7 Minute Security

7 Minute Security is a weekly information security podcast focusing on penetration testing, blue teaming and building a career in security. The podcast also features in-depth interviews with industry leaders who share their insights, tools, tips and tricks for being a successful security engineer.

7MS #734: Insight Recon 08/07/2026

7MS #734: Insight Recon Hey friends! Today’s episode is a two-parter: some security stuff up front, and then a big ol’ personal celebration on the back half. If you’re strictly here for the security bits, I love you and you’re free to bail after the first half. If you’re here for both, God bless you. Part 1: Kicking the tires on Insight Recon What it is: is an Active Directory security assessment tool out of Heath Adams’ new venture, . I signed up for early access a while back, finally got a login, and took it for a spin this week in my lab. Not a sponsor, not an ad — just a tool I was curious about. Watch it in action: I covered the install, a couple of hiccups I hit, and some of the report output in this week’s TuesdayTOOLSday video over at . The setup: Log into the portal, grab the installer, run it on a domain-joined box, then pick whether you want to scan as your current user or specify creds. Say go, wait a few minutes, and your report card shows up on the dashboard. My two nitpicks (and they’re mine, not necessarily yours): The download does a full-blown install with an install footprint, and the raw scan data gets shipped back up to Insight Recon so you can view your report. I can’t help but compare everything in this space to , where you unzip, run the EXE, and your HTML report is sitting right there on the C drive — nothing leaves the building. As someone who tries to be a good data janitor and nuke assessment data after reports go out, cloud storage is just one more place I’ve got to remember to go scrub. What I really liked: The remediation guidance is legit. I clicked into a few of the critical findings — some ESC/ADCS stuff especially — and it walked me through exactly what to change, why an attacker cares, how to verify the fix afterward, and where to go read more. There’s also a “quick wins” view that pares the big list down to the biggest security impact for the least effort. The dashboard and the slide-out detail panes are genuinely pleasant to use. Why this matters even for offense-only folks: We’re mostly on the offensive side with a little blue team consulting — we don’t do hands-to-keyboard remediation. But I think you become a better pentester when you can speak confidently at delivery time about not just what to fix, but the gotchas that might bite them along the way. Pricing: On the podcast I guessed “a few thousand a year” and admitted that number may have come straight out of my bum cheeks. Turns out I wasn’t too far off — there’s a free tier to start, and paid runs $3,000/year with founder pricing at $1,500/year locked in for the first 25 customers. See for the current details. Verdict so far: A promising first dance. I want to give it a proper workout — run it side by side with PingCastle on a couple of real assessments and see if either one has blind spots the other covers. More on that in a future episode. Part 2: Why I’ve got the giggidies My son Cam graduated paramedic school! As of tonight he has everything signed off to go take the gargantuan national test. I’m not going to pretend I got through recording this without getting a little watery-eyed. The journey: Senior year of high school, nothing career-wise floated his boat — there were subjects he tolerated and subjects he hated, and that was about it. Then a conversation with a family friend who’s a paramedic lit a fire in his belly, and he’s been running at it ever since: EMT coursework in high school, then straight into the paramedic program. How he did it: He wrestles with ADHD, so he had to figure out how to hack his own brain to get through a mountain of material. Come home from five or six hours of class, eat dinner, then hit the books again and re-take his own notes. Then he’d sit down with my wife or me and do an Ace Ventura-style verbal dump of everything he’d learned that day — and any time he caught himself glitching on something, he’d write it down, keep going, then go back and shore it up. Every single night. The Mr. Miyagi moment: My wife has been a nurse for 20+ years, and about six months ago she had to tell him she couldn’t help anymore because he’d surpassed her in certain areas of healthcare. Yes, AI made a cameo: The night before his final scenario testing, he and I sat down and had Claude generate random practice scenarios so I could prompt him and just watch him talk for two minutes straight about airway management, medication dosing, all of it. The cliffhanger: Four-ish hours of individual scenario testing, an hour-and-a-half drive to the ceremony, and no word either way on if he passed his tests. I hit the front door of the building not knowing whether I was walking into smiles or tears — and right as my hand hit the door handle, a text came in with a giant happy face: I passed. Somebody must have been cutting onions in that parking lot. His people: Cam’s the youngest of the bunch — most of his classmates had been working EMTs for years — and from day one they told him “we got you, we’ll get through this together.” For the group photo on the steps afterward, one of them tried to pick him up solo and just about threw her back out, so it took three of them. That’s the little family he’s got, and I hope they stay close, because they’ve all got that beast of a test coming next month. The hard part: If you’ve listened to the last few episodes, you know my dad passed away at the end of June, and that Cam was the one who found him and sprung into paramedic mode. My dad was a cop and a pilot who had enormous respect for paramedics, EMTs, and nurses, and he was one of Cam’s biggest cheerleaders. Whenever I did something my dad was proud of, he’d say, “I’m busting my buttons over here!” That’s exactly what he’d have said tonight, and not having him here to say it is a karate kick to the heart. But I’ll tell you what — I’m busting my buttons about Cam for the both of us. Thank you: So many of you have reached out with condolences and shared stories of your own losses these past weeks. I’m sorry for every one of them, and I appreciate you more than I can say. Thanks for listening — to the security stuff, the tangents, or both. Come find us at , and/or subscribe (free or paid) over at , and dig through the our notes at . /episode/index/show/7minsec/id/42358690

