<![CDATA[7 Minute Security's Substack]]>https://www.7minsec.clubhttps://substackcdn.com/image/fetch/$s_!Jlmz!,w_256,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fd5e61286-8e46-43fd-8d4e-d7f83119f472_363x363.png7 Minute Security's Substackhttps://www.7minsec.clubSubstackSat, 20 Jun 2026 11:00:06 GMT<![CDATA[Tuesday TOOLSday: Mythic C2]]>https://www.7minsec.club/p/tuesday-toolsday-mythic-c2https://www.7minsec.club/p/tuesday-toolsday-mythic-c2Tue, 16 Jun 2026 18:05:11 GMTHi friends, this week I give you a quick tour of Mythic C2 including (at a high level):

  • Install overview

  • Building your first payload

  • Obfuscation techniques

  • Getting an initial shell

  • Privesc to SYSTEM shell

  • Mimikatz maximum pwnage!

P.S. I’m thinking of doing a live, long livestream (multiple hours?) where I pwn Ninja Hacker Academy from start to finish. I want to even include the install/setup/configuration of Mythic and use it throughout the stream. What do you think? Fun, or dumbest thing ever? Let me know!

Leave a comment

Thanks,
Brian

]]><![CDATA[Tuesday TOOLSday: Hermes]]>https://www.7minsec.club/p/tuesday-toolsday-hermeshttps://www.7minsec.club/p/tuesday-toolsday-hermesWed, 10 Jun 2026 20:02:21 GMTHey friends. I’ll talk more about this on the podcast this week, but wanted to announce that I’ve moved from OpenClaw to Hermes. This week I was able to set it up on my Mac Mini in about an hour, and completed the install by setting up a Telegram bot. Then, as I zipped around the Twin Cities running errands, I told Hermes to:

  • Install UptimeKuma

  • Install Assistant

  • Research scary movies

  • Create a “daily digest” email with info I care about

…and I’ve only scratched the service. This is awesome!

-Brian

]]><![CDATA[Tuesday TOOLSday: 7MinSecWikiScripts]]>https://www.7minsec.club/p/tuesday-toolsday-7minsecwikiscriptshttps://www.7minsec.club/p/tuesday-toolsday-7minsecwikiscriptsWed, 03 Jun 2026 22:08:11 GMTHey friends!

Yes, I know it’s Wednesday — sorry, mom. 😅 But I’ve got a new Tuesday TOOLSday for you anyway!

This week I’m announcing a brand new GitHub repo: 7MinSec WikiScripts — a soon-to-be-growing collection of scripts (built with a lot of AI help) to make pentesting life easier. You can find it linked from the Scripts section over at 7MinSec.wiki.

The repo is organized into folders for lab setup, Dropbox deployments, maintenance tasks, and pentesting goodies. The first script out of the gate is install-exegol.sh — a one-shot installer for Exegol, which is basically my must-have toolkit for every internal network pentest. It bundles CrackMapExec, Impacket, Responder, and a ton more into a clean container environment so you’re not wrestling with dependency nightmares on a fresh Kali box.

Check out the video, grab the script, and let me know what you think!

Have a great week,

Brian

]]><![CDATA[Tuesday TOOLSday: How to turn your phone into a "Brick"]]>https://www.7minsec.club/p/tuesday-toolsday-how-to-turn-yourhttps://www.7minsec.club/p/tuesday-toolsday-how-to-turn-yourTue, 12 May 2026 19:09:56 GMTThis week’s Tuesday TOOLSday is a bit of a departure from the usual pentest/blue team chatter — but stay with me! Burnout and too much screen time are very real in IT/security, so I wanted to share a $50 gizmo called Brick that’s helped me doom scroll less, focus more, and sleep better over the past week.

The short version: Brick is a small NFC device (magnetic back, so I stuck mine on the fridge) that pairs with the Brick app. You pick the apps you want bricked — socials, games, whatever your time-sucks are — and tap your phone to the device to enable “mindfulness mode.” To get those apps back, you have to physically walk over and tap again. That tiny bit of friction has been surprisingly effective at breaking my continual “pocket check” habit.

