This week, Zac sits down with Shelby Spencer. Shelby is a developer turned red teamer who has worked on some of the most elite teams in the offensive security world. Zac and Shelby discuss the breakdown between pentesting and red teaming, tools development (Shelby created the Jenkins Attack Framework), and different security perspective across industries. We also get two technical deep dives from Shelby, which include hacking into controlled farming equipment remotely, and stealing half a million dollar from a bank!
Shelby's Github: https://github.com/shellster
Episode Summary
In Episode 16 of War Stories, host Zac Davis talks with Shelby Spencer, a red teamer who has worked alongside John Baek (hear John in Episode 12). They cover Shelby's path from software developer to red teamer, the Jenkins attack tool he released publicly, and a red team engagement where a skeptical client asked the team to prove they could move money, and they moved half a million dollars.
Shelby has wanted to do this work since watching the movie Sneakers as a kid. He earned a computer science degree and took programming jobs, including at Lockheed Martin, while asking about security openings until the company created a secure code review role for him, reviewing developers' code and teaching secure coding. His favorite tool is the Jenkins Attack Framework he built, because a Jenkins build server is one of the best places for a red team to harvest credentials.
His war story is a red team engagement against a financial organization with a hardened environment. The team found a small gap that let them push a reverse SSH shell out to a cloud server, then studied the email-driven approval process behind money movement until they could show every piece needed to send funds. Management pushed back and said their controls would never let a transfer go out, and paid for an extra week or two so the team could prove it. On a conference call with the client, the team moved half a million dollars.
In This Episode
- Shelby Spencer's path from software developer and secure code reviewer to red teamer
- Why Jenkins build servers are prime targets for credential harvesting
- The Jenkins Attack Framework and building your own offensive tools
- Finding small gaps in a hardened environment and getting a reverse shell out
- Proving business impact by moving money during a red team engagement
What Would an Attacker Do With Your Payment Process?
Executives care about business impact, not technical jargon. SEVN-X runs red team engagements, application security testing, and penetration tests that show what an attacker could actually do to your organization. Talk with our team about scoping a test for your organization.
