Forum Widgets
Recent Discussions
Hafnium: ProxyLogon (Offensive) - Question 3
For the FQDN, I am wondering about where I am going wrong as I am basically using the command expected of this lab. However, there wasn't any shell code provided nor any expecations of what the shell powershell script should contain. I am wondering if you could provide directions into where I should be digging deeper into, to be able to obtain the FQDN
Kerberos: Active Directory Certificate Services lab - getting KRB-ERROR (16): KDC_ERR_PADATA_TYPE_NOSUPP
Lab: Kerberos: Active Directory Certificate Services - Labs - Immersive I am not able to get tgt ticket using this command .\Rubeus.exe asktgt /certificate:cert.pfx /user:Administrator /ptt It throws error: KRB-ERROR (16) : KDC_ERR_PADATA_TYPE_NOSUPP I have tried all the steps in same order: 1. .\Certify.exe find /vulnerable 2. .\Certify.exe request /ca:DC01.krbtown.local\krbtown-DC01-CA /template:VulnTemplate /altname:Administrator 3. generate cert.pfx and running rubeus. Searched for this error and it says - "In order to login using a certificate through a valid Kerberos TGT, Public Key Cryptography for Initial Authentication (PKINIT) must be supported in AD." Can someone plz help me to solve the lab.
Apache Header Tampering
Can someone point me to the right track? On this one, I found the hidden directory, used an X-Forwarded-For: to see into that directory where scanning for files showed a lot of 404s, with just a few 403 response codes. I've tried everything I can think of with variations on X-Original-URL:, X-Rewrite-URL:, and X-Forwarded-Uri:, but none of them get me able to see into any of the files/directories. I've even tried a few variations instead of X-Forwarded-For:, such as X-Client-IP: and a few others. I feel like I must be missing something. I didn't find any actual .php files in the hidden directory but the question seems to indicate that there are some in there. I found what I think are other directories within that first hidden directory.Ransomware: Darkside - Question 9
In terms of determining the name of the service that is installed after the ransomware was executed, there doesn't seem to be any service installation activities observed from the endpoint. Wondering if I should be focusing on a different code, slightly irrelevant towards service creation activities. when searching for file creation for possible service names "api-ms-win-service-management-l1-1-0.dll" is also showcased to not work. Wondering about what different area should I be looking into instead
Immersive Labs – APT29: Threat Hunting with Splunk
Hi everyone, I’m currently working through the Immersive Labs – APT29: Threat Hunting with Splunk lab and got stuck on Question 10. Question: A PowerShell script was initially executed to extract encoded data from an image file. What is the full ParentCommandLine field value used to execute this? What I’ve tried so far: Searched PowerShell logs (EventCode 4103 / 4104) in Splunk Looked for base64/encoded content indicators (e.g., FromBase64String, -enc, IEX) Filtered for image-related activity (e.g., .jpg, .png) Reviewed process creation context but struggling to identify the exact ParentCommandLine. Appreciate any guidance—trying to understand the hunting logic, not just the answer. Thanks in advance!Lab not getting complete even it is correct
I am working on C# / ASP.NET API from the I am doing ASP.NET Core API: Username Enumeration lab, this lab task 1 is always showing incomplete even after I am generating correct results [HttpPost("login")] public ActionResult<LoginResponse> LoginUser(LoginRequest request) { var user = _repository.GetUserByEmail(request.Email); var passwordValid = _hashingService.VerifyPassword( request.Password, user.Password ); if (user == null || !passwordValid) { return Unauthorized(); } return new LoginResponse { Jwt = _jwtService.GenerateJwt(user.Id, user.Email) }; } Could you please help? I need to complete this today? Regards NageshNeed help in Splunk Lab!
I am attempting the Splunk collection under Upskill. In the final lab i.e. Demonstrate your skill lab, I am getting stuck at a particular task. This is the prompt that I need to solve. The problem is there is no field for Destination IP in the log. Whenever I search according to the prompt, no results are returned and the question won't take 0 as an answer. Please help me move forward.
If your question has been answered, help others by clicking:
