Phillip Wylie Show

By Phillip WylieTechnology

Phillip Wylie Show episodes

October 03, 2023Web Application Pentesting and the Importance of Specialization with Tib3rius
About The Guest:
Tib3rius is a penetration tester with over ten years of experience, specializing in web application security. He is the creator of the popular tool Autorecon, which is widely used for enumeration in the OSCP exam and CTF challenges. Tib3rius also offers courses on Udemy and Hackers Academy, focusing on privilege escalation techniques for Windows and Linux.
Summary:
Tib3rius joins Phillip Wylie on The Phillip Wylie Show to discuss his background in penetration testing and his specialization in web application security. He shares insights into the development of his tool Autorecon, which was initially created for the OSCP exam but gained popularity in the community. Tib3rius also talks about the importance of specialization in offensive security and offers advice for those looking to start a career in penetration testing. He highlights the value of bug bounty hunting as a way to gain practical experience and shares his thoughts on the OWASP Top Ten and the future of web application security tools.
Key Takeaways:
Autorecon, a tool created by Tib3rius, is widely used for enumeration in the OSCP exam and CTF challenges.

Specializing in a specific area of penetration testing, such as web application security, can lead to becoming a subject matter expert and increase value to a company.

Bug bounty hunting can provide practical experience and count as valuable experience in the field of penetration testing.

The OWASP Top Ten has evolved from a list of the top ten vulnerabilities to a list of categories, covering a wide range of web application security issues.

The future of web application security tools, such as Kaido, remains to be seen, but competition in the field can lead to improvements and alternatives to existing tools.

Quotes:
"I think specialize in something and learn that thing well, and you'll be fine." - Tib3rius

"Bug bounty hunting is a great thing to go into because you'll get some experience actually testing real applications." - Tib3rius

"The OWASP Top Ten has become a catch-all category that covers almost every vulnerability." - Tib3rius

Socials and Resources:
https://twitter.com/0xTib3rius
http://youtube.com/Tib3rius
https://tib3rius.com/
https://courses.tib3rius.com/
https://linktr.ee/tib3rius
30 min
September 26, 2023Jakoby's Journey
About The Guest:
Jakoby is a content creator and hacker with over a decade of experience in the field. He started his journey in hacking at a young age and has since become skilled in various areas, including bad USB and PowerShell. Jakoby is known for his ability to make complex concepts easily digestible for newcomers to the field.
Summary:
In this episode, Phillip Wylie interviews Jakoby, a content creator and hacker. They discuss Jakoby's hacker origin story, his experience in the content creation space, and the positive impact of a Discord server for content creators. Jakoby shares his passion for educating and helping others, as well as his journey to overcome imposter syndrome. He also talks about his plans to pursue certifications and work in the security field professionally. The conversation highlights the importance of sharing knowledge and the power of positive communities in the industry.
Key Takeaways:
Joining a positive and supportive community, like the Discord server for content creators, can be incredibly beneficial for learning and growth.

Blind spots in our knowledge can be filled by engaging in conversations and learning from others in the community.

Overcoming imposter syndrome requires recognizing and accepting the value of your own knowledge and skills.

Sharing content that is easily digestible for newcomers can have a significant impact on their learning and understanding.

Leveraging social media platforms, such as YouTube, Twitter, and LinkedIn, can help build a personal brand and create opportunities in the industry.

