Specializing in pen testing, red teaming, and Active SOC. We share our knowledge through blogs, webcasts, open-source tools, and Backdoors & Breaches game.
We did a thing yesterday. We did a low-key release of Backdoors & Breaches on our Amazon storefront.
We only let the people who've made an early request know it was available.
23 hours later... all 2,000 decks have sold out.
Should we make more available?
A one-day. six-hour, session on Threat Hunting from
@Chris_Brenton
of
@ActiveCmeasures
... live... with Q&A... and downloadable labs... totally free!
Sat, Jan 18th | 11am-5pm EST
Register:
John
@strandjs
is teaching a new "pay what you can" training course on -- SOC Core Skills w/ John Strand (16 Hours)
It's the skills all SOC analyst should have to get started.
@WWHackinFest
is running the training course on Dec 14-17.
Learn more:
OMG! There is a legit research paper written on how well Backdoors & Breaches aids in teaching cybersecurity in the classroom.
Lots of science words and stuff...
Hey folks!
In this 1-hour, Black Hills Information Security (BHIS) webcast, Gabriel Prudhomme will cover various SCCM exploitation techniques, research, and abuses. Learn how to exploit, audit, and defend SCCM ecosystems. From reconnaissance to privilege escalation that leads
New to infosec?
Take a 16-hour 'pay what you want' introduction to infosec training course w/
@strandjs
in July.
4-days, 4-hour sessions
Learn more:
Pay between $0 - $395. We and
@WWHackinFest
want to remove barriers and gates to infosec knowledge.
Coming in March, we have community built free open source solutions for Backdoors & Breaches that will be available so you can play remotely with your teams.
The new -- The Infosec Survival Guide -- was created by the
#infosec
community for the infosec community and you can now download the whole PDF for free -- no paywall, no registering.
Get physical copies for $1 each + shipping. United States only.
We think we finally nailed the Purple Team shirt.
Potentially coming this summer in the BHIS Summer2022! Collection.
Essentially what we're saying, would you want to wear this? Let us know in the replies...Yes or No?
Getting Started in Infosec?
@strandjs
is teaching an introductory/practical application course on the fundamentals of infosec w/
@WWHackinFest
on Nov 16-19.
It is a "pay what you can" training course... including $0 if you choose.
Details:
We're proofing the next print run of our Backdoors & Breaches cards.
It's cool getting to see all the cards at once.
Looking for errors.
We fixed a small font error that made "r n" look like "m" in a URL on the Social Engineering card.
"Creating your own lab can sound like a daunting task. By the end of this blog post, you'll be able to deploy your own Active Directory environment in minutes!"
Read more:
Deploy an Active Directory Lab Within Minutes
by: Alyssa Snow
Published: 4/25/2024
"Way back in 2017, two researchers at Black Hills Information Security disclosed how a vulnerability in the Google Calendar app was leaving more than a billion users open to a credential-stealing exploit."
The two researchers:
@dafthack
@ustayready
And... that's a wrap on today's one-day, six-hour free training session on Cyber Threat Hunting Training.
To the 2,600+ of you that joined us live, and then joined us live after the system crash, thank you so much for spending your day learning with us.
Until next time!
I can't believe this is actually happening soon.. from the basement of our house and only have one month of mortgage payments left in the bank to ...this is just crazy to think about...
#TrustedSec
We're working on self-published a new zine that is part infosec magazine and part fun activity book and part graphic novel (true hacking stories in comic form) that is coming this summer.
It is called... prompt#
What topics would you like us to cover?
🧵pt 1. Need a refresher on recon techniques or brand-new techniques to add to your arsenal?
👀 this slide deck on weaponizing corporate intel from
@ustayready
&
@dafthack
to go from 0 knowledge of an organization to stalker status 🕵 !!
Watch here:
**NEW** BHIS | Tester's Blog
Buckle up for this one, because
@notshenetworks
is about to give you A LOT of information.
Shenetworks’ Guide to Landing Your First Tech Job
by:
@notshenetworks
Published: 7/20/2023
Read more:
🧵Building a phishing engagement is hard. While the concept is straightforward, real-world execution is tricky.
Checkout out this 🧵 that take a top-down look at how a phishing engagement is designed.
Check out the FREE webinar by
@ralphte1
👇
.:
REKCAH HOODIES.
We are trying to figure out how many of these to order and in what sizes?
They will be $45 in our Spearphish General Store, near the end of February.
Still need to make a few modifications, but we're excited about the first draft of the Tabletop Simulator edition of Backdoors & Breaches.
This will be available for anyone that has Steam > Tabletop Simulator.
Should be available to play on March 4th (hopefully).
Are you looking for an
#infosec
Twitter alternative?
Over 33,000+ members have joined the Discord server we created to help you share your knowledge and learn from us and others...
You are welcome any time.
This will be our most popular webcast so far this year! Join us next Thursday!
How to Build a Home Lab
w/
@ActiveCmeasures
&
@strandjs
Apr 16, 2020 1:00 PM EDT
Register:
**NEW** BHIS | Blog
Do you want to learn to set up your own Active Directory lab?
Deploy an Active Directory Lab Within Minutes
by: Alyssa Snow
Published: 4/25/2024
Learn more:
**NEW** BHIS | Tester's Blog
Are you using ADCS ? If so, have you reviewed the ADCS configurations in your environment?
Abusing Active Directory Certificate Services (Part 1)
by: Alyssa Snow
Published: 10/5/2023
Welcome to the BHIS team
@notshenetworks
- looking forward to creating a lot of content together to help the community learn as much as they can about
#infosec
.
