Podcast
7 Minute Security
Hosted by Brian Johnson · EN
7 Minute Security is a weekly information security podcast focusing on penetration testing, blue teaming and building a career in security. The podcast also features in-depth interviews with industry leaders who share their insights, tools, tips and tricks for being a successful security engineer.
11episodes
Episodes
Newest firstAll episodes
7MS #731: CARTP – Cloud Red Team Tactics for Attacking and Defending Azure – THE FINAL CHAPTER!
3d ago00:53:41Tap to summarizeHey friends! Fair warning: today's episode is a bit of an emotional rollercoaster — we've got a big security win, some honest lab feedback, and a very personal share about my dad's funeral. Buckle up. CARTP certified, baby! — I'm officially a Certified Azure Red Team Professional (CARTP), courtesy of the folks at Altered Security. It's been a long time coming (I originally signed up for the live version and fell off after missing a couple Saturdays), but I came back for the self-paced 30-day version and finally finished the job. The lab experience — the good: — ~25 objectives, a solid lab guide, and a really fun variety of attack paths. Highlights include stealing tokens, enumerating Azure tenants, attacking apps and VMs and key vaults, simulated phishing against real tenant email addresses, popping reverse shells, and some clever OneDrive-based follow-on attacks via session hijacking. There's even some web app pen testing (hello, server-side template injection!) sprinkled in. The lab experience — the not-so-good: — The included videos are… not my favorite format. Think notepad-on-screen copy-paste tutorials with zero context. To fill in the gaps, I leaned heavily on Claude — pasting blobs of the lab guide and asking things like "why did stealing this token give me X but not Y?" — and it did a great job standing in where a live instructor would normally add color and context. Exam tips (spoiler-free, I promise): — A few things that helped me: I had Claude build me a CliffsNotes study guide from all our study-session chats — token context, command flags, the works. Before hitting start on the 24-hour clock, I fed Claude a list of all the tools I'd been using in the lab and had it build a one-shot PowerShell script to pull them all down from GitHub onto a fresh Windows VM. If your exam lab environment fails to spin up (as mine did in the US region), just try a different region — UK worked great for me. Enumerate. Enumerate. Enumerate. Know your tools, know which ones cover which areas of an Azure tenancy, and know how to get more verbose/tabular output when you need it. Take screenshots and notes as you go — the lab closes after 24 hours and you've got 48 hours to submit your report, so if you forgot to grab a screenshot of a flag… you are SOL, my friend. The exam itself: — I started around 5:30 p.m., wrapped up around 11 p.m., and had the final flag captured, a full Word report drafted, and was in bed at a reasonable hour. Submitted the report the next morning after the gym and a mint hot cocoa, and had my pass confirmation back well within their 7-business-day window. Private pen test training is happening: — I'm currently running a private 3-day session of our Active Directory pen testing class (version 2.0 — it got a big facelift!). It's built on the Game of Active Directory platform and we fully pwn three separate domains over the course of three days. If you can send 3–7 people, reach out at 7MinSec.com/training to line up a private session. I'm also building an interest list for a public version later this fall (reach out if interested)! Also: check out 7MinSec.club — I dropped a little show-and-tell video over on 7MinSec.club this week giving you a peek at what the training looks like in action. Dad's funeral: — I shared some words at my dad's service this past Saturday and wanted to capture them here while they're fresh, since this podcast is basically my journal at this point. The service was perfect — very "him." He'd actually written funeral instructions (yes, they literally sat in a safety deposit box for years) specifying things like: max 10-minute message from the pastor, specific Bible verses, specific songs, and — my favorite — if the service runs over 45 minutes, someone needs to pull the fire alarm. He came up with that final instruction at his brother's funeral, which ran nearly two hours. He leaned over, squeezed my knee and said, "If my service goes over 45 minutes, pull the fire alarm." The song: — I played and sang at the service. The song was "Jesus Savior Pilot Me" — not a personal favorite of my dad's exactly, but he called it "the one about Jesus flying airplanes" after seeing me perform it years ago at the Minnesota State Fair chapel. I practiced it in the car on the way to Caribou every morning until I could get through it without crying. My guitar teacher's advice: close your eyes, focus on your fingers, and pretend you're just playing a tune in a room. It worked. Mostly. Thank you: — Seriously, so many of you have sent kind messages and I just want you to know it means the world. He taught me a lot about being a good dad, a good husband, and how to live with passion, a good attitude about your work, and a heart for serving others.
