Full transcript
0:00How do hackers test the passwords that they've stolen? Like when they have a giant pile of username and password credentials from a recent data breach, how do they see which ones work and which let them into an account that they can compromise? Like there's no way they do this manually trying to log in to each and every one. So hackers automate
0:21it. They use scripts or tools or utilities that will loop through every single username and password and brute force or spray different accounts with different passwords and see what lets them in. They check each credential with a cred checker tool. So, in this video, I wanted to talk about and show you some of the credeer tools that exist so we
0:42have a better understanding of what's out there, what hackers are using, and how they take advantage of leaked credentials. I also want to draw your attention to how some of the tooling has changed in this cat-and- mouse game of cyber security. There's a lot of back and forth when hackers are doing something nefarious and then defenders want to put mitigations or blockers
1:02around it. Anyway, Open Bullet 2 is one of those examples of a utility or tool that can be used to test credentials. It's a cross-platform automation suite powered by.net. You can send requests to a target web application like any online site or website you might be logging into and it can be used for scraping and parsing data alongside automated
1:24penetration testing. Now they do add the note the disclaimer, hey you should only do this on stuff that you own. Performing credential stuffing attacks or distributed denial of service or anything bad against something you don't own is illegal. That's why we say cyber criminals when hackers are doing this the wrong way. And OpenBullet 2 has a pretty well fleshed out wiki and sort of
1:45documentation to get it up and running. We can go ahead and install it on Windows with either a web client if we'd like. Gives us a little bit more flexibility to maybe even access this remotely. That just starts a little server and then you can navigate to the admin interface or the panel here in your web browser. So I do have Open
2:01Bullet 2 here on my desktop in a little Windows virtual machine. I can go ahead and get this started. So we can see that is serving on port 5000. And with that open in a web browser, we could at least see what the interface looks like. Open bullet 2. Now, from what I understand, you would prepare a certain number of
2:21configurations. And they have a neat little hacker thing here where you could actually define and create a whole configuration that will actually run like C code. So I can get back to configs after that's been created and then modify this where we could actually build out like add different blocks for solving captas having logic or
2:41conditions using different functions that you might otherwise use in code. Interact with the browser with like puppeteer maybe selenium utility things here to work with file uploads clearing cookies. Lots of neat things here or just making some simple requests. And you can just drag these in and then make any changes and then completely like
3:01drag and drop a workflow. All that you could start as a job to brute force, scan, automate scraping, parsing website content, or like automated penetration testing work and brute forcing these passwords. There is a ton of flexibility here. If we were to create a job, you could choose whether that has a file
3:22associated with it, word list, range, or combinations that you're working through here. and everything with support for proxies. Proxies are the key component that we'll have to talk about quite a bit here because when you log into a website naturally, really with good intentions as you, that's you operating
3:43out of your identity with your devices, your computer, wherever you are in the world, your location, your region, coming from a usual IP address. But if a bad actor is trying to impersonate you and steal your account and your identity, well, they'll usually want to match all of those little breadcrumbs
4:03and artifacts that make you you or your online digital footprint, identity, devices, connection, etc. So that's why info stealer malware logs are always trying to profile your computer specs, your general location, so they could use a proxy or VPN to connect in as that with those details. So, when you're
4:23using an online account that should really be kept secure, like maybe your Microsoft account or your online cloud identity, those sites and services should be looking into all of those indicators to help triangulate you are who you say you are. But bad actors that try to impersonate you might be using
4:44anonymous browsers to try and look like you or while they're brute forcing and spamming these resources and login pages to try and check their credentials if they work well they'll probably have to even navigate around different IP addresses so they don't get blocked by that online provider. So, another really well-known tool called MSOL spray put
