PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Thinking in Graphs with IPAHound

swarm.ptsecurity.com | research | #attack-chains | #active-directory | #red-team | #bloodhound | #lateral-movement | #freeipa | #ipahound
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

PT SWARM introduces IPAHound, a BloodHound-style collector and GUI for FreeIPA that graphs LDAP data to spot misconfigurations and lateral movement; it lists FreeIPA 0-days the team found.
Published
Collected

Related coverage

blog · specterops.io
Beyond Tier Zero
SpecterOps argues identity risk now extends beyond Tier Zero, as attackers increasingly use legitimate credentials and trusted relationships to reach backups, regulated data, and other critical workloads.
blog · specterops.io
BloodHound 2.0
# BloodHound 2.0 Author Rohan Vazarkar Read Time 16 mins Published Aug 7, 2018 ##### Share * Major New Features * CanRDP — Remote Desktop Privileges * ReadLAPSPassword — LAPS Password Readers *...
blog · specterops.io
BloodHound 1.5: The Container Update
# BloodHound 1.5: The Container Update Author Rohan Vazarkar Read Time 12 mins Published Mar 28, 2018 ##### Share * Containers — GPOs and OUs * SharpHound Changes * Container Collection Method *...
blog · netspi.com
Running LAPS Around Cleartext Passwords
Explains how Microsoft LAPS stores local admin passwords in LDAP, and how incorrect delegation on ms-MCS-AdmPwd can expose cleartext credentials that aid lateral movement.
blog · netspi.com
5 Ways to Find Systems Running Domain Admin Processes
Details five ways to find systems running Domain Admin processes: checking locally, querying domain controllers for sessions, scanning remote tasks, NetBIOS enumeration, and token spraying.
research · portswigger.net
CRLF-Powered Desync Attacks: Beheading HTTP Streams
PortSwigger turns HTTP header injection into a desync worm, with novel methods that shift IP- and connection-locked desyncs into the victim's browser to create XSS and steal HTTPOnly cookies.
Back