KZhead

Bypassing SmartScreen on Web Browsers

John Hammond
2024 ж. 17 Сәу.
55 967 Рет қаралды
Жүктеу

jh.live/keeper || Keeper Security offers a privileged access management solution to deliver enterprise grade protection all in one unified platform -- keep your users, your data, and your environment secure with Keeper! jh.live/keeper
Learn Cybersecurity - Name Your Price Training with John Hammond: nameyourpricetraining.com
📧JOIN MY NEWSLETTER ➡ jh.live/email
🙏SUPPORT THE CHANNEL ➡ jh.live/patreon
🤝 SPONSOR THE CHANNEL ➡ jh.live/sponsor
🌎FOLLOW ME EVERYWHERE ➡ jh.live/twitter ↔ jh.live/linkedin ↔ jh.live/discord ↔ jh.live/instagram ↔ jh.live/tiktok
💥 SEND ME MALWARE ➡ jh.live/malware
🔥KZhead ALGORITHM ➡ Like, Comment, & Subscribe!

Пікірлер

  • Thanks for the shout! And you got it right - Hell - E

    @JoeHellethemayor@JoeHellethemayor17 күн бұрын

    • hi

      @sussteve226@sussteve22617 күн бұрын

    • As of this comment, JH didn't share the link for that article. Can you link a brother up?

      @sigitas909@sigitas90917 күн бұрын

    • Hi Joe!

      @onemoreguyonline7878@onemoreguyonline787817 күн бұрын

    • @@sussteve226 ٢

      @MaysaAhmed-jz7sp@MaysaAhmed-jz7sp6 күн бұрын

  • I don't mind having them put warnings when I try access a supposed "dangerous" link, but now they don't even present the option to advance anyway. This makes me worry about the future where you can't access something because someone of a higher power said No, not because it is dangerous, but because they don't want people to access.

    @mclarenf1gtr99@mclarenf1gtr9917 күн бұрын

    • you can literally just use any other browser that doesn't have safe browsing, nothing to worry.

      @L2002@L200217 күн бұрын

    • on chrome, just type 'thisisunsafe' and will let you through

      @angeleeh@angeleeh17 күн бұрын

  • Err, seems overly complicated when you can: Open "App & browser control" settings Choose "Reputation-based protection settings". Toggle off the switches for "Check apps and files" and "SmartScreen for Microsoft Edge".

    @ThemePro24@ThemePro2417 күн бұрын

    • The point of the issue wasn't that there is some other way to do it. It is that SmartScreen fails open when it can't call home, rather than falling back on something else to handle it.

      @JoeHellethemayor@JoeHellethemayor17 күн бұрын

    • @@JoeHellethemayori learned a lot from your pivoting course, thank you for that… you really motivated me

      @funil6871@funil687117 күн бұрын

    • @@JoeHellethemayor Yep. the whole idea is.. WAIT YOU"RE THE GUY FROM THE VIDEO *HIGH FIVE*. okay. back to reality. The whole idea is that, given a compromised DNS, you can not just redirect people to malicious pages... but you can make the pages acceptable in browsers. It's a big given, but it's still useful info.

      @SaintSaint@SaintSaint17 күн бұрын

  • you could also set up a small tcp server that always returns true and add it on the hosts of your co-worker... now he's gonna have the red screen for every site he browses 😂

    @RodrigoPhysicist@RodrigoPhysicist17 күн бұрын

    • That's just evil, man! :D

      @CZghost@CZghost17 күн бұрын

    • oh dude I really want to do this now i would integrate this in my troll tool and it would be so funny

      @Spiderfffun@Spiderfffun17 күн бұрын

    • you need admin rights?

      @L2002@L200217 күн бұрын

    • That is the punishment people deserve for using edge in the first place 😂

      @funil6871@funil687117 күн бұрын

    • @@L2002 yes.

      @SaintSaint@SaintSaint17 күн бұрын

  • This man is relentless ❤🔥

    @ThisIsJustADrillBit@ThisIsJustADrillBit17 күн бұрын

  • After watching his videos i learnt many things including how to be daring and crazy because this gave me inspiration 🤣 I love his content

    @arjunraghunadhan3611@arjunraghunadhan361117 күн бұрын

  • “He was messing around with his piehole “ ohh joel tsk tsk tsk 😂😂😂

    @b3twiise853@b3twiise85317 күн бұрын

    • Thats crazy

      @5iddd@5iddd17 күн бұрын

    • Security researchers always be testing stuff with their pieholes.....

      @GustavoPinho89@GustavoPinho8917 күн бұрын

    • hope he wasn't doing it on company time

      @vuufke4327@vuufke432717 күн бұрын

  • One possible thing MS and/or Google could do is that if it can't reach the destination of the safe browsing/smart screen DNS, it flashes an error on the screen warning about this nefarious behaviour of your local network, before it lets you to interact with any page. If you didn't do this, you might want to investigate.

