<![CDATA[7 Minute Security's Substack]]>https://www.7minsec.clubhttps://substackcdn.com/image/fetch/$s_!Jlmz!,w_256,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fd5e61286-8e46-43fd-8d4e-d7f83119f472_363x363.png7 Minute Security's Substackhttps://www.7minsec.clubSubstackTue, 05 May 2026 11:40:06 GMT<![CDATA[We'll be back in April!]]>https://www.7minsec.club/p/well-be-back-in-aprilhttps://www.7minsec.club/p/well-be-back-in-aprilMon, 23 Mar 2026 20:27:47 GMTHi friends, in our last post I announced a break from 7MinSec.club to focus on helping our local community/neighbors. I detailed the specifics of my break in these three podcast episodes:

I’m getting back into the regular swing of things now, and plan on posting regular 7MinSec.club content starting in April. I’m not sure if I’ll go back to a strict “Tuesday TOOLSday” schedule we used to have. I’m entertaining the idea of being a bit more frequent in posting throughout the week, rather than a formal big post on Tuesdays. Either way, thanks for your patience and I look forward to getting back into the swing of things in April.

Leave a comment

Brian

Subscribe now

]]><![CDATA[7MinSec.club is taking a break]]>https://www.7minsec.club/p/7minsecclub-is-taking-a-breakhttps://www.7minsec.club/p/7minsecclub-is-taking-a-breakTue, 13 Jan 2026 16:10:58 GMTHello friends. I’m pushing the pause button on this Substack for the time being. I work in the Twin Cities area and there’s a lot of work to do to take care of my family, friends, neighbors and community. I appreciate your support and look forward to resuming our Tuesday TOOLSdays and other content as soon as possible.

-Brian

]]><![CDATA[Tuesday TOOLSday: eramba - a free GRC tool]]>https://www.7minsec.club/p/tuesday-toolsday-eramba-a-free-grchttps://www.7minsec.club/p/tuesday-toolsday-eramba-a-free-grcTue, 06 Jan 2026 16:03:07 GMTHappy new year! Today I give you a quick getting-started guide for eramba (not a partner/sponsor), a “community driven GRC solution that doesn’t break the bank.” It’s pretty easy to get installed via docker, and I added some personal instructions/tweaks of my own on our BPATTY project. Eramba looks super feature-packed, has a huge documentation library (complete with an accompanying video series), and even includes a beefy templates library full of policies, compliance frameworks and more.

Enjoy!

Subscribe now

-Brian

]]><![CDATA[Tuesday TOOLSday: wifi pentesting with USB adapters and Proxmox]]>https://www.7minsec.club/p/tuesday-toolsday-wifi-pentestinghttps://www.7minsec.club/p/tuesday-toolsday-wifi-pentestingTue, 30 Dec 2025 16:02:07 GMTToday I give a quick primer on how to use a USB wifi card (such as the Panda PAU09) with Proxmox and the monitor mode script (and other tips) to successfully position yourself for maximum wifi pentest pwnage!

Subscribe now

Comments/questions/concerns?

Leave a comment

Anything you want me to know?

Thanks,

-Brian

]]><![CDATA[Tuesday TOOLSday: how to fix the ESC8 vulnerability]]>https://www.7minsec.club/p/tuesday-toolsday-how-to-fix-the-esc8https://www.7minsec.club/p/tuesday-toolsday-how-to-fix-the-esc8Tue, 23 Dec 2025 15:02:46 GMTThis week I jump over to the blue team side of the world and walk through how to find, attack and fix the ADCS ESC8 vulnerability! Microsoft has some guidance on various cert fix-ups here as well. During our penetration tests, we see a ton of the ESC1 and ESC8 vulnerabilities. You should also review the excellent article/research from SpecterOps on finding/fixing all flavors of ESC vulnerabilities. Lastly, I’ve had many clients report that the Locksmith tool is excellent for finding, understanding, and even fixing ESC vulnerabilities in your environment.