Transcribe →7MS #730: Baby's First Project Swarm
1w ago00:25:07Tap to summarizeHey friends! Still your grieving pal over here, but also your swarming friend and Protecting My Network Edge host — because this week I've been tinkering with something called Project Swarm and I've got my diapers on regarding it, but I really, really like what I see so far. Then, fair warning, I flip on the tangent light and verbally barf up some personal stuff at the end. I'll make the hand-off super clear, so if you want your free security podcast to do exactly what you want and nothing else — totally fair, and you won't offend me by hopping off. Here's what we cover: What is Project Swarm? This comes to us from our friends over at GreyNoise. It centers around little sensors you deploy to the edges of your network that you can dress up to look like just about anything — attracting flies to the honey, if you catch my drift. You get more enumeration, insight, and logging into whatever shenanigans those flies are using to poke at your edge. Setup was refreshingly easy: You need a very low-powered VM or hardware device (my understanding is it even works on a Raspberry Pi) mapped to a public IP, plus a free GreyNoise account. You generate an API key, copy-paste a one-line install, and off it goes. I threw mine on a tiny Ubuntu VM. The part where I didn't read the flipping manual: Mid-install my SSH connection dropped and I'm going "what the heck?!" Turns out the installer intentionally moves your real SSH to some arbitrary high port — so you can run a fake SSH honeypot on 22 while your legit connection lives elsewhere. Once I spotted the new port in the console, a quick firewall tweak and I was back in. Profiles give me level 14 giggidies: Once your sensor checks in, you assign it a profile. Vulnerable WordPress, Tomcat, a Cisco AnyConnect VPN, FTP honeypot, SSH honeypot — kind of all the honeypots. I went with a vulnerable WordPress instance. My one complaint: you can only assign one profile per sensor. My dream scenario of an SSH honeypot AND an FTP AND a vulnerable Tomcat all on one box will have to wait (or maybe that'd look too suspicious and scare the baddies off — who knows). The results were wild: Within a couple days I had thousands of connections, several flagged as malicious and tied to known botnets. I could see source IPs, malicious labels, whether they were residential or company or Google, and even download raw packet captures. There's clearly more telemetry to dig into (what people tried to spray into the login portal, etc.) — I meant to go deeper before recording and didn't, so consider this a "to be continued." Why do I care, since I'm not defending some huge infrastructure? Honestly it started as a brain break. But I've been testing a ton of external networks lately and nearly every company site is WordPress — which now powers around 43% of the internet. Running my own WordPress honeypot gives real oomph to those "your out-of-date WordPress is a big deal" conversations, where I can say "I run a WordPress honeypot and here's the aggressive password spraying and plugin/theme enumeration I'm seeing right now." See it, don't just hear it: I show the actual portal, sensor config pages, and more over on 7MinSec.club this week. Why not both, right? It's like that meme. GreyNoise also has a Project Swarm user webinar coming up — check their events page. And to be crystal clear: they are not a sponsor, this is all free, and I just think it's clever. Life update (the tangent portion): About the time you hear this, I'll be on my way to my dad's funeral, where I'm sharing some words and singing a song. I've been practicing like a madman per advice from my music director friend and guitar teacher — including a little brain hack of focusing hard on my fingers to stay a half-step removed from the emotion. And if I cry my face off up there? Who cares. This isn't America's Got Talent; it's the gesture. I'll be honest, 2026 has been a rough one, but I promised two bright spots and here they are: my son Cam (about to finish paramedic school) has been keeping grandpa's spirit alive by wearing my dad's shirts, sunglasses, and Apple watch, and getting a Cessna tattoo with my dad's actual handwriting and birth year. And you all — the kind words, the offers to talk, the shared stories — reminded me there are a whole lot of good people out there. Thank you for that. One more thing on the horizon: My brain's been a squirrel on pixie sticks, but for whatever reason I've been happily grinding the CARTP as a little vacation for my mind. I might take a swing at the exam this week — start it in the evening, grind a few hours, sleep, finish in the morning (I'm too old for 24 hours straight). I might pass, I might fail spectacularly. Either way I'll keep you posted, and if I get the cert, that's probably next week's topic!
