge set to improve on
those that is phenomenal advice uh this
industry is
is a challenge because there's so much
breath
and depth that you can take not to
mention that it's evolving every single
day
it's impossible to keep up so you've got
to have that thirst for knowledge
and and without that foundation it is
quite difficult i mean you might throw
that exploit and get that get that shell
back
but then the question is what do you do
next right and so
great advice i want to thank both of you
for being here today uh
thank you again for the sponsorship
looking forward to uh to meeting you in
person
and uh and also with uh with defcon
right around the corner you know uh
looking to engage with old friends and
and make some new ones so so thank you
again
absolutely thank you for the opportunity
and uh we're looking forward to seeing
some folks out at def con
yep thank you oh and i forgot
[Music]
so
[Music]
knock knock who's there this guy what's
up red teamers what's up def con it's
your favorite fake brilliant billionaire
investor
my little birdies cheap cheap cheap
cheap cheap cheap cheap cheap i like
cheap things that's why i'm rich they
let me know
that lunar fire is under fire but that
is a tres gomas company
and that's got so much smart [ __ ]
in it and so it's unhackable or
is it no it isn't not even you boy and
girl geniuses can do it you would have
to be the human equivalent of cars with
doors that open like this
or like this are you can you
will you don't
[Music]
hi everyone my name is savannah from red
team village we also have style for
weapons of security hello
absolutely so shout out to all the away
winners
we love to have you thank you so much
for taking our courses
and getting the vouchers whatever it may
be congratulations
we always encourage you to come back and
uh we have many more certifications
uh offensive security we just launched
365
so that's year round for many many
things at a 20
discount so by all means swim by the
website
check it out and congratulations to each
and every one of you who actually got it
thumbs up
[Music]
so
[Music]
so
[Music]
so
[Music]
so
[Music]
oh
[Music]
do
[Music]
me
[Music]
now
[Music]
no
[Music]
so
[Music]
so
[Music]
now
[Applause]
[Music]
hello everyone i'm bear darnell from the
red team village and today we are here
with omar santos from the red team
village as well as our guest ipsec from
hack the box hey guys what's going on
hello uh ipsec hack the box has been a
long time supporter of the village
can you tell me more about the company
yeah um
hack the box is a hands-on security
training platform and our main goal is
to make good training
readily available to anyone in the world
if you're new to a topic or
just the field in general we have hack
the box academy
and it's a guided learning experience
which just means we have written
material in hands-on labs
and again when building this
accessibility was our number one
desire so we created the prone box which
allows you to have
a whole operating system in your browser
so the machine you're doing this
learning on doesn't even have to be
powerful you can do it on like a
chromebook
if for some reason you want to do it on
a phone you can i wouldn't recommend
that
but everything's done within a web
browser if you want to bring your own os
we also provide a vpn pack for you so
you can join your os to the vpn and
go on learning in addition to the
academy we have
unguided learning which is what we're
most famous for this is the weekly
challenges machines or entire like
networks we put out on the platform and
that we ask people not to publicly talk
about these challenges
until they retire which is typically 20
weeks
this is my favorite and what i credit
most of my success to because it really
enforces building good social
relationships
that not only help get you the help when
you need it but also
when teaching it often validates your
understanding of it and is proven to
help memory retention
so i have a lot of friends from my in my
social network that include barry i met
him through
another friend who met him at derby con
which is a similar event of red team
village
and the funny thing is both my other
friend kyle and barry all lived within
like
30 miles of each other but we met like
hundreds of miles away so definitely
like
important to go view and travel and
experience the community because
you'll never know who you find and how
close people may be it's a small world
absolutely i think we've all been cooped
up these last few months here i think a
lot of people are excited to go in
person to las vegas to attend def con
and so
we're really excited to see some of our
old friends and make some new ones
um speaking of of that community you
know hack the box is a very vibrant
community both on their discord
as well as all over twitter can you tell
me a little bit more about the people
behind hack the box maybe some projects
that you might be working on
yeah we have a innovation team that's
designed at like
pushing what we think is the limit so
typically most of our stuff is either a
docker or a vmware image
and the innovation team is looking into
google cloud aws
and azure to provide a pro lab called
black sky which is just based upon
