Introduction After writing some articles about (what are considered to be) “boring” topics, such as SMB / LDAP signing, email security, and firewalls, I thought I’d dive into something a bit more exciting. Password spraying is a topic I had wanted to explore for quite some time. I had also starred tools such as conpass, but never found the opportunity to explore the underlying concepts in more detail. Until now. In this article, I won’t try to replicate hackndo’s post, although there will be some duplicated information for context purposes, but rather act as a complement to it. As such, some concepts, like GPO and PSO ordering, won’t be explained but links for further reading will be provided instead. ...
Password Audits Part 4: Analysing Results
Introduction Warning The hash-organiser, ntds-organiser, and password-analyser tools mentioned in this article were intially created as PoCs. Their functionality have now been integrated into password-audit. ...
My Take on CRTO
Introduction The Red Team Ops (RTO) certification has been around for a while and is often recommended as one of the best entry points into red teaming. After completing both the course and, in particular, the exam, I can see why. I had RTO bookmarked for more than a year, but I continuously postponed pulling the trigger. I am a pentester rather than a red teamer, and I don’t plan on switching just yet, so I gave priority to certifications that felt more relevant to my day-to-day work, such as OSCP and CAPE. ...
Firewall Security Explained
Introduction After the article about Email Security, I thought I would continue the trend of writing about “boring” and “unpopular” security assessments. While looking at various infrastructure-related components that are never discussed in popular “pentesting” courses, one topic immediately stood out: firewall configuration reviews. These are often treated like a checkbox exercise: more like “let’s get it over with” than “let’s dive into it”. After spending some time fiddling with Cisco configurations and documentation, I have to admit that I now find them a bit less boring than I did before. That’s progress, isn’t? ...
Email Security Explained: SPF, DKIM, DMARC, and MTA-STS
Introduction One security-related topic that is almost never discussed in courses, such as CPTS or OSCP, is email security. There is almost always a phishing exercise, but it never goes more than that. You never get to learn why the spoofed email was accepted in the first place and what could be done to prevent it. This is somewhat strange given that phishing remains one of the most common methods for obtaining an initial foothold in an environment! ...
LDAP Signing and Channel Binding Explained
Introduction We have covered LLMNR/NBT-NS Poisoning (how to obtain credentials from an Adversary-in-the-Middle (AitM) position) and how SMB signing prevents those credentials from being relayed over SMB. We will now explore a similar concept, but this time focusing on the Lightweight Directory Access Protocol (LDAP). We will start by explaining what LDAP is and then have a look at the mechanisms that prevent relaying over it. We will keep our scope intentionally tight and won’t cover any unrelated aspects such as LDAP syntax. ...
SMB Signing and NTLM Relay Explained
Introduction In the first article, we talked about LLMNR/NBT-NS Poisoning and saw how it can be used to capture an NTLMv2 hash. This naturally leads to the next question: what can we do with that hash? Things are straightforward when the captured hash is weak and can be recovered, but what happens when it is not? What options do we have then? Instead of diving straight into NTLM relay, this article focuses on laying the necessary foundations first. We will focus on identifying where an NTLM relay attack is actually possible and, more importantly, why that is the case. For now, we will exclusively talk about relaying over SMB, which requires understanding SMB signing. LDAP signing will be the topic of the next article. ...
LLMNR/NBT-NS Poisoning Explained
Introduction LLMNR/NBT-NS Poisoning is one of the most consistent vulnerabilities I come across during internal tests. Even if the name does not ring a bell, chances are you have, at some point in a lab, launched Responder hoping to capture a hash: If that’s the case, you are already familiar with the attack, but have never really taken the time to explore what is actually happening behind the scenes. Under the right conditions, this attack vector can result in getting an NTLMv2 hash which can be recovered or relayed (e.g. combined with something such as the lack of SMB signing). It can be our way from: ...
Password Audits Part 3: Cracking Hashes
Introduction Warning The hash-organiser and phase-cracker tools mentioned in the Introduction and Vibe-Coding sections, respectively, were intially created as PoCs. Their functionality have now been integrated into password-audit. ...
Password Audits Part 2: Hash Organisation
Introduction Warning The hash-organiser tool mentioned in the Vibe-Coding section was intially created as a PoC. Its functionality has now been integrated into the password-audit tool. ...