Transcribe →7MS #729: Pwning Dracarys
2w ago00:18:36Tap to summarizeHey friends! Still your grieving pal over here, but also your happy hacking host — because today we're diving into baby's first Dracarys! (Yes, I'm probably pronouncing that wrong. Yes, I'm going to keep saying it anyway.) Quick housekeeping: A few days ago I published a mini-series episode from our How to Secure Your Family During and After a Disaster series, where I shared the news that my dad passed away last Friday. So many of you reached out with condolences — thank you from the bottom of my heart. I'll share a little life update at the end of this episode. But first — Dracarys! I didn't know it existed until recently. If you knew about it and didn't tell me, I'm mad at you. But we made up. We're friends forever. Here's what we cover: What is Dracarys? It's a smaller, CTF-style Active Directory pentesting lab from the same crew that brought us Game of Active Directory (GOAD), GOAD-SCCM, GOAD-Light, and Ninja Hacker Academy. Where GOAD holds your hand through the vulnerabilities, Dracarys and Ninja Hacker Academy take more of a "here's your starting point, now figure it out" approach — which I love. The lab setup: One Linux VM, a Windows domain controller, and a Windows application server. Your only hint? Start with the Linux box. That's it. Good luck! TuesdayTOOLSday preview: Over on 7MinSec.club, I did a TuesdayTOOLSday episode walking through initial setup — getting your hosts file configured, running a NetExec sweep to map out the attack surface, and doing some light enumeration on that Linux box. No big spoilers, just enough to get your Kali box ready to rock. What I've learned since: After the TuesdayTOOLSday recording, I kept digging. My methodology has been: nmap to identify open ports and service versions, then research whether any of those versions have known exploits. Once I spotted an interesting web service, AI pointed me toward FeroxBuster for directory and file enumeration — a tool I hadn't used before but am now a huge fan of. It's fast, configurable, and once I got my scan tuned properly… I found a jewel. That jewel feels like the next step deeper into this lab. More on that in future TuesdayTOOLSday episodes! Shameless plug: All of this walkthrough content lives at 7MinSec.club. Subscriptions are free, and subscribing just means you get an email when I publish new content. No spam, no sales pitches — just hacking stuff. (And if you want to financially support the show, there's a paid tier too. Just sayin'.) Life update: We've moved into funeral planning mode. My dad, thankfully, had already mapped out his whole service — the pastor, the verses, everything — which has made things a little easier. We're picking photos for a tribute slideshow and I've been asked to share some words and sing a song. The song I chose is "Jesus, Savior, Pilot Me" — which my dad once described as "that song about Jesus flying airplanes." (He wasn't wrong. Sort of.) I've been practicing it all week and can barely make it through verse two. Prayers, good vibes, and a large supply of Kleenex would be appreciated. Again, you can find the Dracarys lab here. And if you're not already on 7MinSec.club, come hang out — that's where the deeper dives live.
Transcribe →7MS #728: Securing Your Family During and After a Disaster – Part 8
3w ago00:38:03Tap to summarizeHey friends! This is a tough one to write. My dad passed away on Friday, and instead of the hacker-y tech episode I had planned, I pivoted to something more personal — another installment of our "Securing Your Family During and After a Disaster" series. I talk pretty raw and transparently today about loss, grief, and the practical stuff that makes a hard situation just a little less hard. Fair warning: it's about death and dying, so if that's not where your head is today, it's totally okay to duck out – we'll catch you next week. Here's what I cover: My dad's last day — He spent Thursday doing all his favorite things: chainsaws, ATVs, trap-shooting, mowing, and weed-whipping. Then Chinese food with the family and marveling at modern video games for the first time since the Atari 5200. It was, by all accounts, a perfect day for him. How we found out — My son Cameron, who's finishing up paramedic school, was visiting and sprung into EMT mode when my dad was found unresponsive Friday morning. He did CPR for 10 straight minutes — on his grandpa, who was his favorite person in the world. That's the stuff that's going to stay with Cam (and me) for a long time. Getting some closure — Cameron had the presence of mind to ask the paramedics to leave my dad in place so I could have a few minutes with him when we arrived. That was both devastating and, in its own way, healing. Why pre-planning your funeral is a gift to your family — My parents had nearly everything already picked out: the pastor, Bible verses, music, the military honors ceremony, photos for the display board, and even a time limit on service length (45 minutes and no more!). My dad had pre-written his own obituary. When we sat down with the funeral home, the heavy lifting was already done — and that was a genuine gift to all of us in an incredibly hard moment. Storyworth — seriously, do this — Years ago we signed my dad up for Storyworth, a service that sends your loved one a weekly question via email (things like "What's your earliest childhood memory?" or "Do you have any regrets?") and compiles their answers into a