Got out of my car & walked up to the main lobby. A lot of folks coming and going.
It had a badge reader, man trap, and locked down lobby...
...that hadn’t been locked down yet.
So I walked through. Nodding to folks as I passed.
Went into the office area of the warehouse & looked around. Made sure folks saw me. Became part of the busy flow.
Found the server room. Door propped open. Room crowded with network field techs finishing their cabling. Camera folks setting up the management console.
All of the servers had their IP addresses printed out on labels.
The security camera management console had each IP camera’s IP address on display.
Firewall appliances, vuln scanner appliances, security appliances, all labeled neatly.
Lot of little devices on the wall and in the racks plugged in.
I had a couple Raspberry Pi dropboxes in thise black official cases.
I took them out. Plugged them in. Left.
Walked around the place. Looking at the newly constructed cubical farms.
Seats freshly installed.
Plastic, boxes, styrofoam on the floor.
Found the hot ethernet jacks to the side and plugged in some more RPi dropboxes.
Folks just thought I was an installation tech.
Left the site and checked my listeners. The RPi’s had connected.
I had complete access to that location, of course.
But I also had internal access to the WAN. To the central corporate network in another city.
A flat network.
@tinker this ballardian narration was 👌
@tinker ballardian chronicles of pentesting: when the demise of capitalism intertwines with cyber-security
@tinker Yeah! :)
@whonose123 - Hehehe :)
@tinker Woah, that's really cool! (Also, great job!)
@hummingrain - Thanks!
@tinker you accidentally a whole b&e?
@twitter - Just sort of.... I dunno... slipped in.
@tinker if you had a clipboard, everyone was probably too scared to stop you ;)
@twitter - lol 😆
@tinker
Thanks for sharing. This is an exiting way to learn.
@cwcopa - Cheers! And I’m glad! Hopefully it spurns conversation, online and off!
@tinker
It does!
It is maybe a dumb question, but do you change your appearance for such a test?
appropriate clothes, a Wig or even a fake mustache?
@cwcopa - Not a dumb question at all!
I will often wear clothing that is appropriate to my pretext. Hi-viz safety vests for construction. Button up shirts with jeans for supervisors. Slacks for auditors, etc.
I dont often change my face as my face is common and not noticible. I will change my hair to suit my pretext. Let it grow out or cut it short depending on how much time I have.
New warehouse just finishing construction. A lot of different people there. Electricians, network field techs, physical security engineers, etc.
Drove up to the parking lot to see all manner of different companies and installation techs, coming and going.
While driving up to the site, I noticed the place surrounded by high fences, barbed wire, lots of cameras. It had good coverage. Didn’t see a dead zone.
When this place becomes fully operational, it’s going to be a tough nut to crack.