BHIS Webcasts

Are you reviewing findings or managing chaos?

 🛝 Webcast Slides
https://www.blackhillsinfosec.com/wp-content/uploads/2026/01/SLIDES_Simplify-Pentest-Workflows-Using-Cerno.pdf

✏️ Learn from Chris Traynor with Offensive Tooling for Operators
https://www.antisyphontraining.com/product/offensive-tooling-for-operators-with-chris-traynor/

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits –
https://poweredbybhis.com

If you are a pentester, you have been there. Hundreds of findings. Critical vulns buried in noise. Too many terminal windows, lost context, and manual tracking slowing you down. On offensive work, time is everything, and disorganization wastes it fast.

Join us for a free one-hour webcast with Chris Traynor, Security Consultant at Black Hills Infosec, as he introduces Cerno, a new free and open-source tool designed to bring order to pentest findings.

Cerno is a Terminal User Interface tool that imports vulnerability data for structured review and validation. Navigate findings with keyboard shortcuts, launch tools with a single keystroke, track progress automatically, extract CVEs, look up related exploits, compare findings across hosts, and follow built-in or custom verification workflows.

You'll learn how to use Cerno to organize, review, and validate pentest findings faster, reduce chaos during engagements, and stay efficient under real-world time pressure.

Get familiar with Cerno: https://github.com/ridgebackinfosec/cerno

Chapters
  • (00:00) - Intro – Simplify Pentest Workflows Using Cerno w/ Chris Traynor
  • (06:03) - The Problem
  • (10:55) - The Solution
  • (13:14) - Feature Overview
  • (16:37) - Database-First Design
  • (17:17) - Module Architecture
  • (18:11) - Data Flow
  • (19:02) - Interactive TUI
  • (21:16) - Severity Filtering
  • (22:57) - Finding Review
  • (25:09) - Tool Orchestration - nmap
  • (27:35) - NetExec & Custom Tools
  • (28:45) - NetExec DB [Beta]
  • (30:22) - Host Comparison
  • (32:40) - Session Persistence
  • (34:23) - Configuration
  • (36:22) - Demo Time
  • (57:38) - Getting Started
  • (57:49) - Resources
  • (58:13) - Thank You / Free Labs
  • (59:58) - CTF challenge
  • (01:00:23) - Free Survival Guide - Spearphish General Store
  • (01:00:42) - QA Start
  • (01:10:16) - Taking Care of Business Related Plugs


Chat with your fellow attendees in the BHIS Discord server:
https://discord.gg/bhis
in the #🔴live-chat channel

Creators and Guests

Host
Deb Wigley
Deb Wigley is the Director of Kindness and Generosity for Black Hills Information Security (BHIS). She joined the team in 2019 after celebrating 20 years of working in customer engagement and satisfaction in the Automotive Industry. She brings her passion for helping and serving people to the work she does at BHIS. The part of her role she enjoys the most is interacting with the community through our webcasts and educational content, our Discord servers, and conferences. She loves being a mom to her four kiddos and in her spare time, she enjoys reading, hiking, frequently entertaining a beach day, and being whisked away on rewilding adventures with her husband of 20+ years as much as possible.
Host
Jason Blanchard
Jason Blanchard has been happily adopted into the hacker community at Black Hills Information Security (BHIS) since 2019, even though he “works in marketing.” He’s had every dream job imaginable: teaching filmmaking, owning the world’s most famous comic book store, and fostering the infosec community efforts for SANS. While some at BHIS call him the “Director of Excitement,” he is formally known as the Excitement Co-Creator. In his day-to-day work of “sucking at capitalism,” Jason enjoys helping others, sharing his knowledge, and giving away lots of free stuff. When he’s not working, Jason spends time with his wife and daughter, hosts a semiweekly job-hunting Twitch stream, and enjoys writing short stories and performing stand-up comedy.
Guest
Chris Traynor
Chris Traynor is a Security Consultant at Black Hills Information Security (BHIS), where he is responsible for Pentesting web apps, mobile app, APIs, and networks. He has also authored two cybersecurity classes (Offensive Tooling Foundations and Offensive Tooling for Operators) which he teaches via Antisyphon Training. Chris has nearly two decades of experience in Web/Mobile development, QA automation, and Penetration Testing. He thinks the best part of working at BHIS is being surrounded by some of the best minds in the industry (and getting paid to break stuff). When he’s not hard at work, Chris enjoys adventuring with his wife and daughters, exercising, and walking with his dog.
Guest
Logan Bender
Logan Bender joined Black Hills Information Security (BHIS) as a Business Consultant in September 2021. Previously working as a technology advisor, Logan now advises clients on BHIS’s services and provides recommendations for improving security posture. He is excited to be part of an organization that is so involved in providing quality security content to the community, and he loves the team and helpful culture at BHIS. When he’s not working, Logan can be found in the great outdoors — camping, fishing, hunting, golfing, or snowboarding.

What is BHIS Webcasts?

Podcast audio-only versions of weekly webcasts from Black Hills Information Security

Jason Blanchard:

Hello, everybody. Welcome to today's Black Hills information security webcast. My name is Jason Blanchard. I'm the content community director here at Black Hills, and I'm here to help Chris I'm here to introduce Chris and his new tool, Cerno. It's called Cerno.

Jason Blanchard:

And so here's how these webcasts work. I reach out to all the testers and they're like, hey, is there something that you wanna introduce, something you wanna talk about, something you wanna help people get started in, something that's really cool to you that you wanna introduce to other people? And Chris is like, I make I made a tool. And I was like, you did? He's like, I did, and it does this.

Jason Blanchard:

And I was like, that sounds awesome. Do you wanna do a webcast on it? And he says, I did. I do. So this is the webcast on the new tool that Chris has come up with.

Jason Blanchard:

Also, Chris is a fantastic teacher. He's a great communicator and a fan a fantastic tester. So taking all those things together is what made Cerno what it is today. And so hopefully, this will help you in your career, this will help you on your pen test and this will help you be able to do your work better. Alright.

Jason Blanchard:

So Chris, enjoy. I'll be back for q and a and if you need anything, just let me know.

Chris Traynor:

Thank you, Jason. Thank you so much. Thank you, Ryan. Thank you everybody else who joined pre show banter, either from Black Hills or virtually from anywhere else. So, as Jason said, my name is Chris Trainer.

Chris Traynor:

I am a pen tester at Black Hills Information Security. I also teach a couple classes. I'll mention those a little bit later on and stuff. But here today, what we're here to talk about is tool that I created. It it kinda evolved over the last couple years, but over in the last maybe three, four months, it's really kind of really exponentially gotten a whole lot better and a lot more useful.

Chris Traynor:

So I thought that I would start putting it in one of my classes and I did for the first time to a small group in Deadwood at Wild West Hackenfest. I put this tool into the class. It's gone through a lot of changes since then. I also had this tool, gave it out to the testers at Black Hills Information Security internally, and and kinda said, hey, use this, tell me what you think. Is it terrible?

Chris Traynor:

Is it not terrible? Give me some ideas of how to build it up and get it better. And the feedback was was positive. I don't think I got anybody that said, hey, this is is horrible. So that brings me here.

Chris Traynor:

Jason, as he said, I I wanted to do a webcast on this, and share it out kinda more broadly, get some more eyes on it, maybe people come up with more ideas to make it better. But let's get started. So I'll go through a few slides here, not too many, just to make sure that we have something that can then get dropped into into LinkedIn or into the Zoom chat or into the Discord for a slide deck for people to be able to actually go through and sort of understand what the tool does. But we should have some time towards the end that I I have a bit of a demo of the tool kind of roughly prepared that we can walk through and hopefully the demo gods are are kind to me. I I opted not to sacrifice my firstborn on the altar of the demo gods this morning, so let's hope that they're not upset with me.

Chris Traynor:

So getting right into things here, as I just said, Chris Trainor, work at BHIS here. I I also have my own company, Ridgeback Infosec, that exists purely to just help me do tax expenses and deductions for the couple classes that I teach to help bring this to everybody. Both classes around offensive tooling. This this tool here, Cerno, is featured in the two day class of offensive tooling for operators, and I'll mention that a little bit more towards the end as we finish things up if anybody is interested. So Cerno, first off, for a name sake, everybody kinda wondering what Cerno is named, and this tool did go by another name not more than a month or two ago, and I decided to rename it because it outlived its initial purpose and started to grow beyond.

Chris Traynor:

So Cerno actually comes from the a Latin word, which means to discern or to sift through or to try to make a make sense of something. Right? It it has like as most Latin words do, it has like six different actual translations and meanings, but the the main idea of it is to try to take a whole lot of information and distill it down into something that is actionable and makes sense. So that's where the name Cerno kinda comes from. It's an open source.

