Didn't see much noise around this, but is IP rotation through AWS API Gateway now being detected and blocked?
I never had an issue with Fireprox before, but I'm definitely hitting some walls now.
This might be why Flareprox and OmniProx were released in the past few months.
The @NorthSec_io CTF always has its fair share of physical challenges!
Here's how we completed the NFC challenge of the vending machine: https://t.co/dzd1q6uoSL
How's your M365 password spraying game in 2024 ?
On my side, it's harder than ever.
For instance, after 6 rounds each 6 hours apart, starting to lock out accounts more and more each round, to the point where impact is noticeable.
Rounds performed using the great #TeamFiltration
Getting back into bug bounty.
Is the HackerOne CTF for private invites still a thing ? I haven't receive anything for days, which seems different from a few years ago
#bugbounty#hackerone
@ShitSecure Great article, thanks!
I'm currently hosting different versions of my phishing page with different entropy levels and obfuscators, including a custom one as you recommend.
Good results so far, but TrustWave appears to be the most thorough regarding the entropy. @OffenseTeacher
I fail to see how subdomain takeover could still work for https://t.co/QJ9M5AQNbY. Validation through asuid prevents the Custom Domain from being configured, hence it should block the attack. Does it not ?
Almost done with RTO course and I learned a lot, it is very complete and up-to-date.
However, one *key* material is not covered... Which MX switches is @_RastaMouse using ! We hear them in the background during the demo videos, I'm loving the sound.
Hard to break good old habits, I'm still using the deprecated tool Aquatone for subdomain web flyover.
Any suggestions for a replacement ? I especially liked Aquatone's grouping feature for similar-looking pages.
I hadn't written a writeup in a while, here is mine for the NorthSec 2022 internal network track. Props to @davidlebr1 for creating a great challenge!
https://t.co/c0wpLGiqJV
@mpgn_x64 I just got what you meant. Your uncracked NT hashes are the wordlist for hashcat -m 27100 on your captured NetNTLMv2 hashes.
Althought performance is not optimal, it would still be a good idea to run it without a rulefile and with uncracked NT hashes.
Nice find!
@mpgn_x64 I meant, I am not able to crack 5600 hashes with 27100 even thought it looks like the exact same format.
How would you find hashes that could be cracked with 27100 ?