hardcover book. It runs about $100. Reading that book the last few nights has been incredibly comforting — including finding out my dad started smoking at age 8 using used cigarette butts rolled in toilet paper. Gross! Get your end-of-life wishes in writing — My wife's mom had verbally told us she wanted to be cremated, but it wasn't documented, and other family members made a different call. My dad put "cremation" right in his paperwork, no ambiguity. My recommendation: have this conversation with your loved ones, write their wishes down and make them official. Funeral home "upsell" moment — I had no idea there were apparently 627 ways to incorporate your loved one's remains into keepsakes — pendants, rings, necklaces with fingerprints, biodegradable urns for water scattering, etc. Some family members were very into this. I was not quite ready to turn my dad into an Atari cartridge, but your mileage may vary. On grief itself — Everybody handles it differently, at different speeds and intensities. My approach is to head straight into it rather than put on a happy face and deal with unprocessed grief years later. I encourage everyone — especially the kids — to not hold back. Ask the questions. Tell the stories. Cry if you need to. Give each other grace. Coming up next week — Back to pentesting content! I'll share details on a new lab from the folks who brought us Game of Active Directory, and I'm getting back on the CARTP (Certified Azure Red Team Professional) horse. I'm also tentatively eyeing the third Thursday of July for an unedited livestream of owning Ninja Hacker Academy from start to finish — Kali setup, tools, Mythic C2, BallisKit obfuscation, the whole thing. More details to come. If you're the thoughts, prayers, and/or good vibes type, I'd really appreciate you sending some my family's way over the next few weeks.
Transcribe →7MS #727: Securing Your Mental Health – Part 7
Jun 1900:21:28Tap to summarizeHello friends! It's been over a year since we did a dedicated mental health episode, so today I'm doing a big catch-up and running through my 7-point plan for being a more mentally secure me. None of this is professional medical advice (I am most definitely not a doctor or therapist — well, actually, I am in therapy, but that's tip #5), so take what's useful and leave what isn't. Terms and conditions apply. Here's my current mental health toolkit: Drink a ton of water — I try to chug a full Yeti thermos before my morning mint hot cocoa, then keep it going throughout the day. I taper off around dinnertime to minimize, uh, nighttime tinkle stops. Science agrees this does good things for your brain. Brick your phone — I've been using a little Bluetooth device called Brick that hooks into your phone's screen time features so you can block distracting apps on demand or on a schedule. I've got a "Brian Needs Sleepy" timer set for 9 p.m. every night — pretty much everything except the clock app goes dark. Outlook, Gmail, all the socials — gone. It's not revolutionary advice, but it turns out doing what people have been telling you to do for years actually works. Get enough sleep — Directly related to the Brick. Phone goes dark at 9 p.m., I yap with Mrs. 7 or we watch a show, and by 10:30 p.m. my peepers are drooping. I feel more refreshed and less anxiety-ridden during the day. Supplements — I'm not here to hawk some magic elixir with 47 mystery ingredients. What I'm currently trying is Nello Supercalm — a powder you mix into water. It's got magnesium glycinate, L-theanine, vitamin D3, and ashwagandha. I thought it was placebo at first, but kept it up for a week and noticed a legit mood/pep boost. Your mileage may vary, but it's doing something for me. Therapy — I've been in therapy since 2019 when my house burned down (link to those episodes here if you want to get thoroughly bummed out). If I could go back, I'd have started way earlier. The biggest benefit for me isn't some parade of uplifting affirmations — it's having a neutral third party with no stake in my life help me see situations from different angles and cut myself some slack. Take care of the TMJ — A few years back I started getting tinnitus bad. ENTs were basically like "yep, try not to think about it" — super helpful, guys. Eventually a jaw specialist found an irregularity on the left side of my jaw and fitted me with a heavy-duty custom mouth guard. That alone made a monumental difference in the ear ringing. But I also picked up a TMJ Pen on a chiropractor's recommendation — it's a 3D-printed vibrating/heated massager specifically designed for jaw muscles. Looks exactly like a vape (fun times at the airport), but it's been worth every penny of its ~$200 price tag. Between the mouth guard and the TMJ Pen, I wake up feeling way less like I survived a Saving Private Ryan scene. Forced fun — After a full work day plus all the dad/house stuff, my go-to is to be a blob on the couch. Nothing wrong with that sometimes. But I've found that the things that actually recharge me — like singing and playing guitar — require a little push to get started. So tip #7 is basically a note to future tired Brian: go downstairs, plug in the guitar, and start playing. You'll be glad you did. Got mental health tips that work for you? I'd genuinely love to hear them — this is the kind of conversation I want to be two-way. Find me and all things 7MS at 7MinSec.com, our Substack at 7MinSec.club, and our constantly growing pentesting wiki at 7MinSec.wiki.
