Kerbrute - An Script To Perform Kerberos Bruteforcing By Using Impacket

An script to perform kerberos bruteforcing by using the Impacket library. When is executed, as input it receives a user or list of users and a password or list of password. Then is performs a brute-force attack to enumerate: Valid username/passwords pairs Valid usernames Usernames without pre-authentication required As a result, the script generates a list of valid credentials discovered, and the TGT's generated due those valid credentials. Installation From pypi: pip3 install kerbrute From repo: git clone https://github.com/TarlogicSecurity/kerbrutecd kerbrutepip install -r requirements.txt Use Help without arguments: root@kali:~# kerbruteImpacket v0.9.18 - Copyright 2018 SecureAuth Corporationusage: kerbrute.py -h -debug (-user USER | -users USERS) -password PASSWORD | -passwords PASSWORDS -domain DOMAIN -dc-ip <ip\_address> -threads THREADS -outputfile OUTPUTFILE -no-save-ticketoptional arguments: -h, --help show this help message and exit -debug Turn DEBUG output ON -user USER User to perform bruteforcing -users USERS File with user per line -password PASSWORD Password to perform bruteforcing -passwords PASSWORDS File with password per line -domain DOMAIN Domain to perform bruteforcing -dc-ip <ip_address> IP Address of the domain controller -threads THREADS Number of threads to perform bruteforcing. Default = 1 -outputfile OUTPUTFILE File to save discovered user:password -no-save-ticket Do not save retrieved TGTs with correct credentialsExamples: ./kerbrute.py -users users_file.txt -passwords passwords_file.txt -domain contoso.com Example of execution: velociraptor NOT PREAUTH \* Valid user => trex \* Saved discovered passwords in jurassic_passwords.txt">root@kali:~# kerbrute -domain jurassic.park -users users.txt -passwords passwords.txt -outputfile jurassic_passwords.txtImpacket v0.9.18 - Copyright 2018 SecureAuth Corporation\* Stupendous => triceratops:Sh4rpH0rns\* Saved TGT in triceratops.ccache\* Valid user => velociraptor NOT PREAUTH\* Valid user => trex\* Saved discovered passwords in jurassic_passwords.txt Download Kerbrute
Read more...

Building Custom Empire Modules
https://www.reddit.com/r/redteamsec/comments/sglg5r/building_custom_empire_modules/

submitted by /u/DLLCoolJ (https://www.reddit.com/user/DLLCoolJ)
[link] (https://youtu.be/ZS3Rdld_Ebo) [comments] (https://www.reddit.com/r/redteamsec/comments/sglg5r/building_custom_empire_modules/)

How I Found A Simple Stored XSS

This is the story of how I found my first Stored XSS (“Cross Site Scripting”) vulnerability in a bug bounty program and a walk through on…Continue reading on Medium »
Read more...

Hacking on Medium
I am Interested in Cyber Security. Where do I start?

https://cdn-images-1.medium.com/max/1500/1*IyR4X4KE7YuPugIZorGdxw.jpeg
I know just the place.

Continue reading on Everything Secure »

Hacking on Medium
Privilege Escalation in Linux Systems

https://cdn-images-1.medium.com/max/1000/1*FOIjs40QzGv1vT24qgMvuw.jpeg
Looking for a way to gain root access after establishing the initial foothold in Linux systems? Here are some things to look for to…

Continue reading on Medium »

Hacking on Medium
Hacking Django websites: Man In The Middle attack

https://cdn-images-1.medium.com/max/820/1*Q2OJE8anx_Scj7Eb3EWzgw.png
A website served via HTTP is vulnerable to Man In The Middle (MITM) attacks: a hacker can get between your browser and the server…

Continue reading on Medium »

Hacking on Medium
How I Found A Simple Stored XSS

https://cdn-images-1.medium.com/max/800/1*v3z_7_uX2eKGvh7GFtaXhw.jpeg
This is the story of how I found my first Stored XSS (“Cross Site Scripting”) vulnerability in a bug bounty program and a walk through on…

Continue reading on Medium »

Hacking on Medium
Hack a Linux Desktop with The Cheapest USB Rubber Ducky and The Android Terminal (Termux)

https://cdn-images-1.medium.com/max/2600/0*38rjKZvpmfl-S2WG
Last time, I have written an article about making a USB Rubber Ducky with less than $3 and I did a simple test and attach how to…

Continue reading on InfoSec Write-ups »

Good scanners recommendations for learning?
https://www.reddit.com/r/Pentesting/comments/sgo3al/good_scanners_recommendations_for_learning/

<!-- SC_OFF -->I'm interested in learning more about network and web application scanning. I started off with nmap, and found some of the NSE scripts very helpful. I then went to nikto but it's seems very basic, and I haven't been able to find much documentation. Do you all have some recommendations on scanning tools to learn for network, vulnerability, and web app scanning? ​ Kind regards <!-- SC_ON --> submitted by /u/sma92878 (https://www.reddit.com/user/sma92878)
[link] (https://www.reddit.com/r/Pentesting/comments/sgo3al/good_scanners_recommendations_for_learning/) [comments] (https://www.reddit.com/r/Pentesting/comments/sgo3al/good_scanners_recommendations_for_learning/)

How I Found A Simple Stored XSS
https://medium.com/@raymond-lind/how-i-found-a-simple-stored-xss-a2976c5251b?source=rss------bug_bounty-5

This is the story of how I found my first Stored XSS (“Cross Site Scripting”) vulnerability in a bug bounty program and a walk through on…Continue reading on Medium » (https://medium.com/@raymond-lind/how-i-found-a-simple-stored-xss-a2976c5251b?source=rss------bug_bounty-5)

hacking: security in practice
So idk if this is the right place but, how could I bypass securely for chromebooks?

Hello, so I’m wanting to bypass securely for chromebooks. (I am using my own chromebook to test on) the only thing I’ve found that works is ctrl+shift+T I can’t enable Developer mode either. Any ideas anyone?

submitted by /u/Cg6554
[link] [comments]

hacking: security in practice
SOCIAL BOT: My decision

Good night for you Guys and girls.

To day I made this Poll here asking about what to do with my Bot.

SO Here is my final choice I gonna make it reposoty public and acesseble for you guys.

I gonna make it public for 2 main reasons... SO you guys can download and test my project and may in the future give me a feedback and Becouse I want you guys... True Hackers, to help me TO apriomorate my Instagram algorithin Bypass

Social Bot Github page link: https://github.com/G4lile00/Social-Bot

On my Github You can find everything about the project... the documentation the download links and the explication to use the software... Now i count you guys to help me and maybe make this project a big thing.

submitted by /u/G4lile00
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is Yik Yak more secure in 2022?

I know there used to be a man in the middle vulnerability back in the day using the third party "Flurry". As far as I have researched Flurry is still around but does anyone know is they have stopped using plaintext HTTP? Genuinely curious about how secure the "anonymous" app is and if anyone has found any similar exploits.

submitted by /u/Seek7201
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video