Cracking Credit Card Hashes with PowerShell

In continuing with my series addressing common compliance hurdles relating to Payment Card Industry (PCI) requirements, I would like to turn to the topic of data retention.

Some of the team from NetSPI spent the week in sunny Orlando at the 2010 PCI North American Community Meeting.

NetSPI examines why TOTP codes no longer stop determined attackers, walking through a brute force scenario and recommending stronger 2FA alternatives to replace time-based one-time passwords.

Shows how a CAPTCHA that can be solved once and replayed fails to stop brute force - a password was cracked on the 86th try - and lists checks like one-time use and session binding.

Shows how an attacker with domain credentials can request an RSA Emergency Access Tokencode from the self-service console and brute force the numeric PIN, turning recovery features into a 2FA bypass.

Releases Invoke-ExternalDomainBruteforce, which detects whether a Microsoft domain is managed or federated, picks the right authentication flow, and automates password guessing against O365 and ADFS.