    @CZghost@CZghost17 күн бұрын

  • I always had a weird feeling AVs blocking Bloodhound and even maybe mimikatz. I always thought about AVs that protect me from being compromised but in those cases it limits my usage of the machine. Yea, they can be used to compromise OTHER accounts and machines but it's weird that they limit me doing it even in a non AD joined machine. I want AVs to protect me from compromise and then not to moralize about what I want to do with my life!

    @SzaboB33@SzaboB3317 күн бұрын

    • It's within a security tool's interest to block downloads of attacker tools, including Bloodhound and Mimikatz. If an attacker gained user priveleges on a host and Microsoft allowed users to freely download hacking tools from Github, that'd be a very convenient loophole to onboard tools. It's much better to download and use those tools using a sandbox environment without Defender/security features enabled, or even better just stick to a Kali distro where this wouldn't be an issue

      @ThatBlueFalcon@ThatBlueFalcon17 күн бұрын

    • How does the AV differentiate between you using these tools and an adversary on your machine using them? It can't

      @BryanLu0@BryanLu016 күн бұрын

  • Thank you for this😃 i leant something new today

    @ramseyibe2844@ramseyibe284417 күн бұрын

  • John just in case if you don't have admin rights on a laptop like your office laptop in that case that Joe solution is more scalable than that of yours. But, still you are the King.

    @Hybrid_Netowrks@Hybrid_Netowrks14 күн бұрын

  • Yeah man another great video 🎉

    @heeshsusnwo666qsbwsjsjeuhwsns@heeshsusnwo666qsbwsjsjeuhwsns17 күн бұрын

  • It's def a neat trick to stick in the tool belt and also as a mental exercise to possible defeat other security look up based measures. I think a good question here is why doesn't Microsoft and other big tech companies bypass DNS for these type of things?

    @86ajmn@86ajmn16 күн бұрын

  • nice work john

    @torsec6048@torsec604816 күн бұрын

  • Thanks for more formation ⚡🐦‍🔥❤️‍🔥

    @cyber_space09@cyber_space0917 күн бұрын

  • Very interesting, great video bro 👍

    @ancestrall794@ancestrall79417 күн бұрын

  • Cool, but is it not more easier to turn it of the SmartScreen ? Maybe by registry or in edge itself? Or is it to avoid the message pops up you turn off SmartScreen ?

    @claudiafischering901@claudiafischering90117 күн бұрын

    • It's the fact that other people could block these urls and cause smartscreen to fail

      @BryanLu0@BryanLu016 күн бұрын

  • very interesting analysis..loved the video

    @TechnicalHeavenSM@TechnicalHeavenSM13 күн бұрын

  • Thank you, i have just built a Defender hunting query to notify us if the hosts file is modified and or if a request to a Microsoft or google domains returns an IP that's not publically routable (as its then been hijacked or sinkholes), many thanks.

    @chrisjinks5414@chrisjinks541417 күн бұрын

  • informative

    @paritoshbhatt@paritoshbhatt16 күн бұрын

  • Algorithm boost go!!!

    @rohit.vikram@rohit.vikram16 күн бұрын

  • Microsoft traditionally says that local administrator access being required for anything nullifies any merit to it as a vulnerability.

    @logiciananimal@logiciananimal17 күн бұрын

  • Great john

    @funil6871@funil687117 күн бұрын

  • I have definitely learned a lot from you and Ryan Montgomery. As well as from David Bombal and Network Chuck. Thanks for all you do and keep them coming.

    @cmarines7@cmarines717 күн бұрын

  • great Video

    @KyleRice@KyleRice17 күн бұрын

  • Pi-hole can also be ran in a Docker container

    @luketurner314@luketurner31416 күн бұрын

  • Am I correct in thinking that this could be a risk in public networks as well?

    @patrickreuvekamp@patrickreuvekamp16 күн бұрын

    • If you mean, you have trouble trusting open source software/code. I wouldn't blame you, you should be careful. That's why most people use RPIs and Visual computers when playing around, but even then. Should still be sus of it.😒

      @wildstorm74@wildstorm7416 күн бұрын

  • Hi John, are you planning to do a live demo about the most recent Palo Alto CVE related to Globalprotect RCE?

    @amaurisrodriguez9914@amaurisrodriguez991417 күн бұрын

    • If you would know the licensing costs to Palo Alto you would not be asking this. It's pretty much among the lines if you need to ask how much it is you can't afford it. When I was in Uni that does co-operation with their development team we had discounted licensing to PA-220 and even price for that was eye watering.

