Jared Haight jaredhaight

Most OST development is focused on novel tricks, or the latest attack vector, a constant escalation of capabilities. Developing a novel technique is done in a vacuum and if the developer does spend any time researching and documenting detection around a technique, expanding the detection to a network of more than a 100 endpoints is typically a non-trivial task.

Developing mature detection and response capabilties in an organization is a monumental effort, it's not a big surprise that most organizations struggle to catch "boring" attacker techniques (creating scheduled tasks, adding local users to computers, modifyig groups, etc) and while these organzations struggle to keep up, the barier to entry on being an "advanced" attacker gets lower and lower as new tools and techniques come out.

It's easy to take the approach that these organizations that are struggling with infosec get whats coming to them. "Well, maybe they should take infosec seriously if they don't want to get hacked" or "The attacker could ha

I had the pleasure of meeting Ayan through the Share the Mic in Cyber campaign. Talking to her was an absolute blast and super humbling (a rare combination!), she's accomplished so much and still manages to get some sleep. Below are the tweets that we shared through my Twitter account. I wanted to collect them here cause it'd be a horrible shame if they just got lost in the timeline.

1/ Follow this thread as we highlight @ayanmislam as part of the #ShareTheMicInCyber campaign. I am proud to give this talented #cybersecurity practitioner the spotlight. #BlackNatSec #BlackTechTwitter https://sharethemicincyber.splashthat.com/

2/ Meet @ayanmislam, an incredibly talented cyber/infosec practitioner you should all know! A Somali native, who grew up in Kuwait and immigrated to the U.S. in pursuit of stability and the American Dream.

3/ As an avid learner, she certainly leverages her education to benefit every community she participates in. She has a @KogodBiz business degree, @G

I think there’s a couple fronts that make a good red teamer. The technical side of being operator is less about knowing how to use tools (that’s easy to teach) and more about knowing how the technologies you’re attacking works. Having an understanding of how things work at a company gives you the context of how to attack and abuse it.

For example the stronger your sysadmin skills, the better you’re going to be at moving through an enterprise. Stuff like knowing how group policies work, having a solid understanding of AD. It’s all about having that context so you know how to abuse it. Having a development background gives you the context of how to abuse CI/CD systems and such. Knowing how kubernetes, how cloud works, gives you context on how to maneuver around it. Honestly, I don’t think I’ve used a single exploit in red teaming (which probably means I’ve left stuff on the table and made life harder for myself lol), it’s all been about finding and abusing misconfigurations in environments.

I think in a tru

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

	query allAgents {
	agents {
	id
	hostname
	visible
	agent_type {
	name
	id
	}
	transport {

	using System;
	using System.Diagnostics;
	using System.Runtime.InteropServices;

	namespace BlockDllTest
	{
	class Program
	{
	static void Main(string[] args)
	{

	function Split-String {
	param (
	[Parameter(Mandatory = $true)]
	[string]$String,
	[int]$MinLength = 50,
	[int]$MaxLength = 120,
	[string]$VariableName = "data",
	[ValidateSet("PowerShell", "CSharp")]
	$Format = "PowerShell"
	)

	# Stolen from here: https://social.technet.microsoft.com/Forums/en-US/bad2dbb1-5deb-48b8-8f8c-45e2b353dba0/how-do-i-get-video-file-duration-in-powershell-script?forum=winserverpowershell#de6ee12a-1c1e-474f-b5ba-ece4b17e0144

	function Get-VideoLength {
	param (
	$Path
	)

	if (-not $Path) {
	$Path = (Get-Location).Path
	}

	using System;
	using System.IO;
	using System.Text;
	using System.IO.Compression;
	using System.EnterpriseServices;
	using System.Collections.Generic;
	using System.Runtime.InteropServices;
	using System.Security.Cryptography;

	/*

	#!/bin/bash
	#
	# DESCRIPTION:
	#
	# Set the bash prompt according to:
	# * the active virtualenv
	# * the branch/status of the current git repository
	# * the return value of the previous command
	# * the fact you just came from Windows and are used to having newlines in
	# your prompts.