Backdoors & Breaches: Community-Built Open Source Tool
An online version of the game that allows for remote play through the site :
Play for free with your teams, orgs, classes.
Special thanks to Firm Guardian.
BHIS | Upcoming Tester's Webcast
No PowerShell? No Problem! Red Teaming using the BYOI (Bring Your Own Interpreter) lifestyle.
by
@byt3bl33d3r
@byt3bl33d3r
is dropping a huge update to SILENTTRINITY on webcast
Register:
PAY WHAT YOU WANT! John Strand
@strandjs
is teaching a paid ($0 - $395)
@WWHackinFest
4-day, 4-Hour sessions (16-hours), training course on — Getting Started in Security with BHIS and MITRE ATT&CK
Nov 16-19
Learn more:
Here's the recording from last week's 2-hour BHIS webcast with
@vendetce
-- Coercions and Relays – The First Cred is the Deepest with Gabriel Prud'homme
Watch now:
SO MANY DEMOS!
Our team has been working on a print project to hand out at
#infosec
conferences in 2023.
Sending this to the printer this week so we have it in time for
@shmoocon
!
We are developing a new card game about Incident Response -- Backdoors & Breaches -- and we're doing a dry-run on a BHIS webcast tomorrow. Wanna join us...give feedback?
Jun 5, 2019 3:00 PM EDT
The Backdoors & Breaches, Incident Response Card Game - Core Decks, have arrived at the
@DerbyCon
hotel.
We are officially handing these out at our booth on Sat!
First come, first serve.
Our Spearphish General Store is closed until May 9th.
When we launch...we should have the new ICS/OT Backdoors & Breaches deck from
@DragosInc
and
@BHinfoSecurity
We hate ransomware, we hate it so much we dedicated an entire 🧵 about how what you can do to prepare and mitigate damages and what tools can help!
Watch the full webinar for free on our YouTube
here:
"In order to complete a detection lab, we need a framework to reference cyber attacks to our specific environment..."
Read more:
At Home Detection Engineering Lab for Beginners
by: Niccolo Arboleda
Published: 5/2/2024
If you're looking for an alternative to
#infosec
twitter, might we suggest joining the BHIS Discord, to discuss infosec with the other 29,000+ members?
New free 4-hour online workshop on how to build a purple team lab.
Applied Purple Teaming: Infrastructure, Threat Optics, and Continuous Improvement w/
@Krelkci
&
@Rev10D
Sat, Jun 6, 2020 | 11 AM - 4 PM EDT
Register:
Limited to 1,000 registered attendees -- workshop w/ hands-on labs
Atomic Red Team: Hands-on Getting Started Guide
w/
Carrie
@OrOneEqualsOne
Darin
@MrOrOneEquals1
April 8th, 6pm ET (UTC -4)
No recording will be available.
Register:
We are so thankful for your help in raising over $30,000 for
@InnocentOrg
at the BHIS 24-Hour PreShowBanterCon-A-Thon 2021.
Thank you to everyone who donated, watched, shared, joined us live, sent messages, helped, and supported.
We are grateful and exhausted.
NEW COMIC BOOK SERIES LAUNCHING!!
The 30-day pre-order Kickstarter Campaign for THE FUTURE IS ****** is live and we'd love your support if this is a project you want to own.
Back it!
Thank you in advanced for your financial and moral support on this
.
@dafthack
is giving the final review on today's free 4-hour online training session on -- Breaching the Cloud Perimeter.
Thanks to the 1,500+ people that joined us from all over the world for today's session.
BHIS |
#InfoSec
Webcast - Available Now!
Pretty Little Python Secrets - Episode 1 - Installing Python Tools and Libraries the Right Way
w/
@byt3bl33d3r
Recorded: 8/13/2020
Watch:
🃏🛡️🌲🦌🕵️♂️
Join us for an exciting webcast on April 20th and learn how to play Backdoors & Breaches with your teams! 🎉
Our friends at
@HuntressLabs
have teamed up with us to create a new expansion deck for the incident response card game. 💪🃏
During the webcast, we'll teach
We're going to do a webcast soon on how our team has run a virtual
#infosec
conference, like we did with the in-person/virtual AwarenessCon, and the upcoming virtual
@WWHackinFest
.
What topics would you like us to discuss in the webcast?
Do you use DomainPasswordSpray by
@dafthack
?
A tool written in PowerShell to perform a password spray attack against users of a domain. By default it will automatically generate the userlist from the domain. BE VERY CAREFUL NOT TO LOCKOUT ACCOUNTS!
DomainPasswordSpray by
@dafthack
DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain. BE VERY CAREFUL NOT TO LOCKOUT ACCOUNTS!
BHIS | Tester's Blog
Powershell Without Powershell - How To Bypass Application Whitelisting, Environment Restrictions & AV
by:
@fullmetalcache
Published: 8/31/2016
Learn more:
Today I joined the
@BHinfoSecurity
security team! Super excited to join this League of Extraordinary Hackers. Thanks to everyone who reached out and sent DMs about positions.
Backdoors & Breaches Card Game is back on Amazon! The decks are available for pre-order now.
$10/deck covers production, distribution, and helps us offset the expense of giving them away to educators.
How to Play Video:
Just approved the print proof for the 35 new Expansion Deck cards for Backdoors & Breaches!
The printed cards, available in May.
The virtual cards, available by the end of the week in the Tabletop Simulator edition of the game.
Join the B&B Discord --
🔗 Watch this short clip from
@notshenetworks
webcast on Gathering Credentials Through Network Based Attacks:!
🎥 Dive deeper and watch the full webcast ➡️
🔒🌐🔑🕵️♀️📡🔓💻