Hacking Articles Tips Tricks Videos Tutorials

AD Enum is a pentesting (https://www.kitploit.com/search/label/Pentesting) tool that allows to find misconfiguration (https://www.kitploit.com/search/label/Misconfiguration) through the protocol LDAP and exploit some of those weaknesses with Kerberos.
cracking (john) -jp [path] John binary path -w [wordList] The path of the wordlist (https://www.kitploit.com/search/label/Wordlist) to be used john (Default: /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt -v, --version Show program's version number and exit -s Use LDAP with SSL ">
█████╗ ██████╗ ███████╗███╗ ██╗██╗ ██╗███╗ ███╗
██╔══██╗██╔══██╗ ██╔════╝████╗ ██║██║ ██║████╗ ████║
███████║██║ ██║ █████╗ ██╔██╗ ██║██║ ██║██╔███ ╔██║
██╔══██║██║ ██║ ██╔══╝ ██║╚██╗██║██║ ██║██║╚██╔╝██║
██║ ██║██████╔╝ ███████╗██║ ╚████║╚██████╔╝██║ ╚═╝ ██║
╚═╝ ╚═╝╚═════╝ ╚══════╝╚═╝ ╚═══╝ ╚═════╝ ╚═╝ ╚═╝

usage: ADenum.py -d [domain] -u [username] -p [password]

Pentest tool that detect misconfig in AD with LDAP

optional arguments:
-h, --help show this help message and exit
-d [domain] The name of domain (e.g. "test.local")
-u [username] The user name
-p [password] The user password
-ip [ipAddress] The IP address of the server (e.g. "1.1.1.1")
-j Enable hash cracking (john)
-jp [path] John binary path
-w [wordList] The path of the wordlist to be used john (Default: /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt
-v, --version Show program's version number and exit
-s Use LDAP with SSL
Requirement Impacket (https://github.com/SecureAuthCorp/impacket) John (https://github.com/openwall/john) Python 3 If you are using debian or kali: $ sudo apt-get install libsasl2-dev python-dev libldap2-dev libssl-dev pip3: $ pip3 install -r Requirements.txt Features and Functionality LDAP: Enum Domain Admin users Enum Domain Controllers Enum Domain users with Password Not Expire Enum Domain users with old password Enum Domain users with interesting description Enum Domain users with not the default encryption Enum Domain users with Protecting Privileged Domain Accounts Kerberos: AS-REP Roastable Kerberoastable Password cracking with john (krb5tgs and krb5asrep) Demo

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.

9 viewsedited 12:25

Hacking Articles Tips Tricks Videos Tutorials

Microsoft Advanced Threat Analytics ATA detects two suspicious events but does not trigger an alert: The connection with the protocol LDAP without SSL The Kerberoastable attack As shown in this screenshot:

___________________________
@hacking_Attack
@Hacking_Video

9 viewsedited 12:26

Hacking Articles Tips Tricks Videos Tutorials

Source Documentation: https://labs.f-secure.com/blog/attack-detection-fundamentals-discovery-and-lateral-movement-lab-1/ https://theitbros.com/ldap-query-examples-active-directory/ https://docs.microsoft.com/en-us/advanced-threat-analytics/what-is-ata Impacket: https://github.com/SecureAuthCorp/impacket/blob/master/examples/GetNPUsers.py https://github.com/SecureAuthCorp/impacket/blob/master/examples/GetUserSPNs.py Legal Disclaimer: testing purposes only. Usage of this software for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program. ">This project is made for educational and ethical testing purposes only. Usage of this software for attacking targets without prior mutual consent is illegal.
It is the end user's responsibility to obey all applicable local, state and federal laws.
Developers assume no liability and are not responsible for any misuse or damage caused by this program.

Download ADenum (https://github.com/SecuProject/ADenum)

___________________________
@hacking_Attack
@Hacking_Video

10 viewsedited 12:26

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
pcduo-old port

Is there anything I can do with a 5400/tcp pcduo-old port that is open? I tried connecting to it using "pc duo gateway" software but it couldn't connect.

submitted by /u/mustache-eater
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

pcduo-old port

Is there anything I can do with a 5400/tcp pcduo-old port that is open? I tried connecting to it using "pc duo gateway" software but it couldn't...

10 viewsedited 13:15

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
pfsense and vpn

I use a Mcfee Vpn and the connection is protected by a firewall, so the problem is that someone can see what site I visit, but if I use a Vpn I'm protected.

Thanks

submitted by /u/paulred70
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

pfsense and vpn

I use a Mcfee Vpn and the connection is protected by a firewall, so the problem is that someone can see what site I visit, but if I use a Vpn I'm...

10 viewsedited 13:15

Hacking Articles Tips Tricks Videos Tutorials

Open Redirection - QR Code Magic
https://shahjerry33.medium.com/open-redirection-qr-code-magic-18ace1a0170f?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

Open Redirection - QR Code Magic

Summary :

8 viewsedited 13:20

Hacking Articles Tips Tricks Videos Tutorials

8 views13:20

Hacking Articles Tips Tricks Videos Tutorials

Summary :Continue reading on Medium » (https://shahjerry33.medium.com/open-redirection-qr-code-magic-18ace1a0170f?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

Open Redirection - QR Code Magic

Summary :