5:06together by Daft Hack or Bo Bullock. Genius in Microsoft 365 Entra and ID work. MSOL spray is a password spraying tool for these Microsoft online accounts. Think like Azure, Office 365 or now Entra as it's called. But if we take a look at this repository here, they note it's totally possible to lock out accounts as you are hammering maybe
5:28one individual username or email address with multiple passwords. So you'll want to spray like test one password against every single username and not be locking out the accounts, but just slowly more not to say stealthily testing passwords. And there are a handful of these, but for a long while, this has been out for
5:48maybe 5 years now. MSOL would do the trick and it still does. But there is a note here and a big shout out brought to you by Black Hills Information Security. I believe that's where Bo is at for his day job. This tool works well with Firerocks to rotate source IP addresses on authentication requests. That means that if you are spraying passwords
6:08trying one thing after the next, you're actually moving across the internet in a different IP address to make it look like you're coming from a different location every time. that circumvents a lot of rate limiting or being blocked by Azure Smart Lockout. We'll talk a little bit more about Fireproxs and that rotating IP address idea in just a
6:26little bit. But I did want to show you another tool, Entraspray, password spraying tool for Microsoft online accounts. A little bit more modern put together just last year, but it really is honestly genuinely just a rewrite of MSOL spray in Python. MSOL spray was in PowerShell. So if you're on Linux, maybe in Cali or whatever, maybe just as easy
6:45to get this going. And I'm sorry, I keep harping on the Microsoft accounts like the Azure Active Directory, the online identity and Entra ID just because that's so real. We've seen it even this year all throughout there are password spraying attempts on these online intra ID tenants. And whenever credentials are leaked in a data breach, well then those
7:06threat actors, cyber criminals, and hackers are going to be spraying and testing those creds immediately. Actually, question for you. Do you manage an intra ID environment for corporate identities and different users? Well, I should know better. You probably are using an intra ID account for work. And I have a cloud tenant myself. This is one of the old dev
7:28testing tenants or online environments to be able to explore Microsoft 365 Azure and now Entra ID. These are just some of the sample users that are included to mimic a real Entra ID environment. But I got to show you this super cool new feature set from Flare. It's identity exposure management. So with Entra ID and all the different
7:50users that you have now, you can hook them up to Flare so that they are automatically remediated when any of their credentials are leaked out on the dark web. Since Flare is always collecting and tracking information on the darknet, as well as the Clearet in shady Telegram channels, chat groups where info stealer malware logs are shared, cyber crime forums, bulletin
8:12boards, leak sites, all of this. Now there's a new integration where you can connect your Entra ID environment, your whole identity provider. So now all of your users could automatically raise an alert whenever their identity or their online accounts are compromised. So now whenever if Alex or Diego or whoever or whatever user has their password public
8:34leaked in a data breach or whatever like Saturday at 2 in the morning, well, you don't get into the office to test and check those credentials and passwords until maybe Monday morning. But now the instant that that's leaked that account and entra ID can be marked as compromised automatically suspended and locked or all the session tokens active
8:55loggedin connections and sessions revoked. It is super easy to set up. You just click the add integration button in the integrations page and then you'll be able to fill out all the details necessary for an Entra app that you configure and set up inside your tenant. And look at this. You can automatically create identities and identifiers for
9:13each of the accounts. You could even drill that down, filter on a specific group ID. And then you can enable certain kind of features like manually disabling an account, marking one as compromised or revoking sessions or automatically doing this, which is highly recommended because the breaches occur when you are not tracking. This is the coolest set and forget identity
9:34protection we've got. So let me show you. If I hop over to the identifier section, you can see with this new Entra ID integration, it's automatically created this corporate identities group where I could see all of those Entra ID users. So I can take a look at Adele here just as one example. And look, you can see other attributes that might be
9:53added for that identity. You could of course configure alerts, but this identity profile tab is awesome because you can see how it's synced to enter ID and it's a consolidated place to see where their passwords or exposed PII or info that's caught in stealer logs might be present. So they have some passwords