Leave a comment

Thanks,

-Brian

Subscribe now

]]><![CDATA[LPLITE:GOAD pentesting course has launched!]]>https://www.7minsec.club/p/lplitegoad-pentesting-course-hashttps://www.7minsec.club/p/lplitegoad-pentesting-course-hasThu, 18 Dec 2025 13:07:32 GMT

Hello friends! I’m super excited to share that our brand new Active Directory pentesting course, Light Pentest LITE:GOAD (Live Interactive Training Experience: Game of Active Directory) is now open for enrollment!

When: Tuesday, January 27 - Thursday, January 29 (9:00 a.m. - 1:00 p.m. each day)

Where: online via a Web browser (nothing to download/install on your end!)

Where to sign up and get more details:

https://training.7minsec.com/events/90c5636a-a642-45f1-acc3-9c6c547fd887

If you have any comments/questions/concerns, please let me know!

Thanks,

Brian

Leave a comment

Subscribe now

]]><![CDATA[Tuesday TOOLSday: coercion attacks against Windows 11]]>https://www.7minsec.club/p/tuesday-toolsday-coercion-attackshttps://www.7minsec.club/p/tuesday-toolsday-coercion-attacksTue, 16 Dec 2025 16:01:51 GMTHey friends! In today’s Tuesday TOOLSday I demonstrate an attack that I thought Windows 11 and higher was hardened against. On many a internal pentest you might find a Windows system with WebClient enabled - thus (potentially) opening the opportunity to coerce authentication out of that system with a relay attack, thus giving you excessive rights on that victim machine.

My understanding as of a few months ago, though, is that Windows 11 OS and greater were immune to that type of coercion. Turns out I was wrong - check out https://github.com/Hypnoze57/rpc2efs and today’s video to see Windows 11 coercion in action!

Leave a comment

Thanks,

Brian

Subscribe now

]]><![CDATA[Tuesday TOOLSday: I'm out of commission]]>https://www.7minsec.club/p/tuesday-toolsday-im-out-of-commissionhttps://www.7minsec.club/p/tuesday-toolsday-im-out-of-commissionTue, 09 Dec 2025 16:02:51 GMTHello friends,

Sorry (mom), no Tuesday TOOLSday video today (maybe later this week though). My calendar went a bit sideways with work and personal things.

On the topic of Tuesday TOOLSday, though, I’ve started to take some of the videos from these streams and bake them into my BPATTY (Brian’s Pentesting And Technical Tips for You) site for easier reference:

https://bpatty.rocks/tags/video/

Have a great week!

-Brian

]]><![CDATA[Tuesday TOOLSday: DIY pentest dropbox tips]]>https://www.7minsec.club/p/tuesday-toolsday-diy-pentest-dropboxhttps://www.7minsec.club/p/tuesday-toolsday-diy-pentest-dropboxThu, 04 Dec 2025 15:16:04 GMTThis week I show some tips to help make pentest dropbox deployments easier and faster, and also share a shift I’m making in remote access to these boxes. The skinny:

  • Using a Proxmox Twingate LXC makes persistent remote access easy. You can leave this slim VM on your Proxmox box at all times, and not have to nuke and rebuild it with every new customer project!

  • With a little scripting and some use of the qm command at the Proxmox SSH command line, you can set the admin password for both VMs and also set the VMs to start upon Proxmox boot (in whatever order you choose).

Have fun!

-Brian

Leave a comment

Subscribe now

]]><![CDATA[ Tuesday TOOLSday: SQL server defense 101]]>https://www.7minsec.club/p/fc8https://www.7minsec.club/p/fc8Thu, 27 Nov 2025 13:07:40 GMTToday we cover an easy way you can defend against a common SQL server attack - specifically by disabling stored procedures that attackers and pentesters use to give themselves free AD credentials. I’ve got a write-up on the defensive commands here: https://bpatty.rocks/blueteam/sql/.

