The Attacker’s Guide to SSO and Passwordless Technologies
summary
Demonstrates concrete attacks against Windows Hello and browser SSO in hybrid Azure setups, using Mimikatz to extract Kerberos tickets and showing pass-the-ticket still works despite passwordless logins, and a new pass-the-PRT technique where local admin can extract the PRT from TPM/registry to replay SSO from another machine. Describes OAuth BlackDirect flaws where orphaned redirect subdomains let attackers hijack tokens, reports ~6 vulnerable URLs per company on average, and provides a scanner (black.direct) plus mitigation steps.
AI-written summary · about
chapters (11)
- 0:00SSO and passwordless threats
- 2:15Passwords and keys targets
- 5:51Windows Hello passwordless
- 10:30Passwordless in Active Directory
- 14:15Windows Hello attack vectors
- 16:23SSO in hybrid cloud
- 20:52Extracting SSO tokens
- 22:41Pass the PRT attack
- 23:04OAuth token hijacking
- 26:27Mitigating SSO attacks
- 27:52Summary
related talks
41mBeginner’s Guide to Bypassing Modern Authentication Methods to SSO
51mAbusing Microsoft Kerberos: Sorry You Guys Don't Get It
23mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
38mBypassing Windows Hello for Business and Pleasure
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
50mBeyond the Mcse: Active Directory for the Security Professional
58mHacking in 2016 - How is our systems broken?
55mAzure Attacks Unpacked: Real-World Threats & Lessons