Chris Traynor:

It's out there on GitHub. There's a little GitHub link right there under my ridgebackinfosecorg page, organization on GitHub. It's a open source TUI, so a terminal u UI tool entirely going in and out of the terminal for this thing. It should work on Windows. It definitely works on Linux.

Chris Traynor:

So I can I can say that with with certainty? And it's a it's a Nessus review assisting tool, but it does a lot more than that. It starts to go beyond with orchestrating some of the security tools that you'll that you'll execute commonly in network pen tests. And this is really where I started developing this thing myself, taking borrowing ideas from other organizations, from other testers, the type of tools and scripts that were out there doing some of this, and kinda putting them together in a more sensible way for how I do my workflow and how we do things here at at BHIS as well. So the first thing with any any tool and anything that you really want to work with or or put this extra time in your evenings or over your lunch breaks as as I've done over the last several months is you actually have to have a a problem to solve.

Chris Traynor:

Right? So why are you making a thing? Why should you care about this thing? Why should you try to use this thing? So most organizations do a Nessus vulnerability scan of their networks internally and externally.

Chris Traynor:

And certainly with every single network penetration test that BHIS performs, one of the very first things that we do in testing is we set up a Nessence vulnerability scan, we give it the whole scope of the engagement and we have it run the evening before. That way for day one of actual testing, we have the results in our hands able to be actionable and figure some things out for us to help guide us a little bit through the path. Now, I wanna be perfectly clear. Nessus Vulnerability Scanner does a lot of really cool things and it does a lot of things really really well. But it doesn't do so well for pen testers, for people doing remediation at organizations, for managers or supervisors.

Chris Traynor:

It doesn't do a great job to kind of go through what was discovered in those Nessus scans and make them into actionable things for a pen test. Whether for, again, for verification or exploitation or for remediation and tracking if things are getting better, things are getting worse in a in a very very quick way. Now, why why this matters? I got a couple screenshots in these slides here too. This is what you sort of see in Nessus, right?

Chris Traynor:

Is you wind up with this report that comes out of all these hundreds or thousands of findings kind of all all mixed together, listed out. There's there's accounts, there's criticals, there's there's finding families and there's all sorts of CVEs and it's all mess. Going through it in the Nessus UI can be tricky. There's not really a good way to kinda like mark this thing as, yeah, I've checked this, it's remediated or yeah, this is valid or this is not valid. There there's a weird feature in there that lets you do sort of that.

Chris Traynor:

You can hide a finding for a little bit, but it kinda comes back. The other image over here is you can take your Nessus vulnerability results and you could export those into a giant HTML file, and then it's just a huge HTML that you would open up a million tabs and kinda check each finding and then close the tab when you're done. This is a way that that a lot of testers wind up going through Nessus results. It's a way for you to kinda say, these are the things I wanna look at. Each one has its own its own tab and now I have to go through.

Chris Traynor:

The trouble with that is the way that Nessus presents the affected host of any given finding is pretty much how this screenshot on the right looks. Right? Here's the output of this plugin of this plugin. Here is the affected host. Here is the out the output for that affected host for this particular finding and this can appear in different ways for every single type of finding.

Chris Traynor:

So if you're looking at these results and you wanna verify say 20 different systems have this issue, you're going through and trying to pull out each one of those host names or pull out each one of those IP addresses, put them into a file off the side and then you're gonna put that file as input target list to your tools. It's a lot of extra manual work. Now, there's no shortage of of scripts and tools out there that will parse through a Nessus export file, which you can have exported again in HTML or in the XML format called a dot Nessus file. And there's plenty of tools out there that will take that stuff and parse through it and give you affected host list and and mash those things out. And really, that's a lot of where this tool started from, is you waste a lot of time on engagements where for network pen test, just trying to organize one tool's information to be actionable for another tool to use it, and get you another step down the line in your engagement closer to exploitation, weeding out the false positives, and trying to actually provide value to your organization or to your customer that you're performing this for.

Chris Traynor:

So this can be a very time consuming process. Anybody who's been a pen tester, especially as a third party pen tester, you know that the hardest thing to do on a test isn't normally exploitation. The hardest thing for a test is you only have x amount of days. Right? For typical internal network pen test, you might have only five days to do this work.

Chris Traynor:

It's a lot to get done in that time. So any tool, and I get this question asked in both of my offensive tooling classes, Students will ask, which one of all these tools that you're talking about is your favorite? And I say, my favorite tool is the one that saves me time. The one that automates or helps me move through the mundane tasks so I can start doing the cool stuff faster and more reliably. And that's what we're trying to solve here for this for this tool.

Chris Traynor:

So our solution here is the creation of this of this Cerno tool. Yes. It's pronounced Cerno as a as a hard c h or or hard k sound. Actually, if you go to the the GitHub page for the tool, I have a little link that gives you a a audible phonetic voicing of it because I had some tripping of it as well. So it's meant to make everything faster to review these results.

Chris Traynor:

What you do with Kernel is you your starting point is doing a dot Nessus export, that XML file from Nessus, and then you import that into this tool. So I talk a lot in my classes around a offensive tooling ecosystem. Alright. A lot of tools have the capability of importing the the output of another tool and then using that as a starting point, that's nothing new. But that environment of making sure that you can work with other tools quickly is very quickly becoming something that if your tool can't do it, it's not something that's valuable.

Chris Traynor:

Right? So it's what we aim to do here is that we're gonna take a dot nessus file, we're gonna import that into our kernel tool, which is actually gonna be a SQL like database back end. And then you're gonna go start up a a interactive TUI interface in your terminal, and then it's all gonna be keyboard navigation from there. So this is gonna help us get through all order our our affected systems, our findings from Nessus, and then it's gonna start porting things in to a handful of initial tools. Now, I'll be clear about this.

Chris Traynor:

This is this tool is very much under the active development. If you're if you watch the git history of this tool, whenever there's a lot of commits in a short period of time, that's usually when I'm doing a network pen test and I'm using this tool and I'm realizing new things to do. So it's starting out with just a handful of tools that it's gonna drive these things into, these findings, these affected hosts and get you online, but there's a lot more in the pipeline to get plugged in as well. It also allows you some persistent session tracking as you go through these and do some cross scan analysis and host tracking as well, which I'll show a lot of these demos as we get as we get through this to the second half of the webcast. Now some of the big capabilities and these are now screenshots pulled from the tool, for most of this stuff, some of the big features that that this does is that is a color coded review of these findings.

Chris Traynor:

Right? So you can see here in the in the screenshot, you've got severities, the exact plug in ID, naming, and host. Nothing crazy, nothing weirdly specific or or game changing. This is type of information that you would see from Nessus, but we're just putting it in front of us here because what we're gonna try to do is try to focus our efforts a lot more strategically during our little bit of time. So you'll have a view like this in a normal terminal as you start reviewing an actual report, an actual export and and start plugging things in.

Chris Traynor:

Now, as you move through these tools and there'll be few there'll be screenshots coming up for this and as I demo, you're gonna get a quick ability to extract any any relevant CVEs, you're gonna get a quick ability to be automatically notified if there is a Metasploit module for these findings and it's gonna give you the ability within the tool itself to search for those modules and then give you the information about those modules of Metasploit right there without ever having to leave the Cerno interface. It also has something that I just added maybe like a week or so ago. It has the ability to directly query the NetExec database for relevant contextual information as you work through your findings. So as you use NetExec as well, another great network pen testing tool to do different activities, it will start highlighting as you review the findings that, hey, there's this finding you're looking at, but by the way, there's all this information in the NetExec database you might wanna also look at that can help you along and make this benign finding something you might actually be able to do something with. Now I mentioned in the title of this workflows.

Chris Traynor:

This is where I really really love this tool and it's gonna be expanding a lot more in the next couple months. I baked in some default workflows into this tool so that if your scan has certain findings, there are workflows pre built out and it will tell you ones that have workflows for it as you review and then you can view those workflows. Those can be anything from simple verification steps with explanations and links and reference guides to actual full exploitation walk throughs being shown out to you. Another great thing for the mappings is Jason mentioned in in earlier in the in the webcast and pre show banter that we don't like to keep secret sauce ourselves for BHIS, but you as an organization, as a pen tester might. Right?

Chris Traynor:

So this has the ability for you to create your own YAML file in the workflow mapping format and you can provide your mappings for these particular findings and your secret sauce steps as a as an input to enhance the workflow mappings of the tool. Now, you can do that as it'll add to the default workflows and put them in the same list or it will actually you can specify to show only your custom workflows, so either way. As I mentioned, there's a SQL SQLite database in the back end that gets created on it. Here's a snapshot of how the tables look as of a couple days ago. Only reason I'm showing this up here for you now is this is just how we store data.

