Extending BloodHound for Red Teamers
Wild West Hackin' Fest 2017
BloodHound has changed how red and blue teams approach risk in Active Directory environments. The interface is slick, the install is painless enough considering the dependencies, and the pre-built analytics deliver actionable intelligence. However, BloodHound isn’t just another fire & forget tool, it’s a platform for users to build on. The foundational elements – a reliable backend, a means for ingesting, querying, and displaying data – are already taken care of. The piping is in place for users to extend the already-great features and tailor it to their specific job function or workflow.
This talk will cover how I’ve adapted BloodHound to enhance my workflow as a penetration tester. I’ll demonstrate custom extensions used to track and visualize compromised nodes, highlight privilege gains, represent password reuse between users or computers, blacklist unwanted nodes and relationships, and more. Folks who attend this talk will gain a solid understanding of BloodHound’s underlying Neo4j data structures, as well as how to write Cypher queries in order to build their own BloodHound customizations.
___________________________________________________________
Tom (@porterhau5) is a red teamer by trade, however his roots are on the blue team writing netflow analytics and providing network situational awareness. Tom holds a handful of certifications from SANS, as well as degrees in Mathematics and CS. When there's not a baseball game nearby, he can be found scripting, participating in CTFs, dissecting packets, tinkering in his homelab, performing password analysis, or chasing high IBUs.
Видео Extending BloodHound for Red Teamers канала Wild West Hackin' Fest
BloodHound has changed how red and blue teams approach risk in Active Directory environments. The interface is slick, the install is painless enough considering the dependencies, and the pre-built analytics deliver actionable intelligence. However, BloodHound isn’t just another fire & forget tool, it’s a platform for users to build on. The foundational elements – a reliable backend, a means for ingesting, querying, and displaying data – are already taken care of. The piping is in place for users to extend the already-great features and tailor it to their specific job function or workflow.
This talk will cover how I’ve adapted BloodHound to enhance my workflow as a penetration tester. I’ll demonstrate custom extensions used to track and visualize compromised nodes, highlight privilege gains, represent password reuse between users or computers, blacklist unwanted nodes and relationships, and more. Folks who attend this talk will gain a solid understanding of BloodHound’s underlying Neo4j data structures, as well as how to write Cypher queries in order to build their own BloodHound customizations.
___________________________________________________________
Tom (@porterhau5) is a red teamer by trade, however his roots are on the blue team writing netflow analytics and providing network situational awareness. Tom holds a handful of certifications from SANS, as well as degrees in Mathematics and CS. When there's not a baseball game nearby, he can be found scripting, participating in CTFs, dissecting packets, tinkering in his homelab, performing password analysis, or chasing high IBUs.
Видео Extending BloodHound for Red Teamers канала Wild West Hackin' Fest
Показать
Комментарии отсутствуют
Информация о видео
Другие видео канала
![Elevating your Windows Privileges Like a Boss! - Jake Williams](https://i.ytimg.com/vi/SHdM197sbIE/default.jpg)
![Bloodhound Pen-test Tool - Daily Security Byte](https://i.ytimg.com/vi/pKbN9_6zhKo/default.jpg)
![BloodHound - Analyzing Active Directory Trust Relationships](https://i.ytimg.com/vi/gOpsLiJFI1o/default.jpg)
![](https://i.ytimg.com/vi/tMOurXX7JLM/default.jpg)
![Active Directory Enumeration With BloodHound](https://i.ytimg.com/vi/sGO4F23Xik4/default.jpg)
![WWHF | A Master Class on Offensive MSBuild | Chris Truncer & Joe Leon | 1 Hour](https://i.ytimg.com/vi/an8vf1shfmk/default.jpg)
![Incident Response and Compromise Recovery Part 2](https://i.ytimg.com/vi/pzVl3rzmIS0/default.jpg)
![WWHF | Breaking and Entering – Tyler Robinson | Red Team Roundup](https://i.ytimg.com/vi/V0HsMomlHvA/default.jpg)
![n00bz learning 9: BloodHound tutorial for Active Directory analysis](https://i.ytimg.com/vi/wRDGzZsO3gg/default.jpg)
![The Seattle Rapid Access Tool (SEARAT)](https://i.ytimg.com/vi/wZuzbI2bd6Y/default.jpg)
![Certified Pre-Owned: Abusing Active Directory Certificate Services](https://i.ytimg.com/vi/ejmAIgxFRgM/default.jpg)
![WWHF | Which one of these is not like the others? {Can you Detect Abnormal Behavior?} | Erik Goldoff](https://i.ytimg.com/vi/zstXHSAsNWU/default.jpg)
![Introduction to BloodHound](https://i.ytimg.com/vi/BG4SkeKTwm4/default.jpg)
![WWHF | Should you set it and forget it? Intro to IOT Hacking](https://i.ytimg.com/vi/HE8viIS1NA4/default.jpg)
![The Seattle Rapid Access Tool (SEARAT) by Ignition USA](https://i.ytimg.com/vi/S3JTNPLJfWk/default.jpg)
![Gorgeous terrain is SUPER EASY (Unity Tutorial)](https://i.ytimg.com/vi/aQUJ9qMMhlQ/default.jpg)
![WWHF | Why We Red Team : The Real Value of Threat Emulation | Joe Vest](https://i.ytimg.com/vi/XE9JZOC-SCE/default.jpg)
![WWHF | Tactical Burpsuite - Kevin Johnson & Nathan Sweaney](https://i.ytimg.com/vi/TXmWtJb147I/default.jpg)
![WWHF | How Certifications Help You Find Great People for Your Security Team | Kip Boyle](https://i.ytimg.com/vi/MgTh7JsxqxY/default.jpg)
![WWHF | WhatTheF#$ | Chris Truncer | Red Team Roundup](https://i.ytimg.com/vi/n191-QV3HyA/default.jpg)