Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Jennifer Villarreal on how she upped her hacking game
Guest:
Jennifer Villarreal
Published:
Duration:
31 min
Episode summary
Jen, a former military professional turned hacker, shares her journey into cybersecurity and her experiences with the Synack Red Team in the latest episode of WE’RE IN! She transitioned from fixing security issues to actively seeking vulnerabilities, inspired by her brother and motivated by her experiences at the storied hacker conference, DEF CON. Jen emphasizes the importance of skill development and preparation for women entering the male-dominated cybersecurity field, and discusses her preferred hacking tools and techniques.
In this episode of WE’RE IN!, Jen gives her take on AI in penetration testing, suggesting it should be used as a tool for initial reconnaissance but not for exploiting vulnerabilities.
Listen to hear more about:
Why all of Jen’s smart home devices’ warranties are voided
How anyone can be a hacker by following the Open Source Intelligence methodology to find vulnerabilities
The importance of producing high-quality work and going above and beyond to gain trust in the pentesting industry
Listen to the episode
S3 E16 · Jennifer Villarreal on how she upped her hacking gameWE'RE IN! Podcast · 31 min
Key takeaways
Walk in selling your skill set Jennifer's advice for women entering a male-dominated field is to go in prepared, keep practicing and training, and let demonstrated skills be the focus.
Use Nuclei with care Nuclei validates vulnerabilities using YAML templates, but running it with default configs can break things or touch services you did not intend to test.
OSINT starts with public footprints Her workflow moves from social media and LinkedIn scraping to tools like phonebook.cz, email validation, user enumeration, breach data, and then password spraying, always under contract.
Organizations stall after early fixes At CDW she sees repeat customers who fix the path to domain admin found in external and internal tests but do not expand to a Red Team assessment, usually for budget reasons.
AI for recon, not exploitation Jennifer is comfortable using AI to gather reconnaissance data but does not think it should exploit vulnerabilities, because it cannot think like a motivated real-world attacker.
Topics covered
Bug Bounty
Synack Red Team
Veterans
Notable quotes
I just thought, well, I don't wanna be the one who fixes all this. I wanna be the one that does that sort of thing.
…with any technical field, you need to walk in there selling your skill set, and that's gonna be the main focus.
So there are a lot of things that are convenient, but it doesn't necessarily mean that they're secure.
I used to actually get up and get very excited, but now I'm kinda like, oh crap, that was too easy.
Questions this episode answers
How did Jennifer Villarreal get into hacking?
After an Army pre-deployment exercise where a cyber team showed her network was not secure, she decided she wanted to be the one breaking things. Her brother, an SRT member, pointed her to free resources like PortSwigger and Hack The Box, and meeting hackers at DEF CON sealed it. Read this section
What tools does a Synack Red Team member use for API testing?
Jennifer uses Postman proxied through Burp Suite for API tests, and Nuclei, which she cautions against running with default configurations. Read this section
How can I make myself harder to hack?
Avoid posting unnecessary details like pet names, audit who you follow, use a long random passphrase instead of a password, lock your laptop, sign out of devices, and do not store passwords in notes. Read this section
How do pentesters earn trust in the Synack Red Team?
Jennifer says producing high-quality work and reports earns trust, along with helping others and going above and beyond. She has had only one report kicked back. Read this section
Should AI be used in penetration testing?
She thinks AI is fine as an aid for reconnaissance and enumeration but should not validate or exploit vulnerabilities, since it lacks the motives and judgment of a real attacker. Read this section
About the guest
At the time of recording, Jennifer Villarreal was a consulting engineer at CDW, doing internal, external, and wireless penetration testing and phishing, and a member of the Synack Red Team (SRT) for about four years, recently inducted into its Circle of Trust. She is an Army veteran who deployed with active duty twice, setting up secure tactical networks, and later worked at Raytheon supporting defense systems. She also takes part in Synack's Artemis Red Team.
Hello, and welcome to We're In, a podcast that gets inside the brightest minds in cybersecurity. I'm your host, Blake Thompson-Heuer, and with me today is none other than Jennifer Villarreal, consulting engineer at CDW and member of the Synack Red Team of global security researchers. Jennifer has hacked her share of applications, API endpoints, IoT devices, and even AI technologies in the name of improving their cybersecurity, so I expect we'll cover some interesting ground. But before we jump into the conversation, here's a quick word from our sponsor.
