Pinned Repositories
Check-LocalAdminHash
Check-LocalAdminHash is a PowerShell tool that attempts to authenticate to multiple hosts over either WMI or SMB using a password hash to determine if the provided credential is a local administrator. It's useful if you obtain a password hash for a user and want to see where they are local admin on a network. It is essentially a Frankenstein of two of my favorite tools along with some of my own code. It utilizes Kevin Robertson's (@kevin_robertson) Invoke-TheHash project for the credential checking portion. Additionally, the script utilizes modules from PowerView by Will Schroeder (@harmj0y) and Matt Graeber (@mattifestation) to enumerate domain computers to find targets for testing admin access against.
CloudPentestCheatsheets
This repository contains a collection of cheatsheets I have put together for tools related to pentesting organizations that leverage cloud providers.
DomainPasswordSpray
DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain. By default it will automatically generate the userlist from the domain. BE VERY CAREFUL NOT TO LOCKOUT ACCOUNTS!
GraphRunner
A Post-exploitation Toolset for Interacting with the Microsoft Graph API
HostRecon
This function runs a number of checks on a system to help provide situational awareness to a penetration tester during the reconnaissance phase. It gathers information about the local system, users, and domain information. It does not use any 'net', 'ipconfig', 'whoami', 'netstat', or other system commands to help avoid detection.
MailSniper
MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). It can be used as a non-administrative user to search their own email, or by an administrator to search the mailboxes of every user in a domain.
MFASweep
A tool for checking if MFA is enabled on multiple Microsoft Services
MSOLSpray
A password spraying tool for Microsoft Online accounts (Azure/O365). The script logs if a user cred is valid, if MFA is enabled on the account, if a tenant doesn't exist, if a user doesn't exist, if the account is locked, or if the account is disabled.
PowerMeta
PowerMeta searches for publicly available files hosted on various websites for a particular domain by using specially crafted Google, and Bing searches. It then allows for the download of those files from the target domain. After retrieving the files, the metadata associated with them can be analyzed by PowerMeta. Some interesting things commonly found in metadata are usernames, domains, software titles, and computer names.
RDPSpray
Tool for password spraying RDP
dafthack's Repositories
dafthack/MailSniper
MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). It can be used as a non-administrative user to search their own email, or by an administrator to search the mailboxes of every user in a domain.
dafthack/CloudPentestCheatsheets
This repository contains a collection of cheatsheets I have put together for tools related to pentesting organizations that leverage cloud providers.
dafthack/DomainPasswordSpray
DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain. By default it will automatically generate the userlist from the domain. BE VERY CAREFUL NOT TO LOCKOUT ACCOUNTS!
dafthack/MFASweep
A tool for checking if MFA is enabled on multiple Microsoft Services
dafthack/MSOLSpray
A password spraying tool for Microsoft Online accounts (Azure/O365). The script logs if a user cred is valid, if MFA is enabled on the account, if a tenant doesn't exist, if a user doesn't exist, if the account is locked, or if the account is disabled.
dafthack/GraphRunner
A Post-exploitation Toolset for Interacting with the Microsoft Graph API
dafthack/PowerMeta
PowerMeta searches for publicly available files hosted on various websites for a particular domain by using specially crafted Google, and Bing searches. It then allows for the download of those files from the target domain. After retrieving the files, the metadata associated with them can be analyzed by PowerMeta. Some interesting things commonly found in metadata are usernames, domains, software titles, and computer names.
dafthack/Check-LocalAdminHash
Check-LocalAdminHash is a PowerShell tool that attempts to authenticate to multiple hosts over either WMI or SMB using a password hash to determine if the provided credential is a local administrator. It's useful if you obtain a password hash for a user and want to see where they are local admin on a network. It is essentially a Frankenstein of two of my favorite tools along with some of my own code. It utilizes Kevin Robertson's (@kevin_robertson) Invoke-TheHash project for the credential checking portion. Additionally, the script utilizes modules from PowerView by Will Schroeder (@harmj0y) and Matt Graeber (@mattifestation) to enumerate domain computers to find targets for testing admin access against.
dafthack/lab_scripts
Repo for hosting various scripts for creating users for password spraying and other password attacks.
dafthack/BasicPHPRedirector
A basic PHP redirection site that captures request headers
dafthack/Ethereham
A script for tracking and decoding input data messages sent to and from a particular Ethereum address or from every transaction in a block.
dafthack/m365_groups_enum
Enumerate Microsoft 365 Groups in a tenant with their metadata
dafthack/blocksec-incidents
A curated list of blockchain security incidents including exchange hacks, DeFi compromises, blockchain attacks, and others.
dafthack/gitleaks
Scan git repos for secrets using regex and entropy 🔑
dafthack/EyeWitness
EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.
dafthack/TeamFiltration
TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts
dafthack/Bloodhound-Custom-Queries
Custom Query list for the Bloodhound GUI based off my cheatsheet
dafthack/dropengine
dafthack/gcploit
dafthack/ip2provider
Resolves an IP address to the cloud provider it is hosted on
dafthack/Noctilucent
Using TLS 1.3 to evade censors, bypass network defenses, and blend in with the noise
dafthack/PrtToCert
dafthack/solidity-cheatsheet
Cheat sheet and best practices for solidity. Write smart contracts for Ethereum.
dafthack/antitrackingtags
dafthack/aws-api-models
A collection of documented and undocumented AWS API models
dafthack/AzureADJoinedMachinePTC
dafthack/msportals.io
Microsoft Administrator Sites
dafthack/openhaystack
Build your own 'AirTags' 🏷 today! Framework for tracking personal Bluetooth devices via Apple's massive Find My network.
dafthack/dafthack
About Me
dafthack/PurpleCloud
A little tool to play with Azure Identity - Azure Active Directory lab creation tool