Background Hi folks, today, I’d like to discuss how to leverage search engines to identify vulnerable servers used by threat actors. These actors often employ multiple servers for various purposes, such as phishing infrastructure, command and control (C2) infrastructure, and tool/payload servers. …

Background Recently, my friend who works in the accounting industry has been working hard to learn how to use a tool called Alteryx. She occasionally shares her learning experience with me, even though I do not have any knowledge of the accounting industry. Through our conversations, I learned that this software…

Hey friends, it is the 3rd article in my Active Directory Theory and Exploitation series. Today, I would like to talk about 3 types of delegation. Kerberos delegation resolved Double Hop problem, however, an attacker can also abuse delegation to gain remote code execution and move to other machines. …

Hey friends, it is the second article in my Active Directory Theory and Exploitation series. Today, I would like to talk about Kerberos. Kerberos might be complex and daunting in many peoples’ opinion, but never mind, hopefully I can make it simple and easy to understand! Kerberos Authentication Kerberos is an very…

Hey folks, today I start a new series of articles to discuss Active Directory Exploitation. This is the first article, we focus on domain enumeration. …

Hi Folks, today I would like to share how did I design and build a vulnerable AD set. Before moving to this topic, let me introduce the motivation and some features of this AD set. MOTIVATION I know there are few scripts can automate the process of generating common AD misconfigurations…

Hi guys, in previous days I designed and built a difficult and complex vulnerable AD set, I planned to post the guide to reproduce it. However, maybe due to the length, I did not successfully post it on Medium, therefore I posted it on my personal website: https://www.3x3cut3-4ssemb1y.com/how-to-design-and-build-a-complex-vulnerable-ad-set/. …

Hi folks, just as I promised, I am sharing my review on eLearnSecurity’s eCPTX exam from an exam taker without purchasing course material. Yes, it is a black box test for me to pass eCPTX exam. I saw few reviews on eCPTXv2 courses and exam, but almost all of them…

Motivation of The Journey 3 months ago, I passed OSCP exam. After that, I want to dig penetration testing domain deeper , and I become more interested in Red Teaming. At that time, I considered multiple choices, such as CRTP, CRTO, OSEP, etc. I found a fantastic github repo (https://github.com/ryan412/ADLabsReview) that reviewed multiple advanced…