Confusion in the marketplace about which is the best method of security testing is so real. Bug bounty, pentesting, pentesting as a service, what do they all mean? We break it down in our latest playbook, navigating the security testing landscape to demonstrate the strategic value of third party security testing. We cherry pick the best elements across the security testing market to incorporate into a strategic, comprehensive pentesting solution. The Synack platform. Learn more at synack.com/playbook. That's synack.com/playbook. Thank you so much
I was actually in the military. My job in the military was to deploy a secure tactical skiff, And I had about three hours to do that. I would be in charge of encrypting the network. So ordering like the Ku bands, the comm sec stuff, basically being an ISP for the military in deployment zones. I didn't deal with like help desk or actual computer stuff. But during a pre deployment exercise, we had these really cool cyber guys come in. And they're like, yeah, we've rent your guys the stuff. You guys aren't ready or secure for this deployment. And I just thought, well, I don't wanna be the one who fixes all this. I wanna be the one that does that sort of thing. And at the time, I was working at Raytheon. I worked on supporting defense systems, so like radars, things like that.
And my brother was on Synack's Red Team. I really wanted to get into security stuff. He's actually also a army veteran as well. He worked in a different field. He did intelligence.
was basically my whole thing. We... Yeah. So my brother, at the time, was working for MITRE, which comes up with, like, all these best practices for cyber security and etcetera. They also... Attack framework we all know enough.
Yeah. MITRE ATT&CK. I was working at Raytheon, and I was just like, John's doing, John my brother, this hacking thing on the side. He's getting paid for it. I was told while I was on this pre deployment thing that now I've gotta figure out how to fix all this stuff and I just don't wanna do that. I don't wanna fix anything. There have to be a way for me to start getting into this. So he told me, you know, start studying for a suite. Start doing like all these sorts of things, online free resources that I could utilize to study on my own. I did that. I started enjoying it a lot. Really spending basically all my free time on like PortSwigger, Hack the Box, other things like that. And they had a security team at Raytheon. And I asked if, you know, they were going to DEF CON. And they were like, yeah, we're gonna go.
So I was like, hey. I had volunteered to do like a technical demo. So I did... The first box I hacked on Hack The Box was Jerry, which was like an old Apache web server that they had. So I did a live demo of that. Their attitude was like, oh, she thinks she's a hacker. Blah blah blah. And like, no. I'm just trying to learn and like share share stuff, you know. So we get to DEF CON. My first DEF CON ever. My brother is going with his group. I'm going with Raytheon. We had like a group chat. They kinda didn't really like invite me to breakfast and stuff like that. It was kinda like, I feel really out of place here. And I was standing in line and I seen one of the other engineers there. And I said hello to the person and I was right next to my brother. Person asked me if he knew me.
And I was like, woah. Yeah. And my brother's like, you know what? You're here with them. They paid for your ticket but they're like not acknowledging you. The group that I'm with Synack, they're having a party for veterans. I want you to go tonight. So I went, met a bunch of different people, important people, great people, other hackers. Ask them about what they enjoy about it, what their day to day looks like. Trying to get more info because you don't run into people who do this full time ever. So it's really hard to assess if that's something you really wanna do. It's hard to get that information. Pretty rare. Unless you're at DEF CON. They're everywhere. Everybody was so casual and welcoming, respectful,
That's great that you kinda found your footing after what sounds like a pretty rocky start. But I imagine it has to be a little tough, especially when... Before you have all the expertise amassed and all the hack the boxes completed and whatnot. And already, cybersecurity industry is known to be kind of a male dominated industry. And do you have any advice for other women who are making their way in the hacker community?
I think that it's best to just go in prepared knowing that... So like in this case, I was not on the Synack Red Team at that point. I knew that I had to up my game, but being around that group inspired me and motivated me to practice, to train, to learn more, and prove that I have the skill set. So I think with any technical field, you need to walk in there selling your skill set, and that's gonna be the main focus.
