LearnTrack
Identity
An identity test looks at how people prove who they are: whether anyone can send mail as the domain, which passwords people pick, and which MFA prompts they approve. It is not a phishing campaign, which belongs to social engineering, and it does not cover the applications those identities sign in to.
2 pages
What am I looking at
- I have a domain and want to know if it can be spoofed Recon SPF, DKIM and DMARC: test email spoofing
- I have a list of user accounts Access Password spraying and MFA fatigue testing
- I have a valid password but MFA blocks me Access Password spraying and MFA fatigue testing
- I have a stolen session token Persistence Not yet written
Kill chain
-
Recon
- SPF, DKIM and DMARC: test email spoofing Email authentication records are public, so this is one of the few checks we can complete before a test starts. The question we answer is narrow: can someone send mail that shows the client's exact domain in the From line and reach an inbox?
-
Access
- Password spraying and MFA fatigue testing Password spraying tries one likely password against many accounts, staying under every account's lockout threshold. MFA fatigue sends push approvals to a user until one is accepted.
-
Escalation
Not yet written.
-
Persistence
Not yet written.
-
Impact
Not yet written.
-
Report
Not yet written.