CommSec D1 - Faster, Wider, Greater: Modern Pentest Tricks
summary
Shows how to process massive recon and tool output into CSV pipelines, using CSVKit to clean, join and SQL-query million-row scans (IPv4/masscan scale) and Jython to reuse Java crypto like WebLogic PBKDF2 when no Python module exists. Demonstrates parallelizing tasks with GNU PyInstaller and GNU Parallel to compile and drop single-file Python tools (CrackMapExec, Impacket utils), run wfuzz jobs in parallel, and generate automated URL screenshots — all proven to work in live assessments.
AI-written summary · about
chapters (16)
- 0:00Introduction and speaker intro
- 0:54Changes in pentesting field
- 3:03Adapting techniques for modern tests
- 4:07Data processing with CSV
- 7:45CSVKit for data manipulation
- 9:17CSV analysis with CSVStat
- 11:28Data analysis with Dataiku
- 14:01Parallel execution for efficiency
- 15:46Web enumeration with WFuzz
- 17:55Web screenshot automation
- 18:38Reverse engineering with Jython
- 24:09Frida for dynamic analysis
- 24:31Compiling Python scripts with PyInstaller
- 29:13Obfuscation and AV evasion
- 30:16SSH-like tunneling with Rport
- 32:04Conclusion and key takeaways
related talks
55mMainframe Hacking in 2019
13mFreedom of Security
58mOpen Source Pentesting and Security Analysis Tools: the DevOps way
39mHow to think like a hacker
28mBuild your first Cyber Forensic Application
14mDFIR - Don't Forget Your Roots!
32mPicking the Low-Hanging Fruit – Easy Pentest Wins
31mUsing Math to Speed Up Security Assessments of Windows Executables