And you mentioned some of your work for the army. There's obviously a well known pipeline from the armed forces to cyber. Has to mention your your... It sounds like your brother followed the same path in a way. But how did your military service prepare you for taking on this kind of adversarial mindset?
I think it was them handing me a bunch of stuff to fix that I decided, no, I don't really wanna do this. And when I did talk to the cyber team who did like hone my network, they were just like, yeah, you gotta go get a degree in cybersecurity. You gotta go do this. And I thought, well, I don't wanna also. I just don't wanna get a degree either. And I didn't wanna fix all of, like, the patches and everything that would have prevented those vulnerabilities from being exploited. But they didn't really prepare me.
Right. Right. Right. And you may... You you alluded also to some of the tools that you've been that you've been using and some of the must have tools. I think Burp Suite certainly is one. What else is is in your arsenal?
I also... For like API tests, I like to use Postman. I really enjoy that. You can actually get that to proxy through Burp as well. So you can use both of those for when you're testing APIs. Nuclei is a good one, but it has sort of a bad rep because a lot of people just run it with its default configs. So they're not very careful. They can break things. They can interact with services that they didn't mean to.
Nuclei is basically... I don't wanna compare it to Nessus, but it has a bunch of different YAML files that it reads to validate that a vulnerability exists. To say like, oh, this is actually a valid vulnerability on whatever target list you gave it.
That makes sense. Yeah. I I I... As a nontechnical podcast interviewer here, I'd I'd... I'm not familiar with all the niceties of these tools, but I guess they can all be leveraged to to really find some pretty intense vulnerabilities. Are are there any kinda TTPs or vulnerabilities that you tend to specialize in?
When I was more focused on web app testing, I really liked messing with file uploads to see if I could upload file formats that wouldn't be normally allowed to be uploaded.
Yeah. I could see how that would be digested into the system and give you that little foothold that you might need. So I wanted to talk about connected devices, something, you know, that might hit close to home literally for listeners. Are there any flaws that you often find in, like, home networks or consumer IoT? Is that something that you've looked into?
Yeah. So there are a lot of things that are convenient, but it doesn't necessarily mean that they're secure. Let's just say, for example, the Belkin switch. People can actually monitor network traffic. They can interact with network traffic in lifetime use... Utilizing tools like Burp Suite and modify requests being sent to these network devices that are attached to your internal or home network. It just poses a risk because these things are not tested before they're brought into your house. My fiance and I, we both... Even though we know it might void a warranty for a lot of devices that we bring into our home, like our vacuum, our robot vacuum, that has to be tested. Like, most of the things that we have here have to be tested.
So sounds like you share that perspective with your fiance. You mentioned of wanting to be security constantly on alert for various things. I'm I'm like, I don't think I've pentested my robot vacuum upstairs, come to think of it. So maybe that's offering attackers a a backdoor into my home network here. I don't know. Now, obviously, the first part of a a lot of engagements for this kind of work involves open source intelligence, figuring out what's out there. For those of us like me who might not have those technical chops or be curious about getting started, do you have any tips for the for the uninitiated? What should people be looking out for to hone their OSINT skills?
There are many different tools or products that you can use. The first thing I like to do is look at people's social media footprint. There are some tools... I can't think of the name right away because they're probably priced high. But if I wasn't using anything like paid for subscription wise, there are ways that you can just manually check out people's Facebooks, their Instagrams, their OnlyFans, Snapchat, like, different things that are tied to their email, their phone number. You can find addresses online. I like to go on LinkedIn. It's one of the easiest things to do. And I scrape a bunch of employees based on a domain name. I'll also utilize, I think phonebook.cz is free. And you can get all their URLs, sub domains tied to their root domain, phone numbers, emails.
And then what you do with all of that information once you have it, is you run it through an email validation checker. So to see what kind of email they're using. So like if they're using Office three sixty five, I would use o365spray to give me a valid list of users. Then the next step would be to go check out things for your products that release breach data, data leaks. I'm not sure. I use dehashed. There's a bunch of different data breach dumps that you can utilize.
