Jason Haddix USES ShadowCrew
Jason says ShadowCrew was an underground forum where he learned how to make fake IDs.
Explicit Confidence 99% · Jason Haddix EP 130 Details
“one of the resources that I fell upon was ShadowCrew”
Episode
13 December 2022 Official episode · Official transcript
black hat cybercrime dark web carding
Jason Haddix describes his transition from underground activity on ShadowCrew to professional penetration testing, including physical, network, web, and mobile application assessments.
Topics: Physical penetration testing and bypassing electronic-door and parking-garage sensors, Tailgating and man-trap access controls, Reconnaissance of internet-facing assets, domains, and subdomains, Mobile application traffic interception with Burp Suite, Open AWS S3 bucket exposure, Hard-coded credentials in mobile application PLIST files, Apache and Tomcat administrative exposure, Metasploit payload deployment, Password reset abuse and brute-force account takeover, Weak password policies and rate-limit bypass, Cross-site scripting, SQL injection and database extraction, Unauthorized access to paid streams and protected content, PCI compliance and penetration-testing requirements
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
Jason Haddix USES ShadowCrew
Jason says ShadowCrew was an underground forum where he learned how to make fake IDs.
Explicit Confidence 99% · Jason Haddix EP 130 Details
“one of the resources that I fell upon was ShadowCrew”
Jason Haddix MEMBER_OF HP
Jason says he later got a penetration-testing job at HP.
Explicit Confidence 98% · Jack Rhysider EP 130 Details
“then got another job doing penetration testing at HP”
Jason Haddix USES penetration testing
Jason describes performing hundreds of penetration tests during his career.
Explicit Confidence 99% · Jason Haddix EP 130 Details
“I’ve probably done over my career maybe three hundred pen tests”
HP USES penetration testing
Jack says HP obtained contracts to provide penetration testing for companies subject to compliance requirements.
Derived Confidence 91% · Jack Rhysider EP 130 Details
“I guess HP was one of those auditors and offered this service”
Jason Haddix USES physical penetration testing
Jason performed physical penetration tests, including attempts to enter buildings and server rooms.
Explicit Confidence 98% · Jack Rhysider EP 130 Details
“Jason did a few physical pen tests”
Jason Haddix USES network penetration testing
Jason says the majority of his penetration tests were network-based.
Explicit Confidence 99% · Jack Rhysider EP 130 Details
“the majority of pen tests he’s done have been network-based”
Jason Haddix USES web application penetration testing
Jason worked on the web portion of a bank penetration test and later tested a large web site.
Explicit Confidence 97% · Jason Haddix EP 130 Details
“one was the network and web portion of the penetration test”
Jason Haddix USES mobile application penetration testing
Jason was assigned to test a bank's new mobile application.
Explicit Confidence 98% · Jason Haddix EP 130 Details
“the other was their new mobile app and their mobile application”
Jason Haddix USES Reconnaissance
Jason performed reconnaissance to find the bank's publicly exposed web assets and servers.
Explicit Confidence 99% · Jason Haddix EP 130 Details
“We started doing recon on them. We had found a whole bunch of web servers”
Jason Haddix USES Burp Suite
Jason used Burp Suite as an interception proxy to inspect mobile-app traffic and later to brute-force a password.
Explicit Confidence 99% · Jason Haddix EP 130 Details
“I was proxing the web traffic between the phone and the web server with an interception proxy like Burp Suite”
Jason Haddix USES Metasploit
Jason uploaded a payload to a Tomcat server using Metasploit.
Explicit Confidence 99% · Jack Rhysider EP 130 Details
“Jason just uploaded a payload using Metasploit to it”
Jason Haddix USES Tailgating
During a physical penetration test, Jason and two others entered a building by following an authorized person through a locked door.
Explicit Confidence 99% · Jack Rhysider EP 130 Details
“they simply waited until someone was going in and they just went in right behind them and just tailgated them right in through the door”
Jason Haddix EXPLOITS open cloud storage bucket
Jason accessed an open AWS S3 bucket containing check images during the bank assessment.
Explicit Confidence 99% · Jason Haddix EP 130 Details
“it was an open AWS S3 bucket of check images”
open cloud storage bucket AFFECTS AWS S3 bucket
The open-bucket vulnerability affected the AWS S3 bucket used to store check images.
Derived Confidence 98% · Jack Rhysider EP 130 Details
“An open AWS bucket means the entire contents of that storage bucket is available for anyone to see”
Jason Haddix EXPLOITS hard-coded credentials
Jason used credentials hard-coded in a mobile application to access a server's manager console.
Explicit Confidence 99% · Jason Haddix EP 130 Details
“we used these hard-coded credentials that were in the mobile app that we were able to reverse out on this website, and got into that”
Jason Haddix USES Tomcat
Jason gained access to a Tomcat server and used its administrative upload capability to obtain operating-system access.
Explicit Confidence 96% · Jack Rhysider EP 130 Details
“this web server was running something called Tomcat, which as an admin you could upload stuff to it”
Jason Haddix EXPLOITS weak password policy
Jason used the site's five-character password policy to gain access to the target account.
Explicit Confidence 99% · Jason Haddix EP 130 Details
“broke into the account with the image that he wanted through the password reset and the weak password policy”
Jason Haddix USES password reset abuse
Jason initiated a password reset for the target account and exploited the resulting reset flow.
Explicit Confidence 99% · Jason Haddix EP 130 Details
“you could start a password reset for any user on the site”
Jason Haddix USES Brute-force attack
Jason brute-forced the five-character reset password in approximately fifteen minutes.
Explicit Confidence 99% · Jason Haddix EP 130 Details
“You could brute-force that in about fifteen minutes”
Jason Haddix EXPLOITS cross-site scripting
Jason found and exploited cross-site scripting bugs on the site.
Explicit Confidence 98% · Jason Haddix EP 130 Details
“We had found a couple of cross-site scripting bugs”
Jason Haddix EXPLOITS SQL injection
Jason found an SQL injection bug that allowed the site's complete database, including purchases and credit-card data, to be dumped.
Explicit Confidence 99% · Jason Haddix EP 130 Details
“we had found that there was an SQL injection bug that allowed us to dump the complete database”
Ashley Madison breach COMPROMISES Ashley Madison
Jack describes the Ashley Madison breach as a hack that exposed information about the site's users.
Explicit Confidence 97% · Host EP 130 Details
“A major hack tonight is threatening to expose embarrassing information on millions of people around the world”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T07:50:51.600054+00:00