Fosstodon

0 posts0 participants0 posts today

Will HuntTop <a href="https://infosec.exchange/tags/hashcat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashcat</a> tip:Want per-position duplication in your rules to leverage your GPU?It's not available in a single op, but you can emulate it by incrementally duplicating the first N chars, and then incrementally deleting the position and frequency of the redundant characters<a href="https://infosec.exchange/tags/password" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#password</a> <a href="https://infosec.exchange/tags/passwordcracking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#passwordcracking</a> <a href="https://infosec.exchange/tags/pentest" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pentest</a> <a href="https://infosec.exchange/tags/redteam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#redteam</a>

CycloneNew version of <a href="https://infosec.exchange/tags/hashgen" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashgen</a> published.Changelog: v1.1.0; 2025-03-19 added modes: <a href="https://infosec.exchange/tags/base58" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#base58</a>, <a href="https://infosec.exchange/tags/argon2id" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#argon2id</a>, <a href="https://infosec.exchange/tags/bcrypt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bcrypt</a> w/custom cost factor<a href="https://forum.hashpwn.net/post/89" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://forum.hashpwn.net/post/89</a><a href="https://infosec.exchange/tags/hashgenerator" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashgenerator</a> <a href="https://infosec.exchange/tags/hashcracking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashcracking</a> <a href="https://infosec.exchange/tags/hashcat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashcat</a> <a href="https://infosec.exchange/tags/hashpwn" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashpwn</a> <a href="https://infosec.exchange/tags/cyclone" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cyclone</a> <a href="https://infosec.exchange/tags/golang" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#golang</a>

NagaramSo I want to make a script that generates a whole slew of generic NTLMv2 hashes for me to try to crack with Hashcat. I'm doing NTLMv2 because it's actually relavent to my job right now and seems to be the only one I can't find a python script for.Any recs for how I can do this?<a href="https://hachyderm.io/tags/cryptography" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cryptography</a> <a href="https://hachyderm.io/tags/hashcat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashcat</a> <a href="https://hachyderm.io/tags/kali" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#kali</a> <a href="https://hachyderm.io/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a>

CycloneInstalling the official Nvidia CUDA-toolkit on linux distros can be a pain. Here's a script that automates this so you can get back to cracking hashes.<a href="https://forum.hashpwn.net/post/451" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://forum.hashpwn.net/post/451</a><a href="https://infosec.exchange/tags/nvidia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nvidia</a> <a href="https://infosec.exchange/tags/cuda" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cuda</a> <a href="https://infosec.exchange/tags/cudatoolkit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cudatoolkit</a> <a href="https://infosec.exchange/tags/hashpwn" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashpwn</a> <a href="https://infosec.exchange/tags/hashcracking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashcracking</a> <a href="https://infosec.exchange/tags/cyclone" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cyclone</a> <a href="https://infosec.exchange/tags/hashcat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashcat</a>

CycloneAfter seeing yescrypt hashes appear in CMIYC a while back, I started developing a yescrypt cracker in pure Go. Since then, yescrypt has become the default /etc/shadow hash for many popular linux distros such as Debian, Ubuntu, RHEL, Fedora, and Arch (to name a few), but hash cracking support for this algo has been limited to JtR -- until now.Here's a sneak peek of the yescrypt_cracker POC: <a href="https://forum.hashpwn.net/post/446" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://forum.hashpwn.net/post/446</a><a href="https://infosec.exchange/tags/yescrypt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#yescrypt</a> <a href="https://infosec.exchange/tags/hashcracking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashcracking</a> <a href="https://infosec.exchange/tags/cyclone" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cyclone</a> <a href="https://infosec.exchange/tags/hashpwn" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashpwn</a> <a href="https://infosec.exchange/tags/hashcat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashcat</a> <a href="https://infosec.exchange/tags/cmiyc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cmiyc</a> <a href="https://infosec.exchange/tags/jtr" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#jtr</a> <a href="https://infosec.exchange/tags/johntheripper" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#johntheripper</a> <a href="https://infosec.exchange/tags/golang" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#golang</a>

Royce WilliamsGood breakdown from Elcomsoft on 5090 relevance to password cracking.tl;dr better in theory, not yet in practice (perf/$). Not yet sure if driver or hashcat improvements could eventually take better advantage of new hardware features, though.<a href="https://blog.elcomsoft.com/2025/02/nvidia-blackwell-is-out-should-you-upgrade/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://blog.elcomsoft.com/2025/02/nvidia-blackwell-is-out-should-you-upgrade/</a><a href="https://infosec.exchange/tags/hashcat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashcat</a>

