Episode

EP 67 — The Big House

09 June 2020 Official episode · Official transcript

penetration test social engineering

John Strand describes physical and network penetration tests, including unauthorized-access simulations at a military base, office, and prison, as well as an investigation that used a beaconing document to locate a kidnapping suspect.

Topics: Physical penetration testing, Network penetration testing, Passive reconnaissance using public imagery, Social engineering and authority-based pretexts, USB-delivered executable payloads, Command-and-control callbacks, Beaconing documents, IP-address-based attribution with ISP records, Remote shell access, Security procedure failures at a correctional facility

Official episode-page sources

Links published on the Darknet Diaries episode page. Not LLM output.

Entities (25)

Claims (17)

Qualified statements from this episode, not graph facts.

Darknet Diaries DEVELOPED_BY Jack Rhysider

Jack states that he created the Darknet Diaries show.

Explicit Confidence 99% · Jack Rhysider EP 67 Details

“This show was created by me, the ULA violator, Jack Rhysider.”

Jack Rhysider · offsets 39438–39499

Black Hills Information Security DEVELOPED_BY John Strand

John says he started Black Hills Information Security as a penetration-testing company.

Explicit Confidence 99% · John Strand EP 67 Details

“It’s time to start a pen testing company.”

John Strand · offsets 5918–5959

“John called his pen testing company Black Hills Information Security.”

Jack Rhysider · offsets 5974–6043

John Strand MEMBER_OF Black Hills Information Security

John is the founder and operator of Black Hills Information Security, describing it as his company.

Derived Confidence 90% · Jack Rhysider EP 67 Details

“John called his pen testing company Black Hills Information Security.”

Jack Rhysider · offsets 5974–6043

Black Hills Information Security USES penetration testing

Black Hills Information Security performs penetration testing for customers to test whether hackers could access buildings, networks, or computers.

Explicit Confidence 99% · Jack Rhysider EP 67 Details

“Black Hills started doing penetration testing for customers”

Jack Rhysider · offsets 6128–6187

John Strand MEMBER_OF SANS

John became a SANS instructor and taught penetration testing and hacking techniques.

Explicit Confidence 90% · Jack Rhysider EP 67 Details

“he became a SANS instructor and actually taught hacking techniques”

Jack Rhysider · offsets 5622–5688

John Strand USES penetration testing

John performs physical and network penetration testing as part of his work.

Explicit Confidence 99% · Jack Rhysider EP 67 Details

“John’s penetration testing consisted of either going onsite to see if he can sneak into a building, or testing the network”

Jack Rhysider · offsets 8799–8921

John Strand USES passive reconnaissance

John uses passive reconnaissance before attempting to enter a building.

Explicit Confidence 99% · Jack Rhysider EP 67 Details

“First thing’s first, he does some passive reconnaissance.”

Jack Rhysider · offsets 13948–14005

John Strand USES Google Street View

John uses Google Street View to inspect a target building and identify an open window.

Explicit Confidence 99% · John Strand EP 67 Details

“I used Google Street View to go around the building.”

John Strand · offsets 14125–14177

John Strand USES Kon-Boot

John uses or demonstrates Kon-Boot during a physical penetration test to take over computer systems.

Uncertain Confidence 84% · John Strand EP 67 Details

“I’m using, I don’t know, it was like, I think it was Kon-Boot.”

John Strand · offsets 19767–19829

John Strand USES beaconing

John uses beaconing in documents to identify when a recipient opens them and to obtain a callback.

Explicit Confidence 99% · John Strand EP 67 Details

“you can send a document to someone and you can have that document beacon back”

John Strand · offsets 22153–22230

John Strand USES social engineering

John describes using social-engineering tactics to help law enforcement locate a kidnapping suspect.

Explicit Confidence 98% · Jack Rhysider EP 67 Details

“what a gnarly way to use social engineering and phishing methods for good”

Jack Rhysider · offsets 23537–23610

John Strand USES phishing

John uses a document-based phishing method to induce a suspect to open a document that beacons back.

Explicit Confidence 96% · Jack Rhysider EP 67 Details

“use social engineering and phishing methods for good”

Jack Rhysider · offsets 23558–23610

John Strand USES shell

John's prison penetration test sought to establish a shell from the prison network for remote access.

Explicit Confidence 99% · John Strand EP 67 Details

“The objective of the prison was to establish callback documents and get a shell out of the prison.”

John Strand · offsets 26829–26927

John Strand USES implant

John provides a USB executable designed to drop an implant on a target system during a penetration test.

Derived Confidence 94% · John Strand EP 67 Details

“The USB drive had a .exe which just simply dropped an implant on the system.”

John Strand · offsets 27331–27407

John Strand USES command and control server

John and Ben monitor their command-and-control server for connections from the executable used in the prison test.

Explicit Confidence 99% · Jack Rhysider EP 67 Details

“John and Ben are in this coffee shop. They open up their computers and connect to their command and control server.”

Jack Rhysider · offsets 31337–31453

Benjamin Donnelly USES command and control server

Ben connects to and monitors the command-and-control server with John during the prison penetration test.

Explicit Confidence 99% · Jack Rhysider EP 67 Details

“John and Ben are in this coffee shop. They open up their computers and connect to their command and control server.”

Jack Rhysider · offsets 31337–31453

implant USES command and control server

The implant dropped by the USB executable is intended to create a remote connection monitored through John's command-and-control server.

Derived Confidence 88% · Jack Rhysider EP 67 Details

“the executable program on that USB drive tries to open a connection to John’s server.”

Jack Rhysider · offsets 27708–27793

Transcript references

Works mentioned in the transcript. Distinct from show-note sources.

Extraction provenance

Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T06:28:44.410970+00:00