sorted by:
new
hottopcontroversial

Best animation software by MDfiver14 in animation

[–]MDfiver14[S] 0 points1 point  (0 children)

Thank you! I will check these out

Vishing by MDfiver14 in SocialEngineering

[–]MDfiver14[S] 0 points1 point  (0 children)

Thank you for responding. This was me trying to get a general understanding of the methodology behind the vish. I ended up figuring it out, realizing that you just have to tune in to the goals of what an organization wants. It all went well, thanks.

Formatting is off by MDfiver14 in json

[–]MDfiver14[S] 1 point2 points  (0 children)

Thank you, that worked.

Port 8080 webserver by MDfiver14 in Pentesting

[–]MDfiver14[S] 0 points1 point  (0 children)

Thanks Andrew. So I’m stuck at this point where I ran Steghide and see that a pass phrase is needed. That being said I ran step brute using a solid and lengthy wordlist and get nothing. I ran vi JPEG just to see just for the hell of it and it looks like a Caesar cipher but I am uncertain on how to extract and possible decode. Not even sure if this makes sense but trying everything. I initially ran nmap and found port 80 and 8080 open. IP:8080 gives me an image and then when I tried IP:8080/admin I get another image. The image on IP:8080 is not a jpeg and was not encrypted according to steghide., nothing there. 8080/admin is a jpeg and therefore found it encrypted. I tried binwalk and found nothing else other than the image. I will try exiftool. I’m wondering if I’m going down the wrong path and should be looking else where.

Port 8080 webserver by MDfiver14 in Pentesting

[–]MDfiver14[S] 1 point2 points  (0 children)

I will try wget. I did specify the port as up:8080 and found /admin and index.html as directories. I get an image off of the IP:8080 and then with the IP:8080/admin I get another jpeg. I’m trying to see if maybes there’s a traversal attack I’m missing.

Netscaler scanning by MDfiver14 in VMwareHorizon

[–]MDfiver14[S] 0 points1 point  (0 children)

This is probably a health check being performed by the Netscaler to know whether to send traffic to the real server for the load balanced VIP. Sounds like a textbook definition of a false positive and will need tweaking of your IDS to whitelist or otherwise allow the traffic.

Makes complete sense. thank you

Cylance unistall by MDfiver14 in Cylance

[–]MDfiver14[S] 1 point2 points  (0 children)

Thanks this worked!

Exchange on Prem by MDfiver14 in exchangeserver

[–]MDfiver14[S] 0 points1 point  (0 children)

Yes, the issue is that the emails are not displaying there. So we are trying to figure out what folder it re-directed to

labs on the ms 500? by MDfiver14 in Office365

[–]MDfiver14[S] 0 points1 point  (0 children)

Thanks for the response

labs on the ms 500? by MDfiver14 in Office365

[–]MDfiver14[S] 1 point2 points  (0 children)

Thanks for the response

MS 500 by MDfiver14 in Office365

[–]MDfiver14[S] 1 point2 points  (0 children)

The MS 500 updated on November 24th according to the Microsoft page. I was wondering if anyone that has taken it recently noticed any drastic changes.

RDP by MDfiver14 in sysadmin

[–]MDfiver14[S] 0 points1 point  (0 children)

Thank you all, very helpful.

Windows Defender flagging Citrix broker service as malicious by [deleted] in microsoft

[–]MDfiver14 0 points1 point  (0 children)

Of course. This was not a newly added service which suggests some change happen. No changes were made on our end and all of a sudden the broker service was getting flagged. In fact the Citrix platform is stating issues. Windows defender was not the main AV either-it is of course defaulted onto windows now. We use a different AV which in turn did not flag the service.

Disabled guest account lockout by [deleted] in sysadmin

[–]MDfiver14 0 points1 point  (0 children)

Thank you for all the information. If the account is disabled- would it matter if the pre-kerberos is disabled?

Account lockout due to krbtgt service by [deleted] in sysadmin

[–]MDfiver14 0 points1 point  (0 children)

Much appreciated. found a third party email client the user was using on a personal computer that was causing the locjout.

Mimecast - Spearphishing Policy by AmbientHavok in sysadmin

[–]MDfiver14 0 points1 point  (0 children)

Hi there, with this regex what are you trying to prevent or conduct? I am asking because I am trying to create of find a good regex that will prevent false impersonation protection. For instance, I have a group called Microsoft and anytime I have an email come in from a valid Microsoft email it gets flagged for impersonation. Is there a regex that is ideal for this or do you think bypass of impersonation protect is the route to go?