Quotes:
"Everybody needs to hear that you don't have to believe it, but maybe consider that they're telling the truth." - Jakoby

"You give this presentation, you give this lecture, you do this demonstration, and you think it's kind of lame, but then someone comes up and tells you, 'Man, I learned a lot from that.'" - Phillip Wylie

"If you're constantly getting into Twitter disputes and Twitter fights, that's what the algorithm is going to feed you." - Jakoby

"You could be the best at something in the world, but if people don't know who you are, you're still stuck in the manual process of reaching out to people individually." - Jakoby

"You put a lot of effort into your projects. You don't halfway do anything, which is awesome to see." - Phillip Wylie

Socials and Resources:
https://twitter.com/I_Am_Jakoby
https://www.youtube.com/@IamJakoby
https://discord.gg/iamjakoby
41 min
September 19, 2023Michael Taggart's Journey in Education and Information Security
About The Guest:
Michael Taggart is the founder of the Taggart Institute, an education project that aims to provide affordable and accessible learning resources for individuals interested in information security. With a background in teaching and technology, Michael transitioned from K-12 education to security analysis work and is currently a senior researcher at UCLA Health. He is passionate about sharing knowledge and helping others develop their skills in the field of cybersecurity.
Summary:
In this episode, Phil interviews Michael Taggart, the founder of the Taggart Institute. Michael shares his background in teaching and technology and how he transitioned into the field of information security. He discusses the importance of accessible education and the mission of the Taggart Institute to provide affordable learning resources. Michael also talks about the benefits of content creation and learning in public, as well as the tools and equipment needed to get started. He emphasizes the value of diversity in tools and the importance of responsible red teaming.
Key Takeaways:
Learning in public and creating content can be valuable for both personal growth and sharing knowledge with others.

The Taggart Institute aims to provide affordable and accessible learning resources for individuals interested in information security.

It is important to choose tools and equipment that work best for you and your specific needs.

Building a hacking-specific machine from a base OS can provide more flexibility and customization options.

Responsible red teaming involves ethical considerations and responsible handling of customer data.

Quotes:
"Learning in public is incredibly valuable. Teaching is a fantastic learning mechanism." - Michael Taggart

"Diversity is good in all senses. Monoculture is dangerous." - Michael Taggart

Socials and Resources:
https://infosec.exchange/@mttaggart
https://threads.net/@mttaggart|
https://www.linkedin.com/in/mttaggart
The Taggart Institute:
https://taggartinstitute.org
https://discord.gg/taggartinstitute
https://www.linkedin.com/company/the-taggart-institute
43 min
September 12, 2023A Journey From Offensive Security to Leadership with Tom Eston
About The Guest:
Tom Eston is the VP of Consulting and Cosmos Delivery at Bishop Fox, an information security consulting firm. He is also the founder and host of the Shared Security Podcast, which has been running for over 14 years. Tom has over 24 years of experience in the technology and cybersecurity industry, with a focus on offensive security and application security.
Summary:
Tom Eston joins The Phillip Wylie Show to discuss his journey in offensive security and his role at Bishop Fox. He shares how he got started in the industry, his experience in consulting and management, and the importance of mentorship. Tom also gives a preview of his upcoming talk at Summer Camp, where he will discuss personalities, empathy, and difficult conversations in leadership.
Key Takeaways:
Tom Eston started his career in technology as a contractor doing desktop support and Help Desk work.

He transitioned into information security when he was hired to start the first information security department at a real estate company.

Tom's interest in offensive security was sparked when he hired a pen tester for the first time and was amazed by their skills.

He transitioned into consulting to gain more experience and exposure to different environments and clients.

Tom believes that leadership is about making people better and that mentorship is an important aspect of the industry.

Quotes:
"I was just so inspired by this guy. And he let me sit next to him. It was like three or four days he was in the office, and I'm just soaking up all this information." - Tom Eston

"Consulting for me was really that door that I think led me to where I'm at today by just exposing me to different environments, different clients, different people." - Tom Eston

"Leadership is about making people better. Essentially, that's my job. My job is to make people better, help them do their jobs better." - Tom Eston

