Hey there. Thanks for putting this out. Quick question, can this be used on a target machine via a remote session or does this have to be run on a separate machine placed in the network by assessors?
Flamingo is a new open source tool from @Atredis for capturing credentials sprayed by IT and security products: https://www.atredis.com/blog/2020/1/26/flamingo-captures-credentials …
(h/t to @4lex for HTTP NTLM support!)pic.twitter.com/V2jKi3Enpg
-
-
-
both methods work great due to it being a single portable binary; if you have an internal box for the test, it's worth running it, same goes for internal targets in sensitive segments. many scanners send all configured credentials to all in scope targets.
- Još 1 odgovor
Novi razgovor -
-
-
heh, you could tarpit stuff with this :D - spin up like 50 ip addresses - listen on every port for every ip - log to /dev/null - pop open nload or something in another terminal to watch all that portscan data get slogged
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.