Technical Tracks
summary
A lab phishing campaign uses the Evilginx reverse proxy to capture session cookies and then registers a device to steal the Primary Refresh Token; recon tools AzureHound and RoadRecon find a misconfigured Finance Analytics app that enables privilege escalation. FIDO2 passwordless authentication prevents the proxy from working, but captured cookies still allow the attacker to set a temporary access code, escalate to Global Administrator, create a shadow app and exfiltrate SharePoint data via a Python script; recommended mitigations are conditional access, Privileged Identity Management, maintaining an app inventory, and enforcing short privileged sessions.
AI-written summary · about
chapters (5)
- 0:00Introduction and context
- 5:19Cloud risks and identity
- 14:07Attack demonstration
- 23:13Privilege escalation
- 25:22Recommendations and conclusion
related talks
40mGet Rich or Get Hunted Trying: Uncovering Large Scale Fraud Operations
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
49mThe Death of Conventional MFA: How AiTM Attacks Are Changing the Game
48mLateral Movement in the Age of Hybrid Cloud
40mModern Identity Hacking: Have Hackers Really Adjusted to Constant Remote?
42mSeeing Through the Fog: Interpreting Entra ID Signals During AiTM Attacks
23mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
30mTales of Red Teaming