tylous / talon Goto Github PK
View Code? Open in Web Editor NEWThis project forked from optiv/talon
A password guessing tool that targets the Kerberos and LDAP services within the Windows Active Directory environment.
License: MIT License
This project forked from optiv/talon
A password guessing tool that targets the Kerberos and LDAP services within the Windows Active Directory environment.
License: MIT License
Hello,
The 'LockErr' option is missing from the 'Usage' section (the "help" output) of this GitHub repository (https://github.com/Tylous/Talon#usage-1).
The 'Usage' section looks like this:
But when running './Talon_3.1_linux_amd64 --help', it shows that '-LockErr' is an available option for version 3.1:
I have been running this for a while and there appears to be an issue that just popped up on one of my internal engagements. I used ldap relaying to get a list of all user accounts, then used the enumeration feature of Talon to look for valid and non valid accounts to test against. Once I got a list of valid accounts that were not locked (I found it odd they had no disabled accounts), I started my password spray and this morning the client said they had over 500 accounts locked in a 10 minute period. They confirmed that they were doing a lockout of three failed attempts in 30 minutes, I ran my test with 2 in 35 minutes. During my test it appears that 536 of 571 accounts I was spraying were locked in the first 10 minutes. Something tells me that 536 of their users did not enter a password wrong in the first 10 minutes of my scan.
The concerning part is that through the testing, only three accounts were reported back to Talon as being locked. All others were reported as a failed login attempt.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.