0

I have limited experience with Windows networks and certainly no experience with AD forests or anything related.

I have experience and understanding how to secure and maintain a unix style network.

I am wondering if the extra stuff like AD and whatever other windows specific technologies there are allow for Windows specific attacks, or is the AD stuff just the equivalent of LDAP?

Are there any Windows specific attacks specific to windows technologies(without a unix equivalent) on a windows network? Any sources to links or documentation would be appreciated

Improve this question
9
  • 2
    @Sonny - there are so many Windows specific attacks and more developed all the time that this is probably not a suitable question here (see the faq) - try a google for Windows vulnerabilities or exploits...
    – Rory Alsop ♦
    Jun 2, 2011 at 7:48
  • Rory, my question is not for windows specific vulnerabilities, but attacks specific to windows network technologies. I don't mean necessarily at a software level, but at any level. I am having less luck finding information in that context, which is something many of the people here with their experience could answer or give input on.
    – Sonny Ordell
    Jun 2, 2011 at 15:43
  • 1
    @Sonny I think Rory is alluding to the fact that there are vulnerabilities ranging from things as simple as IPV6 networking all the way to the password hashing used by default Active Directory domains. Things as simple as print spoolers and SMB itself as implemented by Microsoft have had multiple vulnerabilities that are remotely exploitable. If you could elaborate on the scenario further it might help define the attack.
    – Ori
    Jun 3, 2011 at 4:00
  • @Ori - I thought I was clear in my question, I am interesting in attacks on windows specific network technologies. For example, print spoolers or IPV6 are not specific to Windows, while the AD stuff is. Or, is there nothing specific to a Windows network and only implementation differences?
    – Sonny Ordell
    Jun 3, 2011 at 4:08
  • @Sonny for the most part it would be mostly the same, though with differen common services around. One big difference, though, would be SPNEGO/NTLM all over the place, though by now it should be mostly Kerberos anyway. Also SMB, but thats just another protocol.
    – AviD ♦
    Jun 6, 2011 at 23:30

1 Answer 1

Reset to default
1

No real information on specific attacks, but as for how the network looks... For the most part it would be mostly the same, though with different common services around (in addition to implementations of regular, common protocols).

One big difference, though, would be SPNEGO/NTLM all over the place, though by now it should be mostly Kerberos anyway.
Also SMB (for file sharing).

I'm not sure this is really the answer you need, but it may be able to help you narrow your focus to ask a more specific question.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .