EvilMog says IRC was his handle's context and that he used the handle there.
Explicit Confidence 98% · EvilMog EP 149 Details
“that was my IRC handle from thence forth”
Episode
03 September 2024 Official episode · Official transcript
incident response penetration test
The episode contains stories about EvilMog’s military communications work in Afghanistan and Joe Sarkisian’s penetration-testing engagements involving credential capture, password cracking, network enumeration, Active Directory, and an accidental network outage caused by Masscan.
Topics: Network credential capture with Responder, Windows shared-drive authentication and password hashes, Password cracking with Hashcat and GPU cloud instances, Network enumeration with Nmap, Active Directory enumeration and privilege escalation, Anonymous domain-controller access, Password spraying, Penetration-testing assumed-breach methodology, High-speed port scanning with Masscan, Network denial-of-service caused by excessive scan traffic, Military satellite communications and remote network deployment, Communications lockout procedures
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
EvilMog says IRC was his handle's context and that he used the handle there.
Explicit Confidence 98% · EvilMog EP 149 Details
“that was my IRC handle from thence forth”
EvilMog USES online piracy
EvilMog says he engaged in online piracy when he was young.
Explicit Confidence 99% · EvilMog EP 149 Details
“was doing a fair bit of online piracy”
EvilMog says he engaged in phreaking when he was young.
Explicit Confidence 99% · EvilMog EP 149 Details
“online piracy, phreaking, a little bit of other various things”
EvilMog USES credit card number generator
EvilMog says he published bogus credit card number generators on local BBS systems.
Explicit Confidence 99% · EvilMog EP 149 Details
“I was publishing bogus credit card number generators”
credit card number generator USES regular expression
The generator produced numbers that could pass a cheap regular-expression check, although the checksum was often incorrect.
Explicit Confidence 96% · EvilMog EP 149 Details
“It was enough that it could pass a cheap RegEx”
EvilMog MEMBER_OF Canadian Forces
The episode says EvilMog joined the military and later worked in support of the Canadian Forces.
Explicit Confidence 91% · Jack Rhysider EP 149 Details
“From there, he joined the military”
Morale Voice ASSOCIATED_WITH Network Innovations
Network Innovations is described as running the Morale Voice internet services.
Explicit Confidence 98% · EvilMog EP 149 Details
“Network Innovations, and basically what they do is they run the Morale Voice, the internet services”
Morale Voice ASSOCIATED_WITH Canadian Forces
Morale Voice is described as an internet service for the Canadian Forces, supporting soldiers' calls to their families.
Explicit Confidence 98% · EvilMog EP 149 Details
“the Morale Voice, the internet services, for the Canadian Forces”
EvilMog USES BGAN terminal
EvilMog says he deployed a BGAN terminal when bringing a forward operating base online.
Explicit Confidence 98% · EvilMog EP 149 Details
“here’s a tiny, little BGAN terminal”
EvilMog USES SATCOM dish
EvilMog says he set up SATCOM dishes as part of restoring communications.
Explicit Confidence 98% · EvilMog EP 149 Details
“set up the SATCOM dish”
EvilMog USES PBX system
EvilMog says the deployed communications setup included a small PBX system.
Explicit Confidence 97% · EvilMog EP 149 Details
“a little, tiny PBX system”
EvilMog USES com-lockout procedure
EvilMog says he executed the com-lockout procedure after confirmed casualties to prevent premature disclosure.
Explicit Confidence 99% · EvilMog EP 149 Details
“I got the phone call, I hit the buttons”
“It was known as a com-lockout procedure”
EvilMog USES Tandberg video teleconference unit
EvilMog used Tandberg video teleconference equipment to connect a soldier in Afghanistan with his wife in Toronto.
Explicit Confidence 99% · EvilMog EP 149 Details
“they were running on Tandberg, we were running on Tandberg”
Joe Sarkisian MEMBER_OF Wolf & Company P.C.
Joe says he works for Wolf & Company P.C.
Explicit Confidence 99% · Joe Sarkisian EP 149 Details
“I work for Wolf & Company P.C. out of Boston”
Joe Sarkisian USES Raspberry Pi
Joe's firm sent a Raspberry Pi to the client as a remote access device for the assumed-breach penetration test.
Explicit Confidence 98% · Joe Sarkisian EP 149 Details
“a little Raspberry Pi that we send them”
Joe Sarkisian USES Responder
Joe says penetration testers commonly start a network test by running Responder to obtain credentials or hashes.
Explicit Confidence 99% · EvilMog EP 149 Details
“you fire up Responder the second they get on a network”
Responder USES password hash
Responder captures a username and password hash when it impersonates a requested shared drive.
Explicit Confidence 99% · Jack Rhysider EP 149 Details
“it snatches that username and that password hash”
Joe Sarkisian USES Hashcat
Joe says his team uses Hashcat to crack captured password hashes.
Explicit Confidence 99% · Joe Sarkisian EP 149 Details
“we use something called Hashcat”
Hashcat USES brute force
Hashcat is used to try large numbers of candidate passwords against a captured hash, including brute-force combinations.
Explicit Confidence 97% · Jack Rhysider EP 149 Details
“A common method for cracking passwords is brute force”
Joe Sarkisian USES Amazon EC2
Joe's team uses Amazon EC2 instances to obtain cloud computing power for password cracking.
Explicit Confidence 99% · Joe Sarkisian EP 149 Details
“we can spin up Amazon EC2 instances”
Amazon EC2 USES Tesla GPUs
The EC2 instances used by Joe's team are configured with Tesla GPUs for password-hash cracking.
Explicit Confidence 98% · Joe Sarkisian EP 149 Details
“we spin up these Tesla GPUs on an instance”
Joe Sarkisian USES Nmap
Joe says Nmap is used to scan a network and identify live hosts and open ports.
Explicit Confidence 98% · Jack Rhysider EP 149 Details
“A good place to start is Nmap”
Joe Sarkisian USES password spraying
Joe describes password-spraying a domain controller using a discovered list of users and common passwords.
Explicit Confidence 99% · Joe Sarkisian EP 149 Details
“start password-spraying against that domain controller”
Joe Sarkisian USES Masscan
Joe's junior tester used Masscan for a port scan during a bank penetration test.
Explicit Confidence 99% · Joe Sarkisian EP 149 Details
“I always use Masscan”
Masscan AFFECTS network switch
Jack speculates that the excessive Masscan traffic could overwhelm a network switch and cause a denial-of-service effect; the specific affected device is not confirmed.
Uncertain Confidence 78% · Jack Rhysider EP 149 Details
“it could easily overwhelm that next hop”
Jack speculates that excessive Masscan traffic could overwhelm a router and prevent other traffic from passing; the specific affected device is not confirmed.
Uncertain Confidence 72% · Jack Rhysider EP 149 Details
“if it was a switch or a router”
Jack speculates that scanning external IPs could overload the firewall or consume the site's internet bandwidth; this is presented as one possible explanation.
Uncertain Confidence 76% · Jack Rhysider EP 149 Details
“the traffic might have traversed the firewall”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T08:27:41.244762+00:00