Discussion
I just realized a thing:
I got in the building. I planted a malicious device that didn't go anywhere because ports were off. I got financial docs, an old backup disk, and access to a device in LAN that didn't go anywhere mostly because time was limited and I did not bring the right thing.
How successful was I really, in that scenario?
@m4iler I think there are all different ways of having a win, and I think this would strike me as definitely counting.
Ultimately, we should remember that our job is to provide value to the client. Does the client say that what you did was valuable and that you're findings were used to them? That's the name of the game.
@deviantollam If 80% of my findings were purely "humans wanted to be helpful to me despite me being a bad bad attacker and your camera/card system is kinda shit," I wonder how much they can use that 😂
@m4iler @deviantollam to quote Dungeon Crawler Carl, “the minute we stop helping eachother, is the minute we stop being human”. It’s important that you highlighted that people will always be faulty when it comes to acting as an access control device and, similar to phishing training, any training or exercise that is meant to remind the people not to do the thing will always have a short expiration and diminishing returns. So the access control needs to be physical, and some of it was and that was what worked at stopping you in some cases, and it was also what was unsuccessful in other cases and it’s where improvements can be made, access cards and cameras, maybe a sign in system with actual checking.
When describing it now, I feel that what I did was easy and what I did not manage to do was the shit that would have been the wow effect.
@deviantollam Is that impostor syndrome? Or am I just shit at this?