A few things I dig about it:

  • $50 one-time fee, no subscription

  • One brick pairs with multiple devices (good for the family)

  • 5 emergency unbricks are allowed within the app (if you’re stuck somewhere without the physical device)

  • Lets you schedule brick/unbrick on a timer without the physical device (great for a “Tommy Needs Sleepy” wind-down)

Grab one at getbrick.com if you’re curious. (7MinSec is not a sponsor, not an affiliate, this is not an ad, etc.)

Got your own focus/mental health hacks for fellow burnt-out IT folks? Leave a comment!

Thanks,

-Brian

]]><![CDATA[Tuesday TOOLSday: 7MinSec.wiki - April updates]]>https://www.7minsec.club/p/tuesday-toolsday-7minsecwiki-aprilhttps://www.7minsec.club/p/tuesday-toolsday-7minsecwiki-aprilWed, 06 May 2026 00:07:52 GMTHi friends, long time no posts! Sorry about that. I took a break for a while, and was hoping to be back in April, but only my mom noticed I didn’t get back into the swing of things until now.

In today’s Tuesday TOOLSday I wanted to (re)introduce you to 7MinSec.wiki and some new/updated pages I pushed in April, including:

Have a great week,

Brian

]]><![CDATA[We'll be back in April!]]>https://www.7minsec.club/p/well-be-back-in-aprilhttps://www.7minsec.club/p/well-be-back-in-aprilMon, 23 Mar 2026 20:27:47 GMTHi friends, in our last post I announced a break from 7MinSec.club to focus on helping our local community/neighbors. I detailed the specifics of my break in these three podcast episodes:

I’m getting back into the regular swing of things now, and plan on posting regular 7MinSec.club content starting in April. I’m not sure if I’ll go back to a strict “Tuesday TOOLSday” schedule we used to have. I’m entertaining the idea of being a bit more frequent in posting throughout the week, rather than a formal big post on Tuesdays. Either way, thanks for your patience and I look forward to getting back into the swing of things in April.

Leave a comment

Brian

Subscribe now

]]><![CDATA[7MinSec.club is taking a break]]>https://www.7minsec.club/p/7minsecclub-is-taking-a-breakhttps://www.7minsec.club/p/7minsecclub-is-taking-a-breakTue, 13 Jan 2026 16:10:58 GMTHello friends. I’m pushing the pause button on this Substack for the time being. I work in the Twin Cities area and there’s a lot of work to do to take care of my family, friends, neighbors and community. I appreciate your support and look forward to resuming our Tuesday TOOLSdays and other content as soon as possible.

-Brian

]]><![CDATA[Tuesday TOOLSday: eramba - a free GRC tool]]>https://www.7minsec.club/p/tuesday-toolsday-eramba-a-free-grchttps://www.7minsec.club/p/tuesday-toolsday-eramba-a-free-grcTue, 06 Jan 2026 16:03:07 GMTHappy new year! Today I give you a quick getting-started guide for eramba (not a partner/sponsor), a “community driven GRC solution that doesn’t break the bank.” It’s pretty easy to get installed via docker, and I added some personal instructions/tweaks of my own on our BPATTY project. Eramba looks super feature-packed, has a huge documentation library (complete with an accompanying video series), and even includes a beefy templates library full of policies, compliance frameworks and more.

Enjoy!

Subscribe now

-Brian

]]><![CDATA[Tuesday TOOLSday: wifi pentesting with USB adapters and Proxmox]]>https://www.7minsec.club/p/tuesday-toolsday-wifi-pentestinghttps://www.7minsec.club/p/tuesday-toolsday-wifi-pentestingTue, 30 Dec 2025 16:02:07 GMTToday I give a quick primer on how to use a USB wifi card (such as the Panda PAU09) with Proxmox and the monitor mode script (and other tips) to successfully position yourself for maximum wifi pentest pwnage!

Subscribe now

Comments/questions/concerns?

Leave a comment

Anything you want me to know?

