LDAP channel binding is a security control that helps protect LDAPS authentication by binding the authentication attempt to the TLS channel being used. It is designed to reduce certain relay and man-in-the-middle attack scenarios where an attacker attempts to forward authentication from one connection to another. The simplest way to think about LDAP channel binding […]
LDAP Channel Binding and Why It Matters Read Post »
NTLM relay is an attack technique where an attacker captures NTLM authentication from one system and relays it to another service. Instead of cracking a password or directly stealing plaintext credentials, the attacker abuses the authentication exchange itself. The simplest way to think about NTLM relay is: an attacker convinces one system to authenticate, then
NTLM Relay in Active Directory Read Post »
Resource-Based Constrained Delegation, often shortened to RBCD, is a Kerberos delegation model in Active Directory where the target resource controls which accounts are allowed to delegate to it. It was introduced to make delegation easier to manage across service boundaries, but it can create serious security risk when permissions on computer objects are weak or
Resource-Based Constrained Delegation in Active Directory Read Post »
Constrained delegation is a Kerberos delegation setting in Active Directory that allows a service to impersonate users only to specific downstream services. It was introduced as a safer alternative to unconstrained delegation because it limits where delegated authentication can be used. The simplest way to think about constrained delegation is: A service can act on
Constrained Delegation in Active Directory Read Post »
Unconstrained delegation is a legacy Kerberos delegation setting in Active Directory that allows a trusted service to impersonate users to other services. It was designed to support multi-tier applications, but it can create serious security risk if the trusted server or service account is compromised. A server trusted for unconstrained delegation may be able to
Unconstrained Delegation in Active Directory Read Post »