While you’re here, why not subscribe?

Subscribe now

Comment/question/concern for me?

Thanks,

Brian

]]><![CDATA[Tuesday TOOLSday: Lithnet AD Password Protection]]>https://www.7minsec.club/p/tuesday-toolsday-lithnet-ad-passwordhttps://www.7minsec.club/p/tuesday-toolsday-lithnet-ad-passwordThu, 20 Nov 2025 13:07:38 GMTThis week I came across Lithnet’s Password Protection for Active Directory (not a sponsor!). It’s awesome! It’s a free utility you can install on your domain controllers to block all of the Have I Been Pwned password list, as well as any custom password lists and words you want to manually import. Perhaps my favorite feature is the ability to add a banned word like 7minutesecurity and have it automatically block variations such as:

  • 7minutesecurity!

  • 7minutesecurity2025!

  • 7m1nut3s3cur1ty2028

Check it out, and while you’re here, why not subscribe?

Subscribe now

Comment/question for me?

Oh and before I forget, I’ve got a cheat sheet write-up on installing password protection here.

Thanks,

-Brian

]]><![CDATA[Light Pentest LITE:GOAD logo winner announced!]]>https://www.7minsec.club/p/light-pentest-litegoad-logo-winnerhttps://www.7minsec.club/p/light-pentest-litegoad-logo-winnerMon, 17 Nov 2025 13:07:55 GMTHello friends,

Just wanted to share with you that we landed on a winner for our Light Pentest LITE:GOAD logo contest - check it out:

Ohhhh I love it so much! This will start getting worked into our LPLITE:GOAD page, and you’ll definitely see more of it if you attend the first live class, which is coming in January, 2026. I’ll announce the class sign-up link here in Substack first, so please subscribe if you haven’t already:

Subscribe now

And don’t forget to join us for tomorrow’s Tuesday TOOLSday where we’ll be showcasing Lithnet AD password protection.

Thanks,

-Brian

]]><![CDATA[Tuesday TOOLSday: LAPS quick install]]>https://www.7minsec.club/p/tuesday-toolsday-laps-quick-installhttps://www.7minsec.club/p/tuesday-toolsday-laps-quick-installThu, 13 Nov 2025 13:07:37 GMTThis week we did a super quick install/demo of LAPS (Local Administrator Password Solution). LAPS is built right into Active Directory and gives you a free/easy way to assign all of your endpoints a unique local Administrator account password, thus making it harder for hackers who compromise one endpoint to compromise all endpoints.

Enjoying this content?

Subscribe now

Questions/comments/concerns for me?

Thanks,

Brian

Get more from Brian Johnson in the Substack app
Available for iOS and Android
]]><![CDATA[Tuesday TOOLSday: Pretender]]>https://www.7minsec.club/p/tuesday-toolsday-pretenderhttps://www.7minsec.club/p/tuesday-toolsday-pretenderThu, 06 Nov 2025 13:07:51 GMTThis week I gave a quick intro of pretender, a tool that has the powers of mitm6 + the spoofing capabilities of Responder. Specifically, I demonstrated how to selectively spoof a hostname that systems are querying but for which no DNS record exists. I’m definitely going to play with this more and use it on future assessments. There’s a great overview of the tool with some examples and videos here.

Do you use pretender on assessments?

Leave a comment

Questions/comments/concerns for me?

