A Pentester's Guide: Osint, Breach Dumps, and Password Spraying
delta.navisec.io
A Pentester's Guide: Osint, Breach Dumps, and Password Spraying
1–10 of 41 posts
Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying
#2There are a few companies which are onto password spraying in this way, and use failed login attempts from a single source (e.g. IP address, ipv6 addresses within the same allocation block, etc) as a trigger state for additional monitoring or verification. That can just mean that the soc gets a notification, or can enable captcha for suspicious sources while the attack is going on.
This does of course fail when an attacker starts using multiple sources for attack traffic. That seems to be the next step in the cat and mouse game though.
Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying
#3Not discussed is the antidote for blue teams:
- 2FA
- Password blacklists
- Application Firewall that detects this hijinx (haven't explored this yet - anyone know of a good one?)
Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying
#4Not discussed is the antidote for blue teams: - 2FA - Password blacklists - Application Firewall that detects this hijinx (haven't explored this yet - anyone know of a good one?)
Thanks, man! I've updated the article to reflect that.
Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying
#5Not discussed is the antidote for blue teams: - 2FA - Password blacklists - Application Firewall that detects this hijinx (haven't explored this yet - anyone know of a good one?)
>Password blacklists
Assuming the external app is using AD auth. What product do you use to blacklist? Currently I just audit the passwords by dumping the hashes from the DC and running them against HIBP NTLM database.
Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying
#6Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying
#7Earlier quoted context omitted.
Thanks, man! I've updated the article to reflect that.
You guys hiring?
We are unofficially, however not Offensive Security roles.
We are open to hiring somebody for firewall management (specifically Fortinet firewalls) as part of our Sentry offering.
Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying
#8Not discussed is the antidote for blue teams: - 2FA - Password blacklists - Application Firewall that detects this hijinx (haven't explored this yet - anyone know of a good one?)
It's also a reason we generally push everyone to centralize authentication on an SSO provider like Okta or Google Cloud Identity, both because those platforms allow you to easily set policy requiring 2FA, which breaks the attack, and because OIDC and SAML let you log into lots of services without exposing each of them to account takeover independently.
There are other good reasons to do this, too.
At Black Hat last year, I cornered a bunch of CSO-types at big startups and asked for what their first 3 initiatives would be, and this was something I heard a bunch.
You should have some kind of SSO set up, early.
Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying
#9Not discussed is the antidote for blue teams: - 2FA - Password blacklists - Application Firewall that detects this hijinx (haven't explored this yet - anyone know of a good one?)
additionally for passwords that are already stored, it's not too costly to check the hashes against the blacklist and revoke those existing passwords.
Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying
#10Not discussed is the antidote for blue teams: - 2FA - Password blacklists - Application Firewall that detects this hijinx (haven't explored this yet - anyone know of a good one?)
It's also a reason we generally push everyone to centralize authentication on an SSO provider like Okta or Google Cloud Identity, both because those platforms allow you to easily set policy requiring 2FA, which breaks the attack, and because OIDC and SAML let you log into lots of services without exposing each of them to account takeover independently. There are other good reasons to do this, too. At Black Hat last y…
Do you mean that your application you 'write' should support SSO early or that the applications you 'use' should?
That is are you talking about integrating your product with SSO or integrating your IT systems?