External/Internal Archives - Black Hills Information Security: Recent Episodes
External/Internal Archives - Black Hills Information Security
While DLL hijacking attacks can take on many different forms, this blog post will explore a specific type of attack called DLL proxying, providing insights into how it works, the potential risks it poses, and briefly the methodology for discovering these vulnerable DLLs, which led to the discovery of several zero-day vulnerable DLLs that Microsoft has acknowledged but opted to not fix at this time.
The post Proxying Your Way to Code Execution – A Different Take on DLL Hijacking appeared first on Black Hills Information Security.
A great place that can sometimes be overlooked on an internal penetration test are the secrets hidden in plain sight. That is, a place where no authentication is required in […]
The post Auditing GitLab: Public Gitlab Projects on Internal Networks appeared first on Black Hills Information Security.
Start this blog series from the beginning here: PART 1 Misconfigurations in Active Directory Certificate Services (ADCS) can introduce critical vulnerabilities into an Enterprise environment. In this article, we will […]
The post Abusing Active Directory Certificate Services (Part 4) appeared first on Black Hills Information Security.
Creating your own lab can sound like a daunting task. By the end of this blog post, you will be able to deploy your own Active Directory (AD) environment in […]
The post Deploy an Active Directory Lab Within Minutes appeared first on Black Hills Information Security.
Quick Jump: In the constantly evolving landscape of cybersecurity, it is common to see features designed for convenience lead to negative cybersecurity consequences. Microsoft Teams, an essential tool for corporate […]
The post Wishing: Webhook Phishing in Teams appeared first on Black Hills Information Security.
What is Hydra? Hydra is a tool that can be used for password spraying. Let’s begin by defining the term “password spray.” A password spray is where an attacker defines […]
The post Hacking with Hydra appeared first on Black Hills Information Security.
The new year has begun, and as a penetration tester at Black Hills Information Security, one thing really struck me as I reflected on 2023: a concerningly large number of […]
The post Revisiting Insecure Direct Object Reference (IDOR) appeared first on Black Hills Information Security.
In An SMB Relay Race – How To Exploit LLMNR and SMB Message Signing for Fun and Profit, Jordan Drysdale shared the dangers of lack of SMB Signing requirements and […]
The post Bypass NTLM Message Integrity Check – Drop the MIC appeared first on Black Hills Information Security.
| Alyssa Snow In PART ONE and PART TWO of this blog series, we discussed common misconfigurations of Active Directory certificate templates. In this post, we will walk through exploitation […]
The post Abusing Active Directory Certificate Services (Part 3) appeared first on Black Hills Information Security.
| Alyssa Snow Misconfigurations in Active Directory Certificate Services (ADCS) can introduce critical vulnerabilities into an Enterprise Active Directory environment, such as paths of escalation from low privileged accounts to […]
The post Abusing Active Directory Certificate Services – Part 2 appeared first on Black Hills Information Security.
| Alyssa Snow Active Directory Certificate Services (ADCS)1 is used for public key infrastructure in an Active Directory environment. ADCS is widely used in enterprise Active Directory environments for managing […]
The post Abusing Active Directory Certificate Services – Part One appeared first on Black Hills Information Security.
ImposterKeanu // Introduction This blog post introduces the reader to “The Obfuscation Hustle”, a term I enjoy using to describe the tedious process of obfuscating and delivering files to corporate […]
Alyssa Snow // During an external or internal network penetration test, it can be challenging to comb through each web server in scope to find the juicy stuff. During a […]
The post Gowitness, a Tester’s Time Saver appeared first on Black Hills Information Security.
Dale Hobbs // As the world becomes increasingly connected through the internet, cyber attacks have become more sophisticated and prevalent. One type of attack that you may not have heard […]
The post MITM6 Strikes Again: The Dark Side of IPv6 appeared first on Black Hills Information Security.
Have you ever been on a pentest and thought to yourself, “I wish I had a robot to do this testing for me right now cuz this is just too much work”?
The post How to Build a Pentest Robot With Selenium IDE appeared first on Black Hills Information Security.
Daniel Pizarro // What is the PNPT? The Practical Network Penetration Tester (PNPT), created by TCM Security (TCMS), is a 5-day ethical hacking certification exam that assesses a pentester’s ability […]
The post PNPT: Certification Review appeared first on Black Hills Information Security.
Dale Hobbs // One thing that I almost always find when performing an internal network penetration test is Simple Network Management Protocol (SNMP) configured with default community strings. Simple Network […]
The post SNMP… Strings Attached! appeared first on Black Hills Information Security.
Jordan Drysdale // Overview The following description of some of Impacket’s tools and techniques is a tribute to the authors, SecureAuthCorp, and the open-source effort to maintain and extend the code. […]
The post Impacket Defense Basics With an Azure Lab appeared first on Black Hills Information Security.
Melissa Bruno // One of the best early steps to take when testing a network, especially a large one, is to run the tool EyeWitness to gain a quick understanding […]
The post For Web Content Discovery, Who You Gonna Call? Gobuster! appeared first on Black Hills Information Security.
Jordan Drysdale // Overview The following description of some of Impacket’s tools and techniques is a tribute to the authors, SecureAuthCorp, and the open-source effort to maintain and extend the […]
The post Impacket Offense Basics With an Azure Lab appeared first on Black Hills Information Security.
Timecode links take you to YouTube: 4:11 – Infrastructure & Background8:28 – Overview & Breakdown of Attack Methodology and Plans11:35 – Start of Attack (Gaining Access), Password Spraying Toolkit15:24 – […]
The post Webcast: Attack Tactics 5 – Zero to Hero Attack appeared first on Black Hills Information Security.
Jordan Drysdale// This is basically a slight update and rip off of Marcello’s work out here: https://byt3bl33d3r.github.io/practical-guide-to-ntlm-relaying-in-2017-aka-getting-a-foothold-in-under-5-minutes.html /tl;dr – Zero to DA on an environment through an exposed Outlook Web […]
The post An SMB Relay Race – How To Exploit LLMNR and SMB Message Signing for Fun and Profit appeared first on Black Hills Information Security.
Darin Roberts// IP-Go-Round – Source IP Rotation I was on an engagement recently that was blocking my password sprays based on my IP address. If I made 3 incorrect requests […]
The post How To Rotate Your Source IP Address appeared first on Black Hills Information Security.
Carrie Roberts //* I have needed to remind myself how to set up RDP access through an SSH connection so many times that I’ve decided to document it here for […]
The post The RDP Through SSH Encyclopedia appeared first on Black Hills Information Security.
Jordan Drysdale // tl;dr Cisco Smart Install is awesome (on by default)…for hackers… not sysadmins. So, you Nessus too? Criticals and highs are all that matter! Right??? Until this beauty […]
The post Cisco Smart Installs and Why They’re Not “Informational” appeared first on Black Hills Information Security.
Kent Ickler // It seemed like we were always cross-referencing the Hashcat Wiki or help file when working with Hashcat. We needed things like specific flags, hash examples, or command […]
The post Hashcat 4.10 Cheat Sheet v 1.2018.1 appeared first on Black Hills Information Security.
Kent Ickler// TLDR: We use a custom dictionary to crack Microsoft Office document encryption. Then we use a custom dictionary for pwnage in LinkedIn hash database. Background: I recently got […]
The post How to Crack Office Passwords with a Dictionary appeared first on Black Hills Information Security.