Jan 25

Retina Vulnerability Reporting Issue

If you think you’re doing a bad job at vulnerability management, maybe it isn’t as bad as you think.

If you use Retina and Beyond Insight, many vulnerabilities over the past 6+ months may not have been marked as remediated.

The scan results may be accurate, but the analytics module continues to show the vulnerability even after remediation.

Every report you run might have months’ worth of vulnerabilities that aren’t really there.


Activity Broken Working
Scan #1 System has 5 vulnerabilities System has 5 vulnerabilities
Analytics Report #1 System has 5 vulnerabilities System has 5 vulnerabilities
Admin Remediation 4 of 5 vulnerabilities are remediated 4 of 5 vulnerabilities are remediated
Scan #2 System has 1 vulnerability System has 1 vulnerability
Analytics Report #2 System has 4 current vulnerabilities and 1 was remediated System has 1 current vulnerability and 4 were remediated
Management Why do we have so many vulnerabilities?! Great job getting rid of so many vulnerabilities!


The development team at Beyond Trust worked quickly to produce a fix just a few days after the issue was reported to them and the fix will be incorporated into the next release.  Unfortunately, you might have already been held accountable for poor results.

If you use Retina and Beyond Insight, compare your scan results to your analytics report to see if you have any discrepancies.  If you do, you might want to reach out to support for the hotfix.

As an IT/Security person, you should question everything.

Don’t blindly trust the data you get from any tool.  Constantly check your tools, test them, and compare them against their competitors.



Jan 15

2017 Year in Review

I’m a statistic for failed New Year’s Resolutions.

Still, I got a lot more done than I would have if I hadn’t set any goals at all.

In 2017 I became a CISSP, lost a family member, gained two new family members, saw the eclipse, lost two pets, rode some waves, put out a microwave fire, climbed trees, saw thousands of bats, blew an engine, bought a new car, went sledding, had too many hangovers, kayaked a river, had some arguments, learned new skateboard tricks, broke both arms, played like a kid at a trampoline park, and more.


Overall, it was a pretty good year!

I had 3 goals for 2017:

  1. Earn the CEH certification and blog about the journey
  2. Pay off some debt
  3. Stop cooking

I know #3 might sound weird but I was constantly buying food and letting it rot in my fridge because I never got around to cooking it.  When I did cook it, it usually tasted bad and the leftovers rotted in the fridge.  It was a huge waste of time and money, so I set out to just eat out and buy premade frozen meals that weren’t too terribly unhealthy.  This was the one goal I kept, and it actually worked out pretty well.

#2 went terribly wrong and I went the other direction on debt but, life happens and I wasn’t ready.

#1 is what the rest of the post is about.  I’m writing this to share my experience in the hopes that someone will relate to it and maybe it will be helpful to see my failures.  I’m also writing it just to give myself closure on this unfinished CEH series.

January 2017 was awesome!  I worked like crazy to learn ethical hacking and write about my journey.  I was learning not only IT but social media and blogging too.  It was a little too much at once though and I couldn’t sustain that time commitment.


I was working all day, coming home and spending time with my kids until they went to bed, then working on my security goals from 10 PM until 2 AM.  My wife was working nights at the time, so I didn’t have anything else to do.  I didn’t have anybody to remind me to go to bed either.

This went great for a couple months, then her schedule changed and she wasn’t working nights anymore.  It’s not her fault that I stopped, we just never had the conversation that I wasn’t going to see her at night 5 nights a week so I could work on my career goals.  It was easier for me to just hang out and watch Netflix after the kids went to bed instead.  I tried to squeeze in the work while watching TV but then I didn’t enjoy the show or the work and I eventually just gave up.  I never actually decided to “quit” it was just that night after night, I never got around to it.

Interestingly, I started drinking again after being sober for almost 2 years.  Looking back at the timing, I didn’t fail my goals because I started drinking…I started drinking again because I didn’t have a goal to keep me motivated.  This might be my most important learning experience of 2017.

So that’s it, the #EarnCEH dream died but I did manage to get the CISSP instead.  I also didn’t throw out any liquified rotten vegetables.


BUT wait…why not try again?  Honestly, I’ve lost interest.  Well, I haven’t lost interest in learning offensive security techniques but I’m no longer interested in pursuing the CEH certification.  Also, I can only focus on one thing at a time and I am working on a big new project in 2018.  This time, I’m not going to post about it at all until it is done!  I think I am just wired to work better that way.

I hope this was helpful for at least one person.  Here’s to a great 2018!

Jun 24

Death to Server Manager Pt 2 – Group Policy Solution

How to Get Rid of the Server Manager Pop-Up For Good!

I made a little video just for fun.  This is for anybody who has ever been driven nuts by Server Manager launching automatically.  Here’s part two; a global solution to disable it on all of your servers at once using Group Policy.


Jun 24

Death to Server Manager

How to Get Rid of the Server Manager Pop-Up

I made a little video just for fun.  This is for anybody who has ever been driven nuts by Server Manager launching automatically.


May 11

Vendors – Select Them Carefully

Vendor Research: Beyond the Fancy Sales Presentations

Choosing a vendor for anything is extremely difficult.

Sales people only show off the best parts of the product.  Demonstrations are exciting and seem almost magical.  Products appear to solve problems in a way you have never seen before.

If you decide to take a product for a “test drive” you only run it on a small sample of your environment and everything seems great.  Or, you are so inept that you can’t really get a good feel for all of the features.  You choose the one you think is best, fork over a bunch of cash, and hope for the best.

