User Enumeration Part 3 – Windows

This is the third installment in a series of blogs on user enumeration.  In Part 1 – Building Name Lists, I talked about ways of building usernames from OSINT and US census data. In this installment, I’m going to discuss putting this info to work in...

Deceiving the Red Team with GPP

A common tactic used by pen testers, “red teams”, and threat actors is searching for Group Policy Preference (GPP) files with usernames and passwords.  These XML files, stored in the domain SYSVOL, are used to create local administrator accounts, map...

User Enumeration Part 1 – Building Name Lists

A common part of pen tests – both network and web app – is password spraying. In order to do that, you need usernames. But how do you find out what your target’s usernames are? This is the first in a series of posts to discuss user enumeration and...