2 ай бұрын
2 ай бұрын
3 ай бұрын
3 ай бұрын
4 ай бұрын
7 ай бұрын
8 ай бұрын
9 ай бұрын
10 ай бұрын
Жыл бұрын
Жыл бұрын
Жыл бұрын
Пікірлер
@void6918 4 күн бұрын
Hi! I really need some help with this concept can you DM me?
@ndog315 18 күн бұрын
Sir, I do appreciate you and your content. I was able to use this on a recent engagement and it worked flawlessly. Sidenote for anyone who stumbles across this comment: Don't forget to check disk space and RAM size before you take a memory dump. Would hate to overfill a C drive on a production server 😂 Get-CimInstance Win32_PhysicalMemory | Measure-Object -Property Capacity -Sum | Select-Object Sum).Sum / 1GB Get-PSDrive C
@OLKdesigns 22 күн бұрын
Thanks for sharing. Unfortunately I’m stuck at the ./setup.sh part of the tutorial, for unknown reasons mine won’t begin the installation process instead is reposts the setup.sh list. Can you please advise. Thank you.
@CyberAttackDefense 22 күн бұрын
My advice is to move to the supported version of gophish released by Kuba Gretsky. Evilgophish doesn’t work as well and puts everything on one system.
@hodgesrebecca1068 23 күн бұрын
I really enjoyed your video, and you've just gained another subscriber! I have a quick question about the AZON EC2. Could you please explain more about how you set up all the prerequisites for the simulation test, such as how to configure the API keys? Thank you so much.
@CyberAttackDefense 22 күн бұрын
Simple I had two Ubuntu instances running in EC2. Both with certificates registered using let’s encrypt. One instance hosted gophish and the other hosted evilginx3. The api key and url of gophish are added to the evilginx configuration and gophish is setup to forward email through amazon SES.
@issacpenke5456 24 күн бұрын
could u please provide some working phislets in 2024 and also create a video on how to create own custom phislets ,btw best content
@cvport8155 28 күн бұрын
Amazing work 👏 Please add time line ❤
@CyberAttackDefense 27 күн бұрын
Added a timeline. Thanks for watching
@StartNight-df3sv Ай бұрын
Really shame on Defender, how idiot it is to flag when seeing base64 like key words. These guys doesn't know smart way of detecting threats. That's why playing safe game by arresting keys words on exe
@StartNight-df3sv Ай бұрын
All antivirus especially Windows Defender are super mad. Sadist... Never be happy.
@SzaboB33 Ай бұрын
What other attacks are possible, if the machine account quota is set too high?
@CyberAttackDefense Ай бұрын
This is probably one of the only ones that abuses the machine account quota. Many orgs now disable the ability for standard users to join the domain due to Kerberos delegation and relaying. If anyone else knows let me know what attacks can abuse this.
@ferassami3362 Ай бұрын
Hi and thanks for the content I have question If template called User Allowing users to enroll and it has client authentication but the user cant specify the san or upn , is it exploitable ? And if yes , how to do that
@CyberAttackDefense Ай бұрын
It’s not exploitable if the user can’t specify those values.
@guangjue Ай бұрын
is evilgophish run in kali linux ?
@CyberAttackDefense Ай бұрын
It can run in Kali
@autohmae 2 ай бұрын
Not my field of expertise normally, but just encoding and using eval or equivalent would by pass your check...? Edit: ahh, of course, you are checking for eval-like keywords as well.
@CyberAttackDefense 2 ай бұрын
Good question! Any rule I would use in practice would be much more robust in looking for encoding evaluation statements and the like. The good thing is first pass on many forms of encoding is done by windows. Nothing substitutes dynamic analysis with breakpoints though.
@autohmae 2 ай бұрын
@@CyberAttackDefense just implement a custom encoding, that's pretty common.
@BestITintelligence 2 ай бұрын
Good topic for all merci
@AbelSheferaw 2 ай бұрын
Another great content! Your hard work and creativity really shine through. Keep up the awesome work!
@nyshone 2 ай бұрын
Does it affect different EDR vendors by chance?
@CyberAttackDefense 2 ай бұрын
It should work against many EDR vendors. You would need to test your specific vendor. I did test against some of the bigger ones and it worked.
