I rarely use Mimikatz for more than parsing memory dumps of lsass.exe taken with procdump64.exe. I’m just not going to risk running Mimikatz from CrackMapExec or uploading Mimikatz to the client’s environment when I can bypass antivirus by using wmiexec.py from Impacket to upload procdump64.exe, run the command to make a dump file from lsass.exe, and download it to be processed offline using Mimikatz on a system that I control. If this sounds like a lot of extra steps, it is. This post is about using a Python3 library to save yourself some work when processing those lsass.exe dump file to get credentials.

While testing web applications, I monitor the application using Wireshark to see if the app is using a protocol that lacks support in Burp Suite, like HTTP2. This post shows how to decrypt TLS traffic in Wireshark on Kali Linux.

One of the prerequisites for using jackit with a CrazyRadio PA USB dongle is first flashing it using mousejack. This has always been problematic when using VMware. I was getting the error “The connection for the USB device ‘Nordic ASA nRF24LU1P-F32 BOOT LDR’ was unsuccessful.” which looked like a VMware dialog, not a dialog generated by the virtual machine (Kali Linux).

I tried to install PowerShell on Kali Linux Rolling by following instructions on the GitHub page as well as other articles I found online and none of them worked. I’m going to tell you what worked for me.

Sure there are already some pretty good security tools that can pull off ARP spoofing: Ettercap, Bettercap, etc. This post details what I learned when I wanted to do it myself using Scapy, in the hopes that I can help someone else who’s also trying to learn how to use Scapy. After a while you get tired of using other people’s tools and want to learn how to do it yourself, even if you’re just creating yet another tool to do ‘X’, at least you’re learning something new.

Sometimes you may want to manually establish TCP 3-way handshakes when you’re using Python Scapy, but wouldn’t it be nice to use sockets to maintain the TCP handshake and pass the data to/from Scapy? If you don’t really care about the TCP handshake and want that taken care of while you fuzz the data, here’s an easy way using a StreamSocket with Scapy:

I frequently use the Intruder tab in Burp Suite Pro to password spray websites which use Active Directory authentication. One of the problems of using Burp Suite is that there doesn’t seem to be a way to avoid lockout when using a long password list. Frequently I don’t get a hit on valid password on the first try with Season/Year stuff like “Winter2018!” and need to run through a list of 51 common AD passwords that I have in a file. Sure, I can paste in a list of three or four passwords (depending on my client’s lockout policy), but then I have to wait X minutes and then replace those passwords with three of four more, track the time between password spray runs, etc. That’s a manual process, and I’d prefer something that I can setup and just let it run to completion.

ScanCannon - Runs Masscan, followed up by Nmap for service version info. This should finish scans much faster than Nmap alone while providing service version info that Masscan doesn’t provide.

The one thing that changed my life was when I read about interest vs commitment. Too often I hear people wish that things were different, or they want things they will never have or accomplish because they don’t know what it means to be committed to something, so they wander through life like a leaf on a stream never knowing they are holding themselves back and maybe they blame others or circumstance.

I tired of maintaining my own Wordpress blog, and issues with Wordpress on Digital Ocean resulted in my database going down repeatedly. Now I’m hosting on github.io and don’t have to worry about site security, databases, etc., just write and publish!