Transcribe →7MS #726: Baby's First Hermes
Jun 1200:22:03Tap to summarizeHello friends! I've been on a bit of an AI agent journey lately, and today I'm sharing my experience ditching OpenClaw and going all-in on Hermes — a self-hosted AI agent built by Nous Research. A Network Chuck video sold me on it, I wiped my Mac Mini (again), and baby's first Hermes adventure began! Here's what we get into today: Why I left OpenClaw — After getting the Mac Mini set up, OpenClaw left me feeling pretty meh: burning through API requests, random mid-conversation shutdowns, and a marketplace where the top listings were flagged as "potentially malicious." Hard pass. Network Chuck's five reasons Hermes rocks — His video summarized why Hermes stands out: (1) Nous Research has serious open source model cred predating OpenClaw, (2) more flexible persistent memory via markdown files + optional Honcho integration for building a profile of you over time, (3) a mission around humanistic and democratic AI, (4) a self-improvement loop where it writes its own skills after figuring things out, and (5) it just doesn't break — it feels like a product, not a project. The install — I used Claude to build a Mac Mini install guide from the Network Chuck transcript, and had Hermes up and running in about 15 minutes (one small Ollama hiccup aside). The install wizard lets you choose cloud models like Claude or ChatGPT, or go fully local with something like Gemma — I'm planning a hybrid setup with two Telegram bots. First real-world use: sitting in a truck running errands — With Hermes running on the Mac Mini and connected via Telegram, I asked it what it could do. It suggested Uptime Kuma for LAN monitoring — weirdly well-timed since I'd just been thinking about flaky IoT devices. I said "go install it," and it did — narrating its own troubleshooting out loud the whole time like a little robot intern. Remote access and Home Assistant — Had it install Home Assistant for smarthome control too, with plans to wire up TwinGate for remote access (it had a TailScale skill ready to fire in about two seconds, but I'm trying to keep VPN services consolidated). Daily digest via email — Hooked Hermes into a dedicated Gmail account and set up a 6 a.m. cron job that sends me a personalized morning digest: weather for my watched locations, recent breach/CVE news from select sites, and a summary of my favorite pentesting-focused Mastodon accounts. Needs tuning, but the first digest landed this morning and it's really good! The privacy angle — The real long-term win I see here is a hybrid model: feed raw, unsanitized pentest data to a local private model, let it analyze and sanitize, then hand off the clean version to a cloud model for deeper insight. Best of both worlds without the data exposure anxiety. Check out the Network Chuck video that started it all, and as always, if you're doing cool AI + security stuff, I'd love to hear about it. Find our pentesting services and training at 7MinSec.com, pentesting tips and scripts at 7MinSec.wiki, and if you want to support the show, head over to 7MinSec.club.
