Hot answers tagged

4

What you're seeing is name canonicalization during the formation of the SPN. Kerberos requires clients to resolve names to the official record in an attempt to restrict hijacking/ticket theft and Windows enforces that. Both Windows 7 and Windows 10 will do this by default, but it's possible to configure it to not do that through registry settings like ...


1

Dealing with Windows failed events can be a very hard task. Firstly, you have consider 2 types of failed events in Windows: Kerberos logins (not in your scope): ID 4768, 4769, 4771 Windows logins: ID 4625, ID 4776 Considering now your event, the most meaning full events are the following: Logon Type: 3 > network event Workstation Name: Win10-Wrk > ...


1

There isn't really any other way to use it other than how it was designed because then you're not using SPNEGO, but some other protocol you've invented. What I think you're asking is whether there are other mechanisms used out in the wild other than Kerberos and NTLM, and the answer to that is yes. A handful that I'm aware of are Digest NegoEx (an ...


1

Burp's Platform Authentication settings let you configure Burp to automatically carry out platform authentication to destination web servers. Different authentication types and credentials can be configured for individual hosts. https://support.portswigger.net/customer/portal/articles/2927576-configuring-ntlm-with-burp-suite


Only top voted, non community-wiki answers of a minimum length are eligible