@tebo2286 2 ай бұрын
Another awesome presentation. Thank you for sharing
@CyberAttackDefense 2 ай бұрын
Thanks for watching!
@Kingdd1os 2 ай бұрын
❤
@ohmsohmsohms 2 ай бұрын
Let’s get it another cyber attack&defense vid
@UmerFarooq-hl9hh 2 ай бұрын
Respect from Pakistan
@UmerFarooq-hl9hh 2 ай бұрын
Man no words. So simple and next level . I look forward to your company and courses on red teaming for beginner
@AbelSheferaw 2 ай бұрын
I was trying to open an account of atera to give it a try. But there are a lot of verification I have to go through. They have to interview me to get an account. This is too much. Is there any alternative you can refer me to?
@dansardinha 2 ай бұрын
What if you dont get the ticket option? Just detect the event id and the cipher code?
@CyberAttackDefense 2 ай бұрын
There is no other way to accurately detect this without the ticket option. If your AES you can look for the cipher code and event id only but if you have rc4 then you need the option.
@AbelSheferaw 2 ай бұрын
Off-topic question: As a pentester wanna be, where do I find exploits before they die. Like before they are 2 years old and works no more. We want more videos on exploits. And thanks for the amazing contents you provide us for free.
@CyberAttackDefense 2 ай бұрын
The true answer is you write them yourself. I know that sounds insane but it’s not that hard once you know how to exploit an application.
@KATEMPAALEXIS 2 ай бұрын
Amazing tricks
@taba303 2 ай бұрын
How do I open the console at minute 6:04? pls
@taba303 2 ай бұрын
@CyberAttackDefense
@twalalyclassic5538 2 ай бұрын
This is awesome! Thank you very much. I keep learning new things from you, buddy
@CyberAttackDefense 2 ай бұрын
You’re welcome. As always the more you share the more I can make!
@NicoleAbraham-v9l 2 ай бұрын
how do i set prefilled user email variable through the lure link and will be prefilled on the login page
@Michael-ok1fe 2 ай бұрын
Anyone have luck creating specific KQL queries for detecting these?
@NicoleAbraham-v9l 2 ай бұрын
How do i keep the evilgophish to persist on screen, i mean i want the gophish and evilginx to run simultanously why i exit my ssh session.
@CyberAttackDefense 2 ай бұрын
You can use screens or background gophish
@adeniranjamiu8417 2 ай бұрын
Have been looking for such this nice video, bro.. kudos to your talent and am having problems showing on evilginx2 after I run this command ./build/evilginx -p ./phishlets/ and it showing certdb: tls: private key does not match public key, could you help on this such case please.
@NicoleAbraham-v9l 2 ай бұрын
just watching this amazing video, what happens if i can't find the gophish binary in the directory. how do i resolve this
@CyberAttackDefense 2 ай бұрын
That means it didn't compile. Try go build
@MrVik24 2 ай бұрын
I don't understand why numbers of viewers is so low? Thank you for sharing
@CyberAttackDefense 2 ай бұрын
Thanks! Share and maybe the numbers will go up!
@MrVik24 2 ай бұрын
@@CyberAttackDefense Yes sirrrr!
@MrVik24 2 ай бұрын
Great video! Thank you
@CyberAttackDefense 2 ай бұрын
Glad you liked it!
@0uss4m4 2 ай бұрын
I love how you simplify stuff !! thanks a lot for this
@richardghani5458 2 ай бұрын
Hi subscriber hereh. We want a video on how we can set up elastic and configure sysmon on all our windows hosts and servers.
@CyberAttackDefense 2 ай бұрын
Ok I might add that to the lineup.
@harshil. 3 ай бұрын
Really nifty usage of dev tunnels another great vid!
@TalbertHoule 3 ай бұрын
If someone has a L7 firewall rule between the compromised host and the file server will that deep packet inspection be able to block the attack?
@CyberAttackDefense 3 ай бұрын
The deep packet inspection would only work if it is designed to stop files being added via an admin share. Given that it’s a file server though odds are that it wouldn’t differentiate between an admin share and a standard share. So the typical consultant answer of it depends :).
@tebo2286 3 ай бұрын
Awesome series, thank you for sharing
@CyberAttackDefense 3 ай бұрын
Thanks for watching! Tell your friends!