That one's a free one. I think you can just check. But Yeah. It's kinda hard because you gotta compare, like, even with the the the paid ones, you don't know which one is the most accurate. Like, what is the latest password? Because few of them I been pwned or like maybe another one. A couple of them will have breached credentials from, like, 2021 or something. You know what I mean? You want the Yeah. Latest
Yeah. And then you can begin, you know, password spraying. You can even, like, if you were being really bad or if you were allowed to spray people's, like, Instagram password, like, to log in as them. It depends on, like... Obviously, I don't do that unless I have a contract and stuff. And I get a lot of people say, oh, you're a hacker? Can you get into my boyfriend's Instagram? I'm like, I'm... I cannot hack Instagram just because your account is on there. It belongs to them. So no.
like it's like anybody who works in IT and they become the default tech support for the whole extended family. Right? It's you know... And I'm sure you probably get a little bit of that as well of just like, oh, you're in cyber. Can you help me with this TV remote? It doesn't seem to connect me to my
Oh, no. Well, I know you said you got into this field because you didn't necessarily wanna fix things. But the flip side of that question is, of course, for those of us who might be a little paranoid looking over our shoulders, what are some easy tips that might make the lives of somebody in your shoes a little more difficult?
Don't use your pets or like a mascot. So like, don't post stuff on the internet that doesn't need to be posted. But once in a while, an audit of who's following you, who you're following, who you're friends with. Make sure that there's not duplicates. Use a passphrase and not a password. Something really, really random and long. It could just be a sentence, you know, passphrase is is better than a password. Because even if we get your hash, it's gonna be a lot harder to crack than something, you know, 10 character. Close and lock your laptop. Sign out of devices when you're done on your browsers. Close out things. Don't save passwords in, your notes on your iPhone or, like, write them down, things like that. It should be something long that's easy for you to remember and not stored anywhere.
Easier said than done for a lot of users, but all good advice for sure. Now on the organizational level, I'd be curious to hear what you think companies struggle with when it comes to implementing a robust security program. Or particularly a security testing program. Like, how do you scope things that you even want folks like you to go poking prod at?
Well, it depends on what they're looking for. Right? So if they just want their external footprint done, there's a method and a process for that. Same with their internal active directory networks. Same with their internal web applications or their external web application. Their wireless networks as well. And then also physical penetration testing, like on-site stuff. So it depends on what they want to get tested. A lot of times, they don't know to test things. We're kinda spoon feeding suggestions. For my job at CDW, a thing that I see often is repeat customers, but they're not expanding their security testing. So for instance, they're always only doing an external or they're always just doing an external and internal.
They get to a point where we out brief them on things that we got DA on. Right? And like the whole path to compromise. They fix it. We test them again next year. Now they're pretty dang secure, but they don't have the funding to pay for a Red Team assessment. So it's it's usually a funding issue.
Right. Because the Red Teaming then would take you to that next level of showing how far you can go and really putting the security... The holistic security program to the test in a more hands on way. So tell me a little bit more about the work that you do with CDW then. It it sounds like a lot of the some of the similar skill sets that you apply in your work for the Synack Red Team.
Yeah. So I do mostly for Synack. I do, like, special side stuff. And then also, I mean, the main thing or bread and butter is web application testing and API testing. For CDW, I do internal penetration testing, external penetration testing, wireless penetration testing. I do phishing, and I just started learning more about phishing.
So you're basically calling somebody or calling a list, a target list to see if you can exfil some kind of data. Maybe you're pretending to be the CEO of a company. And at our job, we've actually... There's some of our team who are so good at it that they're able to do like deep fakes of like CEOs voices and make something sound very urgent. But if you weren't doing that, you could also just pretend to be IT and say, hey, I just needed to validate your credentials or something. You're just trying to get information from people on the phone.
I've seen those types of real world scams actually starting to crop up. I I feel like for so long, that was a... In the realm of sci fi. Right? Of, like, deep fake audio combined with the call. You're like, is that really gonna happen? But no. Like, attackers are siphoning off hundreds of thousands of dollars pretending to be... See, it's like... It's kind of like business email compromise. Right? It's it's so successful, and it's where the money's at. So people are gonna do it. Scary stuff indeed.
Yeah. I always tell people when you answer the phone and they ask, is this so and so speaking? You don't say yes. Never say yes. Because we know, like, what to do with those sorts of things. Right? It's consent in somebody else's voice.
