2 articles tagués avec « Red Team »

Short answer: Kerberoasting abuses a normal Kerberos feature — any authenticated domain user can request a service ticket for any service account, and part of that ticket is encrypted with the account's password hash. The attacker requests tickets, takes them offline, and cracks the weak ones. No exploit, no privilege required, and it still works in most domains.

Short answer: the red team emulates a real attacker to test whether the organisation detects and responds; the blue team defends, detects and responds; the purple team is the two working in the same room so that every attack produces a detection rule. Red teams are glamorous and rare. Blue teams are where most jobs and most learning are.