those types of features so if you want
to exploit im or do a lot of those
unique cloud things black sky
lab is going to be that we also have as
you said the discord community we have
roadrunner who runs that
and they help provide a lot of good
support and just learning to anyone
in addition to a bunch of ctfs i think
we run the ctf like every other month or
something it's
insane well
talking about the ctf and talking about
all the activities you know throughout
the years you guys
have supported the red team village
tremendously
so first of all thank you and thank you
hack the box
so one of i got a couple of questions
right so one of the
questions is you know what would you say
that is the best part
about sponsoring community efforts like
the retin village ctf this year i mean
obviously it helps the community grow
and most of my like relationships i can
credit almost all my professional
success
as to leeching off my friends knowledge
because no one can know everything
and i can't speak for anyone i hack the
box but i know
a bunch of my friends at hack the box
are super excited to play a ctf built by
other people
and we've played the red team village
cts for quite a while
i vaguely remember one i think two years
ago that involved exploiting a printer
which was new to all
of us we were all like big binary
exploit people and then threw a
different architecture at us that we
never really
experimented with and it was just a lot
of fun to play
so super excited to sponsor an event
that we can participate in
and learn new things to hopefully put
out on our platform in the future
thank you appreciate that i think that
you're hitting
my next question which is why do you
think sponsoring the
the retin village this year is so
important for the community
yeah um number one it's important to
like with covet and all we want to
increase our socialization and
everything we've been all cooped up
and the red team village incorporates
all of hack the boxes
things the main thing was being
accessible um if you can't travel you
can do it online and form a team
and additionally if you want it's
available for the high cost of zero
dollars which
it aligns with kind of our methodology
and what we want
all our machines are available for free
for a time and then once they retire
then you have to pay
a small fee to gain access to it because
hosting 150
images permanently would just be
expensive can't do that for free
um additionally i believe infosec is a
unique profession where team building
activities have
immeasurable impact if you look at the
non-infrastruct teams
they still do team building activities
like you have that gimmicky trust fall
and escape room etc
and they're doing them just to help
build that social bond between
co-workers so you know it's valuable
since that's the only thing they care
about
in the infosec world we have ctfs that
is just like that on steroids
it has all that same social bonding
benefits like i mentioned earlier i play
cts with barry
i've played cts with oxdf mr ben john
hammond a bunch of people i just have a
lot of fun with playing these ctfs along
with coworkers
and in addition to that social bond that
you build
it also gives you a lot of techniques
that you may be able to immediately
provide your work value because
you're joining hands with a bunch of
other companies to learn things
it wouldn't surprise me if you do the
ctf and then
find something you can immediately turn
around to do on your job
i remember doing almost any pro lab i'll
use offer as an example where the fret
hold involves exploiting splunk
and i had a pen test that i kept missing
this vector on because i just didn't
know it and mr ben put it in that pro
lab
so when i did that it was just like an
eye-opening thing of oh god what have i
been missing
so definitely the big social aspect is
huge here
awesome and and uh i couldn't agree more
and and once again you know thank you i
have one more last question
when it's around the benefits that your
team actually will receive
by participating at the you know that
con writing village ctf this year
yeah um hack the box and red team
village are almost anonymous and what we
provide
and our methodologies so the only
unfortunate thing is the red team
village ctf is a yearly thing while hack
the box produces new things on a weekly
basis
it's probably not to the scale that red
team village will be doing just because
it's constant
but if you're itching to do more after
doing the ctf
definitely check out the platform if you
haven't and go over to hack the box
because
i'm sure you'll love the challenges we
put on the site awesome
so once again thank you so much for
supporting us thank you hack the box you
know for
sponsoring the red tim village and i
hope to see you at defcon
yeah take care
[Music]
so
[Music]
[Applause]
hi everyone my name is savannah alizera
and i am the co-lead of red team village
and today we have barrett darnell and
caitlin o'neill with us from bishop fox
and they're going to be one of our
sponsors and we're really thankful for
them being a sponsor for
our ctf event at defcon and i'll go
ahead and let them
enter themselves and we're going to get
