Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Inveigh – What's New in Version 1.4

netspi.com | blog | #powershell | #spoofing | #ntlm-relay | #llmnr | #mdns | #inveigh | #nbns

Summary

Kevin Robertson details Inveigh 1.4, his PowerShell LLMNR/mDNS/NBNS spoofer, adding ADIDNS attacks, relay improvements with multiple target handling and BloodHound integration, plus evasion options.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Beyond LLMNR/NBNS Spoofing – Exploiting Active Directory-Integrated DNS
Kevin Robertson argues ADIDNS beats LLMNR/NBNS spoofing for MITM attacks in AD environments: attackers with unprivileged access can add wildcard records that intercept name resolution domain-wide.
blog · netspi.com
Identifying Rogue NBNS Spoofers
NBNS spoofing with Responder.py or Metasploit easily captures and relays hashes, yet mitigations are scarce. A new script queries a nonexistent hostname and alerts admins when a spoofer responds.
research · projectblack.io
Disable LLMNR via GPO (Together with NBT-NS and MDNS)
How to disable LLMNR, NBT-NS and MDNS via GPO to stop attackers capturing password hashes through name-resolution fallback, with an importable GPO and cautions about MDNS side effects.
blog · netspi.com
ADIDNS Revisited – WPAD, GQBL, and More
Kevin Robertson expands on ADIDNS attacks, covering why WPAD records fail against the global query block list and demonstrating GQBL bypasses with wildcard, DNAME, and NS records.
blog · netspi.com
Bypassing SQL Server Logon Trigger Restrictions
Scott Sutherland shows how to bypass SQL Server logon trigger restrictions by spoofing hostnames and application names with lesser-known connection string properties, using SSMS and PowerUpSQL.
blog · netspi.com
Getting Started with WMI Weaponization – Part 2
Teaches enumerating the 1,500-plus WMI classes on a system with Get-CimClass, then dissecting properties and methods of classes like Win32_Process to find attacker-useful functionality.
back