10:14that have been compromised. Okay, PII here. Yep, looks like info was included in previous breaches or combo lists that were out and about. And we could actually go validate this. How was Diego doing? I remember he was one example here. Looks like Okay, password stolen as well. Summer 2024. Great. But take a look at this IDP credential status
10:35column not validated. So with this new identity exposure management and intra ID integration, whenever there's a password that is actively leaked, you could have Flare automatically test to see are these credentials valid? Do they really genuinely log in that user? and is this an immediate threat and risk. So, let me hop over to the credentials browser. And it looks like a lot of the
10:57users and accounts in my tenant have had past password compromises. And you could mark these as remediated so it won't show this again or ignore it. If we click in to Adele here, we could see the event. Maybe learn a little bit as to what breach had this password and other info uncovered. And then we could validate the credential here. I can
11:17click this and it looks like they were exposed passwords, but Adele has since changed her password. That was us simply manually testing the credential. But the real power is when this all happens automatically. So, let me get back to our Entra ID user list. And I want to introduce you to Megan. Megan Bowen is our digital initiative public relations
11:39Mark8 project team retail person. Now, I got an alert from Flare letting me know that Megan had her info exposed in an info stealer malware log. It included 21 different credentials, and we could click to view the event. But I do want to show you this blast radius. Now, this is a super cool visual way to see a
11:59compromised account and identity based off of however many info stealer malware logs, what credentials might have been leaked for their different accounts. HubSpot, Docu Sign, Box, Amazon, Zoom. This includes all of the other leaks, all the cookies, of course, their Entra ID account in here. I think that's pretty stinking cool to be able to see
12:20the blast radius. Looking at the event, it looks like Megan fell victim to the LMA C2 info stealer malware, and that was able to pull down a lot of info on her device, including cookies, passwords, and everything else. Looking at this in the credentials browser, I can see that Flare has already validated those credentials and automatically
12:40mitigated against further potential identity compromise here by locking down that account. This happened in the moment. So I could literally just control shiftr refresh to see Entra ID now and Megan Bowen is no longer going to be able to log in. You could of course do this manually to revoke sessions, disable account, or mark as compromised, but Flare was doing the
13:01hard work for you the instant that those credentials were leaked out to the dark web or the public internet. I for one think this new identity exposure management feature and functionality and this intra ID integration with Flare is super cool. You do get the active real-time protection from identity exposure out and about on the dark web for all of your tenant users and team
13:23members in the cloud identity provider that you already use. Super cool. But hey, you can play with it. You can kick the tires. See for yourself. Get started with the free trial link below in the video description. Huge thanks to Flare for sponsoring this video. Back to that recent case study though of like 80,000 different online intra ID Microsoft
13:43accounts that are being targeted with a cred checker tool or at least a utility that still has the potential to test validate and see if these creds will get into a compromised account. Another one I wanted to bring to your attention is team filtration. Team Filtration is a cross-platform framework for enumerating, spraying, exfiltrating and
14:04backdooring Office 365, Azure Active Directory or Entra ID accounts. And Team Filtration is made put together by a good friend of mine, Flangvic. Big shout out to Melvin. We have a video together where we collabed at Devcon and I have not gotten it out the door and I feel awful and I'm so sorry. But team filtration is super slick. This is again
14:23another utility that's been developed for the good reasons of penetration testing, valid security testing to find flaws and weaknesses as the good guys before the bad guys do and emulate the adversaries that we are up against. Now, team filtration does a similar sort of thing where it could operate with a username or password or tokens or
14:45cookies for an online identity and then xfiltrate some of the stuff that's included in Microsoft Teams or One Drive or Sharepoint or any of the stuff that's all included with that identity provider here. The Office 365 suite, email, Outlook, all of this. But the spraying module is more pertinent to our