them to know them a little bit better
today
hi i'm caitlin i'm with recruitment team
here at bishop fox
i came over here about three years ago
because
of our reputation as one of the largest
professional services firms
focused on offensive security and
security as a service
it's been a wild ride but part of i
stick around is because i love
working with such brilliant people i
love that we go out there and break
things
build new things break more things and
and always working with the latest
technologies to keep people safe
so it was a really exciting opportunity
for us to sponsor the red team village
capture the flag this year at defcon
where we can't wait to meet people
virtually and on site
and to hopefully find some new ways to
grow our team
hi savannah nice to see you i'm barrett
darnell managing senior operator at
bishop fox
i'm part of the continuous attack
surface testing team also known as cast
well we're really excited to have you
guys on this call today and
i would say the first question that we
kind of want to start off with is kind
of seeing
what you guys would say is the best part
of being a sponsor for
an event like this well for bishop fox
we're avid participants of the greater
infosec community and we feel that
sponsorship of conferences and efforts
like this
provide a real tangible value to the
community this ctf in particular
provides a tremendous amount of
realistic hands-on
experiences for those in the offensive
security particularly red teamers
yeah no that's that's awesome and i mean
i'm sure you know this barrett
with so many reasons that resources out
there uh why do you think kind of
sponsoring something like this is so
important
well for one uh this resource is free so
that barrier of entry is out of the way
uh anybody can participate
secondly it's realistic it mimics real
life scenarios that we've seen
on our customer engagements and so it's
not very esoteric uh
it's you know real tools real situations
you might be in
and it's also beginner friendly it
starts off where everybody can join and
get something out of it
but the difficulty ramps up so there's a
lot for experienced red teamers
to hone their skills on awesome i know
we've kind of just talked about
the benefits that people who are joining
the ctf would get out of it but
can you kind of talk about the benefits
bishop fox receives out of being a
sponsor for the red team village
ctf event at defcon yeah well
you know first and foremost we always
want to give back to the security
community
and this is a great way for us to
interact with
the hundreds maybe even thousands of
attendees and participants
uh whether they're there in person or
virtually
um it's great um from where i sit as a
recruiter because it gives us a chance
to meet new talent and people who we
maybe haven't engaged with before
and that's really important especially
as we continue to grow
our two new service lines the continuing
continuous attack
service testing team that barrett is on
and our red team yeah no i mean
everybody knows in the security
community who bishop fox is and i'm sure
they would love to know about the
recruitment
so i guess what types of people do you
guys typically
look for for the team yeah so you know
what we need
and what we're hiring for can kind of
shift month to month so
in the past if you engaged with us and
it wasn't a fit um that might be
changing so you know always stay in
touch
um first and foremost we look for people
who are really passionate about security
because that's definitely who
we are and you know we're always looking
for um a diversity of thoughts a
diversity of backgrounds
so uh you know we have a lot of people
who came from a pretty like traditional
career paths you know school
work but we definitely have folks who
are self-taught who are coming from
non-traditional backgrounds um you know
we we love our folks from the military
as well
so there's a lot of different paths that
can lead you to working at bishop fox
and we're really open to exploring all
of them
you know you can always find me on
linkedin caitlin o'neill
but you can also engage with bishopfox
on twitter
we have an awesome social media gal we
have a really fun twitter account
um we're going to be on site in las
vegas and we're going to be using
twitter to kind of help people find us
and and also find us for some cool
giveaways as well
so definitely check us out there yeah no
that's awesome i'm sure everyone's
looking forward to kind of seeing bishop
fox
um at def con did you guys have anything
else that you kind of wanted to mention
on this call
uh before we end it today yeah i mean
i'm lucky i just get to show up as a
recruiter and a sponsor i know that
all of you guys with the ctf have done
so much work
so you know thank you for everything you
did i'm really excited to see it all
come together
and thanks to the red team village for
this opportunity we're really excited to
meet everyone
and i just want to say uh you know after
months of being on lockdown i think
everyone's itching to get out this might
be the first in-person conference for a
lot of people
and if you haven't registered yet for
defcon i highly recommend it the staff
at defcon is really going above and