Thanks,

-Brian

]]><![CDATA[Tuesday TOOLSday: how to fix the ESC8 vulnerability]]>https://www.7minsec.club/p/tuesday-toolsday-how-to-fix-the-esc8https://www.7minsec.club/p/tuesday-toolsday-how-to-fix-the-esc8Tue, 23 Dec 2025 15:02:46 GMTThis week I jump over to the blue team side of the world and walk through how to find, attack and fix the ADCS ESC8 vulnerability! Microsoft has some guidance on various cert fix-ups here as well. During our penetration tests, we see a ton of the ESC1 and ESC8 vulnerabilities. You should also review the excellent article/research from SpecterOps on finding/fixing all flavors of ESC vulnerabilities. Lastly, I’ve had many clients report that the Locksmith tool is excellent for finding, understanding, and even fixing ESC vulnerabilities in your environment.

Leave a comment

Thanks,

-Brian

Subscribe now

]]><![CDATA[LPLITE:GOAD pentesting course has launched!]]>https://www.7minsec.club/p/lplitegoad-pentesting-course-hashttps://www.7minsec.club/p/lplitegoad-pentesting-course-hasThu, 18 Dec 2025 13:07:32 GMT

Hello friends! I’m super excited to share that our brand new Active Directory pentesting course, Light Pentest LITE:GOAD (Live Interactive Training Experience: Game of Active Directory) is now open for enrollment!

When: Tuesday, January 27 - Thursday, January 29 (9:00 a.m. - 1:00 p.m. each day)

Where: online via a Web browser (nothing to download/install on your end!)

Where to sign up and get more details:

https://training.7minsec.com/events/90c5636a-a642-45f1-acc3-9c6c547fd887

If you have any comments/questions/concerns, please let me know!

Thanks,

Brian

Leave a comment

Subscribe now

]]><![CDATA[Tuesday TOOLSday: coercion attacks against Windows 11]]>https://www.7minsec.club/p/tuesday-toolsday-coercion-attackshttps://www.7minsec.club/p/tuesday-toolsday-coercion-attacksTue, 16 Dec 2025 16:01:51 GMTHey friends! In today’s Tuesday TOOLSday I demonstrate an attack that I thought Windows 11 and higher was hardened against. On many a internal pentest you might find a Windows system with WebClient enabled - thus (potentially) opening the opportunity to coerce authentication out of that system with a relay attack, thus giving you excessive rights on that victim machine.

My understanding as of a few months ago, though, is that Windows 11 OS and greater were immune to that type of coercion. Turns out I was wrong - check out https://github.com/Hypnoze57/rpc2efs and today’s video to see Windows 11 coercion in action!

Leave a comment

Thanks,

Brian

Subscribe now

]]><![CDATA[Tuesday TOOLSday: I'm out of commission]]>https://www.7minsec.club/p/tuesday-toolsday-im-out-of-commissionhttps://www.7minsec.club/p/tuesday-toolsday-im-out-of-commissionTue, 09 Dec 2025 16:02:51 GMTHello friends,

Sorry (mom), no Tuesday TOOLSday video today (maybe later this week though). My calendar went a bit sideways with work and personal things.

On the topic of Tuesday TOOLSday, though, I’ve started to take some of the videos from these streams and bake them into my BPATTY (Brian’s Pentesting And Technical Tips for You) site for easier reference:

https://bpatty.rocks/tags/video/

Have a great week!

-Brian

]]><![CDATA[Tuesday TOOLSday: DIY pentest dropbox tips]]>https://www.7minsec.club/p/tuesday-toolsday-diy-pentest-dropboxhttps://www.7minsec.club/p/tuesday-toolsday-diy-pentest-dropboxThu, 04 Dec 2025 15:16:04 GMTThis week I show some tips to help make pentest dropbox deployments easier and faster, and also share a shift I’m making in remote access to these boxes. The skinny:

  • Using a Proxmox Twingate LXC makes persistent remote access easy. You can leave this slim VM on your Proxmox box at all times, and not have to nuke and rebuild it with every new customer project!

  • With a little scripting and some use of the qm command at the Proxmox SSH command line, you can set the admin password for both VMs and also set the VMs to start upon Proxmox boot (in whatever order you choose).

Have fun!

-Brian

Leave a comment

Subscribe now

]]><![CDATA[ Tuesday TOOLSday: SQL server defense 101]]>https://www.7minsec.club/p/fc8https://www.7minsec.club/p/fc8Thu, 27 Nov 2025 13:07:40 GMTToday we cover an easy way you can defend against a common SQL server attack - specifically by disabling stored procedures that attackers and pentesters use to give themselves free AD credentials. I’ve got a write-up on the defensive commands here: https://bpatty.rocks/blueteam/sql/.

