I'm pen testing the page (IdpInitiatedSignOn.aspx) of a web app which uses an SSO mechanism (Active Directoy Federated Services). The username field requires a domain (e.g. company) to preface the username (e.g. company\jdoe). If I instead use a domain of my choosing (e.g. attacker.com\jdoe), I receive a DNS SRV lookup for _kerberos._tcp.dc._msdcs.attacker.com. Is there any route for exploitation here? What would happen if I stood up a domain controller at _kerberos._tcp.dc._msdcs.attacker.com?


Generally, it would attempt to gather a bit more information about the domain attacker.com, and determine whether the machine domain has a trust with the attacker.com domain. In this case there wont be a trust, so it would just fail the auth request.

This all happens at a very low level and ADFS isn't even involved yet, aside from ferrying the credentials from the web to the underlying Windows API.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.