2023 – Page 2 – NetwerkLABS

Understanding Kerberos Authentication

Kerberos Authentication Referenceshttps://www.youtube.com/watch?v=snGeZlDQL2Q https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/b4af186e-b2ff-43f9-b18e-eedb366abf13 krbtgt account -→ KDC Service Account Ticket Details Authorization Data is Microsoft addition to Kerberos; can be manipulated to modify Group membership..etc and launch attacks. Domian Policy about Kerberos settings (default): The…

Bharath Narayanasamy

Enumeration Attacking Active Directory

PowerView Cheat Sheet

up-to-date version of PowerView: https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1 New function naming schema: Verbs: Get : retrieve full raw data sets Find : ‘find’ specific data entries in a data set Add : add a new object to a destination…

Bharath Narayanasamy

Attacking Active Directory

Attacking Kerberos

Kerberos Kerberos is the default authentication service for Microsoft Windows domains. It is intended to be more "secure" than NTLM by using third party ticket authorization as well as stronger encryption. Even though NTLM has a…

Bharath Narayanasamy kerberos, AD attacks

Practical LABS

TryHackMe: OpenVPN Issues and Fixes

OpenVPN complaining of depreciated ciphers ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-256-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server. Fix: sed -i 's/cipher AES-256-CBC/data-ciphers AES-256-CBC/' *.ovpn

Bharath Narayanasamy

BLUE TEAM Intrusion Detection and Response

Log Management: Basics

Introduction to Log Management Logs are a record of events within a system. These records provide a detailed account of what a system has been doing, capturing a wide range of events such as user logins,…

Bharath Narayanasamy

NIST DETECT

NIST – DETECT: Categories and Subcategories

Bharath Narayanasamy

NIST IDENTIFY

NIST – IDENTIFY: Categories and Subcategories

Asset Management (ID.AM): The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to business objectives and the organization’s risk strategy.

Bharath Narayanasamy NIST, IDENTIFY

NIST

NIST Cybersecurity Framework v1.1: Fundamentals

NIST Functions Identify – Understand what you have and includes activities such as asset management, governance, risk assessment. Protect – Build safeguards and controls to protect what is important to you. Detect – Implement capabilities to…

Bharath Narayanasamy NIST

Threat Detection and Incident Response

Incident Handling Life Cycle

NIST - Security Incident Handling 1. Preparation The preparation phase covers the readiness of an organization against an attack. That means documenting the requirements, defining the policies, incorporating the security controls to monitor like EDR / SIEM /…

Bharath Narayanasamy CISO, NIST, Incident Management, dfir

Bash Scripting

Bourne Again Shell The main difference between scripting and programming languages is that we don't need to compile the code to execute the scripting language, as opposed to programming languages. Structure of Scripting Language Input &…

Bharath Narayanasamy