15:06conversations here where you could include the passwords that it'll try to beat up. It could spray credentials against accounts. It could enumerate information against the tenant backdoor. Lot of stuff here. And shout out to the folks that helped uh put together that utility. But here's the thing. Remember I was mentioning that cat and mouse game in cyber security and kind of the
15:25restrictions of password spraying as oh putting our hacker hat on and even identifying triangulating and detecting a real genuine legitimate login from a potential online account. Remember we had to talk about proxies. We had to talk about rotating your IP address because while team filtration was awesome, cool and amazing public suite
15:46stuff to be able to test these environments and validate our security posture, but it relied on Fireprox. And while we alluded to Firerox previously, it's on AWS or Amazon Web Services. Firerox is an AWS API gateway management tool for creating on the-fly HTTP passrough proxies for unique IP
16:08rotation. Clever way to be able to manipulate and modify your source IP address or looking like where you're coming from when you make connections across the internet. The way that the security industry got around that and everyone in the scene for better or for worse, right, is leveraging some of the cloud hosting providers like AWS. Now, there are a lot of other options. Big
16:30shout out again, Black Hills Information Security, always doing incredible stuff. But relying on AWS or some of these cloud hosting providers means that you're really up to the acceptable use and terms of that service. And it's totally fair, maybe a little bit, oh, wondering, scratching your head, eyebrow raised, questionable to rotate IP address to spam packets. So AWS made
16:51this more explicitly clear on their policy against penetration testing. Very recently, September 30th, the team filtration creator, Flangvic, is saying, "Look, uh, AWS not only made changes to their terms of service, but now this time they are actively enforcing them." So, some of those clever tricks to use fires and by extension, the work that
17:12team filtration would offer since it relies on that capability isn't really feasible right now. At least the from a distance remote enumeration and spraying techniques. smart cyber security community though is tracking this. You've got some of the red team professionals, a little bit more of the offensive security specialists, adversary emulation folks chatting about
17:32it, thinking about, well, look, no, there are other alternatives, right? It doesn't need to rely on AWS. Unfortunate that the current implementation of team filtration does rely on firerocks, but there are alternatives and someone shared a couple here. One mention is IP spinner. Another is omnireox. Now, I've been looking at omniprocks. This is IP rotation from different providers like
17:54Fireproxs but for GCP, Azure, Alibaba and Cloudflare. Zephrfish or Andy Gail has a cool blog post about this again very recent. So I'll link this in the video description for you. Discusses the exact same problem of Firerox and CredMaster now kind of being uh hunkered down on with the AWS change in policy. With the death of Fireroxs, folks are
18:14looking for something new. So over in my Kali Linux virtual machine, I can go ahead and open up a terminal. I do have Omnirox installed and available here for us. We could see what it could do. Quick multicloud proxy manager. And with support for Cloudflare in some of these, we could actually use d- setup and that will kind of walk us through getting
18:35this all going. Now, we do already have a profile set up cuz I've walked through this a little bit. Should be able to create some Cloudflare workers for us. While it might otherwise use Azure, Google, GCP, or Alibaba, we should just be able to use Omni Create and then a URL that we want to be able to go to
18:53just as an example. Maybe as a little test, we could go to a web hook site to be able to capture the requests as it comes through. So, let me just have one example here. And then let's try to create some proxies with this utility going to that address. We can use the Cloudflare ones that I have set up. And
19:11that will spin up some options here for us. Should give us all the commands that we might be able to run to access this. I know this looks a little overwhelming, but you'll see the Cloudflare worker URL and then following that the actual site that we want to go to or navigate to via the proxy. So, just as a test, fingers
19:30crossed I can curl this. Let me go ahead and try one of those examples. Ooh, this URL has no default content configured. We could change the response in web hook.site, site, but it looks like it made through. So, if I get back to Firefox, yeah, okay, we can see that came from 16215863.46
19:51with all of the Cloudflare sort of headers that kind of do tell us this is coming from that Cloudflare worker. If I do that again, will I get a different IP address or a couple more times? There's another different IP address. Let me add the note that Omniprox does state the uh Cloudflare option is not with a true IP