Chris Traynor:

Once you've imported your dot nss file into Kernel, everything happens in this database. You're not manipulating your dot nss file. Everything's in this database and we only extract the information from that XML file that we needed to be actionable. This provides a lot of a lot of power for us to be able to do some cross scan analysis and do some filtering stuff really, really, really quickly that you otherwise would would have to be doing a lot of manual work and a lot of scraping to do. If you go to the GitHub page, this is a Python tool.

Chris Traynor:

It's just how I started it, it's how it works but there's a lot of modules in there. So as I mentioned, this is very much an active development type of phase. I'm adding things all the time to this tool as I get input from other testers, as I run across certain scenarios. If you are one of those people who likes to contribute to open source tools, pull this down, submit pull requests, I'm gonna be reviewing them as best I can, as quickly as I can. I already had a couple come in from the class that I taught and from other people that that had some some really good ideas, and a couple one or two of them were were actual pull requests to fix a few things.

Chris Traynor:

But it's a very modular build out of a Python project. You should be able to find the very specific minute area you need to change fairly quickly. As I mentioned, the the the data flow for for Cerno is just from Nessus into to verified findings. So you're importing the dot Nessus file, you'll do the review of these things, everything has a rich table format or a rich presentation, so there's lots of pretty colors, good organization of the table structure. The reason why I put a lot of effort into these color schemings and and table structure that you'll see in the tool is because a lot of times in pen testing, especially BHIS, our screenshots and our evidence is what makes the report actionable.

Chris Traynor:

Right? So I wanted a lot of this information, lot of the that's being presented to you in the TUI, the things that I will directly screenshot and put into my reports because it organizes the information in a much more consumable format for my customer and a more actionable format for me. Now, one of the things you do when you start actually reviewing things is it'll show once you once you've imported rather, I'll go back here for a second, it'll give you a breakdown of the severities. So you always know how many things you have going in that you need to look at, how many total findings, and then breakdown of each severity individually. When you start reviewing the tool, you do Kernel review.

Chris Traynor:

Now, you're in an interactive TUI for the first time of the whole tool. Right? So you've imported things and now you're jumping in. As soon as you start it up and you select a scan, you're gonna get a scan overview of what you're what you got going on. It'll give you very high level stuff.

Chris Traynor:

One of the things that we put in our reports is you may have given me 1,500 targets, 912 of those were actually responsive. So I got 912 unique hosts right front and center for me. I have a total count of the findings at the top and I have a percentage mark of how far along in the review process I've gotten for these tools. I also have a little little bit of information about the top the top five ports that occurred in your in your environment from the scan, just as a as a little supplemental information. Some people are kind of surprised that they wind up having an SSH port open on hundreds of systems in their environment, and sometimes this information can kind of help.

Chris Traynor:

Now, we're gonna test this this a little bit when we get to the demo, because I increased the font size of my terminal a bunch because we realized that people watch these on their phones, so we wanna make sure we can see it. But the terminal width and the display of information should be fairly responsive and adapt to the width of your terminal. So if you're somebody that likes to have a terminal across your whole screen, it's gonna show you a lot of information horizontally. If you start to get a much smaller terminal depending on where you work from, it should still adapt fairly well and show you the information. I had some people ask me before about why did you stop at a TUI?

Chris Traynor:

Why not make this something that has a front end to it? Well, main reason is when we get on an internal network pen test, I'll be running this tool from the device inside of the internal network. A lot of times, I don't have a UI, I just have my terminal view. So this provides a nice clean way to to execute things without having to rely on having a front end. One of the good things that you can do as you start up and you get into your into your view of your actual findings, is you've selected a scan, this is the next thing it's gonna show you.

Chris Traynor:

Here's your counts of your severities, here's your unreviewed count, your percentages, showing you how far you've gone along in different things. Now one of the good things about this starting point is that you have the capability to dive into single severities, so if you just wanna look at the criticals, just enter one and you're looking at the criticals. If you wanna look at everything from critical to medium all at once, you can just do one dash three and that's gonna select all of the the index number one to three on there and show you all of those in the next screen. But down below, you'll see the two special filters that are kinda built in. One is for Metasploit modules.

Chris Traynor:

If there's a Metasploit module known for that particular finding, if you put m as your selection, it's gonna show you only those findings that have a Metasploit module. Now, the two things that I do first and foremost on Nessus review is I look for Metasploit modules, those quick wins especially on internal networks, those quick things that we can say this definitely exists whether that's by a check or a full exploitation using that module or I go into the critical list. So Metasploit modules, critical list things, you should hit those first in your view. The next thing down below there in special filters is workflow mapped. If you do a w, it's gonna show you only the findings that are mapped to one of those workflows in the either the default YAML file that I provide with the tool or with the custom mappings that you've provided.

Chris Traynor:

Do you have a way to kinda hone in on exactly what you're looking for? So what does this look like when you're reviewing a finding actually, right? So we have here an example finding in the screenshot of SMP agent default community name, right? So you go into You select the severity, you have a whole list of your findings, you select one of those to focus in on, this is the type of information you'll get. Very clear plug in ID for it, whether or not What the severity is, how many unique hosts there are, and an example of one of those hosts for you so that you see at least one of them and it'll give you a a readout of how many ports for this particular finding are in there.

Chris Traynor:

Now, if you have a finding that that has CVE information to it, you can see that here for this particular finding. If you wanna see Nessus specific output details like you have when you're reviewing it in the HTML file or in Nessus itself, you hit d and it's gonna print out in a paginated view the details for that finding for you to go through. Now here's the really cool thing, if it has a workflow mapped to that particular finding, it's gonna state that for you right at the bottom of this title box of the finding. Alright? And then you can click w.

Chris Traynor:

This w workflow will appear if you have a workflow mapped and then it's gonna look something like this. Don't judge on the exact context of that of that screenshot, the workflows are are being built out and they're being polished, so some information is more relevant than others. But this will tell you, right? So if you get an SMP default community strings, you should try one, verifying that it's actually there, checking that SMP information with an n map command, and then you can go on to specifically brute forcing SMP with that step two laid out for you. And then step three, there's actually an SMP login module for for Metasploit that while that module is not mapped to this specific finding because it's not something that Nessus says, oh, this is a CVE and it has a Metasploit module listed with it, so let me associate those, and we get that benefit of that when we import.

Chris Traynor:

This allows us from a workflow perspective to say, there are other Metasploit modules that could be used for this information. So you'd get something like this for for workflow mapping. Now, next up, we get into tool orchestration within the findings. Right? So tool orchestration right now, we do we have n map, net exec, Metasploit, and then we have a custom tool orchestration as well, which I'll show that more in the demo.

Chris Traynor:

But we can jump straight in from the same findings review of that exact finding, we can say, hey, I wanna scan this with an app because I wanna make sure that it's actually saying what it's supposed to be saying. So you'll select t to run a tool and then you'll have a list of the tools to select from. If you choose nMap to run, there's gonna be an nMap configuration screen where you can do you can select from any number of nMap NSE profiles that I've kind of bundled together. You can you can specify individual NSE scripts that you'd want to run and you can also select whether or not you wanna do UDP scanning or not. So by default, UDP scanning is is not enabled.

Chris Traynor:

Once you've kind of settled on your configuration of your nMAP scan a little bit, this is the next thing you'll see. A review of the command that's been built out for you by Kernel. It's gonna tell you you're using nMAP, you have 37 targets, the output of your of your tool execution is gonna be stored in this directory right here and then it's gonna show you the exact command that it's gonna run. Now I've highlighted in a portion of that command because that dash I l is where a lot of the time saving comes into play that I mentioned at the beginning of the webcast. So dash I l and that temporary file that's created, that's your target list.

Chris Traynor:

So no longer do you have to parse through the the end map affected hosts, put those affected hosts in a in a individual file and then pass that file to your tool. So none of that building has to happen. Kernel did all that for you. Another reason I give you the command right here is because you notice there's a copy to clipboard option as well. So you can either run it right now or just copy it to clipboard.

Chris Traynor:

Within BHIS reports, every time we run a tool every time we run a tool, we put that command in the report of the methodology so that anybody receiving those reports can also rerun that same command and determine whether or not they've made any remediation progress. Next thing up here is you can use NetExec or custom tools or other op or the a couple other options as well as Metasploit. So here is an issue for Metasploit. We had a finding that had a Metasploit module that was available for that particular vulnerability that the finding was checking for. And if you select tool and select Metasploit, what you're gonna get is it's gonna pull out search commands and then it's gonna pre build out one liner MSF console commands that you can then select and have Kernel run-in the same TUI and give you the output.