Royce WilliamsThe hashcat.net site is down -- side effect of maintenance by hosting provider. Being worked. [Edit: back up a week later]Current release (GitHub): <a href="https://github.com/hashcat/hashcat/releases/tag/v6.2.6" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/hashcat/hashcat/releases/tag/v6.2.6</a>Convenience Wayback links:Main page: <a href="https://web.archive.org/web/20250211000850/hashcat.net/hashcat/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://web.archive.org/web/20250211000850/hashcat.net/hashcat/</a>Rules: <a href="https://web.archive.org/web/20250211234251/https://hashcat.net/wiki/doku.php?id=rule_based_attack" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://web.archive.org/web/20250211234251/https://hashcat.net/wiki/doku.php?id=rule_based_attack</a>Example hashes : <a href="https://web.archive.org/web/20250216060927/https://hashcat.net/wiki/doku.php?id=example_hashes" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://web.archive.org/web/20250216060927/https://hashcat.net/wiki/doku.php?id=example_hashes</a>FAQ: <a href="https://web.archive.org/web/20250219024304/https://hashcat.net/wiki/doku.php?id=frequently_asked_questions" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://web.archive.org/web/20250219024304/https://hashcat.net/wiki/doku.php?id=frequently_asked_questions</a>Recent beta: <a href="https://web.archive.org/web/20250130114639/https://hashcat.net/beta/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://web.archive.org/web/20250130114639/https://hashcat.net/beta/</a><a href="https://infosec.exchange/@hashcat" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@hashcat</a> <a href="https://infosec.exchange/tags/hashcat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashcat</a>

Royce WilliamsDid you know that Gitea uses pbkdf2 hashes, but they have to be converted for hashcat to crack them? Hashcat's own unix-ninja has written a tool for that!<a href="https://www.unix-ninja.com/p/cracking_giteas_pbkdf2_password_hashes" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.unix-ninja.com/p/cracking_giteas_pbkdf2_password_hashes</a><a href="https://infosec.exchange/tags/hashcat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashcat</a>

Royce WilliamsGreat coverage by Jan Doskočil of NSEC3 hash enumeration, and cracking with hashcat. Also good info about the limits of making that harder (some resolvers cap the work factor they will resolve!)<a href="https://infosec.exchange/@jpmens@mastodon.social/114019491327504188" translate="no" rel="nofollow noopener noreferrer" target="_blank">https://infosec.exchange/@jpmens@mastodon.social/114019491327504188</a>Via <a href="https://mastodon.social/@jpmens" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@jpmens</a> <a href="https://infosec.exchange/tags/DNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNS</a> <a href="https://infosec.exchange/tags/NSEC3" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NSEC3</a> <a href="https://infosec.exchange/tags/hashcat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashcat</a>

alip<a href="https://mastodon.online/tags/sydbox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sydbox</a> 3.32.0 is released! We now officially support <a href="https://mastodon.online/tags/GPU" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GPU</a> access for <a href="https://mastodon.online/tags/ROCm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ROCm</a> and <a href="https://mastodon.online/tags/nVIDIA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nVIDIA</a>! See the release mail here: <a href="https://is.gd/kN1rUt" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://is.gd/kN1rUt</a> and here is a profile auto-generated by <a href="https://mastodon.online/tags/pandora" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pandora</a> for <a href="https://mastodon.online/tags/hashcat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashcat</a> accessing an <a href="https://mastodon.online/tags/nVIDIA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nVIDIA</a> <a href="https://mastodon.online/tags/GPU" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GPU</a> using <a href="https://mastodon.online/tags/cuda" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cuda</a> libraries: <a href="https://dpaste.com/6DQ97T2DM" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://dpaste.com/6DQ97T2DM</a> <a href="https://mastodon.online/tags/exherbo" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#exherbo</a> <a href="https://mastodon.online/tags/linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#linux</a> <a href="https://mastodon.online/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a>

sekurak NewsŁamanie haseł szybsze o 35%. Wyniki najnowszej karty NVIDIA RTX 5090.Właśnie pojawił się benchmark pokazujący szybkość najnowszego flagowca od NVIDII – RTX 5090 FE. Całość oczywiście w kontekście flagowego ;) narzędzia do odzyskiwania/łamania haseł – hashcata. Przykładowe porównania z RTX 4090: Zapewne jeszcze czekają nas aktualizacje sterowników, co wpłynie na szybkość działania hashcata. Czy te szybkości wpływają na obecne rekomendacje...<a href="https://mastodon.com.pl/tags/WBiegu" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WBiegu</a> #5090 <a href="https://mastodon.com.pl/tags/Awareness" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Awareness</a> <a href="https://mastodon.com.pl/tags/Hashcat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Hashcat</a> <a href="https://mastodon.com.pl/tags/Has%C5%82a" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Hasła</a> <a href="https://mastodon.com.pl/tags/Nvidia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Nvidia</a><a href="https://sekurak.pl/lamanie-hasel-szybsze-o-35-wyniki-najnowszej-karty-nvidia-rtx-5090/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://sekurak.pl/lamanie-hasel-szybsze-o-35-wyniki-najnowszej-karty-nvidia-rtx-5090/</a>