While you’re here, why not subscribe?

Subscribe now

Comment/question/concern for me?

Thanks,

Brian

]]><![CDATA[Tuesday TOOLSday: Lithnet AD Password Protection]]>https://www.7minsec.club/p/tuesday-toolsday-lithnet-ad-passwordhttps://www.7minsec.club/p/tuesday-toolsday-lithnet-ad-passwordThu, 20 Nov 2025 13:07:38 GMTThis week I came across Lithnet’s Password Protection for Active Directory (not a sponsor!). It’s awesome! It’s a free utility you can install on your domain controllers to block all of the Have I Been Pwned password list, as well as any custom password lists and words you want to manually import. Perhaps my favorite feature is the ability to add a banned word like 7minutesecurity and have it automatically block variations such as:

  • 7minutesecurity!

  • 7minutesecurity2025!

  • 7m1nut3s3cur1ty2028

Check it out, and while you’re here, why not subscribe?

Subscribe now

Comment/question for me?

Oh and before I forget, I’ve got a cheat sheet write-up on installing password protection here.

Thanks,

-Brian

]]><![CDATA[Light Pentest LITE:GOAD logo winner announced!]]>https://www.7minsec.club/p/light-pentest-litegoad-logo-winnerhttps://www.7minsec.club/p/light-pentest-litegoad-logo-winnerMon, 17 Nov 2025 13:07:55 GMTHello friends,

Just wanted to share with you that we landed on a winner for our Light Pentest LITE:GOAD logo contest - check it out:

Ohhhh I love it so much! This will start getting worked into our LPLITE:GOAD page, and you’ll definitely see more of it if you attend the first live class, which is coming in January, 2026. I’ll announce the class sign-up link here in Substack first, so please subscribe if you haven’t already:

Subscribe now

And don’t forget to join us for tomorrow’s Tuesday TOOLSday where we’ll be showcasing Lithnet AD password protection.

Thanks,

-Brian

]]><![CDATA[Tuesday TOOLSday: LAPS quick install]]>https://www.7minsec.club/p/tuesday-toolsday-laps-quick-installhttps://www.7minsec.club/p/tuesday-toolsday-laps-quick-installThu, 13 Nov 2025 13:07:37 GMTThis week we did a super quick install/demo of LAPS (Local Administrator Password Solution). LAPS is built right into Active Directory and gives you a free/easy way to assign all of your endpoints a unique local Administrator account password, thus making it harder for hackers who compromise one endpoint to compromise all endpoints.

Enjoying this content?

Subscribe now

Questions/comments/concerns for me?

Thanks,

Brian

Get more from Brian Johnson in the Substack app
Available for iOS and Android
]]><![CDATA[Tuesday TOOLSday: Pretender]]>https://www.7minsec.club/p/tuesday-toolsday-pretenderhttps://www.7minsec.club/p/tuesday-toolsday-pretenderThu, 06 Nov 2025 13:07:51 GMTThis week I gave a quick intro of pretender, a tool that has the powers of mitm6 + the spoofing capabilities of Responder. Specifically, I demonstrated how to selectively spoof a hostname that systems are querying but for which no DNS record exists. I’m definitely going to play with this more and use it on future assessments. There’s a great overview of the tool with some examples and videos here.

Do you use pretender on assessments?

Leave a comment

Questions/comments/concerns for me?

Thanks,

-Brian

]]><![CDATA[Tuesday TOOLSday: Kerberoasting Kleanup]]>https://www.7minsec.club/p/tuesday-toolsday-kerberoasting-kleanuphttps://www.7minsec.club/p/tuesday-toolsday-kerberoasting-kleanupThu, 30 Oct 2025 12:07:56 GMTHello friends! This week I talked about how you can clean up old Active Directory SPNs. The main page with all the links is over at our BPATTY repository, but here are the links we talked about during the livestream:

Enjoy, and why you’re here, why not:

Subscribe now

Thanks,

Brian

]]>