Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

delta.navisec.io

Post reply on HN
Print view View original

31–40 of 41 posts

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#31

Post by joeyrideout »

netsectoday wrote: post #12
joeyrideout wrote: post #3

Not discussed is the antidote for blue teams: - 2FA - Password blacklists - Application Firewall that detects this hijinx (haven't explored this yet - anyone know of a good one?)

> Application Firewall that detects this hijinx (haven't explored this yet - anyone know of a good one?) 1. Make sure your app requests are logged with the source IP and configure fail2ban to block the really bad offenders. 2. Set up `actionban` and `actionunban` commands in a custom fail2ban banaction.conf file. 3. Use ipset (an iptables extension) for O(log n) lookup against banned IPs in iptables (which affects al…

At first glance I thought you were describing a more traditional network firewall, but with the data from application logs (failed logins, presumably) this becomes a very elegant entry WAF. Very cool!

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#32

Post by Bombthecat »

joeyrideout wrote: post #29
Bombthecat wrote: post #23

Earlier quoted context omitted.

A colleague is currently implementing okta. As far as I heard it is a ton of work and very complicated. (they can't use saml, they use oauth)

From my experience, anything SSO-related has a steep learning curve in wrapping your head around IDP, SP, metadata, IDP-initiated vs. SP-initiated... there's a whole lexicon that isn't very intuitive. Ask me to set it up a year ago and I would have described it as "a ton of work and very complicated". Eventually it stuck, though :) Okta client here btw, and we use SAML (2.0) for many of our SSO integrations. Okta has…

Nope, not at all. He knew all those words and more (he is basically an oauth expert)

He said the biggest problem is how okta handles user information, roles, rights and how it is stored. He said, that they have there own idea about it. (which can be good or bad...) didn't dig deeper though :)

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#33

Post by czbond »

joeyrideout wrote: post #3

Not discussed is the antidote for blue teams: - 2FA - Password blacklists - Application Firewall that detects this hijinx (haven't explored this yet - anyone know of a good one?)

AWS WAF is great - up and running same day, heck even same hour depending on architecture.

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#34

Post by technion »

Since they mention Office 365, it's worth noting Microsoft's Smart Lockout tooling has been pretty efficient here imo.

https://www.microsoft.com/en-us/microsoft-365/blog/2018/03/0...

There are also some great capabilities like forcing a password reset after multiple "correct password but failed MFA" logons.

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#35

Post by ganoushoreilly »

fosco wrote: post #19
tuxloper wrote: post #7

Earlier quoted context omitted.

We are unofficially, however not Offensive Security roles. We are open to hiring somebody for firewall management (specifically Fortinet firewalls) as part of our Sentry offering. https://navisec.io/services/sentry/

curious on the choice of Fortinet over other vendors like Palo Alto Networks or Checkpoint?

A lot of MSP's sold fortinet into small/med businesses due to costs and preferable licensing terms / commissions. They're everywhere in the market.

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#36

Post by mkagenius »

I need a tool which tells where have I registered using the breached passwords. Often, the problem is not knowing which services you signed up for in the first place.

The easiest way would be for the said services to do this for their users whenever a new password dump surfaces.

Or even a way to test my username and password on top 5000 sites in an automated way should help.

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#37

Post by bashwizard »

nubb wrote: post #22
EnFinlay wrote: post #21

Earlier quoted context omitted.

On one hand I agree with you, on the other hand I don't think the space is short on people writing their own tools. The number of DNS enumerators I've seen shared over the past month alone speaks to this.

I cant disagree with you there :)

While custom tools are nice and all I don't really see the point of reinventing the wheel all the time.

If there is a tool/script/exploit/etc out there doing most of what I want, you can be sure that I'm going to use it and modify it to my needs instead of writing my own.

I'd say that's usually the case in 80% of the cases when doing pentests. Besides, time is money.

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#38

Post by nextgens »

lucb1e wrote: post #18
nextgens wrote: post #16

Earlier quoted context omitted.

Check https://safepass.me out (an active directory password filter)

To prevent disappointment for others that are interested: note that this is commercial and to get any sort of preview, you need to sign up and they emphasize that they want your corporate contact info... @nextgens: are you affiliated with them, or did you just have a good experience with their product and wanted to share it?

I am affiliated and no, you don't need to sign-up to get a preview:

We have a video that shows how to set it up and basic operation: https://safepass.me/demo-video

We have a free "home-use" license: if your PC isn't hooked onto AD, it will just work. https://safepass.me/get-the-documentation https://safepass.me/download (the MSI)

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#39

Post by nextgens »

chelmzy wrote: post #20
nextgens wrote: post #16

Earlier quoted context omitted.

Check https://safepass.me out (an active directory password filter)

Sweet. I'm going to get a demo from them. I've demoed Specops and nFront products but they were a tad out of my organization's price range.

Let me know how it goes; if our sales droids don't come up with something acceptable on their own, I am keen to understand why and will work something out for you.

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#40

Post by svantana »

nubb wrote: post #17

This is a fun read for novices who are interested in infosec stuff. I wish infosec tutorials/articles pushed writing custom tools. I've always considered password spraying to really be just taking super common passwords and flipping them around a bit. or . Instead of pushing some existing tools, I wish this article encouraged writing custom wordlist generators using common knowledge/sense.

That sounds like guesswork, don't we already know which passwords are in common use from the various large-scale breaches? You could even use that data to train a character sequence model (e.g RNN), but really just randomly selecting from the 1000 most common passwords should be superior?
Post reply on HN