Marco Ivaldi<p>Continuing the tour of my <span class="h-card" translate="no"><a href="https://infosec.exchange/@github" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>github</span></a></span> projects, the <a href="https://infosec.exchange/tags/TacticalExploitation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>TacticalExploitation</span></a> toolkit deserves to be mentioned. It's now a bit old, but I believe the concept still applies, and very much so.</p><p><a href="https://github.com/0xdea/tactical-exploitation" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/0xdea/tactical-expl</span><span class="invisible">oitation</span></a></p><p>"The Other Way to Pen-Test" -- <span class="h-card" translate="no"><a href="https://infosec.exchange/@hdm" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>hdm</span></a></span> & <span class="h-card" translate="no"><a href="https://mastodon.social/@Valsmith" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>Valsmith</span></a></span> </p><p>I've always been a big proponent of a tactical approach to <a href="https://infosec.exchange/tags/PenetrationTesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PenetrationTesting</span></a> that doesn't focus on exploiting known software <a href="https://infosec.exchange/tags/vulnerabilities" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>vulnerabilities</span></a>, but relies on <a href="https://infosec.exchange/tags/OldSchool" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OldSchool</span></a> techniques such as <a href="https://infosec.exchange/tags/InformationGathering" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>InformationGathering</span></a> and <a href="https://infosec.exchange/tags/BruteForce" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>BruteForce</span></a>. While being able to appreciate the occasional usefulness of a well-timed 0day, as a veteran penetration tester I favor an exploit-less approach. Tactical exploitation provides a smoother and more reliable way of compromising targets by leveraging process vulnerabilities, while minimizing attack detection and other undesired side effects.</p><p>Since a few years, I've meant to give a talk on this very subject, with the working title of "Empty Phist Style - Hacking Without Tooling" (inspired by <span class="h-card" translate="no"><a href="https://infosec.exchange/@thegrugq" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>thegrugq</span></a></span>). Sooner or later it will happen.</p>