Socials and Resources:
https://www.linkedin.com/in/tomeston/
https://twitter.com/agent0x0
https://sharedsecurity.net/
35 min
September 07, 2023Powerlifting and PowerShell: A Discussion with Jake Hildreth
About The Guest:
Jake is a cybersecurity professional with a background in system administration. He has a deep understanding of Active Directory security and is currently the Active Directory Security Assessment Service Lead at Trimarc. Jake is also the head developer of the open-source tool Locksmith, which focuses on Active Directory Certificate Services misconfigurations.
Summary:
Jake shares his hacker origin story, starting from his early days tinkering with computers and discovering the world of IRC. He talks about his transition from a sysadmin role to focusing on security and his journey to becoming an Active Directory expert. Jake also discusses the importance of automation and scripting in his work and the role of PowerShell in his day-to-day tasks. He emphasizes the value of continuous learning and the parallels he sees between powerlifting and research in terms of setting goals and putting in consistent effort.
Key Takeaways:
Jake's transition from sysadmin to security professional was driven by his passion for tinkering with computers and his desire to secure his organization's systems.

PowerShell is a crucial tool for Active Directory security professionals, allowing for automation and scripting to streamline tasks.

Continuous learning and consistent effort are key to achieving goals, whether in powerlifting or cybersecurity research.

Quotes:
"I was one of those kids, age four, playing on my grandparents' Commodore 64 and typing in Basic from a magazine... anytime I was near a computer, I would play around with it."

"PowerShell is are you familiar with Beto on security, the Twitter account? Okay, so he and I have become buddies, and he has a PowerShell tattoo. I'm not quite to that level, but yeah, PowerShell and I were... I have a red teamer named Spencer that works with me on locksmith. He's part of our core team. We got three guys, Spencer and Sam... we just all love PowerShell."

"Do the work, put in a little bit of work every day, and before you know it, you're going to be to your goal or past your goal... just it wouldn't have felt like it doesn't really feel like anything."

"Powerlifting taught me... you get out there and you do the work... usually if you're out there working, you're going to progressively build up over time and then eventually you're going to look back and see, holy hell, I just put 425 pounds on my back and went down into a squat and came back up."

Links:
Twitter: @dotdotdotHorse

Jake's Infosec Exchange: @[email protected]

Trimark: https://www.trimarcsecurity.com/

Locksmith: https://github.com/TrimarcJake/Locksmith
42 min
September 05, 2023Yuri Diogenes Discusses Building a Career in Cybersecurity
About The Guest:
Yuri Diogenes is a cybersecurity expert and author with over 15 years of experience in the industry. Originally from Brazil, Yuri moved to the US in 2003 to work at Microsoft and Dell Computers. He has published 31 books on cybersecurity and currently works as a People Manager at Microsoft, overseeing the development of cloud security products. Yuri is also a professor at Capitol Technology University and holds a Master's degree in Cybersecurity.
Summary:
Yuri Diogenes, a cybersecurity expert and author, joins the podcast to discuss his book "Building a Career in Cybersecurity." He emphasizes the importance of self-assessment and leveraging existing skills when transitioning into the cybersecurity field. Yuri also highlights the need for a strong foundation in operating systems and network communication. He shares insights on the evolving nature of cybersecurity education and the importance of incorporating security fundamentals into school curriculums. Additionally, Yuri emphasizes the significance of soft skills in the industry and the need for effective communication and collaboration. He encourages individuals to pursue their passion within the cybersecurity field and provides guidance on finding the right specialization.
Key Takeaways:
Self-assessment and leveraging existing skills are crucial when transitioning into cybersecurity.

A strong foundation in operating systems and network communication is essential for success in the field.

Incorporating security fundamentals into school curriculums can help build cybersecurity awareness from a young age.

Soft skills, such as effective communication and collaboration, are highly valued in the industry.

Finding a specialization within the cybersecurity field based on personal passion is key to long-term success.