beyond to make sure that it's a safe
environment for all attendees
especially with you know the the um the
latest developments
and so vaccinations will be required and
so will mask for everybody at that
conference and so
i think it'll be a pretty safe event
we're looking forward to
seeing old friends and making new ones
so we hope to see everybody at defcon
this year
yeah no i'm really excited for the event
as well so thank you guys so much for
hopping on the call today
and thank you again for bishop fox being
a sponsor and we just really appreciate
all the help thank you savannah thank
you savannah appreciate it
[Music]
yeah we have oh
omar i can't hear you can you hear me
oh sorry i was double muted all right so
um
so once again you know congratulations
good speed you're the first winner of
the oscp
course here today we're going to
announce another giveaway
in the next few minutes so look out in
the bottom of your screen
in the next few minutes and with that
i'll pass it back to barrett
hey folks welcome back i've got our next
guest here i'm going to be speaking with
uh with henry
van goghtham from sans
hi thanks barrett thanks for having me
on the show and uh and we want to talk
about some of the curriculum
i've been involved with sans for quite a
bit first as a student and then
as an instructor and so sans is a
sponsor for this event we have a free
sans course that we're giving
out for the first place team of finals
and so that's it that's a great prize
you can take that in any modality
whether it's going to be live online or
or in one of our in-person events so i
invited henry onto the stream so we can
just kind of talk about the curriculum
um the first thing you know let's talk
about the offensive operations
curriculum can you kind of go over
what that what that focuses on
absolutely and so we've got a slide on
the screen here basically
uh we you know steve sims is our
technical director for the offensive
operations curriculum
and if you've watched what's happened in
probably about the last several months
we've transformed what was formally for
a long long time the sans pen testing
curriculum to a offensive operations
curriculum
and i'll cover some of the breakout
basically as to why we did that
uh you know one of the the main reasons
though was we covered the you know a lot
of the uh
baselining of you know the the uh i
guess
how can i phrase it here basically ttp
awareness basically in josh wright's
security 504 course uh and then what to
do with regard to instant handling
we covered a lot of the vulnerability uh
scanning and vulnerability assessment
threat modeling stuff
in matt tusein's security 460 course
over at the top there
and then we go in uh deep dive in you
know with network
authorized network pen testing and tim
median security 560 course
uh in the center there in that pen
testing comprehensive area uh we also go
you know
cover many other aspects to include you
know web even a new cloud
web app databases everything else
including even a new cloud pen testing
course as well
that's over on the right there written
by moses frost
uh and there's a new cert for that one
as well just to call that out since it's
new the gcpn
but one of the things that we noticed
was in addition to
these various areas we needed to grow a
little bit more to serve the purple team
community
the red team community specifically uh
specifically in talking with barrett
with georgia chiles uh previously
talking with uh
joe vest and james tuberville also we
had a single course that uh had started
in the red team uh
area but we wanted to grow the qriklin
to be a little bit more comprehensive
so uh omar can i ask you to uh to slide
to uh the second slide please
so the second slide there now covers a
little bit more of the uh
are we on the foundational still we're
on foundational
yes so next slide after this one please
it should say specialized top left
there we go that's the one all right
perfect
all right so let me let me just chat
about that one for a second basically so
you know we wanted to add additional uh
breadth depth uh in the uh you know
offensive operations curriculum where it
wasn't just
pen testing uh per se basically but we
cover a lot of the different
aspects you know red teaming if you uh
read uh
george archielice's course basically if
you've taken the course you understand
you know we start
with the the scanning the reconnaissance
basically we move on to
you know a little bit more of the you
know the social we move to the
weaponization
we move to the delivery we move to the
reporting the measurements obviously
always working with the uh the blue team
measuring
training trying to get better basically
and one of the things that we
have identified is that we need
additional depth and breadth basically
uh on the red teaming side in addition
to the one course that's mentioned at
the bottom right there which is
georgia chile's course uh and so we
wanted to expand things a little bit
more and that's what we've got with the
various areas now
so top left there is the the specialized
pen testing area
variety of courses that are listed i'll
call out real quick just a couple things
uh the security 467 course uh written by
