Zac Davis chats with seasoned penetration tester and "Purple Queen" Sarah Hume this week on War Stories.
Episode Summary
In Episode 3 of War Stories, host Zac Davis talks with Sarah Hume, a senior penetration tester at Security Risk Advisors, about how she found her way into cybersecurity, the tool that gives her the biggest rush on an engagement, and a physical penetration test where social engineering turned into a 40-minute improvised job interview.
Sarah grew up in Minnesota and was pushed toward security by her dad, who sent her to a cybersecurity summer camp in South Dakota. Her favorite tool is secretsdump from the Impacket suite, because nothing beats watching the password hashes come back.
Her war story is a physical penetration test against an office with some of the strongest physical security she had ever seen: mantraps, cameras everywhere, and armed guards who even documented a co-op for asking someone about coffee. When the usual approaches stalled, the client suggested posing as a job candidate. Sarah showed up in a blazer with a portfolio and no interview on the books, named a recruiter she had picked off LinkedIn, and found herself sitting in a recruiter's office inventing a career as a software developer.
In This Episode
- Sarah Hume's path from a cybersecurity summer camp to senior penetration tester
- Why secretsdump from Impacket is her favorite tool for credential attacks
- Physical penetration testing against mantraps, cameras, and armed guards
- Pretexting as a job candidate and staying in character during social engineering
- Why the best physical testing stories are often the ones that do not go to plan
Would Your Front Desk Stop a Fake Candidate?
Social engineering is one of the fastest ways past even well-funded physical security. SEVN-X runs physical security assessments and penetration tests that show you how your people, processes, and controls hold up. Talk with our team about scoping a test for your organization.
