Past, Present and Future of Offensive Security w/ HD Moore

HD Moore started the Metasploit framework project in 2003, forever changing the game on offensive security. Today, he serves as the CEO of runZero, mapping out global networks from behind the firewall. In this episode, we dive into the scrappy early days of internet security and dumpster diving for computer parts, why the AI revolution might make traditional vulnerability research and CVEs obsolete, and the brute-force reality of modern cybersecurity venture capital. We also explore how HD's deep technical roots helped him build runZero to $1M ARR as a solo operation, plus he shares the hilarious history of how the Blaster worm broke the internet using Metasploit's default port. In our in-depth discussion, HD shares: (00:01:11) Scraping dumpsters for parts: HD's humble origins as a security pioneer. (00:02:42) Shattering early disclosure taboos by publishing exploits without vendor permission. (00:05:55) How a toxic employer's rejection accidentally gave him full ownership of Metasploit. (00:06:44) Birthing Metasploit, battling $30,000 commercial kits, and escaping code thieves. (00:12:22) Rewriting chapters and coding NASL plugins: HD's hidden history with Nessus. (00:14:12) Dumping thousands of zero-days to successfully force Microsoft into killing ActiveX. (00:17:16) Why AI agents building fuzzing harnesses might leave traditional AppSec "cooked." (00:23:28) AI's incoming bug avalanche will quickly make the entire CVE system irrelevant. (00:26:03) Extracting hardware warranties and system data through 16-byte hex GUID leaks. (00:28:15) Breaking AI models with magic words and the unsolvable prompt-injection problem. (00:29:42) Bootstrapping runZero to $1 million in sales alone before making one hire. (00:36:26) How VC-funded security startups brute-force enterprise sales. (00:39:36) The Blaster worm's legacy and why port 4444 remains blocked globally today. (00:41:08) Hacking IoT and OT gateways by altering memory via hardcoded VXWorks debuggers. (00:42:59) How internet-exposed backplanes let hackers remotely unlock jail doors and more. HD’s projects mentioned in this episode: Follow the hosts & guests:   / hdmoore   https://x.com/hdmoore Mehul’s LinkedIn / X / Substack   / mehul-revankar   https://x.com/mehulrevankar https://substack.com/@mehulrevankar Follow the podcast on YouTube: @FromNoise2Signal