Chris Traynor:

And that's gonna show you so Mike here searching for a particular Metasploit module and then the output of that is going to give you a little more information that I'll show in the demo as well where you can then print out the information specifically for that module. And NetExec will help you build out for any number of the NetExec protocols, same idea as Nmap, gives you a Net Execution Summary, the exact command and to run it. And when you're done running these things, you'll get you'll get a a listing and a neatly organized table of where your output went to. This NetExec additional beta feature that again I just put in about a week or two ago is if you have a tool or you have a finding, you run NetExec, anybody who's using NetExec knows that you have the NXC DB, the NetExec database that it populates. So anything that you're running with NetExec, anything it's discovering with NetExec that's of worth, it drops it into the NetExec database.

Chris Traynor:

So what I've done with Kernel is I in the back end, anytime you pull up a finding and you look at that findings info, if there's an anything in the NetExec database that is related to the affected hosts of that finding, it's gonna highlight that information for you here. You don't have to run anything additional. You don't have to do anything else, the Kernel tool is not exporting that information from NetExec, it's directly querying it behind the scenes to give you the latest information every time you get to a finding and view its information. So here we have an example of NetExec context that it's calling out of the hosts of this finding and of and this finding had two hosts. There were two credentials that were found to be valid for for those targets with NetExec and one of those hosts happens to be a a admin actually, I believe.

Chris Traynor:

And it's gonna show you the flags of SMB being disabled and SMB version one affecting how many hosts. Right? And then you can go to a per host breakdown of that net exec data which can be shown later. Now this is all great and grand and everything giving us information on individual findings, but one of the big difficulties that we have for going through a Nessus scan is there's just so much. Right?

Chris Traynor:

And I'm sure there's plenty of time in here or plenty of people in here that that can attest to you did a Nessus scan and Nessus said, hey, there's 400 things related to Apache. Right? And here, some of them have five affected hosts, some of them have two affected hosts, 60 of or 16 of them have four affected hosts and there's some combination of these things. Well, it's real hard to check every individual system all over time marking each individual finding as reviewed. So what I've done here with Karno is give you two options.

Chris Traynor:

When you're looking at the findings list, after you've selected a severity to focus on or a range of severities, you can do a host comparison, which is this one right here on the right. It's gonna take all of the other findings you currently have shown and it's going to group those and allow you to focus on a group of ones that have identical host and port combinations. So you can filter by Apache, see only the Apache findings and then you can say, show me the ones that are identical. So here in this example, there are 14 findings for this scan that have the same exact host and port affected groups, which means that they're the same systems. So why would you check them 14 times for something you could do at once?

Chris Traynor:

Focus on one group, verify the information and the versions and everything for that finding one time, and then mark the whole group as reviewed. Also over here is overlapping findings. So another idea is to say I have a whole bunch of findings, one of them has 14 affected hosts and then all the other ones have some combination of two or three or or a few have six affected hosts. What the overlapping findings is gonna highlight ones that say this one finding encompasses all of the hosts and port combinations of this subset, this batch. So you can focus on an overlapping finding analysis as well to kinda speed up your verification a bit.

Chris Traynor:

Only a couple more slides and then we're gonna get right into the demo and hopefully again the demo gods look favorably upon me. One of the big things that we wind up having in a pen test is let's say that you were doing this manually and you were going through Nessus or you were going through the HTML HTML export of of the Nessus findings and oopsie, your chart your computer shuts down, gets an update overnight, your implant on the internal network got bounced by by the organization and now you've lost your progress. You don't know what 15 tabs you had open looking at stuff before and that kinda sucks, alright? So with that SQLite database on the back end of Kernel, it's tracking your reviewed and unreviewed state, You can back out of the review of a scan, go into a different scan and review that, and then back out. And as you come back into it, it will tell you how long ago you last reviewed that scan, and then as you jump in, it's gonna give you your percentages of how complete you are with all of these different severities and these special filters.

Chris Traynor:

So you'll never lose progress, you'll always be moving forward in your review process, focusing on one thing at a time or batches of related things at a time and actually being able to to feel like you're making some progress in your pen test. You could also have the ability to view all of the review complete findings and then you can selectively flip those back to an unreviewed state or or mark them all back as not reviewed anymore if you need if you accidentally mark something reviewed, you can always undo that easily enough. Now, one of This is the last slide before we get to a bit of the demo for the last twenty something minutes of the of the webcast here. Something else I built into this is I realized that some people have I forget what the statistic is. Somebody told it to me a long time ago, is that some high Obviously, this is this is a fairly male dominated field for now and there's a high percentage of of men out there who have some degree of visual difficulty.

Chris Traynor:

Right? They have they have a bit of a visual impairment. They can't tell blues from blacks, they have difficulty seeing grays on any on certain gradients of a background. So I went through the trouble of putting in a configuration table that is automatically managed for you with with Kernel. It's managed with a YAML file but you can adjust it through the terminal yourself by a series of config commands that I'll show you.

Chris Traynor:

And you can do certain things like, I want to disable all the coloring. I don't like seeing all these fancy colors that Chris painstakingly put in all over the tool, I want just black and white. Just black and white, please don't complicate my terminal for me. You can disable the colors, so it's just black and white. You can do things like if you do have a custom workflow mapping in a YAML file that you always wanna load up, a lot of places can they'll have like an internal GitLab and they can just maintain a constant YAML file that everybody's contributing to.

Chris Traynor:

If you pull that down onto your testing machine, you can set this custom workflow path here in the config file and then you don't have to pass it as an argument in when you run the review command. It's it's all right here. And you can kinda there's a whole bunch in there. There's a lot of documentation about this out on GitHub or the read me page, so you can you can kinda explore that way. Demo time.

Chris Traynor:

Everybody put your hands together, pray up and down to the demo gods and hope that we have a good showing here. I'm just gonna start up a couple target machines before I switch over to a virtual machine here. And I saw some mentions in the chat there of Game of Thrones references, Yes. Because in my two day class, we actually use a game of Active Directory, I think somebody already shared the link in the chat as well, as a as target systems. So that's why you're seeing some references there.

Chris Traynor:

Alright. Let me should be switched over now to the to my virtual machine. Okay. Now, I increased the font here to to make sure that everybody can see this if you're viewing it from a a phone or tablet, small device, but hopefully this will help you through. I we're really gonna test the responsiveness because usually I have, I have this much smaller font.

Chris Traynor:

So we're gonna see how this plays out live. So first thing that we're gonna wind up doing is we I've already have this environment preceded with a few demo Nessus files imported into Kernel, we're not gonna show the import importing action or actually we we can show that quickly. I think we got time. So currently, Cerno is on version one dot two dot 22. It's had a a number of very small iterations and changes and improvements again over the last few the last few months.

Chris Traynor:

A simple run up of Kernel help will give you this bit of information. I only show the help command here because I will absolutely encourage you all to do one of the first things you do with Kernel after install installing it is to install the completion possibilities so that you can just do tab complete for any of these commands that are listed down below. So we have five main command groups. You do Kernel review, Kernel import, Kernel scan, Kernel config, and Kernel workflow. I'll show what each one of those kinda look like here for just a minute, and then we'll look at actual, reviews.

Chris Traynor:

So kernel review is gonna allow you to do a handful of options. So you can do a no tools option where you're never gonna execute a tool, you just wanna look the commands themselves. So a quick question in the chat there, can I do a bulk Nessus file input import? No, it cannot. Not right now, but here's what I'm gonna ask you to do because I have thought about that and so I don't forget.

Chris Traynor:

Go to the issues page in the repo, put that in as a requested feature because that is something that I do wanna I do wanna try to add in there. I mentioned custom workflows in the config, you can also do a dash dash custom workflows and give a file location for your custom YAML file. You have the option to disregard, although I'll be a little bit hurt, disregard my default workflows that I provide for you and only show your own workflows if you like to just see that. Another thing down there is check. This will actually run-in every time you run Kernel review, it'll do this little check beforehand where it's going to check that it can load the eight default workflows or as I add more, it'll be more And what it's gonna do is it's going to check your tool availability.

Chris Traynor:

So it's gonna do is every time you run the workflow run the review cycle, it's gonna check your end map is there and available, net exec is there, Metasploit is there and whether or not custom commands is there which is, of course, always available. Now where you'll be starting out from is the import command. It's very straightforward. You just do kernel import and you give it the Nessus file. That's it.

