Author Archives: appleCIDR

Can klist be used to detect expiry dates for forged kerberos tickets?

Posted on June 22, 2018 by appleCIDR

I have observed that klist is used to list locally cached kerberos tickets. For golden tickets with indefinite expiry dates (say ~10 years), is it possible to list all the tickets submitted to a server?

That way we could loo… Continue reading Can klist be used to detect expiry dates for forged kerberos tickets?→

Posted in hash, hashcat, kerberos, SSO

APIPA traffic in router/netflow logs

Posted on April 9, 2018 by appleCIDR

While inspecting some flow logs, I noticed some port 22 traffic destined to a few local servers (at 10.x.x.x) . What was surprising is that the traffic originated from a 169.254.x.x IP address. Is this normal?

IP addresses … Continue reading APIPA traffic in router/netflow logs→

Posted in ssh | Tagged spoofing