This week, Zac sits down with Mike Piekarski. Mike is a bug bounty specialist, penetration tester, and solutions architect. He is also the founder of Breach Craft (breachcraft.io), a boutique cybersecurity firm based in Pennsylvania. Zac and Mike discuss Mike's most successful bug bounty targeting one of the biggest companies in the world via a insecure Cisco configuration. They also touch on the power of the Project Discovery toolkit (projectdiscovery.io), and Mike tells the story of trying to use a Santa suit on a social engineering engagement.
Episode Summary
In Episode 21 of War Stories, host Zac Davis talks with Mike Piekarski, a bug bounty specialist, penetration tester, and solutions architect who founded Breach Craft, a boutique cybersecurity firm based in Pennsylvania. They cover Mike's early start in hacking, the recon toolkit he relies on, his most successful bug bounty against Apple, and a social engineering engagement that involved a Santa suit.
Mike got hooked on hacking in the AOL era and began penetration testing in 2011, when popping exposed JBoss and Tomcat management interfaces was a staple of almost every test. His approach to offensive security follows the OODA loop of observe, orient, decide, and act, and his favorite tools come from ProjectDiscovery, including SubFinder for subdomain enumeration, which he has wired into automated pipelines to watch bug bounty targets for changes.
His biggest bug bounty win came from looking for a technique he already knew well somewhere new. Cisco Smart Install is a switch feature that lets new devices pull a configuration from their neighbors with no real trust between them. Mike found that service exposed on a switch at an Apple branch office in California, pulled down its configuration, and used that access to see what else was connected. The episode wraps with his story of trying to use a Santa suit as a pretext on a social engineering engagement.
In This Episode
- Mike Piekarski's path from AOL-era tinkering to founding Breach Craft
- The OODA loop and continuous reconnaissance in offensive security
- ProjectDiscovery tools like SubFinder for subdomain enumeration and bug bounty automation
- Exploiting Cisco Smart Install to pull switch configurations
- Bug bounty hunting against Apple and a Santa suit social engineering pretext
What Does Your External Attack Surface Look Like?
Exposed management services and forgotten network devices are some of the easiest ways in. SEVN-X runs external and internal penetration tests, red team engagements, and dark web monitoring to find what attackers see first. Talk with our team about scoping a test for your organization.