Yeah. It's... I mean, it's hard to keep your guard up all the time though. Right? And you gotta you gotta kinda cut yourself some slack in those moments. I think we've all been multitasking and bamboozled by some little blip that gets... Cuts... Catches us at the wrong moment. Right? And
I guess attackers are always are always knocking on the door to try to find that moment. Now you were recently inducted into the Synack Red Team circle of trust. America runs on Dunkin', you know, the pentesting industry runs on trust. Right? You don't let outside or third party or even internal pentesters sometimes, you know, do the work that you do without some level of trust. What does it take for organizations to actually establish that? And how have you built that trust?
I mean, I've been on the platform for about four years now. And while there's many SRT, I think that producing high quality work in reports is what gets you that sort of trust. Right? And even doing things just to help a little, just from the goodness of your heart, can gain trust to people.
Well, would that be in the context of Synack Red Team? Like, I know I I believe you participate in something called the the Artemis program, for example. Is that is that right?
Yeah. That's a... I wanna call it, like, a minorities group. But I do a lot of things for Synack just just to get back because I've been very lucky on the platform. I've made a lot of friendships. I've learned a lot customer wise, producing quality reports. I've only had one report kicked back to me. So I think that quality and participating in other groups just out of the kindness of your heart, going above and beyond, gains trust.
Yeah. No. And and you got it. The Artemis Red Team was established to support women in the SRT and and nonbinary individuals and and gender minorities. So that... That's kind of the the backstory for for Artemis. And we kind of alluded to some of that earlier in our conversation of the getting a foot in the door of cyber, and then once they're getting that support as needed. Right? And I did wanna mention AI, of course. It's a buzzword. Can't not mention AI these days. Taking the tech world by storm, do you do you see a lot of AI in your work? Do you incorporate it? I've I've I've heard mixed, honestly, of how AI could make an impact on hacking.
So for AI, I think that if it's utilized as a tool or as an aid for pentesting or enumeration, then that's fine. Gathering all that information that you would gather in your initial reconnaissance portion, but not the actual validation of vulnerabilities. I do not think that AI should be exploiting things. To me, it's dangerous. I don't think that it has the capability to think like a real world adversary. Right? Because while we're the good people hacking to find laws and help people make their security posture better, Real world attackers are doing it because they need money. They're emotionally driven, and they've got no values, no morals, only bad incentives.
AI doesn't really have feelings. It doesn't have the emotion to drive to feed in to that. Just... It can't think like a real person with incentive to go do something bad. So from that perspective, and then also a technical perspective, I don't think it should be used to exploit things, but just serve as an aid for initial reconnaissance.
I hear you, and that resonates with me. I mean, even if you take it at face value that AI is somehow neutral, which I think a lot of people would take issue with even at some of the scenes, but some of the powerful algorithms are spitting out nowadays. Do you still want somebody pentesting your networks who's just neutral? You know? Like, do you want somebody who's actually trusted and has that capability and that desire to go in? I mean, you're basically... You're working two jobs now. There's gotta be a lot of commitment and passion for this kind of work to do Synack Red Team and CDW internal bend testing. Like, you're living and breathing this stuff in a way that the AI has no feelings about.
Yeah. And then like, you know, you have to think about it. So oftentimes, when we're doing something, like, say there is a soda company. When you're talking to the clients, you reassure them that they're in good hands. You're not going to take down or disrupt their day to day activities while this test is going on. And that you're gonna update them if you find anything critical like those, you know, media things, the new RCE that came out. Everything you see on media, they wanna know. Even if it's things they've never heard of, if it's critical, they wanna know. They also care to know about, like, their own little personal goals. If you are a bad attacker, Jen, can you find our recipe to our number one selling soda? And then like publish it somewhere. Can you get that information from this external host on the internet, pivot your way into our internal network, and find our secret recipe.
So that's when I turn on like the attacker hat. And I'm actually looking, I call it looting for things, whether it's like social security numbers, people's passports, court cases, bank information, and, you know, of course, like recipes or secret sauce for things. I take screenshots of all that information that I find, explain how I found it. Obviously, a lot of things are redacted, but that's where you would put on that attacker hat.