7MS #733: Tales of Pentest Pwnage – Part 87 07/31/2026

7MS #733: Tales of Pentest Pwnage – Part 87 Hey friends! Today’s episode comes to you from a parking lot in the rain, with a mint hot cocoa in hand and your host absolutely dragging his butt (D-R-A-G-G-I-N-G, not D-R-A-G-O-N – I’ve never seen a dragon’s butt and can’t speak to how mine compares). I’ve had a bunch of internals back to back lately and I’m basically a drooling dog who found a frisbee and refuses to put it down. Sleep be darned. So instead of walking through one test start to finish, I want to share a few things that have helped me claw out a foothold in environments that are otherwise really locked down: The “good problem” of a mature client – several of these engagements are third- or fourth-year tests, and the clients actually clear findings off the board. Which is great for them and rough for me, because this year’s test shouldn’t look anything like last year’s. All my favorite go-tos came up empty – machine account quota set to zero, no broadcast traffic tomfoolery ( and mitm6 got me nothing), SMB signing on everywhere, ADCS either absent or buttoned up, and a low-priv account that says has zero interesting permissions and zero local admin anywhere. Cool cool cool. When the network’s clean, go file-hunting – which means firing up and letting it comb the shares. Normally that wraps up in about an hour. On these engagements it was running three and four hours. Then Windows told me I was out of disk – I like having Snaffler pull down copies of interesting files so I can review them locally instead of authenticating to each share. Turns out it had grabbed 50-60 gigs and left me with about eight gigs of breathing room. Tip #1: put a 1 TB drive in your drop boxes – I ran with tiny drives for years early in the 7MS days and it was always a pinch. Beyond situations like this one, sometimes you find a giant backup file or VMDK on a share and you need somewhere to put it so you can crack it open and go shopping. Tip #2: you can grow a VM disk on the fly – in Proxmox you can resize the disk on a running VM, then hop into Disk Management inside Windows and extend the C drive. Instant elbow room, no downtime. Death by a million tiny files – the real culprit was one file extension I should have excluded, and the client had hundreds of thousands of them. Rather than restart a run I was already hours into, I had AI whip up a little PowerShell loop that swept the Snaffler dump folder every 10 minutes and deleted the extensions I didn’t care about. Woke up the next morning to a finished run and plenty of free space. Making a gig-sized log file readable – I fed the log into , a slick web interface for Snaffler output that lets you filter down to just the red stuff or just the likely-credential files, and sort by modified date. Watch those timestamps – I kept finding AD creds in documents, then comparing the doc’s date against the account’s last password reset in BloodHound and discovering the file was a year stale. Son of a biscuit. The tool that actually cracked it open: – my pal Jeff McJunkin recommended this to me years ago, I talked about it on the show once, and then inexplicably forgot about it. Not a sponsor, no kickbacks, just a paid tool that’s earned its keep. It’s basically Google for your hard drive. How I use it – install it on the Windows VM, clear out the default indexing scope entirely, and point it only at the Snaffler dump folder. The top tier (about a hundred bucks a year) will chew through PSTs, DWGs, Office docs, PDFs and more, and it OCRs images too. Indexing took the better part of a day on these engagements, but then search is instant, and it previews basically every file type without Office installed. Years ago this same tool surfaced a photo on a file share of a piece of printer paper where a sysadmin had handwritten a 40-character admin password in Bic pen. OCR for the win. What I search for – the obvious stuff like “password,” plus the domain name, “plain text,” and things like “=sa” to sniff out SQL admin creds. Nuggets and threads to pull – sometimes a hit is the gold. Other times it just tells you where to go dumpster-diving like a raccoon on the live share. That’s how I found upgrade project plans with multiple teams and contractors involved, half-cleaned-up temp work, and high-privilege system, database and local admin creds just sitting there. Worth the hours – these didn’t all end in domain admin, but they were rich, real findings, and a great teaching opportunity about what’s sitting wide open to Domain Users. (Bonus: Copernic can also point straight at a UNC path with your AD creds and index it live.) Know a free alternative? – one of my favorite parts of doing this podcast is when someone writes in with “hey, there’s an open source thing that does that.” If that’s you, I’d love to hear it! Also, on this week’s I walked through getting a self-hosted Bitwarden password vault (and file sender) up and running on Linux, and there’s now a cheat sheet over at that’ll get you there in about seven minutes – all the commands from the official install guide in one place, with a couple of gotchas flagged. Last thing: subscriptions to are free, but paid subs help cover hosting and the time this takes each week, and they’re getting some exclusive content soon. No guilt trip here, Mom – I’m going to keep barfing up everything I learn either way. But if you’ve got the means, I’d sure appreciate it. /episode/index/show/7minsec/id/42278110