Chris Traynor:

And hopefully soon in the future there'll be a bulk Nessus file import that we'll be supporting. Something that you can something that you can do as well before jumping into the review cycle is there's a list of subset commands for the Cerno scan command. You can list your scans, you can delete individual scans if you if you wanna get rid of them and reimport them and start from scratch, you can do that. You can do a comparison of your scans. So let's say that you have a Nessus vulnerability scan that you run on the first of every month for your entire internal network.

Chris Traynor:

You can take it, load every one of these Nessus scans up and then you can say compare this scan to this scan, always putting your baseline scan as the first one and then you can also hone in on show me the scan history for a specific vulnerability. So I'll show a couple examples here real quick. So scan list, you can list out all your scans in the current state of how many are reviewed, when they are last reviewed, the different breakdowns of of the severities. Let's say real quick that I wanted to actually delete the full GAN, full GOAD scan, it's gonna give you a little prompt here just to make sure. It's gonna ask you to please confirm by typing in that new command or that scan's name.

Chris Traynor:

And then we're gonna quickly reimport that scan just to show that you are that you're in there. Now, I did include in the repo, if you dig down deep enough, there is the full basic unauthenticated Nessus scan results for the for the full game of Active Directory environment is included in the repo. So you can see that for training and testing purposes, just so you have something to jump into and I have those here as well. So we're gonna import the scan, it's gonna give you a little ticker that went by real fast, show you some of the information here at a high level that it successfully imported that into a database, and then I give you two two follow-up options. So back to the idea of the tooling ecosystem.

Chris Traynor:

The Nessus file, dot Nessus file can be used in a bunch of things. So I actually wrote a cheat sheet for Red Siege's great folks over at Red Siege maintaining the iWitness tool. You can use that same dot nessus file with either iWitness or GoWitness or any number of tools. So I give you sample commands here that you can use with the direct path for the dot nessus file you already used. So you can just take those, run them again and then you have those tools results as well.

Chris Traynor:

Somebody can probably find that cheat sheet. I mentioned the compare capability briefly. So comparing one scan to the other. This is what this will look like if you were to run it. So again, the the zoom makes it a little bit difficult to get all this information at once.

Chris Traynor:

Comparing the scans, how many resolved findings from the first scan to the next to the second listed scan? How many persistent findings were unresolved? How many new hosts from that first scan to the second scan and what those might be, how many persistent hosts, how many got removed, as well as how the new findings that appeared in your new scan, Right? So you had hand one high new vulnerability that popped up affecting five hosts, a handful of mediums, a bunch of info ones, and then the exact one for a resolved finding comparing those two. Now you can also pass a severity level to focus only on saying what's the difference in just critical findings.

Chris Traynor:

Just from a high level helps organizations know if they are if they are making progress with their remediation efforts. Oh, forgot to hit copy. So if you do scan histories here, you can provide a specific IP address from your scans and it's gonna tell you scan timeline. Right? Where did this scan appear, what kind of vulnerabilities it had, findings had for each of your scans in your database and show you that there's a trend of it's getting worse, there's more vulnerabilities from one scan to the next.

Chris Traynor:

I mentioned the configuration option. If you did I gotta get better at copying, hitting the copy button before I move back over to my terminal. I'll just try typing. Config and show. This is gonna show that same table and you can do a config set, give it the key and give it the new value for yourself.

Chris Traynor:

You might be wondering, well, what are these workflows that Chris talked about that are baked into the tool? You do kernel workflow list and it'll give you a neat formatted table of which exact Nessus plug in IDs have workflows, kinda detailed out for themselves and built out. Again, these workflows are in the repo. If you wanna add to them, do pull requests for them, add new commands, add additional references or context, I encourage you to do so. It's open source.

Chris Traynor:

Submit the PR and I'll review it. It'll show you a workflow name and then a brief description of what that is. So we have eight to start out with. Now, you guys have hung with me for a long time here, so let's get into a bit of reviewing to see how it works. A little call out right there on the review as you start out, gives you the version number, gives you a neat little link, this will bring you to to my LLC's page that lists my two training classes and all of the upcoming trainings and everything I got going on.

Chris Traynor:

So now we're in a review, let's jump in and let's look at the demo scan. So you have your list of your possible scans to review. They've never been reviewed. Let's jump through them quickly here. The first thing that happens, need more ASCII art at the startup.

Chris Traynor:

Yes. So I tried to do ASCII art at the startup and everything that happened and it and I came up with looked terrible. So I'm coming up with some sort of logo or something like that icon for the tool that I can make as ASCII art. So once you select a scan, you're gonna be shown the total findings, how far you are in the reviewed process of all that and those bits of information. The first time you review any scan, so it's never been looked at before, You may have not used this tool for a while and have forgotten all the wonderful things I've talked about here.

Chris Traynor:

So I gave you a getting started with this scan helpful thing that'll appear only the first time you view any scan. Again, the amount of plugins, findings, that's kind of repetitive information that I need to clean up. The recommended workflow, start out with the criticals and highs. Right? Don't forget to mark your reviews at mark your findings as reviewed, run your verification and exploitation tools.

Chris Traynor:

You can always look for duplicate hosts and see your reviewed findings. Also, if your scan happens to have any critical findings, a neat little colored tips thing here is that, hey, this one has 47 critical findings, we'll look at those things first. And oh, by the way, eight findings in the scan already have Metasploit modules mapped, take a look at them. You can either hit enter to continue question mark for more tips and that'll give you some of the shortcuts and information as well. And now we're into our review severity issues.

Chris Traynor:

Like I said, you can you can select a range if we wanted to see all critical to mediums at once. It's gonna show you this. It's a paginated view that automatically adapts to the height and width of your terminal. So here we have 31 pages that you can hit n for next page, p for previous and jump through things a little bit. Hit n too much.

Chris Traynor:

And as it jumps through, it's gonna iterate those pages and this bar here because it's thirty thirty one, it's not really showing it, but if you got halfway through it, kinda highlight that far. Now let's say we have we're looking at right here, all critical high and medium findings. Like a lot of people have, we can we can go back. If we jumped and selected just the Metasploit ones, it's gonna filter and only show the Metasploit ones. If I go back again with b, my keyboard is being silly for the demo gods.

Chris Traynor:

I can hit w to only show me findings grouped by the workflows that they are applicable to, so I can see SMB not required is one of those and I can dive just into the ones that have workflows tied to or plug ins that have tied to that. What I can also do here is let's see, I go to one, three critical to high findings. I wanna see I wanna filter with the f key stroke. I wanna filter for only Apache. 24 total Apache related vulnerabilities, multiple vulnerabilities, overlapping things, three pages of them.

Chris Traynor:

These are things that are that are great for us to say, let me see a host comparison of them. I have I have 24 total of these findings, but I'm fairly certain if I do the h host compare, yep, 14 of those findings share the exact same host and port combinations. All these findings are related to the same machine, 14 of them out of 24. So I can either press d to get full group details or hit enter to be able to select a group, which of course my keyboard again wanted to act up on me there. One enter, you do g one for your group selection and it's jumping all around for me again.

Chris Traynor:

So it's with group one now, identical host and port combinations. There are 14 being shown. So now you can look at any one of these. They all have the same number of hosts affected because they're all they're all identical to each other. You can look at any one of those and and review the individual finding which we'll get to.

Chris Traynor:

We're running low on time but I'm a blow through a few things here. You have a bunch of vulnerabilities in your filtered list to review. I wanna see all of the CVEs for these. Hit e. It tells you there are 30 unique CVEs spread across 13 of those findings.

Chris Traynor:

You can view those in a separated by finding list or a combined total list for all unique vulnerabilities. I hit s and it's gonna show you a list of those by each one of them that you can copy in and paste in to your report. Again, making things faster and easier for us. I'm gonna jump into one of these and I'm just gonna mark it as reviewed with that m. We'll show some other things here in a second.

Chris Traynor:

But I see the vulnerability there, I can view the different hosts, show me some show me some hosts, I can change the format of those hosts to where it's not formatted where it's name, where it's IP address and the port's affected. I just wanna see the hosts only. It's gonna just show you the affected host with no port information. You can copy it to clipboard or not. You can see the exact details of things or not.

Chris Traynor:

These are the details showing the actual Nessus output of that plugin and you can page through those things, next page, back page, next page, previous page and back and so on. At any point, I can hit I to see the finding info again and you can review tools if you want. If you wanna see the CVEs for just this finding, hit e, you'll see the CVEs listed out. Now, I'm gonna pull up a one finding and I'm gonna mark it as reviewed. Now my count is down from 14 to 13.

Chris Traynor:

I'm still in my filtered list but let's say I verified that it was the service inversion so I don't need to verify again for 13 more. Let me hit m. Mark all these 13 findings as reviewed. It's gonna say it again for you. Are you sure?

