DEV Community: ff02x9e

Active Directory Explained like you are ...

ff02x9e — Fri, 31 Jul 2026 14:52:16 +0000

LIKE YOU ARE 5

Imagine Active Directory is a giant Theme Park World:

Forest (The Theme Park World): This is the entire park (like Disney World). Everything inside shares the same master rules, ticket systems, and main security gates.

Domain (The Specific Parks): These are the individual parks inside (like Magic Kingdom or Epcot). Each park has its own manager, but if your ticket works for the World, you can visit them all.

OU / Organizational Unit (The Specific Land/Rides): These are sections inside a single park, like Fantasyland. The manager groups similar rides together here so they can set rules for that whole area at once (like "everyone in Fantasyland must wear hats").

Group (The VIP Clubs): These are wristband groups. Instead of checking every single kid one by one to see if they're tall enough or have a VIP pass, the park puts matching wristbands on a bunch of kids so they can all ride the roller coaster together.

LIKE YOU ARE 10

Forest The Concept: The entire video game world (like Minecraft or Roblox).
The Tech: It holds the Schema (the game's code rules that say what a "player" or "block" is) and the Global Catalog (a cheat map showing where every item in the game is). It uses Transitive Trusts, meaning if Server A trusts Server B, and Server B trusts Server C, then Server A automatically trusts Server C.

Domain The Concept: A specific game server inside that world (like a Survival Server or Creative Server).
The Tech: Controls Security Principals—anything that gets an ID card (SID), like user accounts or computer accounts. It sets the local rules, like how long your password has to be or how Kerberos login tickets work.

OU (Organizational Unit) The Concept: A specific team folder or guild room inside that server.
The Tech: Used for GPO Scoping (sending specific mod settings to just one team) and Delegation of Control (giving a helper mod permission to kick people only in their specific room, instead of giving them full admin power).

Group The Concept: A VIP role badge.
The Tech: Used for RBAC (Role-Based Access Control). Instead of typing every single player's name into a secret door's access list (ACL), you give the door access to the "VIP Badge" group, and just give players the badge.

GPO (Group Policy Object) The Concept: The Server Admin's master remote control.
The Tech: Automatically pushes settings and scripts to computers. Split into two pieces: GPC (the settings listing inside Active Directory) and GPT (the actual script/config files stored in a shared folder called SYSVOL). It processes rules in LSDOU order (Local, Site, Domain, OU)—and whatever rule runs last overrides the older ones.

Red Team Hack ⚡ If you find a user account that has Write Access to a GPO, you win the game. You can inject a secret command into that GPO, wait for the target computers to restart, and the GPO will run your code as the highest level authority (SYSTEM) on every machine in that folder!

LIKE YOU ARE 13

Alright kid, let's break down the actual tech, the jargon, and the acronyms so you know what’s really going on under the hood:

Forest What it is: The top dog. The highest security border in Active Directory.

The Tech: It holds the Schema (the database blueprint defining what objects can exist) and the Global Catalog (GC) (a searchable master index of every object in the whole network). It uses Transitive Trusts, meaning if Domain A trusts Domain B, and Domain B trusts Domain C, Domain A automatically trusts Domain C.

Domain What it is: A boundary for control and login rules.

The Tech: Houses Security Principals—anything the system can authenticate and slap a SID (Security Identifier) onto, like User accounts, Computer accounts, and Service accounts. It enforces a single set of security rules (like Kerberos ticket lifetimes and password length).

OU (Organizational Unit) What it is: A logical folder inside a domain used to group stuff together.

The Tech: Used specifically for GPO Scoping (pointing policies at specific groups of machines/users) and Delegation of Control (giving a low-level admin permission to reset passwords only in that specific folder, without making them a full Domain Admin).

Group What it is: A bucket of Security Principals used for access control.

The Tech: Used for RBAC (Role-Based Access Control). Instead of adding a single user to a file share's Access Control List (ACL), you throw the user into a Group, and give the Group the permissions.

GPO (Group Policy Object) What it is: The remote control for the whole network.

The Tech: A set of configurations pushed out by admins. It splits into two parts: the GPC (Group Policy Container, stored in Active Directory metadata) and the GPT (Group Policy Template, actual files and scripts stored in the SYSVOL network share). Applied via LSDOU order (Local, Site, Domain, OU)—where the last rule applied overwrites the ones before it.

Red Team Pro-Tip 🏴‍☠️
If you ever compromise an account that has Write permissions on a GPO, you win. You can attach a malicious startup script to that GPO, wait for the target machines to reboot, and instantly get system-level shell access across every box linked to that OU.

LIKE YOU ARE A PROFESSIONAL HACKER

Left as an exercise for the reader

Why ISPs Block dig ANY

ff02x9e — Thu, 09 Jul 2026 11:46:02 +0000

Running dig ANY target.com on a home internet connection usually results in a timeout. However, if you append @8.8.8.8 to query Google DNS directly, it works instantly.

Your ISP isn't broken. They block ANY queries by default to prevent a specific type of cyberattack called a DNS Amplification DDoS.

