Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

delta.navisec.io

Post reply on HN
Print view View original

21–30 of 41 posts

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#21

Post by EnFinlay »

nubb wrote: post #17

This is a fun read for novices who are interested in infosec stuff. I wish infosec tutorials/articles pushed writing custom tools. I've always considered password spraying to really be just taking super common passwords and flipping them around a bit. or . Instead of pushing some existing tools, I wish this article encouraged writing custom wordlist generators using common knowledge/sense.

On one hand I agree with you, on the other hand I don't think the space is short on people writing their own tools. The number of DNS enumerators I've seen shared over the past month alone speaks to this.

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#22

Post by nubb »

EnFinlay wrote: post #21
nubb wrote: post #17

This is a fun read for novices who are interested in infosec stuff. I wish infosec tutorials/articles pushed writing custom tools. I've always considered password spraying to really be just taking super common passwords and flipping them around a bit. or . Instead of pushing some existing tools, I wish this article encouraged writing custom wordlist generators using common knowledge/sense.

On one hand I agree with you, on the other hand I don't think the space is short on people writing their own tools. The number of DNS enumerators I've seen shared over the past month alone speaks to this.

I cant disagree with you there :)

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#23

Post by Bombthecat »

tptacek wrote: post #8
joeyrideout wrote: post #3

Not discussed is the antidote for blue teams: - 2FA - Password blacklists - Application Firewall that detects this hijinx (haven't explored this yet - anyone know of a good one?)

It's also a reason we generally push everyone to centralize authentication on an SSO provider like Okta or Google Cloud Identity, both because those platforms allow you to easily set policy requiring 2FA, which breaks the attack, and because OIDC and SAML let you log into lots of services without exposing each of them to account takeover independently. There are other good reasons to do this, too. At Black Hat last y…

A colleague is currently implementing okta.

As far as I heard it is a ton of work and very complicated. (they can't use saml, they use oauth)

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#25

Post by ryanlol »

lucb1e wrote: post #18
nextgens wrote: post #16

Earlier quoted context omitted.

Check https://safepass.me out (an active directory password filter)

To prevent disappointment for others that are interested: note that this is commercial and to get any sort of preview, you need to sign up and they emphasize that they want your corporate contact info... @nextgens: are you affiliated with them, or did you just have a good experience with their product and wanted to share it?

Aren't most people looking for something like this going to be BigCo employees?

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#26

Post by spydum »

mc32 wrote: post #13
tptacek wrote: post #8

Earlier quoted context omitted.

It's also a reason we generally push everyone to centralize authentication on an SSO provider like Okta or Google Cloud Identity, both because those platforms allow you to easily set policy requiring 2FA, which breaks the attack, and because OIDC and SAML let you log into lots of services without exposing each of them to account takeover independently. There are other good reasons to do this, too. At Black Hat last y…

What do you about providers who while they support SAML keep the front door open after setting up trusts?

Front door accounts should be vaulted away for when SSO is broken only.

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#27

Post by spydum »

chelmzy wrote: post #5
joeyrideout wrote: post #3

Not discussed is the antidote for blue teams: - 2FA - Password blacklists - Application Firewall that detects this hijinx (haven't explored this yet - anyone know of a good one?)

>Password blacklists Assuming the external app is using AD auth. What product do you use to blacklist? Currently I just audit the passwords by dumping the hashes from the DC and running them against HIBP NTLM database.

Last I saw black hills had a filter as well - but this is a problem. If companies have adopted Azure AD I believe they have some new options (sorry fuzzy on the details)

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#28

Post by joeyrideout »

tptacek wrote: post #8
joeyrideout wrote: post #3

Not discussed is the antidote for blue teams: - 2FA - Password blacklists - Application Firewall that detects this hijinx (haven't explored this yet - anyone know of a good one?)

It's also a reason we generally push everyone to centralize authentication on an SSO provider like Okta or Google Cloud Identity, both because those platforms allow you to easily set policy requiring 2FA, which breaks the attack, and because OIDC and SAML let you log into lots of services without exposing each of them to account takeover independently. There are other good reasons to do this, too. At Black Hat last y…

100% agree. Fewer auth providers (ideally, one) greatly reduces the work involved with mitigating this attack (and maintaining permissions, auditing, passthrough... everything gets easier, really).

Happy Okta client here.

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#29

Post by joeyrideout »

Bombthecat wrote: post #23
tptacek wrote: post #8

Earlier quoted context omitted.

It's also a reason we generally push everyone to centralize authentication on an SSO provider like Okta or Google Cloud Identity, both because those platforms allow you to easily set policy requiring 2FA, which breaks the attack, and because OIDC and SAML let you log into lots of services without exposing each of them to account takeover independently. There are other good reasons to do this, too. At Black Hat last y…

A colleague is currently implementing okta. As far as I heard it is a ton of work and very complicated. (they can't use saml, they use oauth)

From my experience, anything SSO-related has a steep learning curve in wrapping your head around IDP, SP, metadata, IDP-initiated vs. SP-initiated... there's a whole lexicon that isn't very intuitive. Ask me to set it up a year ago and I would have described it as "a ton of work and very complicated". Eventually it stuck, though :)

Okta client here btw, and we use SAML (2.0) for many of our SSO integrations. Okta has pretty clear support for SAML 2.0. Maybe your colleague's app is a special case?

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#30

Post by joeyrideout »

tuxloper wrote: post #4
joeyrideout wrote: post #3

Not discussed is the antidote for blue teams: - 2FA - Password blacklists - Application Firewall that detects this hijinx (haven't explored this yet - anyone know of a good one?)

Thanks, man! I've updated the article to reflect that.

Thank you for the great piece! I always love to see Burp used in a way I haven't seen before.
Post reply on HN