What follows are some of my favorite training opportunities, news bits, tools/scripts and humorous stories to send you into the weekend with!

Training

• The BHIS Webinar this week on external attacks was good stuff. The YouTube video and slides are up. The key highlights I came away with:

• BHIS has found great success in using infected Powerpoints to trigger shells

• Macro_safe.py - helps turn commands such as Powershell strings into safe text for easy copy/paste. Trims long lines into smaller lines, helps reduce errors, etc.

• BHIS is a big fan of The Backdoor Factory, the goal of which is "to patch executable binaries with user desired shellcode and continue normal execution of the prepatched state."

• There was a free Burp book available for a brief amount of time at Packtpub.com. Thanks @xoke for this link!

• Wanna practice your SQLi skills? Check out this walkthrough from canyoupwn.me. Note: Canyoupwn.me also authors some great vulnhub.com VMs like Kevgir. Another note: Canyoupwn.me is in Turkish, so Google Translate is probably your friend.

• Beef up your Powershell skills with a great cheat sheet from SANS.

General News

• Although it wasn't confirmed whether Hilary Clinton tech team had an Internet-facing printer live on the Internet, it appears to have been configured that way (such as a DNS name of printer.clintonemail.com being created). According to the article, private security researcher Ronald Guilmette had some harsh criticisms about the setup:

“Whoever set up their home network like that was a security idiot, and it’s a dumb thing to do,” Guilmette said. “Not just because any idiot on the Internet can just waste all your toner. Some of these printers have simple vulnerabilities that leave them easy to be hacked into.”

• Twitter's loosening the 140-character chokehold.

• ISIS fanboys intending to strike fear by showing global support for the organization at a meeting this week instead revealed their GPS coordinates according to the article:

Their photos were supposed to instill fear by showing that the group had supporters in major European cities. Instead, the photos were used to geolocate the fanboys, and give tips to local law enforcement officials on how to find them.

Tools/Scripts

• Tired of manually hunting around SMB shares for potentially sensitive information? SMBCrunch might be your new best friend.

• Need to make your phishing campaigns a little more seamless? Check out this good advice on leveraging Facebook and iframes.

Misc/Humor

• Is it pronounced "jif" or "ghif"? This tweet might settle it once and for all.