11 viewsedited 13:20

Hacking Articles Tips Tricks Videos Tutorials

11 views14:16

Hacking Articles Tips Tricks Videos Tutorials

Photo

KitPloit - PenTest Tools!
ADenum - A Pentesting Tool That Allows To Find Misconfiguration Through The The Protocol LDAP And Exploit Some Of Those Weaknesses With Kerberos

https://blogger.googleusercontent.com/img/a/AVvXsEhTiJ8aPNkJFJDlwiC_9agfcKhcNMWHPT6f3OuxNNDFzNjcuEwtNDb4OsWbpl21-F0ztOGoAQJrp0kEdRmjkmHF17rNsIwo1HxsZaclyMYjD7YwJacVP9v_gRFSrOwmLTUyvo3nztQa-ERh2fiKtU6dio5S1bfdYoBhFEAPyPQZVRv6RHvtwX59nTgAjQ=w640-h592 AD Enum is a pentesting tool that allows to find misconfiguration through the protocol LDAP and exploit some of those weaknesses with Kerberos.
cracking (john) -jp [path] John binary path -w [wordList] The path of the wordlist to be used john (Default: /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt -v, --version Show program's version number and exit -s Use LDAP with SSL ">

█████╗ ██████╗     ███████╗███╗   ██╗██╗   ██╗███╗   ███╗
██╔══██╗██╔══██╗    ██╔════╝████╗  ██║██║   ██║████╗ ████║
███████║██║  ██║    █████╗  ██╔██╗ ██║██║   ██║██╔███ ╔██║
██╔══██║██║  ██║    ██╔══╝  ██║╚██╗██║██║   ██║██║╚██╔╝██║
██║  ██║██████╔╝    ███████╗██║ ╚████║╚██████╔╝██║ ╚═╝ ██║
╚═╝  ╚═╝╚═════╝     ╚══════╝╚═╝  ╚═══╝ ╚═════╝ ╚═╝     ╚═╝
usage: ADenum.py -d [domain] -u [username] -p [password]

Pentest tool that detect misconfig in AD with LDAP

optional arguments:
-h, --help       show this help message and exit
-d  [domain]     The name of domain (e.g. "test.local")
-u  [username]   The user name
-p  [password]   The user password
-ip [ipAddress]  The IP address of the server (e.g. "1.1.1.1")
-j               Enable hash cracking (john)
-jp [path]       John binary path
-w  [wordList]   The path of the wordlist to be used john (Default: /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt
-v, --version    Show program's version number and exit
-s               Use LDAP with SSL

Requirement* Impacket (https://github.com/SecureAuthCorp/impacket)
* John (https://github.com/openwall/john)
* Python 3
* If you are using debian or kali: $ sudo apt-get install libsasl2-dev python-dev libldap2-dev libssl-dev* pip3: $ pip3 install -r Requirements.txtFeatures and FunctionalityLDAP:* Enum Domain Admin users
* Enum Domain Controllers
* Enum Domain users with Password Not Expire
* Enum Domain users with old password
* Enum Domain users with interesting description
* Enum Domain users with not the default encryption
* Enum Domain users with Protecting Privileged Domain Accounts Kerberos:* AS-REP Roastable
* Kerberoastable
* Password cracking with john (krb5tgs and krb5asrep) Demohttps://camo.githubusercontent.com/d8a9ab9b9eb4bc9e9761fcc378ab58c365a198fed8dad2728688ed10a91c1815/68747470733a2f2f61736369696e656d612e6f72672f612f3336323031372e737667 Microsoft Advanced Threat AnalyticsATA detects two suspicious events but does not trigger an alert:

* The connection with the protocol LDAP without SSL
* The Kerberoastable attack

As shown in this screenshot: http://1.bp.blogspot.com/-yKIeO2cppno/YZ3Se4tWywI/AAAAAAAA4KQ/57jRZRJfkp4NoIEJnwTi7Oa4LksEmO6TACK4BGAYYCw/s320/ADenum_2_ATAdetection-777808.png SourceDocumentation:

* https://labs.f-secure.com/blog/attack-detection-fundamentals-discovery-and-lateral-movement-lab-1/
* https://theitbros.com/ldap-query-examples-active-directory/
* https://docs.microsoft.com/en-us/advanced-threat-analytics/what-is-ata

Impacket:

* https://github.com/SecureAuthCorp/impacket/blob/master/examples/GetNPUsers.py
* https://github.com/SecureAuthCorp/impacket/blob/master/examples/GetUserSPNs.py Legal Disclaimer:testing purposes only. Usage of this software for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers [...]

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Kitploit – Maintenance in Progress

Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.

15 viewsedited 14:16

Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools! ADenum - A Pentesting Tool That Allows To Find Misconfiguration Through The The Protocol LDAP And Exploit Some Of Those Weaknesses With Kerberos https://blogger.googleusercontent.com/img/a/AVvXsEhTiJ8aPNkJFJDlwiC_9agfcKhcNMWHPT6…

assume no liability and are not responsible for any misuse or damage caused by this program. ">

This project is made for educational and ethical testing purposes only. Usage of this software for attacking targets without prior mutual consent is illegal. 
It is the end user's responsibility to obey all applicable local, state and federal laws. 
Developers assume no liability and are not responsible for any misuse or damage caused by this program.

Download ADenum

___________________________
@hacking_Attack
@Hacking_Video

13 viewsedited 14:16

Hacking Articles Tips Tricks Videos Tutorials

11 views16:22

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
Log4Shell: The log4j Javageddon

https://cdn-images-1.medium.com/max/2533/1*bfqxxvqMzWAKzu-uB_Nl9A.jpeg
What it is, check if you are affected, what to do

Continue reading on The Startup »

___________________________
@hacking_Attack
@Hacking_Video

Medium

The log4j Javageddon

What it is, check if you are affected, what to do

10 viewsedited 16:22

Hacking Articles Tips Tricks Videos Tutorials