Happy Hump Day y’all, it’s storytime!! It’s been while, I know. I hope you forgive me. I’ve been busy getting into trouble and collecting more stories to tell. For newcomers, hello! I’m Jek and I get paid to legally break into buildings. Yes it’s a real job and yes I love it. Occasionally I get to share some of my stories with you crazy people.

It’s story time! Today, I want to tell you the tale of the time I very nearly got caught on a physical penetration test. Target: Medium size office attached to manufacturing facility.
Goal: Gain physical access to the office area to plant a dropbox.

I have a friend that works for a medium-sized company. She's very proud of her employment there & wears a jacket with the company's name embroidered on the front. I've been trying to convince her that this jacket could make her a target. At the very least it is leaking info. But you know how people outside of infosec see us. We're their crazy, paranoid, yet somehow-still-endearing friends.

I had to pull out all my elicitation tricks during this investigation. It was incredibly personal, but left me feeling very confident in my abilities to get at what information I needed. I first started helping friends with OSINT, vishing and phishing, and that quickly led to working with them under contract on actual pen tests.