7MS #732: Tales of Pentest Pwnage – Part 86 07/24/2026

7MS #732: Tales of Pentest Pwnage – Part 86 Hey friends! Welcome back to another Tales of Pentest Pwnage — my favorite mini-series where I share the good, the bad, and the “why didn’t I check THAT first?!” moments from real-world engagements. Today’s story has a little bit of everything: a legit path to domain admin, some late-night rabbit holes, a lesson in humility, and a villain you’ve definitely met before. (Spoiler: it’s DNS.) A couple of quick plugs before we dive in: Private GOAD training is going strong! — We just wrapped a 3-day private session (7 students — that’s max capacity!) of our Active Directory pentesting class built on the framework. Over three days, students enumerate, attack, and fully pwn three separate AD environments. The private format is just *chef’s kiss* — when it’s a team from the same company, the conversation gets real fast. Like, “hey I just checked Bloodhound on break and Bob from accounting has full rights over the DC” real. If you want to send 3–7 people from your org, hit up to line up a private session. Support the show over at — That’s our Substack, where every Tuesday I drop a short TuesdayTOOLSday video about security tools. Free subscriptions are welcome and mean a lot — you’ll just get pinged when new content drops. No spam, no blindly-sent Outlook calendar invites. I promise. Pentest tips and scripts live at — I reference it throughout today’s episode, including some step-by-step guidance on the techniques we’ll talk about below. Now — onto the pwnage. Fair warning: I’ve been burning the candle at three ends lately trying to catch up after a tough few weeks of grief (if you want the backstory, the last couple episodes cover my dad passing away). The good news is my head is semi back on straight and I put it to work on a recurring client environment — one that keeps getting better year over year. Machine account quota locked down? Check. No Kerberoastable or AS-REP roastable users? Check. No local admin rights, no web client running? Check and check. All good signs. And then smiled right into my eyeballs with a big red finding: The DC’s LAN Manager authentication level was weak enough to coerce and capture a downgraded hash — Specifically, an NTLMv1 SSP hash. Using to nudge the DC into authenticating to my Kali box (with Responder running), I captured the goods. Pretty little hashes all in a row. Cracking that hash: enter — The old go-to for this type of crack used to be , but their cracker has been offline for years. What they do still have is a walkthrough pointing to a tool from EvilMog on GitHub that helps you prep the raw hash material and figure out exactly how to crack it with Hashcat. For the GPU horsepower, I rented a beefy multi-GPU instance on Vast.ai — filter for 16+ GPUs, pick a Hashcat Docker image, and SSH in. The whole crack job took about 16 hours at ~$4/hr. Do the math: $64 to reconstruct the DC’s NTLM hash. Worth it. Tmux sidebar — seriously just learn it — Vast.ai is actually what finally got me into , because the Hashcat Docker container drops you right into a tmux session. This is clutch: you can kick off a 16-hour crack job, detach, and reattach later without killing anything. On a pentest, my workflow now is SSH in → tmux → name a few session windows for Responder, Exegol, packet captures, etc. I used to fumble around with Linux screen sessions. Not anymore! From hash to DA — the usual playbook — Once you’ve got the DC’s NTLM hash, you can request a Kerberos ticket and load it up, then run a DCSync to pull the KRBTGT hash. From there it’s god mode: dump hashes, pass-the-hash as domain admins, and you have yourself a cool privesc POC. Except this time…the POC didn’t work. The part where I Jean-Claude Van Damme helicopter kick myself in the face — DCSync failed immediately. Like, suspiciously fast — barely two lines of output and done. I tried every version of every tool I could get my hands on. I tried Windows, I tried Linux. I even asked the client to check if their endpoint protection was blocking me (it wasn’t). I touched grass. I played guitar. I played some Splinter Cell Blacklist (old game, highly recommend if you like the Hitman-style vibes). Came back fresh. Rebooted both VMs. Still nothing. It was DNS. It’s always DNS. — The thing that finally caught my eye: the commands were failing too fast. Like it wasn’t even reaching the DC. I catted the resolv.conf inside my instance (heads up: Exegol has its own resolv.conf and hosts file, separate from your base Kali system!) and found a stale DNS entry pointing to an old DC that was no longer serving anything. Nuked the bad entry, added static hosts file entries for the live DC, ran the command again, and — hash rain. Pennies from heaven. It was midnight and I literally pushed back from my desk like a baby pushing away from a high chair going “Baby Brian is all done!” The lesson: — I know the meme. “It’s always DNS.” I just personally hadn’t hit it hard in my security life since my sysadmin days back before 2013. Now I have. So going forward I’ll check DNS first (and often). Vacation attempt #3 incoming… pray for me — My wife nearly died in Punta Cana earlier this year. Then our summer cabin trip was cold and rainy with zero water time. And now we’ve got families flying in from multiple states for a lake weekend — except we just found out our reservation through Booking.com was basically vaporized because the resort changed hands and never updated their website. My wife (who is an absolute saint and my better three-quarters) almost had a 360-degree head spin (like in The Exorcist) talking to customer service. But we scrambled, found a last-minute place, and I’m choosing to believe it’s not in Jason Voorhees’ back yard. Could this be my last episode? Maybe. But hey — it was a good one. Talk to you next week (hopefully). /episode/index/show/7minsec/id/42177375

7MS #731: CARTP – Cloud Red Team Tactics for Attacking and Defending Azure – THE FINAL CHAPTER! 07/17/2026

7MS #731: CARTP – Cloud Red Team Tactics for Attacking and Defending Azure – THE FINAL CHAPTER! Hey friends! Fair warning: today’s episode is a bit of an emotional rollercoaster — we’ve got a big security win, some honest lab feedback, and a very personal share about my dad’s funeral. Buckle up. certified, baby! — I’m officially a , courtesy of the folks at . It’s been a long time coming (I originally signed up for the live version and fell off after missing a couple Saturdays), but I came back for the self-paced 30-day version and finally finished the job. The lab experience — the good: — ~25 objectives, a solid lab guide, and a really fun variety of attack paths. Highlights include stealing tokens, enumerating Azure tenants, attacking apps and VMs and key vaults, simulated phishing against real tenant email addresses, popping reverse shells, and some clever OneDrive-based follow-on attacks via session hijacking. There’s even some web app pen testing (hello, server-side template injection!) sprinkled in. The lab experience — the not-so-good: — The included videos are… not my favorite format. Think notepad-on-screen copy-paste tutorials with zero context. To fill in the gaps, I leaned heavily on Claude — pasting blobs of the lab guide and asking things like “why did stealing this token give me X but not Y?” — and it did a great job standing in where a live instructor would normally add color and context. Exam tips (spoiler-free, I promise): — A few things that helped me: I had Claude build me a CliffsNotes study guide from all our study-session chats — token context, command flags, the works. Before hitting start on the 24-hour clock, I fed Claude a list of all the tools I’d been using in the lab and had it build a one-shot PowerShell script to pull them all down from GitHub onto a fresh Windows VM. If your exam lab environment fails to spin up (as mine did in the US region), just try a different region — UK worked great for me. Enumerate. Enumerate. Enumerate. Know your tools, know which ones cover which areas of an Azure tenancy, and know how to get more verbose/tabular output when you need it. Take screenshots and notes as you go — the lab closes after 24 hours and you’ve got 48 hours to submit your report, so if you forgot to grab a screenshot of a flag… you are SOL, my friend. The exam itself: — I started around 5:30 p.m., wrapped up around 11 p.m., and had the final flag captured, a full Word report drafted, and was in bed at a reasonable hour. Submitted the report the next morning after the gym and a mint hot cocoa, and had my pass confirmation back well within their 7-business-day window. Private pen test training is happening: — I’m currently running a private 3-day session of our Active Directory pen testing class (version 2.0 — it got a big facelift!). It’s built on the platform and we fully pwn three separate domains over the course of three days. If you can send 3–7 people, reach out at to line up a private session. I’m also building an interest list for a public version later this fall (reach out if interested)! Also: check out 7MinSec.club — I dropped a little show-and-tell video over on this week giving you a peek at what the training looks like in action. Dad’s funeral: — I shared some words at my dad’s service this past Saturday and wanted to capture them here while they’re fresh, since this podcast is basically my journal at this point. The service was perfect — very “him.” He’d actually written funeral instructions (yes, they literally sat in a safety deposit box for years) specifying things like: max 10-minute message from the pastor, specific Bible verses, specific songs, and — my favorite — if the service runs over 45 minutes, someone needs to pull the fire alarm. He came up with that final instruction at his brother’s funeral, which ran nearly two hours. He leaned over, squeezed my knee and said, “If my service goes over 45 minutes, pull the fire alarm.” The song: — I played and sang at the service. The song was “Jesus Savior Pilot Me” — not a personal favorite of my dad’s exactly, but he called it “the one about Jesus flying airplanes” after seeing me perform it years ago at the Minnesota State Fair chapel. I practiced it in the car on the way to Caribou every morning until I could get through it without crying. My guitar teacher’s advice: close your eyes, focus on your fingers, and pretend you’re just playing a tune in a room. It worked. Mostly. Thank you: — Seriously, so many of you have sent kind messages and I just want you to know it means the world. He taught me a lot about being a good dad, a good husband, and how to live with passion, a good attitude about your work, and a heart for serving others. /episode/index/show/7minsec/id/42123380