dave shackleford
and uh james leyte vidal actually goes
live on september 8th
so that's in literally a month from now
so i just wanted to alert the community
about that
also the uh security 550 the active
defense
cyberspace trapping attack disruption
and cyber deception course
goes live on november the 15th at our
pentax hack fest event
we've been waiting for quite some time
for that course to uh to come back
basically
and it's finally made it back and then
finally uh last but not least uh
it's listed i think on the next slide
but we've got an iot pen testing course
in addition to some additional uh red
team courses that are coming as well
for sure we it's it's amazing how much
specialization can happen
with this with this field um you we
started with talking about the
foundational
uh material i i've been teaching 660 for
a bit now
and uh and just when you go to the talks
you see all the different villages
there's all these niches that people
people can dive in so it's nice to see
more and more material around the things
that that interest folks
i know with 660 we we have a date we
have uh
half the course we talk about advanced
pen testing and then we get into exploit
development
and a story that steve likes to tell
when he wrote the course was
he had he had an idea for just an
exploit development course
uh 10 years ago and at the time the
community really wasn't ready just
you know there wasn't a big enough
market just to do exploit development
and so 660 was born
where we talked about advanced pen
testing talked about um uh
exploit development and it was also a
little bit easier for folks to
to get their employers to sponsor that
because you know maybe they're an
offensive security role
but not necessarily something that
warrants an exploit development nowadays
you know there's a huge market for
exploit development uh people wanting
that that knowledge
and so uh you know so you showed us what
was the past what's the future what's
this evolution
in uh in red team training from sans and
so uh if we go to the
the third slide here thank you there it
is over on the right side uh we've got
some
new courses that are in development
right now i've alluded to a couple over
on the left side like at the bottom
there the iot pen testing course that
one actually comes out on september 29th
it is live right now on the uh the
website larry pesci uh james leyte vidal
and steve walbrow just wrote that course
and it's going to be a a great new
course
uh in addition to that though over on
the right side
top right and specific to this community
to the red teaming community
uh we've got a brand new five-day red
team operations course that's coming
now we've had red team operations
courses you know previously if you will
so
at least the security 5604 course
originally written by
joe vest and james tufferbell back in uh
2016-2017 time frame
and then rewritten by george ortillas
plus
c2 matrix integration and a variety of
other things basically that
enhanced that course uh when it was
rewritten in 2019 by george artiles
but we still only have a two-day course
and what we wanted to develop here was
get a little bit more depth on the red
teaming and get a little bit more
breadth
as well and so uh i will quickly
highlight three courses and then i think
uh
best uh thing i can do is i'll describe
what i'm aware of but i think barrett's
gonna be
the the better person to ask about 565
specifically but
565 in summary a five-day red team
operations course basically everything
from the
you know the concepts of red team
operations and performing you know high
value adversary emulation
all the way into the deep dive basically
of
using various tools which ones work best
in which situations
and then obviously doing what we do best
which is measuring people processes
technology everything else
and obviously you know doing both the
overall uh management of it but most
importantly also the deep dive technical
for
growing red team operators as well in
addition to that of course below it uh
security 67 the
that's our red team operations windows
tool development that course is
currently in dev from jonathan ryder
and uh he is taking time to cover what
we consider
a gap in offensive programming right now
by essentially working on
you know tool development working on
enumeration working on you know gaining
a foothold basically
and then obviously just gaining you know
persistence in the space
and then obviously more advanced
techniques and writer is uh
hoping to have that course out i believe
uh in the uh
q4 uh later part of this year finally
i'll
list one more that's not currently
listed on here but it is a
brand new development course as well and
that's matt tucsane's uh security 665
which is going to be an advanced red
team operations course
that's in very initial stages of
development but
with that all said i'm sitting next to
the author of security 565
red team operations of the new five-day
course i'd rather actually turn it
around and ask you
what's what's new what's different
between that security five six core four
or uh 564 course of the past
the two-day version and the new five-day
version that you're writing in security
565.