So, obviously, I know you need to be careful, and you use the fictional example of a soda company. But tell us about a time when you did have that kind of real world hacking moment where you said, we're in and did the fist pump and made it access the networks.
I used to actually get up and get very excited, but now I'm kinda like, oh crap, that was too easy. So last week, actually, I was doing an external test, which is just assessing hosts that are externally available on the internet, right? Externally facing hosts that anybody can access. There was like a couple of servers. The vulnerability allowed you to make a POST request to the server, adding your own SSH key as an administrator. So I was like, cool. I haven't actually seen this happen. So I go and make my POST request. Everything's good. It's so successful. And I'm like, wow, cool. So I'm looking around because you can't be a subject matter expert at every single device that you hack, right? So I don't know the syntax. So I'm Googling how to create my own user account.
And so that way I can leave this one alone. I make myself at home. I make my own account, add myself to the admins. And then I start looking around at like jobs that it has running. And I'm like, oh, it's got jobs that connect out to its more internal systems. And on the initial call with the client, they gave me permission to test internally if I could get access. So I'm like, all right, I'm going start like getting DA. That's going to be my goal. Well, before I did that, I wanted to call them and I let them know. I'm talking to the main point of contact and he's not understanding the vulnerability. So I emailed him resources. I shared my screen, showed him. And he was just like, okay, so do I just change the password? I'm like, no, you have to actually like update the whole thing. And he's like, okay, well, I don't manage this.
I'm going to connect you to my third party network managing people. So I'm like, okay. I get an email invite for a call, Teams call. And I'm like, all right, I have not heard of this guy. I don't know who he is. So I asked him to share his screen because I'm not about to get social engineered and show me the email that he's got the permission from the main point of contact to work with me. So he shows me everything, whatever. I'm now showing him the vulnerability, sharing my screen. And he says, he goes, wow, can you go to accounts and list them? There were so many accounts being added while we were looking at his system, because it's externally facing. This is a vulnerability that was so easy to exploit within like thirty seconds. And I'm telling him, I'm like, hey, this means other people are actively like attacking this right now.
He's like, well, I don't know what to do. And I tell him, I think, you know, we've got to reset everything. And he tells me, can you create an account for me? Because I haven't been able to manage this device in a couple years.
So like, okay, like, you're gonna have to tell me the commands, dude. So we went through that process. They ended up quarantining it and like taking care of the device. But that was something that happened last week that I thought like, doesn't happen every day.
That's really funny. So you, hey, Here to help. Right? You know, if I can carve out a new role for you to reclaim this system that's being actively attacked, more power to you. That's really funny. So really appreciate your insights here, Jen. Some really interesting anecdotes and conversation. There is one question that we ask of all our guests on the podcast, which is what's something that we wouldn't know about you just by looking at your LinkedIn?
Something that people wouldn't know. People might know a little bit like the car hacking thing. I post about that on LinkedIn, but they don't know that I like to work on weekends whenever we have free time with my fiance to like build some of his cars out. I actually learned that a drive shaft is extremely heavy and it sucks to take it out from underneath a car that is not like on a lift and only on jacks. Another thing, I really enjoy true crime videos and I enjoy doing my makeup.
Those are three things that we might not know about you looking at your LinkedIn. So fair fair play, Jen, and really appreciate your time here. Thanks, Jen, for for joining. We really appreciate it.
If you liked what you heard today, I hope you'll give us a five star rating and review. It's a big help. And please share this episode if you know anyone who could appreciate a little info sec wisdom on their morning commute. We have a whole catalog of episodes well worth a listen, so you may wanna check out past interviews as well. Finally, if you know someone who might be a good fit to appear on the podcast or have any comments or feedback, drop us a line at we'[email protected]. That's s y n a c k dot com. Until next time.
WE'RE IN is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack Pen Testing platform to their own customers. This approach helps optimize Synack partners' technical competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding continuous best in class solutions to cybersecurity, cloud, and DevSecOps offerings. Synack partners with organizations around the world to make them safer, more resistant to cyber attacks, and more capable of finding and fixing dangerous vulnerabilities before attackers are able to exploit them. Learn more at synack.com. That's synack.com.
