Hacking Exposed: Next-Generation Tactics, Techniques, and Procedures
summary
Demonstrates harvesting an ADFS private certificate, forging SAML tokens to bypass MFA and access Azure/Office 365, and then using cloud contributor rights to create a backdoor admin on an on‑premises domain controller; tools shown include Mimikatz DCSync to extract NTLM hashes, ADFSDump to pull the certificate, ADFSpoof plus Burp Suite to inject forged SAML, and a Kali workflow that achieves circular cloud ↔ on‑premises control.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 2:35Stellar Particle
- 5:24Primer
- 10:07Demo
- 12:05User Password Data
- 13:20Moving to ADFS
- 14:46Decoding ADFS
- 16:04Accessing Office 365
- 19:17countermeasures
related talks
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
50mAttacking and Defending the Microsoft Cloud (Office 365 & Azure AD)
42mWriting Your Own Ticket to the Cloud Like APT: A Dive to AD FS Attacks, Detections, and Mitigations
55mOffensive Azure Security
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
50mBeyond the Mcse: Active Directory for the Security Professional
40mWhat’s Old is New: Hybrid Security for Microsoft Azure and On-Premises Tech
48mLateral Movement in the Age of Hybrid Cloud