Results for “credential-handling”

Authentication and credential security assessment. Tests password brute-force, credential stuffing, password spraying, default credential testing, credential harvesting, lockout analysis, MFA bypass, OAuth/OIDC abuse, session token entropy, Kerberos attacks, and intelligent wordlist generation. Uses hydra, john, ncrack, medusa, cewl, crunch, netexec, impacket, kerbrute, and nuclei default-login templates. Covers OWASP A07:2021 Identification and Authentication Failures.

Automate credential rotation for service accounts across Active Directory, cloud platforms, and application databases to eliminate stale secrets and reduce compromise risk.

Take over Active Directory user and computer accounts by writing alternate certificate keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, and Certipy, then authenticate via PKINIT.

Deploy CyberArk Privileged Access Management to discover, vault, rotate, and monitor privileged credentials across enterprise infrastructure, covering vault architecture, session isolation, credential rotation policies, and NIST 800-53 integration.

Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible travel patterns, unauthorized resource provisioning, and credential abuse indicators using GuardDuty, Defender for Identity, and SCC Event Threat Detection.

Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules.

Audits WordPress plugin and theme code for secret-handling issues: hardcoded credentials, weak randomness, insecure password storage, cookie flags, and secret leakage in logs.

Use this when reviewing or designing how secrets, API keys, service credentials, signing keys, tokens, and environment-specific credentials are stored, loaded, rotated, and kept out of untrusted runtimes.

Run authenticated vulnerability scans using valid credentials to deeply inspect target systems for missing patches, misconfigurations, and security weaknesses.

Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correlation.

Extract cached credentials, password hashes, Kerberos tickets, and authentication tokens from memory dumps using Volatility and Mimikatz for forensic investigation.

Extract Active Directory credentials via DCSync attacks and establish domain persistence by dumping KRBTGT, Domain Admin, and service account hashes for Golden Ticket creation.

Traces identity flows, Windows host artifacts, enterprise messaging, and lateral-movement chains in CTF sandbox challenges.

Designs and automates identity governance lifecycle processes including joiner-mover-leaver workflows, role mining, access requests, periodic recertification, and orphaned account remediation using IGA platforms.

Extract DPAPI-protected secrets such as credentials and browser data from Windows systems during authorized penetration tests.

Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins using statistical analysis on Splunk or raw log data.

Implement PCI DSS compliance requirements for secure handling of payment card data and payment systems. Use when securing payment processing, achieving PCI compliance, or implementing payment card security measures.

Traces host-to-host pivot chains in Windows CTF challenges by recovering Kerberos tickets, credential material, and privilege edges across WinRM, SMB, and RDP.

Manage Redpanda authentication and authorization from the CLI using the `rpk security` command group, covering SASL/SCRAM users, Kafka ACLs, RBAC roles, and Cloud secrets.

Scan source code repositories, CI/CD pipelines, and configuration files for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native detection mechanisms to prevent credential theft and unauthorized account access.

Manages and analyzes Clerk authentication resources, including users, organizations, and sessions, with commands for user growth, auth health, and membership review.

Exploit Active Directory Certificate Services (AD CS) misconfigurations, specifically ESC1. By requesting a certificate based on a overly permissive template that allows the enrollee to supply a Subject Alternative Name (SAN), an attacker can impersonate highly privileged users (like Domain Admins) and seamlessly escalate privileges across the entire AD environment.

Store and retrieve API keys, passwords, and credentials in an HSM-backed encrypted vault via MCP or REST API, with policy-based access control, secret rotation, multi-chain signing, and prompt injection scanning.

Discovers, classifies, protects, and governs API keys, tokens, secrets, and credentials across all providers with enterprise-grade security auditing and governance.

Active Directory and network lateral movement assessment. Pass-the-hash, pass-the-ticket, Kerberoasting, AS-REP roasting, NTLM relay, SMB relay, WMI/WinRM/PSRemoting abuse, constrained/unconstrained delegation, RBCD, cross-trust exploitation, and pivoting. Uses impacket, netexec, enum4linux-ng, smbmap, smbclient, bloodhound-python, Responder, ntlmrelayx, mitm6, and ldap-utils. Chains from /post-exploit or /credential-audit.

Secure environment variable management with Varlock. Use when handling secrets, API keys, credentials, or any sensitive configuration. Ensures secrets are never exposed in terminals, logs, traces, or Claude's context. Trigger phrases include "environment variables",...