Thanks,

-Brian

]]><![CDATA[Tuesday TOOLSday: Kerberoasting Kleanup]]>https://www.7minsec.club/p/tuesday-toolsday-kerberoasting-kleanuphttps://www.7minsec.club/p/tuesday-toolsday-kerberoasting-kleanupThu, 30 Oct 2025 12:07:56 GMTHello friends! This week I talked about how you can clean up old Active Directory SPNs. The main page with all the links is over at our BPATTY repository, but here are the links we talked about during the livestream:

Enjoy, and why you’re here, why not:

Subscribe now

Thanks,

Brian

]]><![CDATA[Tuesday TOOLSday: egress filtering]]> external network]]>https://www.7minsec.club/p/tuesday-toolsday-egress-filteringhttps://www.7minsec.club/p/tuesday-toolsday-egress-filteringTue, 21 Oct 2025 15:02:56 GMT

Hey friends,

I’m on the road this week but didn’t want to miss our Tuesday TOOLSday! Today we talk about egress filtering (with the help of this BPATTY article) and talk about:

  • What traffic you might want to hard block from traversing your internal > external network.

  • What traffic you might want to filter so that only specific hosts can send it outbound.

  • A quick demo of go-out to test egress filtering.

Enjoy!

Leave a comment

-Brian

Subscribe now

]]><![CDATA[Tuesday TOOLSday: benefits of a security ticketing system]]>https://www.7minsec.club/p/tuesday-toolsday-benefits-of-a-securityhttps://www.7minsec.club/p/tuesday-toolsday-benefits-of-a-securityWed, 15 Oct 2025 12:07:32 GMT This week I talked through how 7MinSec is using a security ticketing system (JitBit specifically but they’re not a sponsor/advertiser) to help manage our internal infosec program. Specifically, we use tickets to:

  • Manage an asset inventory

  • Track incidents

  • Generate automatic tickets for important system maintenance (backups, patching, etc.)

Do you use a system like this to help manage your internal infosec program?

Leave a comment

Any thoughts you want to share directly?

Thanks,

Brian

Get more from Brian Johnson in the Substack app
Available for iOS and Android
]]><![CDATA[Tuesday TOOLSday: mssqlkaren]]>https://www.7minsec.club/p/tuesday-toolsday-mssqlkarenhttps://www.7minsec.club/p/tuesday-toolsday-mssqlkarenTue, 07 Oct 2025 14:55:26 GMTHey friends, in last week’s podcast I talked about a fun pentest where I relayed an SCCM machine account cred to a SCCM server with SQL installed, then dumped delicious information out of the database - which contained clear text SCCM creds! Today I show this in more detail, and how the credential stealing process was made much easier with the help of mssqlkaren.

Other reference links:

  • 7MS #695 - where we talk about this attack in more detail

  • Pentesting GOAD SCCM - shows how to make a SQL connection to an SCCM server (I was wrong in today’s video in that we didn’t actually show an SCCM relay in the YouTube video, but at least you can see things from a SQL prompt POV)

Enjoy!

Subscribe now

Brian

]]><![CDATA[Tuesday TOOLSday: coercing HTTP auth w/scheduled tasks]]>https://www.7minsec.club/p/tuesday-toolsday-coercing-http-authhttps://www.7minsec.club/p/tuesday-toolsday-coercing-http-authFri, 03 Oct 2025 12:07:09 GMTHello friends! In this week’s Tuesday TOOLSday we continue the theme of using schtasks for evil - this time by camping out on a WinRM connection with local admin access, and then coercing HTTP authentication from a logged-in domain admin account to give us full control of the domain.

Hey and while you’re here, why not…

Subscribe now

Thoughts to share?

Leave a comment

Questions for me?

Brian

Get more from Brian Johnson in the Substack app
Available for iOS and Android
]]><![CDATA[Tuesday TOOLSday: coercing SMB auth w/scheduled tasks]]>https://www.7minsec.club/p/tuesday-toolsday-coercing-smb-authhttps://www.7minsec.club/p/tuesday-toolsday-coercing-smb-authFri, 26 Sep 2025 15:33:41 GMTToday I demonstrate a method to leverage local admin access to coerce SMB auth out of that system, on behalf of a higher-privilege user, and “catch” the request with downgraded authentication you can crack using something like Vast.ai.

Enjoy!

Leave a comment

Brian

Get more from Brian Johnson in the Substack app
Available for iOS and Android
]]>