MSSQL Analysis Services - Coerced Authentication
A technique to coerce a Windows SQL Server to authenticate on an arbitrary machine.

https://github.com/p0dalirius/MSSQL-Analysis-Coerce
#mssql
#ntlm
@NetPentesters

​​DNS Reaper

Sub-domain takeover tool, but with an emphasis on accuracy, speed and the number of signatures in our arsenal!

We can scan around 50 subdomains per second, testing each one with over 50 takeover signatures. This means most organisations can scan their entire DNS estate in less than 10 seconds.

https://github.com/punk-security/dnsReaper
#tools
@NetPentesters

​​evilginx2

A man-in-the-middle attack framework used for phishing login credentials along with session cookies, which in turn allows to bypass 2-factor authentication protection.

This tool is a successor to Evilginx, released in 2017, which used a custom version of nginx HTTP server to provide man-in-the-middle functionality to act as a proxy between a browser and phished website. Present version is fully written in GO as a standalone application, which implements its own HTTP and DNS server, making it extremely easy to set up and use.

https://github.com/kgretzky/evilginx2
#MITM
@NetPentesters

​​ADenum

ADEnum.py is a pentesting tool that allows to find misconfiguration through the protocol LDAP and exploit some of those weaknesses with Kerberos.

LDAP:

▫️ Enum Domain Admin users
▫️ Enum Domain Controllers
▫️ Enum Domain users with Password Not Expire
▫️ Enum Domain users with old password
▫️ Enum Domain users with interesting denoscription
▫️ Enum Domain users with not the default encryption
▫️ Enum Domain users with Protecting Privileged Domain Accounts

Kerberos:

▫️ AS-REP Roastable
▫️ Kerberoastable
▫️ Password cracking with john (krb5tgs and krb5asrep)

https://github.com/SecuProject/ADenum

#ad
#redteam
@NetPentesters

SilentHound
Quietly enumerate an Active Directory Domain via LDAP parsing users, admins, groups, etc.

https://github.com/layer8secure/SilentHound
#ad
#enum
@NetPentesters

​​BARK

BARK stands for BloodHound Attack Research Kit. It is a PowerShell noscript built to assist the BloodHound Enterprise team with researching and continuously validating abuse primitives. BARK currently focuses on Microsoft's Azure suite of products and services.

BARK requires no third party dependencies. BARK's functions are designed to be as simple and maintainable as possible. Most functions are very simple wrappers for making requests to various REST API endpoints. BARK's basic functions do not even require each other - you can pull almost any BARK function out of BARK and it will work perfectly as a standalone function in your own noscripts.

https://github.com/BloodHoundAD/BARK
#AD
@NetPentesters

Friends, if you have any questions about network penetration testing, contact us with the following bot:
@ChatNPTbot

Active Directory Certificate Services Abuse

https://rayrt.gitlab.io/posts/Active-Directory-Certificate-Services-Abuse/
#ad
#adcs
@NetPentesters

Autobloody

Automatically exploit Active Directory privilege escalation paths shown by BloodHound combining pathgen.py and autobloody.py.

Here is the list of the BloodHound edges currently supported for automatic exploitation:

MemberOf
ForceChangePassword
AddMembers
AddSelf
DCSync
GetChanges/GetChangesAll
GenericAll
WriteDacl
GenericWrite
WriteOwner
Owns
Contains
AllExtendedRights



https://github.com/CravateRouge/autobloody
#ad
#bloodhound
@NetPentesters

[ LDAP Nom Nom ]
Anonymously bruteforce Active Directory usernames from Domain Controllers by abusing LDAP Ping requests (cLDAP)

https://github.com/lkarlslund/ldapnomnom

#ldap
#ad
#enum
#bruteforce
@NetPentesters

PowerHuntShares
is design to automatically inventory, analyze, and report excessive privilege assigned to SMB shares on Active Directory domain joined computers.
It is intented to help IAM and other blue teams gain a better understand of their SMB Share attack surface and provides data insights to help naturally group related share to help stream line remediation efforts at scale.

https://github.com/NetSPI/PowerHuntShares


Attacking and Remediating Excessive Network Share Permissions in Active Directory Environments

https://www.netspi.com/blog/technical/network-penetration-testing/network-share-permissions-powerhuntshares

#ad
#SMB
@NetPentesters

JuicyPotatoNG
Another Windows Local Privilege Escalation from Service Account to System

LINK TO RESEARCH

https://github.com/antonioCoco/JuicyPotatoNG
#windows #LPE
@NetPentesters

linWinPwn
bash noscript that automates a number of Active Directory Enumeration and Vulnerability checks

https://github.com/lefayjey/linWinPwn
#ad
#enum
@NetPentesters

Azure Active Directory security operations guide for applications

https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications

#Cloud
#Azure
@NetPentesters

+ Anonymously bruteforce AD usernames from Domain Controllers by abusing LDAP Ping requests (cLDAP)
https://github.com/lkarlslund/ldapnomnom
+ Relaying YubiKeys
https://cube0x0.github.io/Relaying-YubiKeys
+ Stealing Access Tokens From Office Desktop Applications
https://mrd0x.com/stealing-tokens-from-office-applications
#Ad
#redteam
@NetPentesters

#Red_Team
1. Kerberoast attack "pure python"
https://github.com/skelsec/kerberoast
2. A Guide to DNS Takeovers
https://blog.projectdiscovery.io/guide-to-dns-takeovers
3. Maquerade any legitimate Windows binary by changing some fields in the PEB structure
https://github.com/D1rkMtr/MasqueradingPEB

@BlueRedTeam

Azure Attack Paths

https://cloudbrothers.info/azure-attack-paths

​​ADDS_Tool

Active Directory Domain Services Tool.

Windows Command shell program that is a wrapper for ADDS toolset: - DSQUERY - DSGET - DSADD - DSMOD - DSMOVE

Features:
▫️ Main Menu
▫️ Settings Menu
▫️ Logs
▫️ Search Universal
▫️ Search User
▫️ Search Group
▫️ Search Computer
▫️ Search Server
▫️ Search OU

https://github.com/DavidGeeraerts/ADDS_Tool

#ad
#tools
@NetPentesters

A new version of the popular #BloodHound tool has been released, including:

- 12 new and/or improved techniques, mostly for Azure
- Completely rewritten AzureHound on Go and more

https://posts.specterops.io/introducing-bloodhound-4-2-the-azure-refactor-1cff734938bd
#pentest
#cloud
#news
#tools
@NetPentesters

Systematization of attacks on the perimeter of L2/L3 network equipment. Ver. 2.0.
#attack
#Analytics
@NetPentesters

Network Relaying Abuse in a Windows Domain

https://labs.nettitude.com/blog/network-relaying-abuse-windows-domain/