7MS #730: Baby’s First Project Swarm 07/10/2026

7MS #730: Baby’s First Project Swarm Hey friends! Still your grieving pal over here, but also your swarming friend and Protecting My Network Edge host — because this week I’ve been tinkering with something called and I’ve got my diapers on regarding it, but I really, really like what I see so far. Then, fair warning, I flip on the tangent light and verbally barf up some personal stuff at the end. I’ll make the hand-off super clear, so if you want your free security podcast to do exactly what you want and nothing else — totally fair, and you won’t offend me by hopping off. Here’s what we cover: What is Project Swarm? This comes to us from our friends over at GreyNoise. It centers around little sensors you deploy to the edges of your network that you can dress up to look like just about anything — attracting flies to the honey, if you catch my drift. You get more enumeration, insight, and logging into whatever shenanigans those flies are using to poke at your edge. Setup was refreshingly easy: You need a very low-powered VM or hardware device (my understanding is it even works on a Raspberry Pi) mapped to a public IP, plus a free GreyNoise account. You generate an API key, copy-paste a one-line install, and off it goes. I threw mine on a tiny Ubuntu VM. The part where I didn’t read the flipping manual: Mid-install my SSH connection dropped and I’m going “what the heck?!” Turns out the installer intentionally moves your real SSH to some arbitrary high port — so you can run a fake SSH honeypot on 22 while your legit connection lives elsewhere. Once I spotted the new port in the console, a quick firewall tweak and I was back in. Profiles give me level 14 giggidies: Once your sensor checks in, you assign it a profile. Vulnerable WordPress, Tomcat, a Cisco AnyConnect VPN, FTP honeypot, SSH honeypot — kind of all the honeypots. I went with a vulnerable WordPress instance. My one complaint: you can only assign one profile per sensor. My dream scenario of an SSH honeypot AND an FTP AND a vulnerable Tomcat all on one box will have to wait (or maybe that’d look too suspicious and scare the baddies off — who knows). The results were wild: Within a couple days I had thousands of connections, several flagged as malicious and tied to known botnets. I could see source IPs, malicious labels, whether they were residential or company or Google, and even download raw packet captures. There’s clearly more telemetry to dig into (what people tried to spray into the login portal, etc.) — I meant to go deeper before recording and didn’t, so consider this a “to be continued.” Why do I care, since I’m not defending some huge infrastructure? Honestly it started as a brain break. But I’ve been testing a ton of external networks lately and nearly every company site is WordPress — which now powers around 43% of the internet. Running my own WordPress honeypot gives real oomph to those “your out-of-date WordPress is a big deal” conversations, where I can say “I run a WordPress honeypot and here’s the aggressive password spraying and plugin/theme enumeration I’m seeing right now.” See it, don’t just hear it: I show the actual portal, sensor config pages, and more over on this week. Why not both, right? It’s like that meme. GreyNoise also has a Project Swarm user webinar coming up — check their events page. And to be crystal clear: they are not a sponsor, this is all free, and I just think it’s clever. Life update (the tangent portion): About the time you hear this, I’ll be on my way to my dad’s funeral, where I’m sharing some words and singing a song. I’ve been practicing like a madman per advice from my music director friend and guitar teacher — including a little brain hack of focusing hard on my fingers to stay a half-step removed from the emotion. And if I cry my face off up there? Who cares. This isn’t America’s Got Talent; it’s the gesture. I’ll be honest, 2026 has been a rough one, but I promised two bright spots and here they are: my son Cam (about to finish paramedic school) has been keeping grandpa’s spirit alive by wearing my dad’s shirts, sunglasses, and Apple watch, and getting a Cessna tattoo with my dad’s actual handwriting and birth year. And you all — the kind words, the offers to talk, the shared stories — reminded me there are a whole lot of good people out there. Thank you for that. One more thing on the horizon: My brain’s been a squirrel on pixie sticks, but for whatever reason I’ve been happily grinding the as a little vacation for my mind. I might take a swing at the exam this week — start it in the evening, grind a few hours, sleep, finish in the morning (I’m too old for 24 hours straight). I might pass, I might fail spectacularly. Either way I’ll keep you posted, and if I get the cert, that’s probably next week’s topic! /episode/index/show/7minsec/id/42037970

7MS #729: Pwning Dracarys 07/04/2026

7MS #729: Pwning Dracarys Hey friends! Still your grieving pal over here, but also your happy hacking host — because today we’re diving into baby’s first ! (Yes, I’m probably pronouncing that wrong. Yes, I’m going to keep saying it anyway.) Quick housekeeping: A few days ago I published a mini-series episode from our series, where I shared the news that my dad passed away last Friday. So many of you reached out with condolences — thank you from the bottom of my heart. I’ll share a little life update at the end of this episode. But first — Dracarys! I didn’t know it existed until recently. If you knew about it and didn’t tell me, I’m mad at you. But we made up. We’re friends forever. Here’s what we cover: What is Dracarys? It’s a smaller, CTF-style Active Directory pentesting lab from the same crew that brought us Game of Active Directory (GOAD), GOAD-SCCM, GOAD-Light, and Ninja Hacker Academy. Where GOAD holds your hand through the vulnerabilities, Dracarys and Ninja Hacker Academy take more of a “here’s your starting point, now figure it out” approach — which I love. The lab setup: One Linux VM, a Windows domain controller, and a Windows application server. Your only hint? Start with the Linux box. That’s it. Good luck! TuesdayTOOLSday preview: Over on , I did a TuesdayTOOLSday episode walking through initial setup — getting your hosts file configured, running a NetExec sweep to map out the attack surface, and doing some light enumeration on that Linux box. No big spoilers, just enough to get your Kali box ready to rock. What I’ve learned since: After the TuesdayTOOLSday recording, I kept digging. My methodology has been: nmap to identify open ports and service versions, then research whether any of those versions have known exploits. Once I spotted an interesting web service, AI pointed me toward FeroxBuster for directory and file enumeration — a tool I hadn’t used before but am now a huge fan of. It’s fast, configurable, and once I got my scan tuned properly… I found a jewel. That jewel feels like the next step deeper into this lab. More on that in future TuesdayTOOLSday episodes! Shameless plug: All of this walkthrough content lives at . Subscriptions are free, and subscribing just means you get an email when I publish new content. No spam, no sales pitches — just hacking stuff. (And if you want to financially support the show, there’s a paid tier too. Just sayin’.) Life update: We’ve moved into funeral planning mode. My dad, thankfully, had already mapped out his whole service — the pastor, the verses, everything — which has made things a little easier. We’re picking photos for a tribute slideshow and I’ve been asked to share some words and sing a song. The song I chose is “Jesus, Savior, Pilot Me” — which my dad once described as “that song about Jesus flying airplanes.” (He wasn’t wrong. Sort of.) I’ve been practicing it all week and can barely make it through verse two. Prayers, good vibes, and a large supply of Kleenex would be appreciated. Again, you can find the Dracarys lab . And if you’re not already on , come hang out — that’s where the deeper dives live. /episode/index/show/7minsec/id/41958325

