Attacking ADFS Endpoints with PowerShell

Presented at DerbyCon 6.0 Recharge (2016), Sept. 24, 2016, 6 p.m. (50 minutes).

Active Directory Federation Services (ADFS) has become increasingly popular in the last few years. As a penetration tester, I’m seeing organizations opening themselves up to attacks on ADFS endpoints across the Internet. Manually completing attacks against these endpoints can be tedious. The current native Microsoft management tools are handy, but what if we weaponized them. During this talk, I will show you how to identify domains that support ADFS, confirm email addresses for users of the domain, and help you guess passwords for those users. We’ll cover how you can set up your own hosted ADFS domain (on the cheap), and use it to attack other federated domains. On top of that, we’ll show you how you can wrap all of the native functionality with PowerShell to automate your attacks. This talk should give penetration testers an overview on how they can start leveraging ADFS endpoints during a penetration test.

Presenters:

• Karl Fosaaen / gLoBuS   as Karl Fosaaen

Similar Presentations:

• DeepSec 2015 „DeepSec No. 9“ / PowerShell for Penetration Testers
• May Contain Hackers (MCH2022) / Running a Domain Registrar for Fun and (some) Profit
• DeepSec 2018 „I like to mov &6974,%bx“ / Leveraging Endpoints to Boost Incident Response Capabilities