Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

delta.navisec.io

Post reply on HN
Print view View original

11–20 of 41 posts

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#11

Post by tptacek »

kasey_junk wrote: post #10
tptacek wrote: post #8

Earlier quoted context omitted.

It's also a reason we generally push everyone to centralize authentication on an SSO provider like Okta or Google Cloud Identity, both because those platforms allow you to easily set policy requiring 2FA, which breaks the attack, and because OIDC and SAML let you log into lots of services without exposing each of them to account takeover independently. There are other good reasons to do this, too. At Black Hat last y…

Do you mean that your application you 'write' should support SSO early or that the applications you 'use' should? That is are you talking about integrating your product with SSO or integrating your IT systems?

That, too! Especially if you have support personnel interacting with in-house applications, though putting those behind a VPN also goes a long way towards preventing account takeover on those applications.

But in general, the idea is that you want an SSO early so all the random SAAS applications you subscribe to can have a coherent security policy.

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#12

Post by netsectoday »

joeyrideout wrote: post #3

Not discussed is the antidote for blue teams: - 2FA - Password blacklists - Application Firewall that detects this hijinx (haven't explored this yet - anyone know of a good one?)

> Application Firewall that detects this hijinx (haven't explored this yet - anyone know of a good one?)

1. Make sure your app requests are logged with the source IP and configure fail2ban to block the really bad offenders.

2. Set up `actionban` and `actionunban` commands in a custom fail2ban banaction.conf file.

3. Use ipset (an iptables extension) for O(log n) lookup against banned IPs in iptables (which affects all input/forward/output network requests).

4. Tadaa!

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#13

Post by mc32 »

tptacek wrote: post #8
joeyrideout wrote: post #3

Not discussed is the antidote for blue teams: - 2FA - Password blacklists - Application Firewall that detects this hijinx (haven't explored this yet - anyone know of a good one?)

It's also a reason we generally push everyone to centralize authentication on an SSO provider like Okta or Google Cloud Identity, both because those platforms allow you to easily set policy requiring 2FA, which breaks the attack, and because OIDC and SAML let you log into lots of services without exposing each of them to account takeover independently. There are other good reasons to do this, too. At Black Hat last y…

What do you about providers who while they support SAML keep the front door open after setting up trusts?

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#14

Post by Kalium »

mc32 wrote: post #13
tptacek wrote: post #8

Earlier quoted context omitted.

It's also a reason we generally push everyone to centralize authentication on an SSO provider like Okta or Google Cloud Identity, both because those platforms allow you to easily set policy requiring 2FA, which breaks the attack, and because OIDC and SAML let you log into lots of services without exposing each of them to account takeover independently. There are other good reasons to do this, too. At Black Hat last y…

What do you about providers who while they support SAML keep the front door open after setting up trusts?

You feed your strong preference for SSO into procurement, which can really help cut down on the number of such vendors.

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#15

Post by [deleted] »

Kalium wrote: post #14
mc32 wrote: post #13

Earlier quoted context omitted.

What do you about providers who while they support SAML keep the front door open after setting up trusts?

You feed your strong preference for SSO into procurement, which can really help cut down on the number of such vendors.

[deleted]

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#16

Post by nextgens »

chelmzy wrote: post #5
joeyrideout wrote: post #3

Not discussed is the antidote for blue teams: - 2FA - Password blacklists - Application Firewall that detects this hijinx (haven't explored this yet - anyone know of a good one?)

>Password blacklists Assuming the external app is using AD auth. What product do you use to blacklist? Currently I just audit the passwords by dumping the hashes from the DC and running them against HIBP NTLM database.

Check https://safepass.me out (an active directory password filter)

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#17

Post by nubb »

This is a fun read for novices who are interested in infosec stuff.

I wish infosec tutorials/articles pushed writing custom tools. I've always considered password spraying to really be just taking super common passwords and flipping them around a bit. or . Instead of pushing some existing tools, I wish this article encouraged writing custom wordlist generators using common knowledge/sense.

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#18

Post by lucb1e »

nextgens wrote: post #16
chelmzy wrote: post #5

Earlier quoted context omitted.

>Password blacklists Assuming the external app is using AD auth. What product do you use to blacklist? Currently I just audit the passwords by dumping the hashes from the DC and running them against HIBP NTLM database.

Check https://safepass.me out (an active directory password filter)

To prevent disappointment for others that are interested: note that this is commercial and to get any sort of preview, you need to sign up and they emphasize that they want your corporate contact info...

@nextgens: are you affiliated with them, or did you just have a good experience with their product and wanted to share it?

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#19

Post by fosco »

tuxloper wrote: post #7
chelmzy wrote: post #6

Earlier quoted context omitted.

You guys hiring?

We are unofficially, however not Offensive Security roles. We are open to hiring somebody for firewall management (specifically Fortinet firewalls) as part of our Sentry offering. https://navisec.io/services/sentry/

curious on the choice of Fortinet over other vendors like Palo Alto Networks or Checkpoint?

Re: A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

#20

Post by chelmzy »

nextgens wrote: post #16
chelmzy wrote: post #5

Earlier quoted context omitted.

>Password blacklists Assuming the external app is using AD auth. What product do you use to blacklist? Currently I just audit the passwords by dumping the hashes from the DC and running them against HIBP NTLM database.

Check https://safepass.me out (an active directory password filter)

Sweet. I'm going to get a demo from them. I've demoed Specops and nFront products but they were a tad out of my organization's price range.
Post reply on HN