Transcribe →7MS #725: Building a Bulletproof Backup Solution
Jun 500:21:57Tap to summarizeHey friends! Backups are not as cool as pentesting, but boy do they matter when things go sideways. This week I'm sharing how a Proxmox backup disk space meltdown led me to a completely overhauled — and honestly pretty bulletproof — backup setup for both home and work. Claude played a big role in helping me sort it all out. Here's what we get into: The backup history tour — I've been through CrashPlan, Dropbox, Backblaze (which saved my bacon after my house fire in 2019!), and a mystery one that may or may not have had "Panda" in the name. These days I'm settled on ARQ for personal backups — dead simple, backs up to just about everything (Dropbox, OneDrive, Google Drive, even their own ARQ Cloud for ~$80/year), and all data is encrypted at rest. Not a sponsor, but they should be. The 3-2-1 rule — I actually asked Siri mid-episode, and she initially thought it was a grounding/anxiety technique. (Valid, I guess?) The real answer: three copies, two different media, one offline. I've got a local copy plus OneDrive, Google Drive, and Dropbox — so I think I'm covered. The work side: Proxmox + PBS — My "data center" is a beefy Hetzner Proxmox box with about a dozen VMs. I had Proxmox Backup Server (PBS) set up on a secondary Hetzner box, happily cranking away… until it ran out of disk space and started yelling at me every night. Claude to the rescue — I spun up a Claude project, fed it terminal output and retention configs, and it gave me a straight-up honest assessment: either gut your retention policy (risky) or get more disk. It then walked me through Hetzner's auctions page — which I didn't even know existed — to find a storage-heavy, low-horsepower box. Ended up with two mirrored 8TB drives plus a 14TB drive for around $40/month. Not cheap, but totally worth it as a business expense. The new setup — PBS is now on its own dedicated Hetzner box. VMs from both my data center and my home NUC Proxmox box back up there nightly. Claude also suggested using that 14TB drive as an SFTP target for ARQ, giving me yet another redundant copy of all my personal data. It'll take a few weeks to fully sync, but I'm running some flavor of the 4-3-2-1 rule now (I made that up). Proxmox forever — Someone wrote in asking if I'd go back to ESXi now that Broadcom brought back the free version. Hard no. I've fallen in love with Proxmox and I'm not going back. 7MinSec wiki scripts repo — Head over to 7MinSec.wiki and click the Scripts button to find a new GitHub repo where I'm publishing pentesting scripts. First one up: a push-button Exegol installer. More to come — and I'll probably tease new scripts first over at 7MinSec.club on TuesdayTOOLSday! Have a backup horror story — or a setup you're proud of? Hit us up! And if you need assessments, pentesting, training, or other security goodness, find us at 7MinSec.com.
Transcribe →7MS #724: Tales of Pentest Pwnage - Part 85
May 2900:30:14Tap to summarizeHey friends! Today we're going deep on external network pentesting — something I realize we've barely touched in however many episodes we've done. I'm currently in a long stretch of back-to-back external assessments, so it felt like a good time to talk about it. Here's what we get into: Scoping headaches — why the old "count your public IPs and multiply by a big hourly rate" approach drives me crazy, and how we actually scope external tests to be fair to everyone Web apps in scope or not? — this needs its own conversation before the test starts, and skipping it causes pain later Testing under real conditions — the debate around whether to request an allowlist vs. scanning as-is, and why I lean toward creating the best testing environment possible Multi-tool enumeration — why we run Nessus, Project Discovery, and Shodan together, and what each catches that the others miss Reporting the surface — why just walking a customer through what's exposed to the internet (ports, services, screenshots) has more value than I used to give it credit for SNMP and NTP findings — two protocols that keep showing up open when they really (probably) shouldn't be OSINT phase — how we've grown externals to include open-source intelligence work on the customer's domains, not just IP-level scanning WordPress hygiene — it keeps coming up on these assessments, and I've got some practical recommendations Dorking and metadata searches — using AI to quickly sift through publicly exposed documents for things attackers could use to pretext a social engineering attack Subdomain hijacking — a sneaky attack path I've seen in the wild that flies right in the face of all the "check if the URL is spelled right" advice we give users Even when the technical findings are pretty quiet, there's a lot you can do to punch up an external pentest report with stuff that's genuinely valuable to customers!