Quotes:
"Unless we start building this level of awareness about information security that becomes second nature, it will continue to be a challenge for many people to be aware of what's going on out there." - Yuri Diogenes

"Soft skills are important. If you don't have the soft skills to manage those things and to interact with people, it becomes very hard." - Yuri Diogenes

"Go to where you feel passionate about. That's a question I receive a lot. Should I be a pen tester? Should I be a cybersecurity analyst? Well, I don't know. It depends on what you want for your life." - Yuri Diogenes

Socials and Resources:
https://twitter.com/yuridiogenes
https://www.linkedin.com/in/yuridiogenes/
https://www.amazon.com/Building-Career-Cybersecurity-Strategy-Succeed/dp/0138214514
32 min
August 29, 2023The Power of Community: A Conversation with Kevin Johnson
About The Guest:
Kevin Johnson is a renowned cybersecurity expert and the founder of Secure Ideas, a consulting and training company. He has been in the industry for over 30 years and has extensive experience in penetration testing and application security. Kevin is also actively involved in the open-source community and is a strong advocate for the OWASP (Open Web Application Security Project) organization.
Summary:
In this episode of The Phillip Wylie Show, host Phillip interviews Kevin Johnson, founder of Secure Ideas and a prominent figure in the cybersecurity industry. They discuss Kevin's journey into pen testing, his involvement with the open-source community, and the importance of OWASP. Kevin also shares his thoughts on the need for increased membership and support for OWASP to ensure its continued success.
Key Takeaways:
Kevin Johnson emphasizes the importance of sharing knowledge and helping others in the cybersecurity community.

He believes that true expertise is demonstrated when one can effectively teach and explain complex concepts to others.

Kevin highlights the need for improved membership and support for OWASP to address the challenges it currently faces.

He encourages individuals to ask questions and seek guidance from experienced professionals in the field.

Quotes:
"I am where I am today because other people showed me stuff or helped me."

"For you to be able to teach it to somebody, that's proof you actually know it."

"The fear of being found to be ignorant makes these people clam up."

"The vast majority of people that say 'go figure it out yourself' don't actually know the things they say they do."

"OWASP has lost two major flagship projects to OpenSSF. We need to fix this or we're going to lose."

Socials and Resources:
https://www.linkedin.com/in/kevinjohnson/
https://twitter.com/secureideas
https://www.secureideas.com/
40 min
August 22, 2023A Discussion with Active Directory Security Consultant Brandon Colley
About The Guest:
Brandon Colley is a cybersecurity professional who specializes in Active Directory security. He has a background in IT operations and has worked in various roles, including help desk support, desktop support, and server administration. Brandon currently works for Trimarc Security, a well-known Active Directory security company.
Summary:
In this episode, Brandon discusses his journey from IT operations to his current role in Active Directory security. He shares how he discovered his passion for security and the steps he took to specialize in Active Directory. Brandon also talks about the importance of understanding the technology behind security and the value of having a background in IT operations. He emphasizes the need for continuous learning and recommends playing with Active Directory in a lab environment to gain hands-on experience. Brandon also highlights the benefits of giving talks and being active in the cybersecurity community.
Key Takeaways:
Understanding the technology behind security is crucial for effective Active Directory security.

Playing with Active Directory in a lab environment is a great way to gain hands-on experience.

Having a background in IT operations provides valuable insights for defending against attacks.

Giving talks and being active in the cybersecurity community can help in learning and sharing knowledge.

Quotes:
"One of the things I like to do outside of mentoring and teaching is share resources, and some of those resources are awesome people like yourself, where people can learn from." - Brandon

"Meet security where you are. See things that are security-related in your current role." - Brandon
"Security is everyone's responsibility. Go out and find it, do it, learn about it, and suggest things." - Brandon

Socials and resources:
https://www.linkedin.com/in/techbrandon/
https://twitter.com/TechBrandon
33 min
August 18, 2023A Conversation about Hack Red Con with Dan and Ken
About The Guest(s):
Dan and Ken are the founders and coordinators of Hack Red Con, and Hack Space Con. They are passionate about bringing hands-on technical training and mentorship to the cybersecurity community. They believe in the power of community and strive to bridge the gap between experienced professionals and those just starting out in the industry.
Summary:
Dan and Ken discuss their upcoming conference, Hack Red Con, and the mission behind it. They emphasize the importance of hands-on training, mentorship, and building connections within the cybersecurity community. They also share stories of how their organization has helped individuals from low-income and at-risk communities find jobs and change their lives. The conference aims to provide a unique and accessible experience for attendees, with a focus on community and education.
Key Takeaways:
Hack Spacecon is a hacker conference that focuses on hands-on training, mentorship, and building connections within the cybersecurity community.