Chris Traynor:

Yes. Now all 13 of those findings are reviewed. If I was to go back, now I see my severities, my percentage of my reviews have gone up. You can also view in each one of those findings the ones that have been fully reviewed and mark those as I wanna flip that back to an unreviewed status and do that. We're gonna show real quick one example of the Metasploit flow.

Chris Traynor:

So these are only the Metasploit ones for that scan. I'm gonna say number four, show me finding number four. See, it gives us a little lightning mark here to let you know there is in fact Metasploit stuff there so you should pay attention to it. There's a map module. We'll select tools, Metasploit, here's available commands.

Chris Traynor:

Let's run that first one. Here's what it'll actually execute. Hit yes. It's gonna search for that one line MSF console to show you a search for all of those different Metasploit modules that might match that search for you. It's gonna take a minute and it's gonna show you that Metasploit style output.

Chris Traynor:

Now if you wanted to see more information about any one of these modules without having to leave the Kernel TUI, highlight, copy the name, provide it here, hit enter, and then run. Now and then another confirmation. I need to clean that flow up a little bit. It's going to run a one line MSF console to get you the information for all of the of of that specific Metasploit module right here without ever having to leave Kernel. Now, this tool stops.

Chris Traynor:

It is not an auto prone tool. This is meant to help you get information and move along more quickly. This is the output that you can then screenshot for your reports, your actual options, things like that, all things that I I put in my reports. Now, let's back out of this for a second. I'm gonna go back.

Chris Traynor:

We got we got three four minutes. I'm gonna go back real quick. We're gonna see if we can do this people. All the way back. All the way back.

Chris Traynor:

We're gonna choose a different scan. I have my game of active directory running here, my fan is blowing real hard on my on my laptop trying to keep six VMs running at one time. What we're gonna do here is we're gonna look at the workflow mapped. We're gonna do the SMB not required. There's our our our matching plugins and findings for SMB not required.

Chris Traynor:

I'm gonna select one. Here we have workflow available, SMB is not required. Hit w for workflow to view the workflow. These are those those steps listed out that you can read through, screenshot, keep to the side, run the tool in here, run it someplace else. Then you're also hit enter.

Chris Traynor:

I'm gonna go to the tool for this. To run a tool, I'm gonna select NetExec. This is an SMB related thing. The default protocol for a NetExec is SMB because that's where a lot of our time is spent, but I'm gonna do two. You can select any of them.

Chris Traynor:

Our execution summary, I'm gonna hit run now. Let's see. We're down to the last few minutes. Let's see if it can run through. It's finding some information about our targets for the game of Active Directory there.

Chris Traynor:

It output the execution summary. Results, where are they, files generated. I just I generated a target list for relaying as part of the default command for SMB. Do I run a run do I wanna run another command? No, don't.

Chris Traynor:

I'm gonna click select the findings information. I'm viewing the information and now suddenly NetExec context has has entered the chat. One of the last things we're gonna show. There's more things if you can believe it. I'm gonna run a predetermined net command.

Chris Traynor:

This one is for the game of active directory, it's gonna scan all those game of active directories. I realize this is small text on the screen, it's not important, it's just populating more of that net exec database on the back end. Now, when I hit I again, notice I have only the information from the command I ran in there of SMB signing disabled. I'm a hit I again and it's I I I over and over and over. My keyboard doesn't wanna like me.

Chris Traynor:

Now it's gonna show the matching credentials for those from the other command we ran outside of Kernel automatically. So many things. We're down down to the last minute. If you back out and I start doing keyboard interrupt, back out, come on keyboard, you can work. I think it's having trouble because of all the VMs.

Chris Traynor:

We're gonna go back one more time out of this, it's gonna give you a summary of the session. We spent eleven minutes and twenty six seconds on that scan, we reviewed 11 findings, we did not mark any complete, so on and so forth. There's so much more to this tool guys, a lot of it's out there in the in the GitHub page. There's a whole document section, I'm gonna stop sharing here, I'm gonna go back over to my slides and I'm gonna show you where to go real quick to see that stuff and then we are done with Let's see, presenter flow. Right here, getting started, a little snippet there.

Chris Traynor:

It's a one line command with PIP execs to get this thing started and up and running. Import your scans, there's a little snapshot. I thought we would have time for questions but obviously not. Inside the GitHub page under the docs folder, there's detailed documentation on how to create your own custom workflows, how to submit things, how to ink how to do PRs, how to go through the tool in the read me, and a bunch of features we had no time for here. I mentioned in the chat, if you have feature ideas, if you found bugs, put them in the issues in the GitHub page, I'll resolve those as quickly as possible.

Chris Traynor:

And the last thing is, if you wanna see some free labs that BHIS provides for all

Jason Blanchard:

of you and

Chris Traynor:

have a lot of fun, go to the free labs link, do that QR code. If you wanna see my classes and stuff, the fastest way to see all that information collected, past recordings I've done, webcasts, blog posts, cheat sheets, they're all aggregated on the Ridgeback info sec page. Jason, take take the mic away from me.

Deb Wigley:

Oh, great.

Jason Blanchard:

Good job, Chris.

Deb Wigley:

Good talking.

Jason Blanchard:

You'll have this to

Chris Traynor:

is gonna be the only video on YouTube you have to slow down the pace of the speaker. I want you to bark.

Jason Blanchard:

So what you're saying is a part two for this Well done, Chris. Hey, I'm gonna let you talk one more time before people go. If you could sum up everything today and one final thought, what would it be, Chris?

Chris Traynor:

Don't waste time. Your best tools are the things that save you time, not the tools that do some ninja exploit for you that's only possible in very specific con conditions. Right? Spend your time building things that help help you do better and also, if you build the thing, come and share it somewhere. Put it out there, let people see it, expect some disgruntled people, but hopefully most will be supportive.

Chris Traynor:

Right? Yeah. And as I mentioned, this tool is featured inside of my class, my two day offensive tooling for operators class. It is running at Wawa Sackenfest Denver, both in person and virtual options. That's gonna be in about a week and a half, I think.

Chris Traynor:

So check that out too. I'll drop a link for it as well in the chat.

Deb Wigley:

Alright. So that's Cerno. Cerno.

Chris Traynor:

Cerno. Cerno. The weirdest There

Jason Blanchard:

is a free CTF this week. I put in the Zoom chat. So go to the Zoom chat, find the free CTF. You can participate. There's prizes for Antisyphon Training.

Jason Blanchard:

It's a CTF that goes along with some things that we'll cover today. But the main thing is free CTF. Free CTF. Free CTF. Go to the link.

Jason Blanchard:

Participate. Learn something new. Cool. Alright. Also in the chat is, if you're willing to trust us, there's a link that takes you to the SpearFist General Store also.

Jason Blanchard:

Know, incredibly untrustworthy. But that will get you the free InfoSec Survival Guide for the Instant Response Edition. We'll mail that to you for free. Alright. So we're gonna Thank you so much for joining us.

Jason Blanchard:

But what we're do now is some q and a, Chris. There was a couple questions that came in about Cerno. Serno. Damn it. Cerno.

Jason Blanchard:

Cerno.

Chris Traynor:

You can say it however you want, Jason. It's okay. Yeah.

Jason Blanchard:

So we'll ask those questions. Also got a loving the tool, great presentation. Someone said this is badass. So Chris, I think you definitely touched on a nerve that there is a niche of a niche of a niche of a niche that is really blown away right now. Mhmm.

Jason Blanchard:

And so that's what Deb and I like, sometimes our friends go, like, why did those people walk up to you wanna take a picture with you? And I'm like, well, in this niche of a niche of a niche of a niche of of a niche

Deb Wigley:

People know who we are.

Chris Traynor:

That's it.

Jason Blanchard:

People know who

Deb Wigley:

are.

Chris Traynor:

That's it. Kind of a big deal.

Deb Wigley:

No. No. No. No.

Jason Blanchard:

People know who we are.

Deb Wigley:

Recognize us.

Jason Blanchard:

Alright. So Logan is here. If if you're new, if this is your first time here today, if you've attended a whole bunch of these before, you know, Black Hills started as a pen testing firm. So starting back in 2008, John Strand started it with a few very few testers. Now we've grown over to a 140 people, I think 43, 45 full time pen testers.

Jason Blanchard:

And so Logan's here to talk to you about what it's like to do pen testing with us. But first, we're gonna answer a couple q and a questions from from the audience for Chris. So the first question is, can you build trends for a long period of time with the compare function?

Chris Traynor:

Can I build can you build trends? So for the compare function that's in there right now, you have to specifically choose a baseline scan first that you list, and then the scan you're comparing it to as a one off. There is a a plan in the future to say, of all of my tool of all my scans in there, compare them and give me a a trend line, am I getting better, am I getting worse, am I staying stagnant just by counts of things? That's something that I thought about doing, I might still do, but the issue is you might have scans that are entirely unrelated. Right?

