Skip to main content

Recently Updated Pages

John the Ripper Help Tricks

Hash Cracking John the Ripper

Find Hash Format Modules Find supported hash types # Field 1 is the Format label # Field 7 is ...

Updated 1 year ago by 0xBEN

Generate Hashes Passwd Overwrite

Linux

SALT=$(openssl rand -base64 6) # Salted MD5 openssl passwd -1 -salt $SALT your_password # Salt...

Updated 1 year ago by 0xBEN

OpenSSH Server on Windows Hosts

SSH Administration

Enable SSH Server Capability Get-WindowsCapability -Online -Name 'OpenSSH.Server*' | Add-Windows...

Updated 1 year ago by 0xBEN

Token Impersonation

Active Directory Post Exploitation: Attacks

Overview Tokens are temporary keys that allow a user to perform actions on a system or network w...

Updated 1 year ago by 0xBEN

Group Policy Preferences (GPP)

Active Directory Post Exploitation: Attacks

Overview GPP allows admins to create policies with embedded credentials. The credentials are enc...

Updated 1 year ago by 0xBEN

PrintNightmare

Active Directory Post Exploitation: Attacks

Local Privilege Escalation https://github.com/calebstewart/CVE-2021-1675

Updated 1 year ago by 0xBEN

Mimikatz

Active Directory Post Exploitation: Attacks

Overview https://github.com/gentilkiwi/mimikatz There are various spin-offs of the Mimikatz pro...

Updated 1 year ago by 0xBEN

ZeroLogon

Active Directory Post Exploitation: Attacks

Caution This can potentially break a domain controller, due the fact that this attack temporaril...

Updated 1 year ago by 0xBEN

Enum4Linux

Active Directory Post Exploitation: Enumeration

Details Enum4linux is a tool for enumerating information from Windows and Samba systems. It at...

Updated 1 year ago by 0xBEN

LdapDomainDump

Active Directory Post Exploitation: Enumeration

When to Use    You'll know when you've found a domain controller, because it will have ...

Updated 1 year ago by 0xBEN

PowerShell AD Module on Any Domain Host as Any User

Active Directory Post Exploitation: Enumeration

Borrow a DLL Normally, one must install RSAT (Remote Server Administration Tools) on a host to m...

Updated 1 year ago by 0xBEN

Alternate Information Gathering Methods

Linux

Current User Example would be if you have LFI or some other means to read from the local file sy...

Updated 1 year ago by 0xBEN

Dynamic Word Lists with Maskprocessor

Hash Cracking

Project Github https://github.com/hashcat/maskprocessor Example Usage You have a base pass...

Updated 1 year ago by 0xBEN

Have I Helped You Today?

The goal of this blog is to share technical and educational content that is: Well-documented ...

Updated 1 year ago by 0xBEN

WinRM (PowerShell Remoting)

File Transfers and Data Exfiltration File Transfer Techniques

WinRM runs on TCP port 5985 for unencrypted sessions and 5986 for encrypted sessions. # Open a P...

Updated 1 year ago by 0xBEN

TFTP

File Transfers and Data Exfiltration File Transfer Techniques

If the target has a TFTP client installed, Metasploit has a TFTP server you can run ad-hoc on you...

Updated 1 year ago by 0xBEN

SOCAT

File Transfers and Data Exfiltration File Transfer Techniques

Listener on Attack Box # Start a listener on the attack box and create a file when received soc...

Updated 1 year ago by 0xBEN

SCP

File Transfers and Data Exfiltration File Transfer Techniques

SCP Syntax Review The most fundamental syntax for using scp is this: # Password Authentication ...

Updated 1 year ago by 0xBEN

Multipart Forms and Boundary Parameters

Web Web Protocols

Multipart/Form-Data Example Example Web Form Consider the following web form... File Uploa...

Updated 1 year ago by 0xBEN

Using an Ad-Hoc Python Web Server to Catch HTTP Client Requests

Web Ad-Hoc Web Servers to Catch HTTP Client...

nano serv.py import http.server bind_address='0.0.0.0' port=80 class CustomRequestHandl...

Updated 1 year ago by 0xBEN