This week, Zac sits down with Dave Catling. Dave is the founder and principle consultant of Phoenix Ops (https://www.phoenixops.io/), a boutique cybersecurity firm based in the Philadelphia area. Zac and Dave discuss the similarities and overlaps in their career paths, Evilnginx 3.0 (https://github.com/kgretzky/evilginx2) for conducting social engineering campaigns, and finally Dave tells a story about how a voice phishing engagement lead to a call to the local PD.
Episode Summary
In Episode 6 of War Stories, host Zac Davis talks with Dave Catling, founder and principal consultant of Phoenix Ops, a boutique cybersecurity firm in the Philadelphia area. They compare their career paths, dig into Evilginx for social engineering campaigns, and hear the voice phishing story behind this episode's title.
Dave took a nontraditional route into offensive security. He grew up fascinated by computers, started a liberal arts degree, stepped away, and eventually found his way into penetration testing, crossing paths with Zac along the way. His favorite tool is Evilginx, an adversary-in-the-middle phishing framework, and he explains why testers need to dig into its code and built-in canaries if they want it to slip past modern defenses.
His war story comes from a vishing engagement. After calling employees as the help desk and asking them to set a new password, Dave worried word might have spread, so he tried something that felt too simple to work: he called the real help desk posing as a nervous employee who had just been scammed and needed a password reset. The help desk was sympathetic and ready to help, until they asked for an employee ID he did not have. The engagement ended with a call to the local police department.
In This Episode
- Dave Catling's nontraditional path into offensive security and founding Phoenix Ops
- Using Evilginx for phishing and multifactor authentication bypass testing
- Running voice phishing (vishing) and help desk social engineering campaigns
- Why help desk password reset processes are a common weak point
- His first physical penetration test and what it takes to plant a device on site
Would Your Help Desk Reset That Password?
Help desk social engineering is behind many real-world breaches. SEVN-X runs social engineering and red team engagements alongside penetration tests to show how attackers would target your people and processes. Talk with our team about scoping a test for your organization.