Sometimes it works and sometimes you are left disappointed.  Just like interviewing candidates for a job, you can’t possibly know all the details until after you make the hire…until after you buy the product.

I’m writing this short post today to share an idea for evaluating vendors beyond the perfect demos.  The results really surprised me.

Continue reading

Feb 01

A Year of Ethical Hacking – Month One

Month One Review

One month down, eleven to go.

It’s hard to believe that the year is already one-twelfth of the way over!

My goal is to spend 416 hours studying Ethical Hacking in one year.  416 isn’t a random number.  416 is 8 hours per week, times 52 weeks.  I finished month number one with 34 hours.  Plus or minus a couple hours, I am on pace to meet my goal!  Have your 2017 goals made it through the first month?

If you aren’t sure exactly what this is all about, take a look back at my first post in the series, Investing a Year in Ethical Hacking.

It is surprising how much work can get done with consistent daily effort.  Also, it is easy to let several days go by with no progress.  Making a schedule to study at the same time every day has helped keep me mostly on track.

A few life events came up that prevented me from studying the last few days of the month but other than that, the first 3 weeks were a huge success.

Here is a summary of my first month of Ethical Hacking.

Week 1: 9 hours – Total: 9 hours – Google Hacking & Port Scanning with Nmap

Week 2: 11 hours – Total: 20 hours – Scanning, Enumeration, Linux

Week 3: 10 hours – Total 30 hours – Enumeration & Password Cracking

Week 4: 4 hours – Total 34 hours – Privilege Escalation, Antivirus Bypass, and Alternate Data Streams


Keep reading for the highlights of the month…

Continue reading

Jan 30

Becoming an Ethical Hacker – Week 4

Week 4 – Privilege Escalation, Antivirus Bypass, and Alternate Data Streams

This week, life happened and I didn’t get a whole lot done.  But some progress is better than none.

I did manage to escalate a standard user’s privileges to local Administrator and disable Antivirus software.  I also migrated the blog to a new host.  If you are reading this, your DNS has updated and you are now seeing the new site.  Welcome!


Yay!  I successfully migrated the blog to a new host and platform.  This was a lot less fun than hacking into stuff but it had to be done.  It was up for renewal anyway and I really didn’t like that the free blog was serving advertisements to you that I couldn’t control.

So, new blog, new theme, and no more ads.  But unfortunately, not much CEH progress.

I did do a few cool things that are worth talking about.  Continue reading to hear more…

Continue reading

Jan 25


Week 3 – Enumeration and Cracking

Week 3 is done and it was the best yet!  In this course, I have a feeling that every week will be better than the one before it.  I studied for 10 hours after work and on the weekend and still managed to do a little painting!

In my original post, Investing a Year in Ethical Hacking, I detail my plan to invest 416 hours in 2017 to learn ethical hacking.  Current progress: 30 / 416.

The end of the month is dangerously close.  The year is almost 1/12th of the way over.  Are you almost 1/12th of the way to your goal for the year?



Enumerating SMTP was…. a disappointment actually.

Keep reading and I’ll explain what I found along with how I cracked some passwords!

Continue reading

Jan 20

Becoming an Ethical Hacker – Week 2

Week 2 – Scanning, Enumeration, and Back to Basics

The second week in my quest to become an ethical hacker is complete!  With 11 hours of study time logged, this was a very productive week that touched a lot of different areas.

If you’re not sure why I’m posting this, take a look back at my original post, Investing a Year in Ethical Hacking where I detail my plan to invest 416 hours in 2017 to learn ethical hacking.  Current progress: 20 / 416.

The hours are starting to add up and this is only week 2 of 52.  I can’t wait to keep going and I hope you will join me!



As you know by now, I am a big fan of going SLOWLY through this content to really understand it.  That is why I am still working on scanning here in week 2.

Some of the scans like the Null scan and Xmas scan don’t work against Windows systems.  I tried scanning my Kali Linux system but since it is a locked-down OS for penetration testing, it doesn’t respond to anything.  I don’t want to just skip this part and memorize the information without ever using it!

So I researched different Linux distributions and decided to download and build a CentOS 7 system since it is basically the same OS as Red Hat, only CentOS is free.  After getting it installed, I got to run some scans against it and watch the magic happen.  An interesting result I found is the difference in default ports that are open for Windows (firewall off) vs. Linux.  Linux only has SSH open while Windows has ports for SMB and NetBIOS open.


I also ventured outside my isolated lab to do some careful testing on the real internet.  HackThisSite.org is a wonderful resource which gives anybody a free pass to try basically anything as long as it is non-destructive.  Keep reading to see what I found this week…

Continue reading

Jan 09

Becoming an Ethical Hacker – Week 1

Week 1 – Google Hacking and Port Scanning

My first week of ethical hacking is done and it was a great week!  I spent 9 hours working on scanning and reconnaissance.  As I mentioned in my post, Investing a Year in Ethical Hacking, my goal is to spend 416 hours learning ethical hacking this year.  Current progress: 9 / 416.

For anybody else studying CEH (or anything else), I hope this shows you that even little investments of time can result in huge improvements when done consistently over time.


Google Hacking

Google “hacking” is a great starting point even though it isn’t actually hacking at all.  It is amazing how much OSINT (Open Source Intelligence) is out there.  I searched myself to start off and even found some old forum posts of mine from years ago that I had forgotten about!


Catching Phishers with Google?

Here is just one example of the fun you can have while learning search terms.  I was really excited when I stumbled on what looked like a phishing page.  Keep reading to see what happened.

Continue reading