CycloneNvidia RTX 5090 hashcat benchmarks.<a href="https://forum.hashpwn.net/post/391" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://forum.hashpwn.net/post/391</a><a href="https://infosec.exchange/tags/hashcat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashcat</a> <a href="https://infosec.exchange/tags/nvidia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nvidia</a> <a href="https://infosec.exchange/tags/rtx5090" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#rtx5090</a> <a href="https://infosec.exchange/tags/hashcracking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashcracking</a> <a href="https://infosec.exchange/tags/hashpwn" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashpwn</a>

Aaron Toponce ⚛️:debian:Do we have any updated <a href="https://fosstodon.org/tags/password" class="mention hashtag" rel="tag">#password</a> cracking benchmarks with <a href="https://fosstodon.org/tags/Hashcat" class="mention hashtag" rel="tag">#Hashcat</a> on the new NVIDIA RTX 5000-series GPUs?<a href="https://fosstodon.org/tags/passwords" class="mention hashtag" rel="tag">#passwords</a>Ping: <a href="https://infosec.exchange/@tychotithonus" class="u-url mention">@tychotithonus</a>

patpro1236 emails envoyés à autant d’utilisateurisses dont j’ai pu casser le mot de passe lors d’un audit. Si tout se passe bien, demain j’aurais de la lecture.<a href="https://mastodon.green/tags/hashcat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashcat</a> <a href="https://mastodon.green/tags/JohnTheRipper" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#JohnTheRipper</a> <a href="https://mastodon.green/tags/motdepasse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#motdepasse</a> <a href="https://mastodon.green/tags/RSSI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RSSI</a>

Erik van Straten<a href="https://social.bau-ha.us/@CCC" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@CCC</a> : aus dem Artikel:"Ein einfacher Satz wie „IchLiebeEsGegenFaschistenZuDemonstrieren!“ ist sicherer als „Mb2.r5oHf-0t“. Lange Sätze sind leicht zu merken und zu tippen, aber schwer zu knacken." 🚨 Das ist FALSCH. 🚨Wenn einmal in einem "Dictionary" (Worterbuch), wie z.b. "Rockyou" [1] macht die länge nichts aus.[1] Z.b. <a href="https://dekisoft.com/rockyou-txt-gz-password-list-download/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://dekisoft.com/rockyou-txt-gz-password-list-download/</a>Am sichersten braucht man eine Password Manager mit einem random generierties Passwort für jedem Account.Mehr info (Englisch): <a href="https://infosec.exchange/@ErikvanStraten/113022180851761038" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://infosec.exchange/@ErikvanStraten/113022180851761038</a>; mit Android Screenshot: <a href="https://infosec.exchange/@ErikvanStraten/113549056619471557" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://infosec.exchange/@ErikvanStraten/113549056619471557</a>.Passkeys sind leider noch ungeignet: <a href="https://infosec.exchange/@ErikvanStraten/113832302818012852" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://infosec.exchange/@ErikvanStraten/113832302818012852</a>.Password "cracking" mit hashcat und NVidia Video-Karte: <a href="https://gist.github.com/ZephrFish/b849331aafa015ddd7786ca20ce718d7" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://gist.github.com/ZephrFish/b849331aafa015ddd7786ca20ce718d7</a>.Edit 17:25: beispiele aus RockYou2021.txt (~90MB) in <a href="https://infosec.exchange/@ErikvanStraten/113923644127405769" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://infosec.exchange/@ErikvanStraten/113923644127405769</a>.(Verzeihe Fälle-Fehler, ein Holländer hier).<a href="https://infosec.exchange/tags/Passwords" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Passwords</a> <a href="https://infosec.exchange/tags/Passwoerter" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Passwoerter</a> <a href="https://infosec.exchange/tags/Rockyou" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Rockyou</a> <a href="https://infosec.exchange/tags/hashcat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashcat</a>

Cyclone🚀 New Release: crackmon v0.2.0Details: Hashcat wrapper for bypassing current session if crack rate falls below threshold.<a href="https://forum.hashpwn.net/post/79" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://forum.hashpwn.net/post/79</a><a href="https://infosec.exchange/tags/crackmon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#crackmon</a> <a href="https://infosec.exchange/tags/hashcat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashcat</a> <a href="https://infosec.exchange/tags/hashpwn" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashpwn</a> <a href="https://infosec.exchange/tags/hashcracking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashcracking</a> <a href="https://infosec.exchange/tags/cyclone" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cyclone</a> <a href="https://infosec.exchange/tags/golang" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#golang</a>