absolutely so uh we're shooting for a q1
next year
uh release of the beta version of the
course so uh what i've been working on
is is this five day course with the
sixth day of a fully immersive
environment
um the focus uh it's gonna be it's the
title is red team operations
and assume breach and uh and and the
course is
is is a is is uh
is sandwiched between some of those soft
skills that are often overlooked when
people think about red teaming
right of course you've got uh the
technical aspects of
of you know having strong tradecraft uh
getting that initial foothold doing that
louder movement
spending a lot of time in active
directory uh you know being comfortable
with with the tools and the way that
things are set up
but there's a lot about red teaming that
i think us uh can get overlooked and
and that's uh you know that's about
really understanding what your purpose
is as a red team
you know why are you there uh in the
first place whether you're an internal
red team
uh or a uh consulting red team you know
you know i often feel that your goal is
to make that blue team better
right uh if you if you do a pen test and
you find a lot of a lot of issues
you deliver those there's not a whole
lot of collaboration that happens it
kind of depends on
on the contract but uh but you might
come back a year later and still
see some of those things uh you know as
a red teamer
you want to do that adversary emulation
it's almost like giving
the test to the blue team hey this is
these are the ttps we're going to use
uh they're well documented we're going
to stick with this
and this is how you can you can grade
your systems as long as
uh you know we give you that score card
of we're going to emulate this adversary
you can make sure all of your detection
and response
are set up properly and so it's it's
very specific
but what you know what we can walk away
from after that engagement
is knowing that all of those controls
are in place and they're working
properly
right we're able to we're able to
validate and test it so uh you know i
think some of that
is important on the front and the back
end and then um and then the three days
in the middle we're gonna do a lot of
deep dive into active directory
go beyond what uh what we do in some of
the other courses in sam's curriculum
excellent
and uh let's see here we did we talked
about the um
the purple team tactics course we did
not yet actually so there are
uh two existing purple team courses
right now so there's security uh
599 uh written by uh the nviso team
basically but uh eric van buggen out and
steve sims
and that course essentially goes into
you know all the different uh techniques
that adversaries use
specifically advanced adversaries but
then each step in the kill chain
how defenders can actually help stop the
adversaries as early in the kill chain
as possible and then of course there's
another uh of course uh right on the
tail of that the security 699
uh purple team tactics uh course that
one's written by eric van buggen out of
the enviso team again
and uh jim shoemaker as well uh of sans
and uh that course is a little bit more
on the red side
more with emulating specific adversaries
so i want to say and i'm going off
memory here
he emulates three to four different uh
uh you know advanced uh groups if you
will basically threat actor groups
and then actually walks through and
helps individuals to
prep from both the red team perspective
of emulating them and then obviously
you know what you would do for it to
help the purple team side as well
basically or
tell both the uh the red and the blue
side as well
i'm really excited about the way that
the curriculum is just expanding and
going deeper into all these uh all these
different topics
uh another thing we've done uh with the
offensive operations curriculum is we
have a discord server out there um it
allows
it allows students to communicate with
instructors instructors after the course
is done
we obviously have our platform that we
use when we do the training but but this
is great to uh to circle back
with folks you can you can reach out to
the instructors uh can you kind of talk
about what you've used after the course
uh and so that that that's out there on
discord i'll i'll put a link out on our
uh
um on on our platform later and uh are
