+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Running responder in a Azure Ad environment (/showthread.php?tid=6249910)
Running responder in a Azure Ad environment - Noctem187 - Aug 22, 2023
Does anyone have experience with internal pentests in a azure environment without an onprem AD.
I have been running responder and I don't get any hashes, even though I see successful poisons.
RE: Running responder in a Azure Ad environment - DramaKing - Aug 23, 2023
If you're poisoning local workstations, and they have autodetect proxy enabled or try to access file shares, I don't see why not. If the machines aren't requesting wpad.dat, I suggest using NTLM Theft from GitHub. Generate an HTML file with a file://IP ADDRESS/image.jpg link and embed it into an email.
RE: Running responder in a Azure Ad environment - Noctem187 - Aug 24, 2023
Thanks , let me give it a go!