Angerman 🦅While I am at it anyway; <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Phishing</a> meets <a href="https://infosec.exchange/tags/SMB" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SMB</a>: Exploiting network trust to capture <a href="https://infosec.exchange/tags/NTLM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NTLM</a> hashes (<a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pentesting</a> fun)One effective phishing method leverages SMB connections to capture <a href="https://infosec.exchange/tags/NetNTLM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NetNTLM</a> hashes for offline <a href="https://infosec.exchange/tags/cracking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cracking</a>, providing attackers with credentials for the next phase (for example social engineering or other tech attacks). Oh; BIT B.V. (bit.nl) did send my a set of abuse mails, … sorry 😆 … but very nice and thx 🙏🏼, anyway;Exploit Path: Initial Phishing Vector: The attack starts with a phishing email or download website or something something, containing a payload (e.g., a malicious document or shortcut file, whatever, choose your poison). The payload initiates an SMB request to the attacker-controlled server (`\\<C2IP>\share`), tricking the victim’s system into authenticating with it. Modern browsers like edge won’t fly; you need to get a bit more creative to execute this and no it’s not a hyperlink. Think Java. Or macro (although; meh). Then we have SMB Request Redirection: Tools like Responder on the attacker’s C2 server capture NetNTLMv2 hashes during these authentication attempts. This works over IPv4 and IPv6, with IPv6 often prioritized in networks and less monitored. Hence <a href="https://infosec.exchange/tags/mitm6" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mitm6</a>. But that’s another story. Captured hashes are cracked offline using tools like <a href="https://infosec.exchange/tags/Hashcat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Hashcat</a>, potentially giving credentials for further attacks. It’s also an excuse for my new RTX 5090 card. 😉Observations from recent penetration tests where I executed this attack; -Firewall Rules: not excisting … at all. 🥹 Many environments have outbound 'any-any' rules on firewalls, even on critical nets like Citrix farms. This unrestricted outbound traffic allows SMB authentication requests to reach attacker-controlled servers on the internet. And there is something with remote workers and open internet access lately… -<a href="https://infosec.exchange/tags/Azure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Azure</a> and <a href="https://infosec.exchange/tags/2FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2FA</a> Gaps, here we go again (see <a href="https://lnkd.in/g2ctMEDG" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://lnkd.in/g2ctMEDG</a>); 2FA exclusions are another common issue: - Trusted locations (e.g., `192.168.x.x` or specific IP ranges) configured to bypass 2FA/MFA.. intended to improve usability, such exclusions can be exploited once an attacker gains access to these "trusted" locations; simply put a VM inside a 192.168 range and chances are…. Good. These misconfigurations reduce the effectiveness of otherwise robust security measures like MFA and firewall segmentation, giving attackers unnecessary opportunities.The Takeaway: Attackers thrive on overlooked gaps in configuration. Whether it's outbound "any-any" firewall rules or MFA bypasses for trusted locations, these lapses provide unnecessary pathways for compromise. By combining phishing, SMB exploitation, and tools like Responder, we can target foundational weaknesses in even hybrid environments. I’ve seen soc’s only respond after mission target; because most are monitoring just on the endpoint (EDR/XDR), poorly.<a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Phishing</a> <a href="https://infosec.exchange/tags/SMB" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SMB</a> <a href="https://infosec.exchange/tags/NTLM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NTLM</a> <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MFA</a> <a href="https://infosec.exchange/tags/FirewallSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FirewallSecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> The meme is absolutely intended as shitposting. Sorry 🤣

patproLes yeux plus gros que le ventre.<a href="https://mastodon.green/tags/hashcat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashcat</a> <a href="https://mastodon.green/tags/motdepasseoublie" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#motdepasseoublie</a>

totoMit <a href="https://fosstodon.org/@chriseth" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@chriseth</a> die <a href="https://chaos.social/@winkekatze" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@winkekatze</a> <a href="https://social.mrtoto.net/tags/TelnetKlartextReden" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TelnetKlartextReden</a> challenge erfolgreich geschafft zum Ende des Tag 3. Und das M4 MBP mal ein bisschen mit <a href="https://social.mrtoto.net/tags/hashcat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashcat</a> schwitzen lassen 🐱<a href="https://chaos.social/@winkekatze/113739483146611341" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://chaos.social/@winkekatze/113739483146611341</a>

Royce WilliamsFor folks (kindly) reporting that the hashcat.net cert has expired - apologies, and it's been escalated (no ETA yet, though)<a href="https://infosec.exchange/tags/hashcat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hashcat</a>

Recent searches

Search options

Administered by:

Server stats:

#hashcat