7MS #728: Securing Your Family During and After a Disaster – Part 8 06/30/2026

7MS #728: Securing Your Family During and After a Disaster – Part 8 Hey friends! This is a tough one to write. My dad passed away on Friday, and instead of the hacker-y tech episode I had planned, I pivoted to something more personal — another installment of our “Securing Your Family During and After a Disaster” series. I talk pretty raw and transparently today about loss, grief, and the practical stuff that makes a hard situation just a little less hard. Fair warning: it’s about death and dying, so if that’s not where your head is today, it’s totally okay to duck out – we’ll catch you next week. Here’s what I cover: My dad’s last day — He spent Thursday doing all his favorite things: chainsaws, ATVs, trap-shooting, mowing, and weed-whipping. Then Chinese food with the family and marveling at modern video games for the first time since the Atari 5200. It was, by all accounts, a perfect day for him. How we found out — My son Cameron, who’s finishing up paramedic school, was visiting and sprung into EMT mode when my dad was found unresponsive Friday morning. He did CPR for 10 straight minutes — on his grandpa, who was his favorite person in the world. That’s the stuff that’s going to stay with Cam (and me) for a long time. Getting some closure — Cameron had the presence of mind to ask the paramedics to leave my dad in place so I could have a few minutes with him when we arrived. That was both devastating and, in its own way, healing. Why pre-planning your funeral is a gift to your family — My parents had nearly everything already picked out: the pastor, Bible verses, music, the military honors ceremony, photos for the display board, and even a time limit on service length (45 minutes and no more!). My dad had pre-written his own obituary. When we sat down with the funeral home, the heavy lifting was already done — and that was a genuine gift to all of us in an incredibly hard moment. Storyworth — seriously, do this — Years ago we signed my dad up for , a service that sends your loved one a weekly question via email (things like “What’s your earliest childhood memory?” or “Do you have any regrets?”) and compiles their answers into a hardcover book. It runs about $100. Reading that book the last few nights has been incredibly comforting — including finding out my dad started smoking at age 8 using used cigarette butts rolled in toilet paper. Gross! Get your end-of-life wishes in writing — My wife’s mom had verbally told us she wanted to be cremated, but it wasn’t documented, and other family members made a different call. My dad put “cremation” right in his paperwork, no ambiguity. My recommendation: have this conversation with your loved ones, write their wishes down and make them official. Funeral home “upsell” moment — I had no idea there were apparently 627 ways to incorporate your loved one’s remains into keepsakes — pendants, rings, necklaces with fingerprints, biodegradable urns for water scattering, etc. Some family members were very into this. I was not quite ready to turn my dad into an Atari cartridge, but your mileage may vary. On grief itself — Everybody handles it differently, at different speeds and intensities. My approach is to head straight into it rather than put on a happy face and deal with unprocessed grief years later. I encourage everyone — especially the kids — to not hold back. Ask the questions. Tell the stories. Cry if you need to. Give each other grace. Coming up next week — Back to pentesting content! I’ll share details on a new lab from the folks who brought us Game of Active Directory, and I’m getting back on the CARTP (Certified Azure Red Team Professional) horse. I’m also tentatively eyeing the third Thursday of July for an unedited livestream of owning Ninja Hacker Academy from start to finish — Kali setup, tools, Mythic C2, BallisKit obfuscation, the whole thing. More details to come. If you’re the thoughts, prayers, and/or good vibes type, I’d really appreciate you sending some my family’s way over the next few weeks. /episode/index/show/7minsec/id/41895850

7MS #727: Securing Your Mental Health – Part 7 06/19/2026

7MS #727: Securing Your Mental Health – Part 7 Hello friends! It’s been over a year since we did a dedicated mental health episode, so today I’m doing a big catch-up and running through my 7-point plan for being a more mentally secure me. None of this is professional medical advice (I am most definitely not a doctor or therapist — well, actually, I am in therapy, but that’s tip #5), so take what’s useful and leave what isn’t. Terms and conditions apply. Here’s my current mental health toolkit: Drink a ton of water — I try to chug a full Yeti thermos before my morning mint hot cocoa, then keep it going throughout the day. I taper off around dinnertime to minimize, uh, nighttime tinkle stops. Science agrees this does good things for your brain. Brick your phone — I’ve been using a little Bluetooth device called that hooks into your phone’s screen time features so you can block distracting apps on demand or on a schedule. I’ve got a “Brian Needs Sleepy” timer set for 9 p.m. every night — pretty much everything except the clock app goes dark. Outlook, Gmail, all the socials — gone. It’s not revolutionary advice, but it turns out doing what people have been telling you to do for years actually works. Get enough sleep — Directly related to the Brick. Phone goes dark at 9 p.m., I yap with Mrs. 7 or we watch a show, and by 10:30 p.m. my peepers are drooping. I feel more refreshed and less anxiety-ridden during the day. Supplements — I’m not here to hawk some magic elixir with 47 mystery ingredients. What I’m currently trying is — a powder you mix into water. It’s got magnesium glycinate, L-theanine, vitamin D3, and ashwagandha. I thought it was placebo at first, but kept it up for a week and noticed a legit mood/pep boost. Your mileage may vary, but it’s doing something for me. Therapy — I’ve been in therapy since 2019 when my house burned down (link to those episodes if you want to get thoroughly bummed out). If I could go back, I’d have started way earlier. The biggest benefit for me isn’t some parade of uplifting affirmations — it’s having a neutral third party with no stake in my life help me see situations from different angles and cut myself some slack. Take care of the TMJ — A few years back I started getting tinnitus bad. ENTs were basically like “yep, try not to think about it” — super helpful, guys. Eventually a jaw specialist found an irregularity on the left side of my jaw and fitted me with a heavy-duty custom mouth guard. That alone made a monumental difference in the ear ringing. But I also picked up a on a chiropractor’s recommendation — it’s a 3D-printed vibrating/heated massager specifically designed for jaw muscles. Looks exactly like a vape (fun times at the airport), but it’s been worth every penny of its ~$200 price tag. Between the mouth guard and the TMJ Pen, I wake up feeling way less like I survived a Saving Private Ryan scene. Forced fun — After a full work day plus all the dad/house stuff, my go-to is to be a blob on the couch. Nothing wrong with that sometimes. But I’ve found that the things that actually recharge me — like singing and playing guitar — require a little push to get started. So tip #7 is basically a note to future tired Brian: go downstairs, plug in the guitar, and start playing. You’ll be glad you did. Got mental health tips that work for you? I’d genuinely love to hear them — this is the kind of conversation I want to be two-way. Find me and all things 7MS at , our Substack at , and our constantly growing pentesting wiki at . /episode/index/show/7minsec/id/41613835

