“Killer” lol So bad. ;)

I'm home after teaching Offense for Defense at NineStart Connect. They offered free (yes, free) training to whomever wanted to attend. I can't thank them enough for offering this to our community! The class is available here: training.redsiege.com (affordable, not free... sorry you missed out 😉)

Wrapping up @defcon.bsky.social Bahrain at the ICS Village. Not my best picture, but excellent photo bomb.

Damn. I’m never going to find this room.

Two days of teaching Pen Testing: Beyond the Basics ✅ Two hour Kerberos workshop ✅ Talk ✅ Tomorrow, time to be a full time booth babe.

Last year at @wildwesthackinfest.bsky.social a few packages arrived late (not mine). The maintenance staff regularly receives packages and thought it was theirs. They opened it, found a pack of stickers. They have been putting them on their stuff and the hotel. "We wondered who that guy was"

Senior Security Consultant Justin Palk tells you everything you need to know about getting started with proxy chains in this blog 🔗 redsiege.com/proxychains #hacking #infosec #cybersecurity

The booth is hopping! Stop by to get tons of stickers, a shirt, and get entered to win a framed autographed picture from Hackers.

Join us tomorrow!

Live now with pre-show banter with @mzbat.bsky.social (Kimber) and @antisyphontraining.bsky.social. Close Security Gaps, Pass Audits, Stay Secure w/ Kimber Amos and @redsiege.com www.antisyphontraining.com/event/anti-c...

I think about this often. What is a real world bad guy's level of effort for cracking? How long do they spend? How big is their cracker? Do they have multiple crackers? How do they distribute the load?

BRB, going to wake up Billie Joe. www.youtube.com/watch?v=pGhw...

Join me next week on the Thursday Defensive (thursdef.com) next Thursday at 1:30 ET on Offensive for Defense - How defenders can use offensive tools to test themselves.

Couldn't agree more. How many high/crit PHP findings in your vuln scan reports that are meaningless because that function isn't used (or used with user input). Teams work hard remediate issues that have 0 impact, largely because it shows up in a dashboard, metrics, or KPIs... not because it matters.

Really cool to be interviewed and quoted in this article.

RC4 used with Kerberos isn't the fundemental flaw we think. Yes, RC4 is deprecated, but the real issue is the key generation for AES v RC4 for cracking (Kerberoasting). With RC4 the key = password hash. With AES it is 4096 rounds of hashing of hash+username+domain. The 4096 rounds matters, a lot!

I'm looking forward to @wildwesthackinfest.bsky.social. I also have a Kerberos workshop there, so check that out. Oh, and we'll have tons of swag at the @redsiege.com booth, so stop by if you're in-person!

In response to Senator Ron Wyden's letter to the FTC, I have put together my comments on Kerberoasting and RC4. redsiege.com/blog/2025/09...

A senator talking about Kerberoasting was not on my bingo card!

The issue isn't as much RC4 as it is bad passwords. While RC4 isn't good, other encryption does *not* prevent Kerberoasting. AES128 and AES256 just slow down the attack by ~100-170x. If the password is really bad, 170x is meaningless. @matthewdgreen.bsky.social arstechnica.com/security/202...

“Always go for more sparkles!” Words of wisdom from a 9 yo at Heathrow when I asked if I should get the more and less sparkling water. Such a valuable life lesson there. She also said, “trust the diva”. Another valuable lesson.

I love KC. BBQ capital of world! Had some fantastic Gates BBQ!

After some fantastic KC BBQ at Gates last night, Molly and I are at INTERFACE KC 2025. Great group and I'm thankful for the opportunity to present! If you're here, come stop by the @redsiege.com booth!

Day 1 of Red Team Tactics in the bag! And we got the best named room at @blackhatevents.bsky.social!

I watched Happy Gilmore 2 with my boys last night. It was fantastic and so much fun. Loved all the fan service and cameos. It was actually funny too. Loved it!

lol

Got to the gate three minutes before boarding. What do I do with all this extra time?

Back in studio recording another class!

[email protected] just expanded the number of seats in our class, so there is (new) room available! Come join us!

The most listened to song of all time is not from the Beatles. It's this banger. That said, no one wanted to listen to it. www.youtube.com/watch?v=IAjY...

Wow, it's been a year since we went our own way on training. I couldn't be happier where things have ended up. We now have 4 classes! One is running at Black Hat. Two are running at WWHF. One more will be ready for on-demand very soon. The price point for the direct classes is more affordable too!

I’ve been reading Fox in Sox to my kids for 16 years and I *finally* had a perfect reading with no mistakes or stumbles! Sorry, but the world now ends tomorrow.

Super excited to have this available for you all. The videos are 🔥!

How many dozen oysters is too many dozen oysters? I’m at three. It’s $1/oyster today. The record here is 144 (12 dozen).

Two boys, two balls. I love how baseball players and fans make it about the kids.

Yankees Stadium with the boys (two of them)

I love NYC, but is there a grosser combo of subway and taxis anywhere in the developed world? Paris is almost as bad.

Had a great time at #SecretCon today.

A single line poem

Finally fought my way to Inbox Zero to find that Microsoft updated the empty inbox image. What the heck is it? Soap holder? AirPod case?

lol, spammer oopsie

[email protected] and I talking about our latest service offering. I'm really excited about it. Let us know if you have questions or want to discuss.

The awesome by-product is that I now look forward to spam texts. I'm a little bummed the numbers have dropped off.

This week on the 2nd Best Show on the Internet, the @redsiege.com Wednesday Offensive. This week with @secureideas.bsky.social (Kevin Johnson) from @secureideas.com (lol) talking about Talking to Execs. Join us this week or any Wednesday at redsiege.com/wedoff at 1:30ET.

Nah, Borgs try to wear badass Alethe Denis costumes.

Cool version "I came here to kick ass and chew gum. And I'm all out of gum." Actual version "I came here to sit through a zoom meeting and drink coffee. And I'm all out of coffee."

I started to respond to text spammers as "Bird Facts". I setup a bunch of auto replacements for "bird1", "bird2", ... to responses to make it faster.

It's Midweek! You know that means The Wednesday Offensive! The 2nd Best Show on the Internet! 🔗http://redsiege.com/wedoff Adam Mashinchi is coming on to discuss Perception vs Reality with AI, LoLbins, RMM, Zero Trust - what is actually useful for folks to focus on vs. not? See you at 130pm ET

🚨 Hands-On Kerberos with @timmedin.bsky.social 🚨 May 2nd An @antisyphontraining.bsky.social Pay What You Can Workshop! 🔗 Register now: www.antisyphontraining.com/course/works... #hacking #Infosec #cybersecurity

Heading to Alaska. We had three delays. None due to plane issues and the plane was on time. Unruly passenger. Overweight plane. Tug broke pushing the plane back. It was three hours so they had to legally opened the door. When they opened the door the FA timed out.