WEBVTT

00:00:01.540 --> 00:00:02.360
Before I go,

00:00:02.370 --> 00:00:04.740
I want to leave you some addition information so you can

00:00:04.740 --> 00:00:06.310
be more successful in your attacks.

00:00:07.040 --> 00:00:08.530
First, as we've seen in the demos,

00:00:08.540 --> 00:00:13.140
we need to crack the hash passwords to get plain text credentials. For that,

00:00:13.290 --> 00:00:15.450
there are a few password cracking tools that you can use.

00:00:15.940 --> 00:00:17.440
We already talked about John the Ripper,

00:00:17.450 --> 00:00:20.150
which is really easy to use, and it comes with Kali Linux.

00:00:20.640 --> 00:00:23.150
You can find more information about John the Ripper on its GitHub.

00:00:23.540 --> 00:00:24.860
You can type this link manually,

00:00:25.060 --> 00:00:28.670
or you can go to the exercise files for this course, open the PDF

00:00:28.670 --> 00:00:30.850
for this slide, and click on the link there.

00:00:31.840 --> 00:00:33.870
The second cracking tool is the hashcat,

00:00:33.910 --> 00:00:37.500
which is also a great tool for password cracking. The hashcat

00:00:37.600 --> 00:00:39.680
requires some effort in the initial configuration,

00:00:39.840 --> 00:00:41.550
especially if you want to use your GPU.

00:00:42.140 --> 00:00:44.580
However, once it's configured, you're good to go.

00:00:44.690 --> 00:00:48.850
It is really easy and fast to crack passwords. As important as having this

00:00:48.850 --> 00:00:52.670
good cracking tool is having a password list so we can do our dictionary

00:00:52.670 --> 00:00:56.550
attacks. In our demo, we used a RockYou password list,

00:00:56.940 --> 00:00:59.200
but if you want to get other really good lists, go to the

00:00:59.200 --> 00:01:02.800
SecLists GitHub. In there, there are millions of passwords

00:01:02.800 --> 00:01:04.750
gathered from data breaches across the globe.

00:01:05.239 --> 00:01:06.750
It is a really good source of passwords.

00:01:08.430 --> 00:01:10.660
Also, if you want to learn more about the Responder,

00:01:10.820 --> 00:01:14.190
you can check its official documentation. In there, you see that

00:01:14.190 --> 00:01:16.050
you can use Responder for some other attacks.

00:01:16.640 --> 00:01:19.670
And if you're wondering how to protect your company from this attack,

00:01:19.840 --> 00:01:24.340
the easiest way is by disabling both LLMNR and NBT‑NS protocols in

00:01:24.340 --> 00:01:27.720
your environment. This process is not that simple because some

00:01:27.720 --> 00:01:31.010
legacy system may still be using it, but it's totally doable.

00:01:31.600 --> 00:01:35.370
In this link, you can find how to disable both protocols in a safe way.

00:01:37.040 --> 00:01:40.060
So that's it. That's the end of the course. In my opinion,

00:01:40.160 --> 00:01:42.350
this would be your main attack on internal network.

00:01:42.940 --> 00:01:45.750
Once you practice it, you see how easy it is to get credentials.

00:01:46.340 --> 00:01:48.980
So, I hope you enjoyed this course, and I hope to see you soon.