The Mechanics of the Attack

DNS queries normally use UDP, which means there is no handshake. Because there is no handshake, an attacker can easily fake (spoof) their IP address to look like a victim's IP.

The ANY tag tells a DNS server to return every single record it has (A, MX, TXT, etc.). This creates a massive payload discrepancy:

Request: ~50 bytes
Response: ~1000+ bytes

If an attacker sends millions of these tiny ANY requests using the victim's spoofed IP to open DNS servers, those servers will blast massive responses at the victim. The victim's bandwidth gets flooded, knocking them offline.

Why Your ISP Blocks It (But Google Doesn't)

Your ISP blocks ANY requests at the router level because normal web browsing never uses them. It is a simple way to stop their network from being used in DDoS attacks.

Google (8.8.8.8) and Cloudflare (1.1.1.1) allow them because they have massive global scrubbing networks to filter out spoofed traffic. They also use "TCP Fallback." If a response gets too big, they force the connection to switch to TCP. Since TCP requires a real handshake, spoofing becomes impossible.

The Fix for Recon

When doing CTFs, Hack The Box, or bug bounties, home internet security configurations will regularly block your traffic.

Skip your ISP's local resolver and query a public server directly:

dig @8.8.8.8 ANY target.com +short

Hash Identification Reference Guide

ff02x9e — Sun, 28 Jun 2026 18:53:48 +0000

With commands and tools
This document serves as a professional, end-to-end reference for identifying, parsing, and cracking cryptographic hashes and encodings encountered during penetration tests, CTFs, and practical exams (like the CPTS).

1. Deep Dive: The Bcrypt Hashing Algorithm

How to Identify Bcrypt

Bcrypt is an adaptive, salted cryptographic hash function based on the Blowfish cipher. In database dumps, a bcrypt hash is immediately recognizable by its structured layout, modular delimiters ($), and a fixed length of exactly 60 characters.

Structural Breakdown

A standard bcrypt string is split into four distinct fields:

Plaintext

  $2y$13$e9zuohgFZzGtbQalcn9Mz.5PJbjxob00GMBXo8NHp3P/B42LUg0lS
  \ / \/ \____________________/\_____________________________/
   |   |            |                        |
 Identifier Cost   22-Char Salt            31-Char Hash

Identifier (Prefix): Defines the specific variant of the bcrypt algorithm.

- `$2a$`: The classic implementation.

- `$2b$`: Modern implementation fixing minor caching bugs.

- `$2y$`: Specifically generated by PHP (e.g., Laravel, custom frameworks) to handle specific password hashing variations.

Cost Factor: A two-digit integer indicating the work factor. It represents the number of key-expansion rounds as a power of 2 ($2^{\text{cost}}$).

- _Example:_ A cost of `13` means $2^{13} = 8,192$ iterations. This intentional slowness (key stretching) thwarts brute-force hardware.

Salt: A globally unique, 22-character string that prevents rainbow table attacks.
Ciphertext (Digest): The remaining 31-character output containing the actual scrambled data.

Key Learning: Bcrypt uses a custom Base64 alphabet (./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789). This is why you will see characters like . and / scattered through the text, but never padding signs like =.

2. Comprehensive Identification Matrix: Encodings vs. Hashes

As a pentester, you must distinguish between data that is merely encoded (reversible) and data that is cryptographically hashed (one-way).

Non-Cryptographic Encodings (Reversible)

Type	Character Set	Length Characteristics	Structural Indicators / Giveaways
Base64	`A-Z`, `a-z`, `0-9`, `+`, `/`	Always a multiple of 4.	Frequently ends with `=` or `==` padding characters.
Hexadecimal	`0-9`, `a-f` (or `A-F`)	Always an even number of characters.	No letters past `F` will ever appear.
ROT13	`A-Z`, `a-z`	Matches the original plain text length.	Retains all native punctuation, spaces, and numbers.
URL Encoding	`0-9`, `A-F`, `%`	Variable.	Dominated by percentage signs (`%20`, `%3f`, `%2b`).

Base64 Example: YWRtaW4xMjM= $\rightarrow$ Decodes to admin123
Hex Example: 61646d696e313233 $\rightarrow$ Decodes to admin123
ROT13 Example: nqzva123 $\rightarrow$ Decodes to admin123

Standard Linear Hashes (Fast Hashes)

These are raw hexadecimal outputs. They do not store their salt natively inside the output string and are identified entirely by character count.

MD5 (Message Digest 5)

Length: 32 characters (128-bit)
Format: Hexadecimal
Example: 0192023a7bbd73250516f069df18b500

SHA-1 (Secure Hash Algorithm 1)

Length: 40 characters (160-bit)
Format: Hexadecimal
Example: a0f7169bb83ab40d21d51a6579cf299e5a1532f7

SHA-256

Length: 64 characters (256-bit)
Format: Hexadecimal
Example: 240a1921a37c15234f9a0c6a589cf299e5a1532f7a0f7169bb83ab40d21d51a65

Application & OS Hashes (Slow / Salted Hashes)

SHA-512 Crypt

Where found: Linux /etc/shadow files.
Indicator: Starts explicitly with $6$ .
Example: $6$rounds=5000$saltsalt$HashedOutputStrings...