there any other resources that sans has
yeah in addition to the discord which i
think that's you and that's john
gorenflow right i believe uh in addition
to that we've also got sans.org free
and that's just simply s-a-n-s dot o-r-g
slash free basically anyone can go there
whether you're looking for
webcasts posters you know various
distributions to include uh one that we
have called slingshot
basically uh that's a you know multi-use
uh distribution basically
whether there's white papers blog
articles or blogs sorry uh
white papers anything else that you're
looking for uh whether you're new to
cyber or experienced and you're just
looking for more things
more uh details basically or more depth
it's all available at sans.org
free uh also one last thing that i'll
put out there as well
there's some free ctfs that they're
doing these days as well so it's scotus
and uh the team basically simon vernon
several others just did one for the uh
uh defcon event and blackhead event that
was going on in addition to that
uh it always puts on counteract always
puts on the sands holiday hack challenge
so be aware of that that will also be
listed and tied into sans.org free as
well
great i appreciate you coming out hey
thank you for having me
uh while we're here i want to do one
more thing and that is uh
i know we recently announced on the
website uh that we had uh
certified you as an instructor again
that was totally unrelated to uh
to me coming out here but it was nice
because all the stars actually align for
once
instead of taking six months between
when we see each other and whatever else
uh may happen but i got a call from lisa
peterson who is somebody that i know you
know very well and all of our sans
instructors know very well
and she truly has been the sherpa is
probably the best way to put it
to get instructors from you know new
instructors
all the way through certified status she
is just good people for
always guiding somebody through the
various wickets of the process and
everything else and
pitfalls of the process as well and
getting people from a to z
she called me specifically and asked if
she could bring
me something because she knew i was
going to come out and see you
and that is i've got a plan all right
that is
your sans certified instructor plaque
and i know we announced it to you a week
ago and we changed the website but i
wanted to say congratulations
thanks seriously thanks for watching
thanks for everything that you are doing
to increase the knowledge in the
community to increase you know obviously
people's awareness
of you know uh things such as the 660
course that you and
steve sims and many others jim
schumacher many others teach but in
addition to that
uh the work that you're doing on the red
team side as well and with the course
that you're writing as well so uh
definitely
look forward to many other great things
to come and uh thank you again
thanks aaron thanks i appreciate it oh
i'm going to kick it back over to omar
in the studio we are going to close out
this stream because coming up next
is our joint panel with the ai village
and we are we're going to finish out for
today
uh for all the players that are in
finals right now keep that communication
uh on discord if you if you run to any
issues uh thank you for
for uh signing up with the finals as i
mentioned i just wanna say this one more
time
we are gonna leave the scenario up
because there's a lot going on there
despite the fact that we're we're doing
the hybrid event here
we will leave everything up it'll be
minimally supported but then we're going
to finish things
up tomorrow morning and see how
everyone's doing so it's back to you
omar
awesome thank you so much and
congratulations again hey
thanks that was awesome actually can you
show the the
the black sure microphones in the front
there you go
i'm actually taking a picture right now
i'll do that
awesome i am doing that
all right so uh funny ip or barrett let
me know mention
um please check out the scoreboard it's
in the bottom of their screen
please continue to communicate with each
other even though you know we're in the
finals
go to the red to the red team village
ctf
channel in the discord server from
defcon and with that
congratulations again and we're going to
break in a few seconds
thanks again thank you again for
[Music]
everything