AS-REP Roasting is an Active Directory attack technique that targets user accounts configured with Kerberos preauthentication disabled. When preauthentication is not required, an attacker can request Kerberos authentication data for the account and attempt to crack it offline to recover the user’s password. AS-REP Roasting is dangerous because it does not require administrative privileges. In […]
AS-REP Roasting in Active Directory Read Post »
Kerberoasting is an Active Directory attack technique where an authenticated domain user requests Kerberos service tickets for accounts that have Service Principal Names, then attempts to crack those tickets offline to recover the service account passwords. Kerberoasting is dangerous because it does not require administrative privileges. In many environments, any valid domain user can request
Kerberoasting in Active Directory Read Post »
LDAP signing is a security control that helps protect communication between LDAP clients and Active Directory domain controllers. It helps ensure that LDAP traffic has not been tampered with in transit and reduces exposure to certain man-in-the-middle and relay-style attacks. In many Active Directory environments, LDAP is used constantly. Applications, servers, workstations, network appliances, and
LDAP Signing and Why It Matters Read Post »