timewarp256

Gaining Access to Card Data Using the Windows Domain to Bypass Firewalls

Posted by timewarp256 on Wednesday April 24, 2019 @04:28PM
from the markitzeroday.com dept.

https://markitzeroday.com/pci/active-directory/kerberoast/firewall/2019/04/24/gaining-access-to-card-data-using-the-windows-domain-to-bypass-firewalls.html

( Read More... | no comments | 2 points | on HN )

Re:Google Phishing Quiz on Saturday January 26, 2019 @10:53PM (#19010264)

Clicking links can be a problem in corporate environments where automatic login has been enabled on Internet Explorer and outbound SMB not blocked.

The phishing site immediately gets their domain ntlm hash, which can often be cracked to gain a password.

This can also be a problem in PDF and Word docs without the need to employ a 0 day. https://resources.infosecinstitute.com/steal-windows-login-c...

Also to note that password managers can help mitigate phishing, as they will not offer to complete passwords if the domain does not match.

Re:Drag – Change the way you work inside Gmail on Friday March 24, 2017 @07:54AM (#13948279)

In both Gmail and Inbox I miss emails when two come in at once in the same thread - wish they could solve that without turning off convos altogether.

Re:TSA gave my MacBook Pro to another passenger at LAX, and now it's gone on Tuesday May 24, 2016 @09:55AM (#11761492)

Never knew guest mode would allow access to Safari only. Probably worth enabling for incidents like these.

http://apple.stackexchange.com/a/82707/145499

Done!

Re:Ask HN: Facebook clickjacking – is it detectable? on Monday September 14, 2015 @12:04PM (#10215733)

According to this http://stackoverflow.com/q/7328295/413180 there's no known way to prevent both Clickjacking and CSRF at the same time in a widget - unless you have an ugly popup asking the user to confirm the like.