This week, Zac sits down with Andrew Allen. Andrew is a former pentester, red teamer, and security manager who has worked with some of the largest companies in the world. Zac and Andrew discuss the power of PowerShell, unique attack scenarios for PCI compliance, international pentesting, and finish it up with a story of physical pentesting.
Episode Summary
In Episode 8 of War Stories, host Zac Davis talks with Andrew Allen, a former penetration tester, red teamer, and security manager who has worked with some of the largest companies in the world. They cover his unusual start in IT, why PowerShell changed offensive security, and a PCI penetration test that ended with access to protected credit card data.
Andrew's first taste of networking came during an Army deployment in Iraq, where his team sergeant had him crimping and running Cat5 cable over a high-latency satellite network. After the Army he studied programming at Temple University, then moved into offensive security and fell in love with it. His favorite tool is PowerView, the PowerShell-based Active Directory enumeration tool he calls a force multiplier because it lets testers map an environment quietly and focus their attack.
His war story is a PCI penetration test, where domain admin is not the finish line because cardholder data should still be out of reach. Andrew broke out of a Citrix environment by opening a command prompt through Internet Explorer, found an administrator who reused the same credentials on jump boxes and the VMware ESXi hypervisor, and used hypervisor access to snapshot a guest server. Analyzing that snapshot with a debugger let him reach the credit card data the environment was built to protect.
In This Episode
- Andrew Allen's path from the Army and Temple University into offensive security
- Why PowerView and PowerShell are force multipliers for Active Directory enumeration
- How PCI penetration tests differ from standard internal network tests
- Citrix breakouts and escaping restricted desktop environments
- Credential reuse, ESXi hypervisor access, and extracting data from VM snapshots
Is Your Cardholder Data Really Segmented?
PCI DSS requires penetration testing because segmentation and encryption are only as strong as the credentials and systems around them. Learn more in our guide to what PCI DSS is and is not, or see how SEVN-X approaches PCI penetration testing. Talk with our team about scoping a test for your organization.