7MS #726: Baby’s First Hermes 06/12/2026

7MS #726: Baby’s First Hermes Hello friends! I’ve been on a bit of an AI agent journey lately, and today I’m sharing my experience ditching OpenClaw and going all-in on — a self-hosted AI agent built by . A sold me on it, I wiped my Mac Mini (again), and baby’s first Hermes adventure began! Here’s what we get into today: Why I left OpenClaw — After getting the Mac Mini set up, OpenClaw left me feeling pretty meh: burning through API requests, random mid-conversation shutdowns, and a marketplace where the top listings were flagged as “potentially malicious.” Hard pass. Network Chuck’s five reasons Hermes rocks — His video summarized why Hermes stands out: (1) Nous Research has serious open source model cred predating OpenClaw, (2) more flexible persistent memory via markdown files + optional Honcho integration for building a profile of you over time, (3) a mission around humanistic and democratic AI, (4) a self-improvement loop where it writes its own skills after figuring things out, and (5) it just doesn’t break — it feels like a product, not a project. The install — I used Claude to build a Mac Mini install guide from the Network Chuck transcript, and had Hermes up and running in about 15 minutes (one small Ollama hiccup aside). The install wizard lets you choose cloud models like Claude or ChatGPT, or go fully local with something like Gemma — I’m planning a hybrid setup with two Telegram bots. First real-world use: sitting in a truck running errands — With Hermes running on the Mac Mini and connected via Telegram, I asked it what it could do. It suggested Uptime Kuma for LAN monitoring — weirdly well-timed since I’d just been thinking about flaky IoT devices. I said “go install it,” and it did — narrating its own troubleshooting out loud the whole time like a little robot intern. Remote access and Home Assistant — Had it install Home Assistant for smarthome control too, with plans to wire up TwinGate for remote access (it had a TailScale skill ready to fire in about two seconds, but I’m trying to keep VPN services consolidated). Daily digest via email — Hooked Hermes into a dedicated Gmail account and set up a 6 a.m. cron job that sends me a personalized morning digest: weather for my watched locations, recent breach/CVE news from select sites, and a summary of my favorite pentesting-focused Mastodon accounts. Needs tuning, but the first digest landed this morning and it’s really good! The privacy angle — The real long-term win I see here is a hybrid model: feed raw, unsanitized pentest data to a local private model, let it analyze and sanitize, then hand off the clean version to a cloud model for deeper insight. Best of both worlds without the data exposure anxiety. Check out the that started it all, and as always, if you’re doing cool AI + security stuff, I’d love to hear about it. Find our pentesting services and training at , pentesting tips and scripts at , and if you want to support the show, head over to . /episode/index/show/7minsec/id/41613605

7MS #725: Building a Bulletproof Backup Solution 06/05/2026

7MS #725: Building a Bulletproof Backup Solution Hey friends! Backups are not as cool as pentesting, but boy do they matter when things go sideways. This week I’m sharing how a Proxmox backup disk space meltdown led me to a completely overhauled — and honestly pretty bulletproof — backup setup for both home and work. Claude played a big role in helping me sort it all out. Here’s what we get into: The backup history tour — I’ve been through CrashPlan, Dropbox, Backblaze (which saved my bacon after my in 2019!), and a mystery one that may or may not have had “Panda” in the name. These days I’m settled on for personal backups — dead simple, backs up to just about everything (Dropbox, OneDrive, Google Drive, even their own ARQ Cloud for ~$80/year), and all data is encrypted at rest. Not a sponsor, but they should be. The 3-2-1 rule — I actually asked Siri mid-episode, and she initially thought it was a grounding/anxiety technique. (Valid, I guess?) The real answer: three copies, two different media, one offline. I’ve got a local copy plus OneDrive, Google Drive, and Dropbox — so I think I’m covered. The work side: Proxmox + PBS — My “data center” is a beefy Hetzner Proxmox box with about a dozen VMs. I had Proxmox Backup Server (PBS) set up on a secondary Hetzner box, happily cranking away… until it ran out of disk space and started yelling at me every night. Claude to the rescue — I spun up a Claude project, fed it terminal output and retention configs, and it gave me a straight-up honest assessment: either gut your retention policy (risky) or get more disk. It then walked me through Hetzner’s auctions page — which I didn’t even know existed — to find a storage-heavy, low-horsepower box. Ended up with two mirrored 8TB drives plus a 14TB drive for around $40/month. Not cheap, but totally worth it as a business expense. The new setup — PBS is now on its own dedicated Hetzner box. VMs from both my data center and my home NUC Proxmox box back up there nightly. Claude also suggested using that 14TB drive as an SFTP target for ARQ, giving me yet another redundant copy of all my personal data. It’ll take a few weeks to fully sync, but I’m running some flavor of the 4-3-2-1 rule now (I made that up). Proxmox forever — Someone wrote in asking if I’d go back to ESXi now that Broadcom brought back the free version. Hard no. I’ve fallen in love with Proxmox and I’m not going back. 7MinSec wiki scripts repo — Head over to and click the Scripts button to find a new GitHub repo where I’m publishing pentesting scripts. First one up: a push-button Exegol installer. More to come — and I’ll probably tease new scripts first over at on TuesdayTOOLSday! Have a backup horror story — or a setup you’re proud of? Hit us up! And if you need assessments, pentesting, training, or other security goodness, find us at . /episode/index/show/7minsec/id/41548905

