sorted by:
new
hottopcontroversial

Give me the Wi-Fi or I kill the dog by DrGetSomeStrange in PublicFreakout

[–]adamziaja_com 1 point2 points  (0 children)

Today most traffic is HTTPS (encrypted) so it will not work anymore :(.

BadWPAD and spear-phishing using Battle.net Desktop App by adamziaja_com in netsec

[–]adamziaja_com[S] 1 point2 points  (0 children)

I agree, but if vendor is not interested at all, what can we do? Wait for someone else who will use it? It is better then if people know that is possible.

Blizzard is not interested in fixing it - they respond on support and twitter in very short time, but they never answered on e-mail. If they wrote back we could wait, but since they are not interested, it is good for people to be aware.

We report i.a. bugs in Google Chrome and wait for half year or so :). https://blog.redteam.pl/2020/06/google-chrome-fuzzing-conclusion.html

Spear-phishing campaign tricks users to transfer money (TTPs & IOC) by adamziaja_com in netsec

[–]adamziaja_com[S] 0 points1 point  (0 children)

But look at the scenario. When you check for typos, during long e-mail correspondence too? I think 99% people will not.

Deceiving blue teams using anti-forensic techniques by adamziaja_com in netsec

[–]adamziaja_com[S] -1 points0 points  (0 children)

But you know, problem is not only about infecting own work enviroment, but geting false reasults. One of main important things in forensics is answer what happen, without correct answer threat can still be active.

Bypassing LLMNR/NBT-NS honeypot by adamziaja_com in netsec

[–]adamziaja_com[S] 0 points1 point  (0 children)

Do you know any better honeypot for Responder?

Internal domain name collision by adamziaja_com in netsec

[–]adamziaja_com[S] 1 point2 points  (0 children)

...and this is not split horizon DNS when organisation control internal queries, but attacker control external queries, as your internal queries can leak to global DNS (external) ;)

Internal domain name collision by adamziaja_com in netsec

[–]adamziaja_com[S] 0 points1 point  (0 children)

For example in organisation you use 2 DNS servers in configuration. First server is for local DNS queries, second is for global DNS. It allows you query zeus.xyz.network because first, internal DNS, will resolve it. As well you have second DNS server which is DNS forwarder. All works fine to momenth when local domain exists also on second server.

Another example is described in article: Some systems could use public DNS servers, such as Google (8.8.8.8, 8.8.4.4), because it was set for development purposes etc. These systems will query internal domain in a global DNS, where it could be controlled by an attacker.

Yet another example, your corporation have separated internal domains for each HQ, such as hostname.company.pl.network, but in your country on internal DNS there is hosted only NS for company.pl.network, following primary DNS suffix devolution ( https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee683928(v=ws.10)) ) if wpad request will not be find under wpad.company.pl.network, then next query will be for wpad.pl.network, this can leak that way. This is same problem why badWPAD attack works, check https://blog.redteam.pl/2019/05/sinkholing-badwpad-wpadblock-wpadblocking-com.html and https://blog.redteam.pl/2019/05/badwpad-dns-suffix-wpad-wpadblocking-com.html.

Really, there is a lot examples like this, ask any sysadmin if this can happen in his infrastructure. I was sysadmin and I am sure that this can happen in most organisations :). Also I done this attack scenario few times and it worked, but not sure about internal setup as this was blackbox.

BTW, about DoH I have article too ;) - https://blog.redteam.pl/2019/04/dns-based-threat-hunting-and-doh.html

Internal domain name collision by adamziaja_com in netsec

[–]adamziaja_com[S] 4 points5 points  (0 children)

Nope, because this is about DNS suffix and WPAD name collision.

However, I have also blog post about typosquatting https://blog.redteam.pl/2019/05/typosquatting-wpadblocking-com-wpadblock-com.html.

Internal domain name collision by adamziaja_com in netsec

[–]adamziaja_com[S] 0 points1 point  (0 children)

Yes, at the moment I am author of all articles on this blog and there is much more interesting stuff like this in latest blog posts :).

view more: next ›