Chris Traynor:

So if you if you import two or three scans into Kernel and they're of different environments completely, doing a batch comparison, it's just such a small area where people might not have that big concern. They're probably just first concerned with this scan to this scan. Am I getting better or not? So that's what I did first. If you want that feature, drop it into the issues of the GitHub page and I'll I'll take a look at it.

Jason Blanchard:

Would there be a future integration with OpenVOS or is there no API for it?

Chris Traynor:

Yes. Yes. I get excited.

Deb Wigley:

I get excited.

Chris Traynor:

There's So that's one of the reasons why I didn't just say Cerno import. It's Cerno import Nessus and then you specify Nessus files. So there are plans for the other vulnerability tools out there, that do scanning, to get a hold of some of those sample scan outputs and and get their exact export structure and then I can try to map those in to the same Cerno database structure and and try to do that as well. So that you eventually, you'll have the option to say, there's three, four, five vulnerability scanners out there. I want to do mine.

Chris Traynor:

Right? I don't wanna have to use Nessus. Nessus is just what we use for VHIS, so it made the most sense for our workflow starting out to try to address our needs first. Yeah.

Jason Blanchard:

And if you haven't checked in yet for Hackett, please definitely check-in for Hackett if you have no idea what I'm talking about. Hello, and welcome to your first Black Hat Information Security webcast. So one of the attendees said, looks like a good tool. A question, is there a way to mark workflows verification tools as potentially harmful? Think Nmap SafeScripts to avoid things like testing DOS and potentially harming the client environment.

Chris Traynor:

Yes. So that is something that I thought of. So the template commands that you get for nmap, they are Specifically, they'll use that dash capital a option. So that will, on its own, not run anything that is categorized as an NSE script that is harmful or risky. It is default NSE scripts only and then you only have the you have the option to specify custom NSC scripts that you wanna add on top of those.

Chris Traynor:

So by default, you cannot run anything that's risky, you have to specifically tell Kernel to to build that into the command you want And then you'll still get a review, are you sure? Yes. Run the command. So by default, it will not be aggressive or malicious to your environment.

Jason Blanchard:

Yeah. And to the 40 people that clicked on the link to go to Spearfish General Store to order their free copy, thank you so much for going to a, you know, a pen testing firm ask you to go to a website and then put in your contact information. That takes a lot of trust. We appreciate it. And it's a story called Spearfish.

Jason Blanchard:

We get it. Seems fishy. Alright. So last question. Are you currently I wanna so it's called Go, g o a d, but I wanna call it the greatest of all directories.

Jason Blanchard:

But I know that's that's not right. It would

Chris Traynor:

it would be It's a game of Active Directory. I did not build it. Gotcha. I utilize the things that the community puts out as a big thing that I do for my my classes. All the tools except for maybe one in my two classes, they are free, they're open, the community puts them out there and maintains.

Chris Traynor:

The great people over at I think it's Orange Cyber Defense or something like that, put out Game of Active Directory a long time ago, and have maintained it very well. So we use that for targets and and practice and learning and things like that. So I have thought of putting a different skin on it or putting a different theme or a different building my own custom one, but honestly, I don't have the time. So

Jason Blanchard:

So, Chris, you're teaching soon. I got my last question for you, then we're gonna talk to Logan.

Deb Wigley:

Chris Okay.

Jason Blanchard:

And I've asked you this question before, and from the very minute I met you, I realized how much you liked teaching. You were like a TA at another organisation. Like, there's a there's a desire in you to share your knowledge. Chris, why do you like to teach?

Chris Traynor:

Every time I have to answer this question, it's a bit of a self deprecating question. Or answer. Am I do not learn quickly. I I also don't remember things. I'm a big fan of the Indiana Jones quote is that I wrote them down in my diary so I wouldn't have to remember.

Chris Traynor:

Learning does not come easily to me and as I started out in my career, I had questions and I was at an organization that kind of, while the people were friendly, it kind of didn't look good if you asked questions to try to know what you were doing or try to learn something else. They just assumed that you take on a role and you suddenly by some cosmic miracle know everything about it. So if I can somehow, in a little bit, make it so that other people like me, who don't learn very quickly, but once they learn something, they know it fairly well. If I can make it easier, if I can if I can shortcut that for you guys a little bit, then that's that's why I like to teach. And honestly, when I do teach my classes, I learn more.

Chris Traynor:

I'm big making changes as any instructor for Antisyphon will probably attest. It's about a week before big conference. So of course now, we're gonna make a lot of changes to our classes, and I have probably 15 or 20 to do in the next five days. So I I like teaching. I like I like having people hopefully get to a certain spot faster than I would be able to, so

Jason Blanchard:

Yeah. If anyone's ever wondered what it's like to get a job or want to work at Black Hills, I mean, the the core of who we're looking for is someone who has a heart of a teacher that not only are they willing to, like, you know, do the work and get the work done, but it's like, I I wanna show you what I did. I wanna show you how I did it. I want you to see what I was capable of, not because I'm trying to impress you, but because I need you to understand. Because if you see how I did it, and if you see how I was able to accomplish this, then you can protect yourself, you can secure it, you can fix it, you can prepare it.

Jason Blanchard:

Our reports are not there to, like, impress you or to brag. Our reports are there to teach you and educate you. And so unless you have that inside you, then it's really hard for you to put a report together where you're not bragging, you're not being arrogant. And so the the main thing we look for at Black Hills is do you have the heart of a teacher to come work here? Is why so

Chris Traynor:

many other something that I tried to bake in in this tool as well, is that you look at the workflows, you may come across a finding that you've never done before, you don't know how to approach it and rather than going out and googling and finding 15 blogs or medium articles that try to explain it, hopefully, Cerno can help walk you through and give you links out of of good sources to to learn from, so.

Jason Blanchard:

Yeah. Tomato Surna. Alright. So Logan, and if if you if you don't wanna know what it's like to do business at Black Hills, totally fine. See you next time.

Jason Blanchard:

Thank you so much for being here. But if you would would like to know what the process is to to have a pen test from Black Hills Information Security, Logan's here. So Logan, how many pen tests do you think we do a year?

Logan Bender:

I think we're hovering around 1,500 plus different engagements. Chris might have the metrics more, but close to 1,500.

Jason Blanchard:

Okay. So that means 1,500 reports? Is that what you're saying?

Logan Bender:

At least. Yes. Okay.

Deb Wigley:

I did not know that. Holy cow.

Jason Blanchard:

So if we're at 1,500 reports now, do we double book and triple book and quadruple book our testers?

Logan Bender:

I think Chris would have already left this organization here. Yeah. That's another reason why pentesters love to come to Black Hills Information Security is we we keep our testers focused on one client environment per engagement. So we don't have multiple testers coming in, working on multiple different engagements. It's one tester solely assigned to your organization, and you're able to pick up the phone and call the tester at any given time.

Logan Bender:

A lot of our clients, we do like Teams channels or Slack channels or Signal. So it's really nice. We hear a lot of good feedback as far as the collaboration and communication from our clients when they engage in a pen test with us.

Jason Blanchard:

Okay. Yeah. So when you say it's a tester from, like, start to finish, like, there isn't who how many people are involved in the whole, like, process? Like, I'm a client, I wanna hire Black Hills. How many people are do you feel like I'm gonna talk to during my entire time of working with Black Hills?

Logan Bender:

We're a really small team, so you usually just talk with someone on the business capture team in order to solicit a quote and and get everything dialed in from a scoping perspective. From there, you work with a project manager that works miracles as far as booking engagements and moving things around. So we'll schedule the pen test, and then you have your rules of engagement call with the tester that's performing the work. And then from that rules of engagement call, you're solely working with the tester unless you have any questions from from the business side. So once you sign the statement of work, get everything scheduled, you're solely working with the pen tester themselves.

Logan Bender:

And, you get direct access to work with that tester. So you don't have to go through three different middle managers or have Chris talk with someone that try to portrays the issue over back to the end client. You get you're able to work very closely with our testers during these engagements.

Jason Blanchard:

Okay. So Chris, from a tester perspective, what's your favorite environment to do a pen test for?

Chris Traynor:

A favorite environment to do a pen test for, I don't wanna say it's the it's the the bad environments, but you you do wind up with like like hospitals are great environments to to play around in. Obviously, it very carefully. Human life and health and everything may be in the balance for the for the systems that you're interacting with. But a lot of times, when you get into hospitals or health organizations, you you have professionals working for that organization that they've been IT managers, they've been sys admins, they've put things out, but they don't quite understand that when you buy an MRI machine, that machine was designed ten years ago, put into production five years ago, and cannot possibly be patched and continue to work. So you are inherently putting your environment more and more at risk, and it's hundreds of thousands or millions of dollars to replace the machine, that's just not possible.