20:09rotation. They're using different headers to be able to actually specify look for a connection uh look like we're coming from this location. They also discuss this here in a little bit of their setup. You can see some of the Azure containers that they create as an example alongside the Cloudflare ones, but they do note that is headers only
20:28for Cloudflare. Another tool that was suggested as an alternative to Fireprox for doing some of that potential password spraying or at least IP rotation to different connections here. IP spinner was another one that was included. So, uh again, we'll leave links in the video description for you to explore and play with that if you would like. I will say IP spinner is
20:48neat though because alongside Azure and some of the other options for like cloud hosting providers to be used for this IP address rotation. They also offer one feature for GitHub actions which is kind of neat. But I thought for at least some demo as you know I like to make sure I have those in videos actually be on
21:05keyboard and do something. Why not try to mask our IP address for some oh brute forcing password spraying options with tour. Now, let me say obviously that would be very slow, but it could still work and we'll have a different IP address every time. So, Entra ID and beating up these Microsoft accounts won't get too mad at us and block the IP
21:28address we connect from. One of our previous options for password spraying was intraray and that was a simple and easy Python script as a quick and easy rewrite of MSOL spray. and it has a little argument and parameter that we could provide for a proxy for us to send traffic through. We could do that with
21:48tour. Maybe that helps puts a little uh dark web cyber crime spin on this whole thing. But I want to go download the tour expert bundle. That way I can run the service and connect to the network. And I'll just be doing that on Linux since I know the entray python script will work easy in Python on Linux. So,
22:05I've got tour downloaded in an opt tour directory that I extracted into another tour directory that included a folder with the other tour binary in it. So, it looks really funny. Opour to tour to tour to but this will get us connected to tour. And now in another terminal, let me open up down here. I did download
22:23intraspray from that GitHub repository. So, let me move into that directory and we could simply run our intraspray script. Now this requires a proxy that we'll of course provide from our tour listener. We know that is on localhost 9050 and we need to provide a user list and a password to spray against those
22:44users. So I also have a user list of the users that are just in my entra ID tenant the Azure Active Directory and Microsoft online accounts here and say that they were included in some leak. Uh, forgive me. I know we're doing a little bit of movie magic here, but we could use our intray cred checker with
23:06the user list that we have in our current directory. A password that say, oh, we just found in one of these leak dumps or info stealer malware logs worth testing anything that we might see. And let's include the proxy with the sock 5 for tour on 127001 and 9050. I'm hoping this will work.
23:28spraying across 16 total users logging output. We are working over tour. So, we'll see if this gets a hit for our movie magic. I did make sure that one of the users has that leaked password. And there it is. There's Miriam. Miriam G. They still need to register with MFA.
23:48But now that we know her password, could we log in as her? Login.microsoft.com. Acting as the adversary. Putting my hacker hat on here. Will we get into Miriam's account since now we've been able to test and check her credentials that were stolen, leaked, available some way somehow? Yeah, let's set up Microsoft Authenticator and enroll in
24:10our own two-factor authentication. All right. So, look, that I know was a little bit of a safari ride, going a little all over the map, exploring different tools, seeing what exists, what's out there, and how it's changed over time with the security cat-and- mouse game of, yeah, maybe some security questionable things of rotating IP
24:30addresses to potentially do offensive security or brute force and spray passwords, but it's real and that's what's actually happening in the real world. and so many different corporate online IDs, different accounts and identities, business email compromise, session hijacking, account takeover, that stuff happens all too often and it's what opens the door for ransomware
24:52and even more malware in the environment. So, I hope you learned a thing or two. I hope you enjoyed this video. If you did, please do all those YouTube algorithm things like, comment, subscribe, and please, pretty please do give some love to our sponsors. Really genuinely I think this Flare identity exposure management platform and the Entra ID integration is so cool because
25:11I know you've got an Entra ID environment. We all do. You can help protect your users, protect your people, protect your security posture with some of the sweet stuff they're cooking now. Link below in the video description. Thanks so much for watching. See you in the next video.