Logo

Rootways of the World Tree

  • Rootways of the World Tree
    • The hidden challenges
    • Why this matters
  • Transmission Control Protocol (TCP)
    • Attack tree: Compromise a target via TCP vulnerabilities
    • Attack tree: Manipulate BGP routing by compromising TCP-based BGP sessions
    • TCP Reflection/Amplification attacks
    • RST/FIN Floods (State-Exhaustion attacks)
    • TCP Zero-Window attacks (Resource Starvation)
    • SYN Floods (Classic but Persistent)
    • TCP Injection (In-Path adversaries)
    • TCP Middlebox exploits (Policing Evasion)
    • Low-Rate TCP attacks (Partial DoS)
    • Trends and takeaways
    • Defence recommendations
    • Thoughts
    • Emerging threats
    • Emerging defence
  • Network Layer Protocol (IPv4 or IPv6)
    • Attack tree: Compromise Internet Protocol (IP)
    • IP spoofing & DDoS amplification
    • BGP hijacking & route leaks
    • IP fragmentation attacks (Teardrop, Ping of Death Revisited)
    • ICMP ause (Smurf, flooding, covert channels)
    • IPv6 exploitation (Flooding, SLAAC attacks)
    • TTL expiry attacks (Resource exhaustion)
    • Geolocation spoofing (Evasion & Censorship bypass)
    • Trends & takeaways
    • Defence recommendations
    • Emerging tech
  • Border Gateway Protocol (BGP)
    • Attack tree: Disrupt or manipulate BGP routing
    • BGP hijacking (Route leaks & prefix hijacking)
    • BGP route leaks (Accidental or malicious)
    • BGP blackholing (DDoS weaponization)
    • BGP side-hijacking (Partial traffic interception)
    • BGP timed attacks (Short-lived hijacks)
    • Trends & takeaways
    • defence recommendations
    • Thoughts
    • Emerging defence trends
  • BGPsec validation
    • Attack tree: Compromise BGPsec validation
    • BGPsec downgrade attacks (Forcing fallback to insecure BGP)
    • RPKI-to-BGPsec exploits (Invalid ROAs leading to hijacks)
    • BGPsec key compromise (Theft or fake certificates)
    • BGPsec implementation flaws (Router vulnerabilities)
    • BGPsec drowning attacks (Flooding with invalid routes)
    • Trends & takeaways
    • Defense recommendations
    • Thoughts
  • Internet Control Message Protocol (ICMP)
    • Attack tree: Exploit ICMP for malicious purposes
    • ICMP flood attacks (Bandwidth exhaustion)
    • ICMP redirect attacks (Man-in-the-Middle)
    • ICMP tunneling (Data exfiltration & C2)
    • Ping of Death (Fragmentation exploits)
    • ICMP NDP attacks (IPv6 exploitation)
    • Trends & takeaways
    • Defence recommendations
    • Thoughts
    • Emerging defence trends
  • Domain Name System (DNS)
    • Attack tree: Compromise DNS infrastructure or Data Exfiltration
    • DNS amplification DDoS attacks
    • DNS Cache poisoning (Intoxication)
    • DNS tunneling (Data exfiltration)
    • DNS hijacking (Registrar/Provider compromise)
    • Phantom domain attacks (Resolver exploitation)
    • DNS rebinding (Bypass Same-Origin policy)
    • Trends & takeaways
    • Defence recommendations
    • Thoughts
  • TLS/SSL (for BGPsec)
    • Attack tree: Compromise TLS/SSL Security
    • Attack tree: Compromise BGP via TLS/SSL Weaknesses
    • Attack tree: Compromise TLS/SSL via BGPsec Weaknesses
    • TLS version downgrade & weak cipher exploits
    • Certificate spoofing & fake CA compromise
    • Ransomware abuse of TLS for C2
    • Session hijacking via TLS renegotiation
    • ALPACA & cross-protocol attacks
    • TLS 1.3 Early Data (0-RTT) exploits
    • Trends & takeaways
    • Defence recommendations
    • Thoughts
    • Emerging threats
    • Future defences
  • TCP-AO (Authentication Option)
    • Attack tree: Bypass or compromise TCP-AO protection
    • TCP-AO Downgrade attacks (Forcing Fallback to TCP-MD5/None)
    • TCP-AO key reuse & Weak key management
    • TCP-AO implementation flaws (Router vulnerabilities)
    • TCP-AO session resets (Forged RST/ACK attacks)
    • TCP-AO drowning attacks (Resource exhaustion)
    • Trends & takeaways
    • Defence recommendations
    • Thoughts
    • Emerging threats
  • MD5 (for TCP-AO)
    • Attack tree: General MD5 attack
    • Attack tree: Compromise BGP session via MD5 exploitation
    • MD5 hash collision attacks (Session hijacking)
    • Key leakage & reuse (Compromised shared secrets)
    • Downgrade attacks (Forcing TCP-MD5 instead of TCP-AO)
    • CPU exhaustion via flooding (MD5 verification overload)
    • Replay attacks (Reusing captured MD5-Auth segments)
    • Trends & takeaways
    • Defence recommendations
    • Thoughts
    • Emerging defence
  • Resource Public Key Infrastructure (RPKI)
    • Attack tree: Compromise RPKI validation
    • Attack tree: Combined RPKI + BGPsec attack tree
    • RPKI-Invalid hijacking (Exploiting unprotected routes)
    • RPKI Time-to-Live (TTL) attacks (Cache poisoning)
    • ROA Overclaiming (Authorizing too-broad prefixes)
    • RPKI CA compromise (fake or revoked certificates)
    • Ghost prefix attacks (Exploiting RPKI “Unknown” state)
    • RPKI drowning (Validator DoS)
    • Trends & takeaways
    • Defence recommendations
    • Thoughts
    • Emerging threats
    • Emerging defence