Argon2 (2i / 2id)

Where found: Modern enterprise databases, KeePass databases.
Indicator: Starts with $argon2i$ or $argon2id$ , followed by resource allocation variables (m= memory, t= time, p= parallelism).
Example: $argon2id$v=19$m=65536,t=3,p=4$Y29v...

NetNTLMv2

Where found: Sniffed over Windows networks via Responder or LLMNR/NBT-NS poisoning.
Indicator: Look for username, domain, and challenge blocks divided by double colons (::).
Example: Administrator::DOMAIN:1122334455667788:A1B2C3D4...

3. Cracking Suite Toolkit: Hashcat vs. John the Ripper

Understanding when to deploy specific cracking engines determines how quickly you recover credentials.

Architectural Differences

Hashcat (The GPU Beast): Specifically engineered for massively parallel hardware acceleration. It leverages graphics cards (GPUs) via OpenCL/CUDA.
John the Ripper (The Flexible CPU Swiss-Army Knife): Highly optimized for single-core or multi-core CPU architecture. It excels at parsing non-standard formats and handling heavily customized syntax structures easily.

Definitive Use-Case Table

Scenario	Recommended Tool	Core Reason
Massive Hex Lists (MD5/SHA256)	Hashcat	GPUs process simple linear math algorithms millions of times faster than CPUs.
Complex Linux/Windows Files	John the Ripper	Native internal tools (like `unshadow` or `ssh2john`) easily parse raw system formatting into crackable structures.
Bcrypt / Argon2	John / Hashcat	Tied. Because these hashes are intentionally slow, high-end GPUs lose their structural scaling advantage over CPUs.
Custom Rulesets & Mangling	John the Ripper	JTR’s custom rule syntax engine is highly descriptive for complex conditional character modifications.

4. Practical Execution Reference (Commands)

Identifying a Hash Programmatically

Before running an intensive attack, use automated validation scripts to rule out edge cases:

Bash

# Method 1: Using hashid
hashid -m '$2y$13$e9zuohgFZzGtbQalcn9Mz.5PJbjxob00GMBXo8NHp3P/B42LUg0lS'

# Method 2: Using hash-identifier
hash-identifier

Hashcat Execution Reference

Hashcat requires you to define the mode parameter (-m) corresponding to the specific algorithm target.

Hash Type	Mode ID (-m)
MD5	`0`
SHA-1	`100`
SHA-256	`1400`
Bcrypt	`3200`
NetNTLMv2	`5600`

Standard Wordlist Attack (Straight Mode)

Bash

hashcat -m 3200 -a 0 targets.txt /usr/share/wordlists/rockyou.txt

-m 3200: Specifies the target format is Bcrypt.
-a 0: Direct straight attack (runs lines exactly as they appear in the dictionary file).

Rule-Based Mangling Attack

Applies complex changes (capitalization, character substitution, padding) to every item in the wordlist:

Bash

hashcat -m 3200 -a 0 targets.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

John the Ripper Execution Reference

John natively attempts to auto-detect formats, but manually defining the configuration flag (--format=) prevents parsing errors.

Standard Wordlist Attack

Bash

john --format=bcrypt --wordlist=/usr/share/wordlists/rockyou.txt targets.txt

Cracking Linux Shadow Files (Unshadow Workflow)

John handles system authentication structures natively by merging configuration databases:

Bash

# Step 1: Combine passwd and shadow files into a cohesive crackable layout
unshadow /etc/passwd /etc/shadow > unshadowed.txt

# Step 2: Run the attack using John's default internal rule settings
john --wordlist=/usr/share/wordlists/rockyou.txt unshadowed.txt

Checking Found Credentials

Bash

john --show unshadowed.txt

5. Situational Problem Solving (Troubleshooting)

Problem 1: "Hashcat returns an 'Assocated hash encoding salt length exception' error"

Root Cause: The input format is broken. Fast hashes (MD5/SHA) cannot have extra white spaces, trailing newlines, or username descriptions appended without explicit syntax flags.

Resolution: Clean the target file using string utilities:

Bash

# Clean trailing spaces and convert strings to lowercase completely
tr -d ' ' < broken_hashes.txt | tr '[:upper:]' '[:lower:]' > clean_hashes.txt

Problem 2: "Bcrypt cracking speeds are painfully slow ($<500$ hashes/sec)"

Root Cause: This is expected behavior. Bcrypt's internal cost factor causes it to compute deliberately slow loops to mitigate massive computing arrays.
Resolution: Do not attempt massive multi-gigabyte wordlists right away. Optimize your dictionary strategy:

1. Extract custom words from the target's public-facing website using cewl -w custom.txt http://target.htb.


Run top-tier password structures first (e.g., rockyou.txt trimmed down to the top 10,000 entries).

Problem 3: "John the Ripper fails to recognize a valid SSH Private Key"

Root Cause: Modern keys must be stripped of extraneous header markers and reformatted into a standard linear cryptographic string.

Resolution: Process the file through the appropriate formatting tool before attacking:

Bash

ssh2john id_rsa > rsa_hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt rsa_hash.txt