Good work, want to see setup python on windows from scratch and how to run scripts from it as most of the hacking related scripts are based on python and not every one knows Linux.
Hi Sir your video was very but i cant get out in this error pray 2.1 the Password Sprayer by Jacob Wilkin(Greenwolf) Spraying with password: Users Username Cannot connect to server. Error was NT_STATUS_LOGON_FAILURE Cannot connect to server. Error was NT_STATUS_LOGON_FAILURE Cannot connect to server. Error was NT_STATUS_LOGON_FAILURE Cannot connect to server. Error was NT_STATUS_LOGON_FAILURE maybe you can help me with this, i been searching in the internet i cant find any solution. I was able to ping my domain IP. Thank you
Great question! Assuming you're in a domain environment, you'll want to make sure you have a GPO setup to "Audit Logon Events" for success and failures. Once that is in place, I believe the event IDs you need to monitor for are below, but you'll want to test and verify this. Pre Server 2008: Logon Success: Event ID 528 Logon Failure: Event ID 529 - 537 Account Lockout: Event ID 539 Server 2008 and Newer: Logon Success: Event ID 4624 Logon Failure: Event ID 4625
Good work, want to see setup python on windows from scratch and how to run scripts from it as most of the hacking related scripts are based on python and not every one knows Linux.
Thanks for the idea!
Hi Sir your video was very but i cant get out in this error
pray 2.1 the Password Sprayer by Jacob Wilkin(Greenwolf)
Spraying with password: Users Username
Cannot connect to server. Error was NT_STATUS_LOGON_FAILURE
Cannot connect to server. Error was NT_STATUS_LOGON_FAILURE
Cannot connect to server. Error was NT_STATUS_LOGON_FAILURE
Cannot connect to server. Error was NT_STATUS_LOGON_FAILURE
maybe you can help me with this, i been searching in the internet i cant find any solution. I was able to ping my domain IP. Thank you
Does anyone know what type of log entries are generated for this type of attack.. 4624 ?
Great question! Assuming you're in a domain environment, you'll want to make sure you have a GPO setup to "Audit Logon Events" for success and failures. Once that is in place, I believe the event IDs you need to monitor for are below, but you'll want to test and verify this.
Pre Server 2008:
Logon Success: Event ID 528
Logon Failure: Event ID 529 - 537
Account Lockout: Event ID 539
Server 2008 and Newer:
Logon Success: Event ID 4624
Logon Failure: Event ID 4625
@@InfiniteLogins Thank you, that is really helpful !