Mycelium Patch

  • Mycelium patches
    • The hidden challenges
    • Why this matters
  • Routing Information Protocol (RIP)
    • Attack tree for RIP
    • Notes
  • Enhanced Interior Gateway Routing Protocol (EIGRP)
    • Attack tree for EIGRP
    • Notes
  • Open Shortest Path First (OSPF)
    • Attack tree for OSPF
    • Notes
  • Intermediate System to Intermediate System (IS-IS)
    • Attack tree for Is-Is
    • Notes
  • Border Gateway Protocol (BGP)
    • Attack tree for BGP in Local Networks
    • Notes
  • Static routing
    • Attack tree for Static Routing
    • Notes
  • First-Hop Redundancy Protocols (HSRP/VRRP)
    • Attack tree for HSRP
    • Attack Tree for VRRP
    • Key differences
    • Common attack patterns
    • HSRP-Specific Exploits
      • Crafting Malicious HSRP Packets (Takeover Active Role)
      • HSRP DoS via Fake Resign Messages
    • VRRP-Specific Exploits
      • VRRPv2 Master Takeover
      • VRRPv2 DoS via Invalid VIPs
    • Post-Takeover MITM attacks
    • Defensive measures

The Spore-Thief's Grimoire

  • The Spore-Thief’s Grimoire
    • What?
    • Why?
    • How?
  • Packet manipulation
    • PCAP files
    • Example
    • Sniffing
    • Forging and decoding packets
    • Resources
  • Wireless intrusions
    • Common attack vectors wireless
    • Common Wi-Fi attack scenarios
    • WEP
    • WPA and WPA2
    • WPA3
    • Scanning and sniffing
    • Probe-Request
    • Hidden SSID
    • Deauthentication attacks
    • Example deauthentication attack
    • Cracking WEP
      • Verify wireless NIC
      • Discover networks with Airodump-ng
      • Capture traffic with Airodump-ng
      • Associate with access point and replay traffic
      • Crack the WEP key
    • WPS pin attack
      • Verify wireless NIC
      • Scan for potential WPS vulnerable networks
      • Brute-force the WPS pin
    • Cracking WPA/WPA2 keys
      • Verify wireless NIC
      • Discover networks with Airodump-ng
      • Perform deauthentication attack
      • Crack the WPA/WPA2 key
    • Using Wifite
    • Dragonblood attack
    • Rogue access points
      • Evil twin attack
      • Karma attack
      • Captive portal
    • Downgrade and SSL strip
    • Resources
  • Bluetooth barrages
    • Protocol stacks
    • Classic Bluetooth protocol stack
    • BLE – Bluetooth Low Energy
    • Device discovery
    • HCI
    • Simple python scanner script
    • Bluejacking
  • Network access altercations
    • Simple ARP spoofing
    • Network ARP cache poisoning
    • Attacking the spanning tree protocol
    • VLAN hopping attacks
      • Switch spoofing
      • Double tagging
    • Bypassing access controls
    • Compromise router
    • Port redirection
    • Sources
  • Internet incursions
    • IP spoofing
    • Denial of Service (DoS)
    • Distributed Denial of Service (DDoS)
    • Distributed Deflection Denial of Service (DrDoS)
    • On-path attack (alias MitM)
  • Transport raids
    • Replay attack
    • TCP sequence number prediction attack
    • Hijack session
    • BGP hijack
  • Application layer hacks
    • Attacks against SSL
      • SSL stripping
