LEARNING OSCP: Day #12 Active Directory Tips: 1. Use LLMNR poisoning for SSRF exploitation 2. Search for service accounts with ldapsearch and bloodhound 3. If a domain is being hit by the target, use updateDNS scripts with domain account access and setup LLMNR #oscp #infosec

4. If you get a user list, try AS-REP roasting with GetNPUsers 5. If port 88 open, obtain SPN account tickets with GetUserSPNs and crack them 6. If an account is allowed to delegate control to domain (AllowToDelegate), request service tickets with impersonate (admin) and psexec

@techhacker98 Fyi, LLMNR poisoning (like all spoofing attacks) is explicitly disallowed in the OffSec lab environment and exam

@techhacker98 Do u have activedirectory resources am finding it very tough to learn

@techhacker98 @SaveToNotion #tweet #sec #oscp

@techhacker98 @SaveToNotion #Thread #OSCP

@techhacker98 Plz reply to my dm wanna ask smthng important

@techhacker98 @SaveToNotion #thread #OSCP

@techhacker98 @SaveToNotion #Thread #OSCP

@techhacker98 There is no SSRF exploitation in the oscp at all ..

@techhacker98 @SaveToNotion #Thread #OSCP