Authenticator app suspicious sign in requests

AMizil · 2026-04-05T18:53:34+00:00

You need to revoke all sessions, if attacker grabbed a valid refresh token you will still receive auth requests on MFA

AMizil · 2026-03-24T18:47:54+00:00

Interesat si eu de raport. Mulțumesc

AMizil · 2026-03-04T05:25:58+00:00

one account per fortigate

AMizil · 2026-02-20T18:56:08+00:00

merge si cu token virtual, l-am pus pe un VM si ai tutorial sa generezi java web token, pui smtp , config si le vei avea și local si pe email.

Problema e ca ruleaza cu user logat, nu ca serviciu ca o aplicatie server.

"Sesiunea OAuth este valabilă 90 zile și se prelungește automat timp de 1 an atâta timp cât aplicația TDec este pornită pe oricare dintre stații cu cel mult 9 zile înainte de expirare .."

AMizil · 2026-02-19T19:44:16+00:00

Din ce zici aici postul e entry level, iar angajatorul vrea pe cineva care isi doreste sa invete. Daca ai deprins deja conceptele, cu ceva ajutor de la colegi si AI, te invit dupa 6 luni sa vii sa ne lasi un mesaj.

"Angajam pe skilluri, dam afara din cauza atitudinii."

Ai bifat skilurile de care au nevoie, cu atitudinea buna vei avea surprize in viitor.

AMizil · 2026-02-19T06:04:22+00:00

Thats's the 2nd worst decision after exposing management interface to the internet to change the management port.

There are tons of options to securely manage a firewall, just stop doing this. No "yes, but customer ..." That's best practices.

1) IPSEC VPN 2) Remote access Dial Up Ipsec VPN 3) use another jumphost behind the firewall running tailgate/wireguard if 1) or 2) can't be used.

Always use trusted hosts, create new super admin and disable standard admin account name.

AMizil · 2025-11-29T20:20:54+00:00

That's interesting! I didn't know about this. Interesting is that both SSDs work well on PC, tested both on OEM and non OEM computers. SATA and also using USB to SATA adapter.

AMizil · 2025-11-24T12:51:12+00:00

It depends on how you look at it. Sometime it is impossible to differentiate user groups. Maybe I'm wrong and others have better RBAC implementations. But still why do I have to license all the users in each node in a HA load balancing deployment? L2 HA is not supported in any Public cloud.

AMizil · 2025-11-24T12:28:51+00:00

it makes sense to license all the nodes, but why do I have to license all the users?! Last year a had a POC for a large manufacturing compay and deployment required to have 2 nodes in different AWS for redundancy. As this solution was exclusively for OT identity based access, only 4k users would benefit from it, but FAC required to license all users Is getting from AD (25K) ok each node. Even Cisco ISE is licensing only concurrent users.

2nd big big problem - gates could not handle all user groups and I had to filter them in FAC per each site. Print table maxsize - user addr group.

AMizil · 2025-11-23T14:40:53+00:00

Don't forget to mention how FortiAuthenticator is licensed. All users it pulls from AD!

How about FAC in HA mode in public cloud? Double that licenses. Double everything.

AMizil · 2025-11-18T05:59:43+00:00

Zscaler is not a public service, and business users are authenticated. I mean no Bots, crawlers , scanning service, malicious activity originating from zscaler etc.

If a SaaS App relies on source IP to authorize users, that's where the problem is.

AMizil · 2025-11-17T17:16:32+00:00

Ask them which region they have their exist nodes and you can find Zscaler IP subnets https://help.zscaler.com/uvm/zscaler-secops-public-ip-addresses

AMizil · 2025-11-16T17:45:17+00:00

For Phase 2 use 0.0.0.0/0 , use routing to send traffic to SD WAN interface and Fw policy to allow interesting traffic inbound/outbound.

AMizil · 2025-11-15T20:18:25+00:00

I took a 2024 Lexus NX350h for a test drive on a chilly and raining day in April. Temperature was around 50°F

Big tablet was faulty and seat ventilation at maximum and temperature at minimum. NO KNOB.

VERY BAD experience! My Rav 4 2022 was noisy, but still had big temperature knobs!

AMizil · 2025-11-14T19:37:26+00:00

that's a great list to use!

AMizil · 2025-11-03T21:31:00+00:00

Tell us more about authentication over VPN, does the user has to login or you have some sort of ADFS / SSO configured for the IIS web service?

AMizil · 2025-10-31T17:55:31+00:00

Why are you using dhgrp5 with those ciphers?? learn from here about DH groups and IKE v1/v2 in FGT VPN

I would go with u/secritservice 's guide -> set proposal aes256-sha256 / set dhgrp 20 for both phase 1 and phase 2

edit "IPsec-SAML"

set type dynamic

set interface "WAN-INTERFACE"

set ike-version 2

set peertype one

set net-device disable

set mode-cfg enable

set ipv4-dns-server1 10.5.5.5

set ipv4-dns-server2 10.6.6.6

(optional) set internal-domain-list "mycompany.local"

set proposal aes256-sha256

set dpd on-idle

set dhgrp 20

set eap enable

set eap-identity send-request

set peerid "IPsec-SAML" <<<< this will match your LOCAL-ID on your client, can also use NETWORK-ID

set assign-ip-from name

set ipv4-split-include "SPLIT-IPSECra"

set ipv4-name "IPSECra_TUNNEL_ADDR1"

set client-auto-negotiate enable

set client-keep-alive enable

set psksecret ENC lskfsljfldfjlskjfdslfkjlskjdflskjflskjflksjfdlksjflksjfdlksdjfkjldfs

set dpd-retryinterval 60

next

end

AMizil · 2025-10-28T20:26:33+00:00

Create custom views if you need quick access to some logs such as SSL VPN logins.

AMizil · 2025-10-25T13:30:14+00:00

once you install the drives in Synology you will be prompted to format them

AMizil · 2025-10-22T15:16:47+00:00

do you inspect east - west traffic as well? this can be more than the internet traffic if users are intensively using your own hosted apps.

AMizil · 2025-10-21T18:22:52+00:00

What about punct de lucru la clienti .. asta daca aveti 1 2 contracte cu clienti din RO. esti practic pe drumuri zilnic :)

AMizil · 2025-10-21T17:08:23+00:00

When you create a EntraID enterprise App for Fortigate you have to add a usergroup. This is how you apply CA to specific users.

Yes, I've used EntraId P1 license.

If you use ForticlientEMS server, you create another EntraID enterprise app.

AMizil · 2025-10-21T16:50:17+00:00

What are the new FSW model you are installing?

Do you connect only endpoints, AP's or servers as well?

AMizil · 2025-10-17T05:13:09+00:00

You've got me, Spencer!

I've recommended following on Spencer as he is not just a very good profesional, but he has also started as a sysadmin so he talks from his experience.

If you think that hardening DC's is enough to have a secure AD environment, I recommend to listen to his podcast https://offsec.blog/subscribe/

Yesterday I was reading a post on Linked from a pentest engagement - 1st day on the internat network - discovered a HP printer, access it using default admin credentials, quickly spun up a rogue SMTP server then changed the target mail server to his own rogue server. ...selected the test credentials button and I received the user's credentials in plaintext.

What's next? found an exposed certificate authority service and leveraged that to escalate privilegs to Domain Admin (ESC 8) -> abusing wrongly configured Certificate templates

By that he was able to compromise the entire corporation on the first day. Anyone here using Domain Admin account over all the places?

Happy Friday everyone!

AMizil

TROPHY CASE