      • SSL hijacking
      • SSL beast
    • HTTPS spoofing
    • Resources
  • Name resolution skirmishes
    • DNS attacks
    • DNS cache snooping
    • DNS spoofing
    • Example: DNS spoofing and cache poisoning
    • Example: Forging redirection records for poisoning
    • Attacking LLMNR and NetBIOS
    • Example: LLMNR/NBT-NS poisoning through SMB
    • Example: LLMNR/NBT-NS poisoning through WPAD
    • NTLM relay attack
    • Example NTLM relay attack
  • Active directory run-ins
    • Main concepts of an Active Directory
    • Attack scenario
    • Kerberos authentication
    • Transport layer
    • Agents
    • Encryption keys
    • Tickets
    • PAC
    • Messages
    • Kerberos tickets overview
    • Attack privilege requirements
    • Active directory vulnerabilities
      • Users having rights to add computers to domain
      • AdminCount attribute set on common users
      • High number of users in privileged groups
      • Service accounts are members of Domain Admins
      • Excessive privileges shadow Domain Admins
      • Service accounts vulnerable to Kerberoasting
      • Users with non-expiring passwords
      • Users with password not required
      • Storing passwords using reversible encryption
      • Storing passwords using LM hashes
      • Service accounts vulnerable to AS-REP roasting
      • Weak domain password policy
      • Inactive domain accounts
      • Privileged users with password reset overdue
      • Users with a weak password
      • Credentials in SYSVOL
    • Post exploitation basics
      • Enumeration with Powerview
      • Enumeration with Bloodhound
      • Dumping hashes with mimikatz
      • Golden ticket attacks with mimikatz
      • Maintaining Access

Spore Nursery (Other locations)

  • Mimic Mushrooms
  • Tidefinger Lichen
  • Driftspore Lanterns

Moonlit Readying (Other locations)

  • Mapping the Dew Trails
  • Counting the Fruiting Bodies

Blight-Weaver's Spore-Songs

  • MAC changer
  • ARP spoofer
  • File interceptor
  • Code injector
  • Client-server skeleton
  • Network scanner
  • DNS spoofer
  • Packet sniffer
  • Netcat replace
  • Wireless

TryHackMe grotto

  • Introduction
    • What?
    • Why?
    • How?
  • Attacktive directory
    • Attack tree
    • Scan with nmap
    • Enumerate 139/445
    • Enumerate the DC
    • Exploiting Kerberos
    • Enumerate the DC further
    • Elevate privileges within the domain
    • Tools
  • Attacking kerberos
    • Attack tree
    • Scan with nmap
    • Enumerate DC users
    • Harvesting & password spraying
      • Harvesting
      • Password spraying
    • Kerberoasting
    • AS-REP Roasting
    • Pass the ticket
    • Golden/silver ticket attacks
      • Dump the sqlservice and Administrator hash
      • Dump the krbtgt hash
      • Create a golden/silver ticket
      • Use the ticket to access other machines
    • Kerberos backdoors
    • Tools

More caves

  • Mythical blue lake (scenario)
Riches in the ground
  • Ty Myrddin Home
  • Unseen University
  • Improbability Blog
  • About
  • Contact
Unseen University, 2025, with a forest garden fostered by /ut7.