Video of my presentation:
(edit: the videos audio doesnt start until 18 seconds in. I’ve edited it, and the video is updating on youtube. This is temporary, please bear with me)
Slide Deck: long-tail-of-the-internet.pdf
Script: shodan-turk.py
Archive for the ‘protips’ Category
LayerOne 2012 | Drinking from the caffeine firehose we know as shodan
Monday, May 28th, 2012So, you pillaged a domain controllers hashes…
Wednesday, February 29th, 2012So you’ve managed to find your way to a domain controller, perhaps used metasploits meterpreter, perhaps got system, migrated to lsass.exe and perhaps were able to use incognito to smart_hashdump and nab all the password hashes. Well, you can hand those off to john the ripper and it will happily crack the LM portion of what you’ve got – but you’ll end up with a bunch of uppercase passwords.
Enter lm2ntcrack.pl – a dandy little perl script that will take the uppercase password and use it as a dictionary to crack the NTLM password for you. Only trouble is that since it was written, the awesome guys at openwall who develop john the ripper have changed the output format of cracked password files. The lm2ntcrack input format was written for a ~2009 version of JtR, so to get it properly working someone had to go and make a tiny tweak in the script where it analyzes the syntax/order of the input file.
So I did it! First time, actually, that I’ve done something like this. And it appears to work! – at least it works on the ntlm hashes I have from a demo network.
Anyhow, here’s my updated copy of the script - lm2ntcrack-viss.pl
Save that as a .pl file (it’s a .txt so it doesn’t get run on the site).
Feedback welcome!
Quickly spotting social engineering attempts with TinEye.
Thursday, October 27th, 2011TinEye is a great service that you can use to search for similar photos on the web. You provide a photo and it compares it to its database looking for similar and modified images.
You can use TinEye to quickly spot fake accounts on social networking sites.
For example. I received this LinkedIn network request the other day.
Not only have I never worked with a “Jennifer Gray”, her profile photo looks like it may be a stock photo. TinEye returned 4 results for stock photography.
Looks like this account may be a recruiting bot or something.
TinEye can also be used to verify the authenticity of a photo and to see if it is a repost or duplicate of another photo. It even has Firefox and Chrome plugins!