WEBVTT

00:00:01.620 --> 00:00:02.130
Awesome.

00:00:02.140 --> 00:00:04.650
I hope you really enjoyed our demos. As you can see,

00:00:04.660 --> 00:00:08.590
it was fairly easy to get tons of information from the AD and even easier to

00:00:08.590 --> 00:00:11.550
get access to a service account with an insecure password.

00:00:12.640 --> 00:00:12.960
Now,

00:00:13.080 --> 00:00:16.149
if you want to know more about this too, I do recommend you check in the

00:00:16.149 --> 00:00:20.180
official documentation on the GitHub of this project. In there he said that it

00:00:20.180 --> 00:00:22.850
too has tons of other features and really cool reports.

00:00:24.180 --> 00:00:27.000
And if you don't want to type those links manually, you can simply go

00:00:27.000 --> 00:00:29.250
to the course files and check the links in there.

00:00:30.610 --> 00:00:31.040
Also,

00:00:31.100 --> 00:00:33.270
if you want to get really technical in Active Directory

00:00:33.270 --> 00:00:36.150
Reconnaissance, the same author of this tool gave a really

00:00:36.150 --> 00:00:38.920
interesting talk about the topic on a OWASP Conference.

00:00:39.570 --> 00:00:41.700
This presentation is almost two hours long,

00:00:41.770 --> 00:00:45.020
but has tons of really interesting technical details about Active

00:00:45.020 --> 00:00:47.150
Directory and how to extract information from it.

00:00:48.220 --> 00:00:52.850
Also, as we saw in the last demo, I used a password cracking to called Hashcat.

00:00:53.540 --> 00:00:57.290
If you want to know more about this tool, you can check this link. Or if

00:00:57.290 --> 00:00:59.250
you don't want to use the Hashcat to crack passwords,

00:00:59.390 --> 00:01:02.250
you can also use the John the Ripper, which does a similar job.

00:01:03.380 --> 00:01:06.760
And if you were wondering how to prevent your company from this kind of attack,

00:01:07.070 --> 00:01:09.730
the main recommendation is to implement rules in your detection

00:01:09.730 --> 00:01:12.450
solutions to monitor high traffic of AD requests.

00:01:13.120 --> 00:01:13.770
For example,

00:01:13.820 --> 00:01:16.600
if you see one user requesting tons of information from the

00:01:16.600 --> 00:01:18.750
Active Directory in a short period of time,

00:01:19.000 --> 00:01:20.750
then it may be something suspicious.

00:01:21.840 --> 00:01:25.290
Also very important, to prevent people from cracking the passwords of

00:01:25.290 --> 00:01:29.120
your service accounts, you should use really strong passwords. I do

00:01:29.120 --> 00:01:32.830
recommend at least 30 random characters, so then attackers will not

00:01:32.830 --> 00:01:37.930
be able to crack the password that easily. So that's it, that's the

00:01:37.930 --> 00:01:38.560
end of the course.

00:01:38.910 --> 00:01:41.160
I hope that today you learned about the importance of

00:01:41.160 --> 00:01:42.790
getting information from the Active Directory,

00:01:43.440 --> 00:01:46.850
and I hope you have one more tool in your belt to help in Red Team engagements.

00:01:47.340 --> 00:01:49.650
So thank you for watching and I'll see you soon.