7MS #724: Tales of Pentest Pwnage - Part 85 05/29/2026

7MS #724: Tales of Pentest Pwnage - Part 85 Hey friends! Today we’re going deep on external network pentesting — something I realize we’ve barely touched in however many episodes we’ve done. I’m currently in a long stretch of back-to-back external assessments, so it felt like a good time to talk about it. Here’s what we get into: Scoping headaches — why the old “count your public IPs and multiply by a big hourly rate” approach drives me crazy, and how we actually scope external tests to be fair to everyone Web apps in scope or not? — this needs its own conversation before the test starts, and skipping it causes pain later Testing under real conditions — the debate around whether to request an allowlist vs. scanning as-is, and why I lean toward creating the best testing environment possible Multi-tool enumeration — why we run Nessus, Project Discovery, and Shodan together, and what each catches that the others miss Reporting the surface — why just walking a customer through what’s exposed to the internet (ports, services, screenshots) has more value than I used to give it credit for SNMP and NTP findings — two protocols that keep showing up open when they really (probably) shouldn’t be OSINT phase — how we’ve grown externals to include open-source intelligence work on the customer’s domains, not just IP-level scanning WordPress hygiene — it keeps coming up on these assessments, and I’ve got some practical recommendations Dorking and metadata searches — using AI to quickly sift through publicly exposed documents for things attackers could use to pretext a social engineering attack Subdomain hijacking — a sneaky attack path I’ve seen in the wild that flies right in the face of all the “check if the URL is spelled right” advice we give users Even when the technical findings are pretty quiet, there’s a lot you can do to punch up an external pentest report with stuff that’s genuinely valuable to customers! /episode/index/show/7minsec/id/41465875

7MS #723: CARTP - Cloud Red Team Tactics for Attacking and Defending Azure - Part 1 05/23/2026

7MS #723: CARTP - Cloud Red Team Tactics for Attacking and Defending Azure - Part 1 Hello friends! Today’s a hybrid episode — some security content up top about a new certification I’ve kicked off, followed by an aggressively quick trip to Tangent Town. Feel free to bail after the security stuff if tangents aren’t your thing! The security part: starting CARTP I’ve started the Certified Azure Red Team Professional course from Altered Security (). It’s the Azure follow-up to , which I took a few years back. Quick notes: Why now: Active Directory and internal pentests will always be my first love, but more and more of our customers are shifting to hybrid or full-Azure environments. Time to get some formal training in that lane. Self-paced vs. live: They offer both. I’m past the point of giving up Saturdays to security training, so I went with the ~$500 self-paced 30-day option. You get a portal, a lab manual, and a remote Windows VM with low-priv creds into a target Azure tenancy to attack and enumerate. The catch: The lab manual is thorough on “do this, see this output” steps, but light on “and here’s the wow moment hiding in line 47 of the output.” With the live class, an instructor would highlight that stuff in real time. In the self-paced version, you’re on your own to find the meaning in 200 lines of output. The fix: Started a Claude project that’s effectively co-teaching the class with me. I paste command output and ask “what’s the important bit here?” — Claude pulls out the line that matters and explains why (e.g., “this user has write access to a key vault, which means…”). Way more efficient than ALT-TABbing alone. Tools I’ve touched so far: , , and (kind of a PingCastle-for-Azure that spits out a health-check report). Where I’m at: Module 4 of 40-something. Course culminates in a 24-hour exam, which I swore I’d never do again after CRTP — but James Bond and Justin Bieber both say “Never say never.” Tangent Town: The Shake Shack incident. It’s gross and not funny. But kind of funny. Saw (and sort of met) Calum Scott at the Fillmore in Minneapolis. Standing-room-only venue, but my wife found a clutch spot wedged between a security barrier and a support beam, perfect for our family. During an acoustic set, Calum and his band came right past us. My wife (unable to help herself) gave his shoulder a squeezy squeeze. I held out for the fist bump on his return trip to the stage — and we’re basically best friends now. I highly recommend his show: very positive guy, family-friendly, genuine. Seven super-fast non-spoilery movie reviews from plane rides and hotel nights: Coherence — for smart people. I am not those people. Probably great if you can follow it. Deadstream (Netflix) — YouTuber live-streams a night in a haunted house. Surprisingly entertaining, a couple of real jump-scares. Get Away — a family vacations on a forbidden island. Goes somewhere unexpected in the third act. Hell House LLC — found-footage haunted house. A couple of genuine flinches; story was just OK. Hokum — Adam Scott as a writer at a hotel with a personal history. Creepy-crawly, goes to some dark places. Loved it. Predator: Badlands — went in expecting mind-numbing action, but I loved it! I’d give it an 8 or 9 out of 10. It had action, LOLs, and even some tender Predator moments. Going to watch it again soon. Obsession — young man buys a wish-granting trinket so a young lady will like him. It works. Then it really works. The movie slowly goes into full-on bonkers sauce mode! Satisfying but uncomfortable to watch at parts. That’s it! for services, for the Substack, for pentest tips and scripts. /episode/index/show/7minsec/id/41402250

