Never stop frontin: How to quickly setup a redirector and transparent reverse proxy

Protecting your infrastructure from prying eyes is an important part of landing a phish and maintaining access to a client’s network. The process of setting up redirectors and reverse proxies has traditionally been difficult and hard to automate across different cloud platforms.

Today, we’re going to solve that problem with our new repository, sneaky_proxy, which will allow you to automate your efforts.

Read More...

The ultimate tag team: PetitPotam and ADCS pwnage from Linux

PetitPotam and ADCS exploitation are nothing short of amazing. Exploitation is a breeze and results in full domain admin access.

With these two TTPs, an attacker can hop on a network, exploit the vulnerability, do some command-line magic and have local administrator privileges on a domain controller in under 15 minutes. So far, no one has detailed the exploitation process fully on Linux and that’s what we’re going to do today.

Read More...

#PrintNightmare – Is your company protected from this Print Spooler vulnerability?

Hey, you love printers right? They’re that reliable, steadfast piece of technology that always seems to work and never gives you any headaches ... right? Well, buckle up.

Microsoft is releasing emergency security patches to address a critical privilege escalation and remote code execution vulnerability found within the Print Spooler service.

Read More...

How to limit cleartext password storage and fix the issue in your organization

The key to our engagements often and unfortunately involve the discovery of credentials on internal network file shares. We’re going to show you how we find cleartext password storage problems and how to address them.

Read More...

Never had a bad day phishing. How to set up GoPhish to evade security controls.

I’m going to quickly go through the process of setting up GoPhish and show you how we evade defenders to increase the success rate of our phishing campaigns.

Read More...

Reliable Username Enumeration: A step-by-step guide

Collecting and validating an organization’s employee base is critical for any successful offensive information security operation. With this information, we’re able to conduct social engineering campaigns and password spray endpoints. Check out the full post to learn the process for fully enumerating an organization’s employee base.

Read More...

Launching a pentest: How to discover related DNS records

When starting a penetration test, we first try to discover domains associated with our target apex domain.

To help you navigate this part of the process, we’re going to detail it, highlighting tips and tricks for working around registrant privacy services and other roadblocks you may face.

Read More...

Leveraging hijacked Slack sessions on macOS

Let’s face it, Slack is a treasure trove of information for hackers. Credentials. Proprietary data. Social engineering opportunities. You get the picture – it’s an information-rich environment.

I’m going to dig into Slack workspace compromise via Mythic C2 and macOS to provide additional information and tooling you can use to leverage a stolen Slack session.

Read More...

How to hunt for SolarWinds Orion usage

Recent reports from FireEye revealed a large-scale campaign to infect company networks using a modified version of the SolarWinds Orion monitoring agent.

To give you a clear understanding how continuous penetration testing can help you enumerate the possible use of SolarWinds Orion we’re going to highlight methodologies we use every day at Sprocket.

Read More...

Pro tips for purchasing and aging phishing domains

Good command-and-control infrastructure requires a known, trusted domain. When you’re first starting out, this can be difficult to find, but luckily other testers have provided many great resources.

So, let’s dive into what’s available and how to make the right choices when building out an attack infrastructure.

Read More...