@tebo2286 2 ай бұрын
@@CyberAttackDefense I shall do so
@局外祥神浪跡天涯 3 ай бұрын
I love this series of video! They're just too great. Thanks!
@BEAST4LIF3 3 ай бұрын
Lol sophos doesnt alert on default smbexec……..
@CyberAttackDefense 3 ай бұрын
There is always one EDR that lets things go.
@DJ-Riggz 3 ай бұрын
My main problem is invisibility cloak only supports one project file, but i only have one solution file on the outside so individually doing the folders doesn't work either. i get this error normally [*] INFO: Generating new GUID for C# project [*] INFO: New project GUID is bb1ce2d5-e8ab-44fc-92ef-15754b1a870f [-] ERROR: Currently this tool only supports having one C# project file to modify. The project directory you provided has 4. or when trying each folder separately. Traceback (most recent call last): File "C:\Users\Riley\Desktop\Personal\RedTeam\Obfuscation\InvisibilityCloak.py", line 542, in <module> main(theObfMethod, theDirectory, theName) File "C:\Users\Riley\Desktop\Personal\RedTeam\Obfuscation\InvisibilityCloak.py", line 497, in main replaceGUIDAndToolName(theDirectory, theName) File "C:\Users\Riley\Desktop\Personal\RedTeam\Obfuscation\InvisibilityCloak.py", line 96, in replaceGUIDAndToolName copyfile(slnFile, slnFile + "_copy") File "C:\Users\Riley\AppData\Local\Programs\Python\Python312\Lib\shutil.py", line 260, in copyfile with open(src, 'rb') as fsrc: ^^^^^^^^^^^^^^^ FileNotFoundError: [Errno 2] No such file or directory: '' How can I get around this? And its sad I noticed on the invisibility git hub they mentioned adding support for this but it hasn't been updated in 2 years.
@YTAnimation52 3 ай бұрын
You rlly saved me a lot of trouble with this one!
@UsamaAli-kr2cw 3 ай бұрын
MindBlowing Content as always. Only thing is bothering me that memory dump size can be huge if our target systems are windows servers so how we will be able to exfiltrate that huge file without detection and evading dlp?
@CyberAttackDefense 3 ай бұрын
That’s the catch with this technique. Now if your rules of engagement allow software installation. You could cut it up with memprocfs on box and exfil just the minidump.
@UsamaAli-kr2cw 3 ай бұрын
@@CyberAttackDefense Cool. thanksalot sir ❤️❤️❤️❤️
@ohmsohmsohms 3 ай бұрын
Thank you a bunch for this series, im a newb when it comes to red teaming and you've been helping a bunch on my journey, will edit the comment after i've watched :D Loved the video. Very interesting version of memprocfs, I used the tool once and had to resort to the pypykatz module. Since you showed it's possible I will try to tweak it!
@CyberAttackDefense 3 ай бұрын
Glad you enjoyed it. Thanks for watching!
@BEAST4LIF3 3 ай бұрын
Do you happen to have a way for winpmem to be able to write to a remote location? Also why you gotta flex the custom memprocfs like that..... Sending me on a mission this weekend.
@CyberAttackDefense 3 ай бұрын
I don't have a way to do this specifically however using any ram capture works. Velociraptor or remote forensics collection utilities can collect ram remotely.
@BEAST4LIF3 3 ай бұрын
@@CyberAttackDefense makes sense thank you!
@harshil. 3 ай бұрын
Love this series!
@CyberAttackDefense 3 ай бұрын
Thanks! I think these techniques aren't emulated enough by Red/Purple Teams so I want to make sure people know they exist.
@alexanderdell2623 3 ай бұрын
Would be really nice from your side if you are stop promoting memprocfs since author is really against of it use in any kind of redteam activity and he explained why in he's discord
@alexanderdell2623 3 ай бұрын
He putted so much effort to make this tool and he did it for free Mostly for forensics and game hacking, not burning it l just as another "hacktool"
@rongabay6598 3 ай бұрын
Always have the best content
@CyberAttackDefense 3 ай бұрын
Thanks! Spread the word! The more people that watch the more I can make.
@b1U3b0i 3 ай бұрын
Correct me if I am wrong but this is not gonna work in win11 - the MOTW bypass ;)
@CyberAttackDefense 3 ай бұрын
You can find MOTW bypasses that work on 11. I haven’t tested isos on win11.