Hack Log

Penetration Testing Hub › the full series of practical guides Before you do anything Only test systems you own or have explicit written permission to test. Unauthorised access to a computer system is a criminal offence in Ireland under the Criminal Justice (Offences Relating to Information Systems) Act 2017. Every guide on this site assumes […]

There is an easy version of this article. Search Shodan for a building-automation port, count the results, and publish a number with the word “exposed” next to it. It takes ten minutes and it is wrong, usually by a large factor, and anyone who checks the working will find that out. This is the other

Every article in this series has quietly depended on a switch behaving correctly. Passive asset discovery assumed the mirror port copied the traffic you needed. Segmentation testing assumed VLANs separated what they claimed to separate. Detection assumed the sensor saw every packet worth alerting on. If any of those assumptions is wrong, the work built

Enterprise network detection is hard because enterprise networks are chaotic. A user opens forty tabs, a laptop joins from a hotel, a new SaaS tool appears without anyone telling security, and the traffic profile on Tuesday bears no useful resemblance to Monday’s. Anomaly detection in that environment generates alerts nobody can triage. Industrial networks are

Every industrial site will tell you the OT network is segmented. Most of them believe it. A fair number are wrong, and the interesting thing is that they are rarely wrong about the firewall – the firewall is usually configured exactly as designed. They are wrong because a path exists that the design never contemplated.

Modbus was published in 1979, for serial links, by a company making programmable controllers for General Motors. It has no authentication, no encryption, no session concept and no integrity checking beyond a link-layer checksum. It is also, more than four decades later, one of the most widely deployed industrial protocols in the world. That combination

Ask an industrial site for its asset inventory and you will usually be handed a spreadsheet. Ask when it was last verified against the network and the answer is often a shrug, or a date that predates the last two upgrade projects. That gap matters more in operational technology than almost anywhere else. You cannot

Most security testing advice assumes that the worst thing you can break is a web application. In operational technology, the worst thing you can break is a process – and processes move pumps, valves, conveyors and turbines. That difference is why every OT walkthrough on CyberLabs starts in a lab rather than on a live