Transcribe →7MS #723: CARTP - Cloud Red Team Tactics for Attacking and Defending Azure - Part 1
May 2300:32:31Tap to summarizeHello friends! Today's a hybrid episode — some security content up top about a new certification I've kicked off, followed by an aggressively quick trip to Tangent Town. Feel free to bail after the security stuff if tangents aren't your thing! The security part: starting CARTP I've started the Certified Azure Red Team Professional course from Altered Security (enterprisesecurity.io). It's the Azure follow-up to CRTP, which I took a few years back. Quick notes: Why now: Active Directory and internal pentests will always be my first love, but more and more of our customers are shifting to hybrid or full-Azure environments. Time to get some formal training in that lane. Self-paced vs. live: They offer both. I'm past the point of giving up Saturdays to security training, so I went with the ~$500 self-paced 30-day option. You get a portal, a lab manual, and a remote Windows VM with low-priv creds into a target Azure tenancy to attack and enumerate. The catch: The lab manual is thorough on "do this, see this output" steps, but light on "and here's the wow moment hiding in line 47 of the output." With the live class, an instructor would highlight that stuff in real time. In the self-paced version, you're on your own to find the meaning in 200 lines of output. The fix: Started a Claude project that's effectively co-teaching the class with me. I paste command output and ask "what's the important bit here?" — Claude pulls out the line that matters and explains why (e.g., "this user has write access to a key vault, which means…"). Way more efficient than ALT-TABbing alone. Tools I've touched so far: ROADtools, GraphRunner, and Monkey365 (kind of a PingCastle-for-Azure that spits out a health-check report). Where I'm at: Module 4 of 40-something. Course culminates in a 24-hour exam, which I swore I'd never do again after CRTP — but James Bond and Justin Bieber both say "Never say never." Tangent Town: The Shake Shack incident. It's gross and not funny. But kind of funny. Saw (and sort of met) Calum Scott at the Fillmore in Minneapolis. Standing-room-only venue, but my wife found a clutch spot wedged between a security barrier and a support beam, perfect for our family. During an acoustic set, Calum and his band came right past us. My wife (unable to help herself) gave his shoulder a squeezy squeeze. I held out for the fist bump on his return trip to the stage — and we're basically best friends now. I highly recommend his show: very positive guy, family-friendly, genuine. Seven super-fast non-spoilery movie reviews from plane rides and hotel nights: Coherence — for smart people. I am not those people. Probably great if you can follow it. Deadstream (Netflix) — YouTuber live-streams a night in a haunted house. Surprisingly entertaining, a couple of real jump-scares. Get Away — a family vacations on a forbidden island. Goes somewhere unexpected in the third act. Hell House LLC — found-footage haunted house. A couple of genuine flinches; story was just OK. Hokum — Adam Scott as a writer at a hotel with a personal history. Creepy-crawly, goes to some dark places. Loved it. Predator: Badlands — went in expecting mind-numbing action, but I loved it! I'd give it an 8 or 9 out of 10. It had action, LOLs, and even some tender Predator moments. Going to watch it again soon. Obsession — young man buys a wish-granting trinket so a young lady will like him. It works. Then it really works. The movie slowly goes into full-on bonkers sauce mode! Satisfying but uncomfortable to watch at parts. That's it! 7MinSec.com for services, 7MinSec.club for the Substack, 7MinSec.wiki for pentest tips and scripts.
Transcribe →7MS #722: I Turned My Phone Into a Brick
May 1500:23:51Tap to summarizeHey friends! Quasi-vacation week over here, so today's episode is lighter and more personal: just a story about how I turned my phone into a "brick" (kind of) and what that's done for my mental health over the past week. The product is called Brick (getbrick.com). Not sponsored, no discount code — just something I've genuinely been enjoying. It's a $50 NFC dongle + app that lets you "brick" your time-waster apps until you physically tap the brick again. Here's what stood out: The physical separation is the magic. Other digital-wellbeing apps just need a code to unlock — Brick makes you walk to wherever the dongle lives (mine's on the fridge) and tap your phone to it. That extra step is enough to break the habit mid-flight. I caught myself doing three or four Pavlovian pocket checks an hour, on autopilot, with zero notifications waiting. "Junk food for the eyes" realization. First day I bricked socials until end of day → felt great. Then I unbricked, sat down, and spent 25 minutes catching up on everything I "missed" → felt noticeably worse afterward. Scheduling is a sleeper hit. You can set the phone to auto-brick on a schedule — no physical tap needed. Mine kicks in from 9pm to 8am. Result: calm wake-up with my wife and son, no email triage in the school drop-off line, and my "work brain" doesn't fire until 8am. One-to-many is a real win. A single Brick works across household members, each with their own app profile. My oldest son Cam (deep in paramedic-school crunch) tried it for a study session and reported the same thing — reaching for his phone between turning book pages, for no reason at all. He even left for evening class with his phone still bricked and decided not to burn an emergency unbrick. Emergency unbricks are scarce by design. You get five total and that's it! The stats are anti-shaming. Instead of the dreaded Sunday-morning "your screen time is up 10%" notification, you get to see number of hours you spent in brick mode. Love that! Want to see screenshots and hear more about Brick? Hop over to 7MinSec.club — this week's Tuesday TOOLSday was all about Brick. Got a digital-wellbeing tool you swear by? Let us know!
Transcribe →