Volunteering at conferences is a great way to build relationships, gain experience, and give back to the community.

CTFs (Capture the Flag) are an important part of cybersecurity training and provide opportunities for competition, camaraderie, and skill development.

The conference aims to bridge the gap between experienced professionals and those just starting out in the industry, with a focus on supporting individuals from low-income and at-risk communities.

The organization offers scholarships, education vouchers, and job placement assistance to help individuals break into the cybersecurity field.

Quotes:
"We wanted to take a more hands-on approach towards what we, as founders, have a lifetime of experience in: hands-on technical training, getting involved, and learning by doing." - Dan

"Volunteering at conferences is an amazing way to build relationships, both on a personal and business level, and to impact people's lives." - Ken

"CTFs are a great way to not only compete and prove yourself, but also to build friendships, connections, and camaraderie within the cybersecurity community." - Dan

"Our goal is to get people into a better economic position by providing training, mentorship, and job opportunities." - Ken

"Teaching others and mentoring them is a high that helps both the mentor and the student learn and grow." - Dan

Socials and Resources:
https://www.hackredcon.com/
https://twitter.com/HackRedCon
https://www.linkedin.com/company/hackredcon/
https://twitter.com/k3nundrum
https://discord.gg/YaNp8SfUfj
53 min
August 10, 2023The Importance of Quality Pen Testing: A Conversation with Katerina Tasiopoulou
About The Guest:
Katerina is the CEO and founder of Exelasis, a cybersecurity organization that focuses on elite pen testing and advanced security testing. She is one of the first female CEOs in the industry, and she is passionate about bringing the elite back into cybersecurity and promoting the importance of pen testing.
Summary:
Katerina discusses the commoditization of pen testing and the need for organizations to prioritize quality over quantity. She explains the difference between pen testing and red team operations, emphasizing that pen testing is coverage-based while red teaming is objective-based. Katerina also shares her thoughts on the role of AI in pen testing and cybersecurity, highlighting the importance of human expertise and the need for ethical guidelines in AI development. She emphasizes the need for organizations to invest in pen testing and validate their cybersecurity measures to ensure the safety of their digital assets.
Key Takeaways:
Pen testing is coverage-based, while red teaming is objective-based.

AI can enhance pen testing, but it cannot replace the human expertise and ethical decision-making required in cybersecurity.

Organizations should prioritize quality over quantity when it comes to pen testing and invest in elite testing to validate their cybersecurity measures.

Pen testing is crucial in identifying vulnerabilities and reducing exposure, but it cannot guarantee 100% security.

Quotes:
"Pen testing really lost the eliteness it could have had. It's become a checklist." - Katerina

"Red teaming is an objective-based exercise. It will tell you if the ultimate objective is achievable or not." - Katerina

"AI cannot possibly go into an organization and have that logical thinking saying, 'I'm not going to touch that because it's a real customer.'" - Katerina

"We want to enhance, not replace. Use AI to enhance, not to replace." - Katerina

"Pen testing is not commodity. It's a lot more elite, it's a lot more strategical." - Katerina

Socials and Resources:
https://www.linkedin.com/in/katerina-tasiopoulou-a71424128/
https://www.linkedin.com/company/exelasis-ltd/
www.exelasis.com
34 min

About Phillip Wylie Show

From the publisher's feed

The Phillip Wylie Show is a premier cybersecurity podcast and media source for offensive security professionals. Hosted by Phillip Wylie, globally recognized ethical hacking expert, keynote speaker,…