7MS #722: I Turned My Phone Into a Brick 05/15/2026

7MS #722: I Turned My Phone Into a Brick Hey friends! Quasi-vacation week over here, so today’s episode is lighter and more personal: just a story about how I turned my phone into a “” (kind of) and what that’s done for my mental health over the past week. The product is called Brick (). Not sponsored, no discount code — just something I’ve genuinely been enjoying. It’s a $50 NFC dongle + app that lets you “brick” your time-waster apps until you physically tap the brick again. Here’s what stood out: The physical separation is the magic. Other digital-wellbeing apps just need a code to unlock — Brick makes you walk to wherever the dongle lives (mine’s on the fridge) and tap your phone to it. That extra step is enough to break the habit mid-flight. I caught myself doing three or four Pavlovian pocket checks an hour, on autopilot, with zero notifications waiting. “Junk food for the eyes” realization. First day I bricked socials until end of day → felt great. Then I unbricked, sat down, and spent 25 minutes catching up on everything I “missed” → felt noticeably worse afterward. Scheduling is a sleeper hit. You can set the phone to auto-brick on a schedule — no physical tap needed. Mine kicks in from 9pm to 8am. Result: calm wake-up with my wife and son, no email triage in the school drop-off line, and my “work brain” doesn’t fire until 8am. One-to-many is a real win. A single Brick works across household members, each with their own app profile. My oldest son Cam (deep in paramedic-school crunch) tried it for a study session and reported the same thing — reaching for his phone between turning book pages, for no reason at all. He even left for evening class with his phone still bricked and decided not to burn an emergency unbrick. Emergency unbricks are scarce by design. You get five total and that’s it! The stats are anti-shaming. Instead of the dreaded Sunday-morning “your screen time is up 10%” notification, you get to see number of hours you spent in brick mode. Love that! Want to see screenshots and hear more about Brick? Hop over to — this week’s Tuesday TOOLSday was all about Brick. Got a digital-wellbeing tool you swear by? Let us know! /episode/index/show/7minsec/id/41285220

7MS #721: Fun Professional and Personal AI Project Ideas – Part 2 05/08/2026

7MS #721: Fun Professional and Personal AI Project Ideas – Part 2 Hello friends! Picking up the AI-automation series from a couple weeks back — here’s another batch of scripts and integrations that have been giving me precious minutes (and sanity) back. Yes, I had to upgrade to Claude Max. No, I’m not trying to automate myself out of a job — just freeing up bandwidth for the more interesting parts of work/life. QuickBooks invoice automation: Got tired of the eight-factor login plus click-fest just to send a few invoices. Now I run a PowerShell menu — type the client name, pick the project, enter the amount, hit Enter — done in ~30 seconds. The QuickBooks dev onboarding (security questionnaire, IP allowlist) was actually a bigger time sink than the script itself. API integration: A menu-driven PowerShell script that prompts for a label, pops an Explorer window to grab the files, optionally adds a password, then auto-drafts the client email with the secure link filled in. A few minutes saved each time, a couple times a day — adds up to some nice time saved! Basecamp + Claude: Linked Basecamp into a Claude project so I can ask plain-English questions like “what personal project tasks are due this month?” or just voice-note a new task while I’m in the car. Honestly the biggest win is anxiety reduction — once it’s in Claude, it’s out of my always-simmering pressure cooker of a brain. Blumira agent auto-installer for the GOAD lab: I revert the GOAD lab to vanilla a couple times a week, which means re-installing Blumira agents constantly to show clients the attack/defense telemetry side. Wrote a Kali-side script that uses NetExec over WinRM to check each box for the Blumira service and push the installer if it’s missing. (Tried SMB exec first, but escaping got wonky on the PowerShell one-liner.) Bonus: Blumira’s dashboard auto-removes agents that haven’t phoned home in 24 hours, which is a perfect fit for a lab that’s constantly getting nuked. Auphonic + API for podcast production: This one’s a little meta. Old workflow: record → drag into Hindenburg/GarageBand → manually line up intro and outro → noise reduction → export. New workflow: one terminal script that previews the first and last few seconds so I can trim silence, ships the audio to via API, and returns a cleaned-up, levels-corrected MP3 plus a full transcript and auto-generated chapter markers. (If your podcast app supports chapters (like Downcast) pop open this episode or and you’ll see them.) Next step: pipe the transcript straight into Claude for a show notes first draft. One quick personal note before I run: my oldest son just landed an EMT job with a great Minnesota medical network, and is wrapping up paramedic school in a few months. I cried some happy dad tears today. /episode/index/show/7minsec/id/41221865

7MS #720: Tales of Pentest Pwnage – Part 84 05/01/2026

7MS #720: Tales of Pentest Pwnage – Part 84 Hey friends! Today’s another Tales of Pentest Pwnage! Quick tangent first on a couple side projects: I’ve got a music thing at (like the duck noise, not the drug) and a podcast with my dancer son Atticus at . Speaking of Atticus — he just landed a spot in Master Ballet Academy’s summer program in Phoenix, and I am a very proud dance dad over here. OK, on to the pentest: A weird runas quirk: If your AD test account password ends in a percent sign, runas seems to misbehave (Claude thinks Windows is interpreting the % as a variable delimiter). Workaround: runascs.exe, which wraps your tool launch with creds inline. Worked like a champ — notes over on the . Standard first pass: PingCastle for the AD overview, then Snaffler for share crawling, with as a nicer web UI for searching the Snaffler JSON. The “Snaffler missed something” moment: Snaffler is great but it primarily uses pattern matching, so manual review of interesting directories still matters. I found a PowerShell script with a funky obfuscation routine, fed it to Claude for context, tracked down the function definition, and ended up decrypting a local admin password. Going loud: SMB-sprayed that cred across the subnets → handful of machines popped → ran a deeper, targeted Snaffler against just those boxes → enumerated sessions and spotted a domain admin interactively logged in. Plan A fizzled: Wanted to pull off a favorite trick — sneak in via WinRM and queue a scheduled task as the logged-in DA (no password needed). WinRM was disabled. Oh fart. Plan B — the “trap” file: Dropped a malicious .library-ms file directly into the DA’s desktop folder. No clicks required — just the desktop being open is enough to trigger an HTTP coercion to my evil box. (Caveat: I think you need a DNS record or computer object that the victim box trusts as “intranet zone.”) The escalation: Had ntlmrelayx standing by, ready to relay to LDAP on a DC. The coerced auth fired the moment the “trap” file landed on disk. An interactive LDAP shell fired in the DA’s context, and I used it to add my low-priv account to the Domain Admins group. Defense angles: Rather than chase each technique individually (LDAP signing, web client GPOs, library-ms neutralization, etc.), I like to back up to the systemic fixes that break the chain earlier. Big ones here: deploy LAPS so a single decrypted local admin password isn’t a master key everywhere, and a thorough sweep for sensitive data and custom obfuscation routines hanging out on shares. Got thoughts on any of this? Shoot ’em over — I always love hearing how you’d have tackled things differently. /episode/index/show/7minsec/id/41117365