Chris Traynor:

So you get to work with that organization to understand that risk and to isolate those systems or get rid of them the best that they can. A lot of times those places, there is no such thing as zero vulnerabilities. There's only mitigations and and isolations.

Jason Blanchard:

Then, you know, Chris, what makes an ideal pen test client? Like, from your perspective, what are you looking for? Right? Like, if there was a matchmaking thing going on right now between a client and a pen tester and a pen tester and a client, what's Chris looking for?

Chris Traynor:

I'm looking for long walks on the beach. Yeah.

Jason Blanchard:

I set you up for this. I did.

Chris Traynor:

So a good customer is always somebody who is, one, responsive. So if if we send you a message, particularly in the middle of an engagement, and we're blocked with testing, I realize that I'm gonna get paid either way, but it it really is bad when we have five days on a test and we lose an entire day because our point of contact is not responsive. But for everybody, aside from being non responsive, is we're pen testers. It's our job to find the things that are wrong. We are gonna have not great information for you a lot of the times.

Chris Traynor:

So if you can be somebody who can take bad news well and understand that it's meant from a direction of being constructive and assistive to your organization to get better and more secure, you're gonna be my favorite customer. Because there are certainly organizations that take bad news poorly and get very defensive and aggressive of it, and nobody likes that situation.

Jason Blanchard:

So Logan, let's say someone right now is listening and they're thinking about hiring a pen testing firm, somebody else. Is there a way to be better prepared for the pen test? Or do you just come like, show me the way it is now, or do you want me to clean it up before I get there? Like, I guess that's the question. Because I think some people are like, well, let me fix everything before we bring it to test.

Jason Blanchard:

Or is it just let's do it now to figure out what to fix? What what would you suggest?

Logan Bender:

Yeah. Again, pen testing, we only have limited days. I think Chris mentioned it, you know, he's got, like, five days to try to be successful on an internal pen test. Right? So the more things that you can have cleaned up in your environment will ultimately kinda yield better results for your Chris can spend time in other areas of your environment.

Logan Bender:

Right? So we've got a few other, I think, webcasts out there. It's like what to expect when you're expecting a pen test that helps clients kinda get ready to let them know what's gonna be taking place during it. So the more you can fix as far as vulnerabilities that you're aware of or if there's skeletons in the closet that you're able to fix before the pen test or even point it out to the tester during the rules of engagement, again, we wanna prioritize our efforts and make sure you're getting value out of the pen test. So certainly, the areas if you work in a more like white box approach or provide Chris with documentation or objectives or goals that you want as part of your pen test, it's another unique approach that Black Hills will do is that we're not just stuck in our methodology and our strict statement of work.

Logan Bender:

We do have a little flexibility in there to try to get you as much value as you can within that allotted time.

Chris Traynor:

Yeah. And and every test you're on the rules of engagement call, we'll typically ask one a version of of one question, which is, what's your motivation for this engagement? What's what's valuable to you for this particular engagement and and your driving force for that so that we can pay attention to it? Because certainly, as as Logan mentioned, our time is limited. If you if you have a particular concern, tell us about it.

Chris Traynor:

If you have an environment that hasn't had anything patched in fifteen years, it's part of our due diligence and our our responsibility to verify, at least to a certain degree, your unpatched systems. Right? And that's gonna take up a good bit of time. So if you wanna focus elsewhere or if you wanna make sure that the time is spent doing super cool ninja back flips through your environment, those low hanging fruit you wanna maybe try to mop up. But don't make that be thing that stops you from getting a pen test for a year and a half.

Logan Bender:

Right? I was gonna say we kinda have that consultancy effect a lot of times too where a lot of the the technical team members we're working with are already aware of the things that are wrong in their environment. They've been telling leadership about the things that they need fixed and really, they wanna hire BHIS in to validate that and then say something very similar that they've been saying for years. And we then you all of a sudden leadership's on board. Why aren't we fixing this?

Logan Bender:

What why didn't you tell us about this? So we're really good at being an advocate on the client's behalf and helping them portray stuff over to leadership in addition.

Chris Traynor:

I phrase that on ROE calls as giving you ammunition to fight a battle. Right, that people inside organizations have have been facing for years and years and years. Like, I'll get to a debrief call after a test and we'll go through a particularly problematic few systems and they're like, oh my god, we've been trying to get rid of these for five years, but I can't get anybody to let me get rid of it. And now they have a third party report that in the event of a breach would be discoverable in a a court case, and they they kinda don't have as much ground to back into to not do it. So

Jason Blanchard:

Yeah. I get a chance to see the consultant effect on tabletop exercises where I'll make a suggestion and I see smirks from a couple of people on the team and I'm like, oh, they're super happy I just said that because they've been saying that for a while.

Deb Wigley:

Three years. Yeah.

Jason Blanchard:

But Jason's from Black Hills. So

Chris Traynor:

A lot of people like to play our backdoors and breaches game for the people I talk to for that exact reason, is they'll do, like backdoors and breaches and they'd be like, see this procedural process problem or that we only have Tim over here who can do the job and I've been trying to get a second person for three years. Mhmm. In this simple tabletop exercise, everything in this incident went to crap because Mhmm. We just didn't do these things.

Jason Blanchard:

Yeah. I'm gonna wrap it up with this. You can tell that Logan doesn't work on commission, because when I asked him, should you just get a pen test or should you clean up your environment? Logan's like, yeah, up your environment. Be better prepared.

Jason Blanchard:

Get the best value out of your pen test instead of like, yeah, get on down here to Black Hills Information Security and get yourself a pen test right now. No money down. No problem.

Chris Traynor:

Can we have Logan doing that outside at Denver? Maybe not outside, depending on how cold it is. Just so off

Logan Bender:

a pen test. That sounds kind of awesome.

Chris Traynor:

We totally should do that. How about the the last we'll do like a, you gotta keep your hand on a car game Yeah. For like twelve hours. Whoever keeps their hand on on that for last gets a free pen test.

Jason Blanchard:

Thousand end points.

Chris Traynor:

That is not binding at all. Yeah. I'm not speaking for John Strand and the organization, it's just an idea.

Jason Blanchard:

I I just texted him. John, we're getting a Tesla, first of all. Alright, Logan. If somebody wanted to work with us, what's the first step?

Logan Bender:

Yep. Multiple ways to get a hold of the team here. You can hit anyone up on Discord. Everyone that's associated with Black Hills information security will point you in the right direction. You can always reach out on the contact us form.

Logan Bender:

There's a website. There's link. Yep. There however you wanna get a hold of us, send pigeons. We will respond to you.

Logan Bender:

We will get on a call within a business day. We will get a proposal usually into your hands within a business day, so we move rapidly quick over here, and we don't drag out any processes for you too. And we're not gonna send you a 100 different emails once you reach out for a pen test. Even if you just wanna see where you're at with pricing, get some general information compared to what you're doing today, They're very light, easygoing calls, and that's usually a good time. We try to treat it like a pre or post show banter.

Deb Wigley:

Can I can I add one more thing? Is if we have a really good interaction with you, they send you guys over to me, and then I send you gifts just for reaching out. So I'm not sure if the community

Jason Blanchard:

Yeah.

Deb Wigley:

Really knows that. But to the 192 people here, tell your friends.

Jason Blanchard:

Tell your friend.

Deb Wigley:

Tell your friends.

Jason Blanchard:

Speaking of which, Deb, final thoughts for us today?

Deb Wigley:

Final thoughts. It's gonna be the same. Just thank you for sharing your time with us. Thank you for allowing Chris to dump his knowledge on your hearts and your brains, break your brains a little bit. And we love you guys.

Deb Wigley:

We're just so grateful that you show up and be a part of our community. So thanks for being awesome.

Jason Blanchard:

Alright, Ryan. Do it, Ryan. Kill it with fire, Ryan.

Deb Wigley:

Kill it. Good job.

Jason Blanchard:

Remember Calissa? That was fun.

Deb Wigley:

Calissa Kill us a snobberly.

Jason Blanchard:

That was so much fun.

Deb Wigley:

No. It was

Jason Blanchard:

good day.

Deb Wigley:

And then It was a good pictures day.

Jason Blanchard:

Of us as

Deb Wigley:

I know. I was a wreck.

Chris Traynor:

I saved that picture of the animals. I'm keeping it.

Deb Wigley:

I did. It was a good day. It was a wreck. Thanks, everybody. Kill it, Ryan.