Email Enumeration with Prowl

During an engagement, having an email list for your target can be useful for a variety of reasons. When it comes to social engineering and password spraying, more email addresses translate to higher chances of success. While some clients will provide an employee directory, for others it may be necessary…

A SharpView and More Aggressor

Any red team looking to improve is constantly adapting, changing their tactics and implementing new techniques & procedures. To many professionals in the industry, this is known as Tradecraft – a term that resonates with me. Previously, I had written about various tools that are used by the Tevora Threat Team…

Configuring Secure Boot + TPM 2

This post will walk through the process of automatically decrypting a LUKS encrypted drive on boot using a chain of trust implemented via Secure Boot and TPM 2. Background The Tevora Threat Team uses deployable devices for remote testing. The current generation of these devices consist of commercial off the…

Blind Command Injection Testing with Burp Collaborator

In this post we will demonstrate how Burp Collaborator can be leveraged for detecting and exploiting blind command injection vulnerabilities. Burp Collaborator is an excellent tool provided by Portswigger in BurpSuite Pro to help induce and detect external service interactions. These external service interactions occur when an application or system…

Aggressor PowerView

Tevora employs a lot of different tools depending on what our need is. During penetration tests and red teams one of the most common that is used is PowerView from PowerSploit. PowerView is an excellent tool in performing reconnaissance in Windows environments and provides a wealth of value. The functions…