      @xYarbx@xYarbx16 күн бұрын

  • You can also block the call to their connection test server and you device will have internet access but the Network Icon will change to "No internet access"

    @Crysal@Crysal17 күн бұрын

  • This is exactly how I get all my streaming and other things to work on ✈️ Internet. Try it out next time you're flying

    @aabdulr@aabdulr15 күн бұрын

  • can you call the download in terminal to avoid the download via browser? or does it still flag it?

    @demonagito666@demonagito6668 күн бұрын

  • how ur that smart ❤

    @usaidkbf@usaidkbf17 күн бұрын

  • Interesting.

    @carsonjamesiv2512@carsonjamesiv251217 күн бұрын

  • OTW

    @professional.hacker.@professional.hacker.17 күн бұрын

  • Did they really contact Microsoft? 😂it's really a basic attack. I also wouldn't call it a security bug. What do you want them to do? Prevent you from downloading any file until you fix your network? Yeah, doesn't make sense.

    @L2002@L200217 күн бұрын

    • yea. i agree. still cool to see

      @xdestino@xdestino17 күн бұрын

  • I'm curious about the CRDOWNLOAD file. While it is a temp file, I am guessing to check there is enough space to complete the download, in this instance, does it download the whole file? Or does it check with google/microsoft before completing the download and then flag it? If it does, can the extension be changed to give the original file?

    @lfcbpro@lfcbpro17 күн бұрын

    • It's the browser temporarily saving info about the file, which can be used to start off where you left off if, for example, you lose internet for a moment. It can also be used for pausing/unpausing file downloads. That's what I know about CRDOWNLOAD, although I must admit I don't know a ton about it.

      @mollthecoder@mollthecoder17 күн бұрын

  • please do a pihole video

    @davisjansons7384@davisjansons738417 күн бұрын

  • This is a little bit of an issue, and good to know, but it takes a lot more in a real world scenario, and if you can do this, you can probably do something much more meaningful.

    @Spiderfffun@Spiderfffun17 күн бұрын

  • doesn't need to go and investigate every url just sinkhole the whole smartscreen and its subdomains with wildcard thats just saves time, unless someone wants fine grain control

    @ankanroy2@ankanroy216 күн бұрын

  • You should always update windows John...

    @younjesus4087@younjesus408717 күн бұрын

    • It's a VM used for demos...

      @nordgaren2358@nordgaren235817 күн бұрын

  • Anyone know where I can get that hacker/hunter shirt he is wearing?

    @mattjohnson6276@mattjohnson627616 күн бұрын

  • Thanks for the video! But is there a way to bypass the verification of phishing site that was made, for example, by security team of a company to educate the personnel? It is possible of course to distribute those changes to hosts file to all assets, but this can be dangerous, since no verification will be made for real malicious sites.

    @andrejs.smirnovs@andrejs.smirnovs17 күн бұрын

    • If the company makes the phishing site for personnel only then it really shouldn't end up on a SmartScreen or Safe Browsing list.

      @mollthecoder@mollthecoder17 күн бұрын

  • I wish to see what data browser sends to these addresses

    @msalih@msalih17 күн бұрын

  • you think the browser would notify you "hey some wierd stuff is going on with your dns settings we cant access smartscreen/url screening but your connected.. 🤔 it could just check another dns name for internet check and use those domains its checking as a sanity check for tampering

    @ToniMorton@ToniMorton13 күн бұрын

    • i think a solution would be a notification explaining your dns settings may have been altered or something just in the case of malware but i guess av is kinda the limit here? hmmm i feel like the browser could totally help notify the user of tampering here tho

      @ToniMorton@ToniMorton13 күн бұрын

  • This is just yet another example of why i only use Windows exclusively for gaming and Linux for everything else cos with Linux i get much better privacy and security and complete control of almost everything on my computer without having to jump through hoops.

    @draugr7693@draugr769317 күн бұрын

    • you know that the security of SmartScreen/Safe Browsering in Windows and Linux are same?!

      @L2002@L200217 күн бұрын

    • i use linux for everything because proton is awesome :3 the only instance of windows i will allow on my laptop is the stripped-down edition of win11, locked down in ~300gb of storage space to make sure i can have both D2 and fl studio alongside it

      @thesoftone@thesoftone17 күн бұрын

  • useful technique could be used to find malware, but I would use wget or curl for download bit? sorry Linux convert 80)

    @6pfk@6pfk16 күн бұрын

    • Oh! could block Microsoft spyware?????

      @6pfk@6pfk16 күн бұрын

  • Eeww dude what are you using? Edge?

    @Sourpusscandy@Sourpusscandy17 күн бұрын

    • 😂😂😂😂

      @notyoursanymore9027@notyoursanymore902717 күн бұрын

  • 🤞🏾

    @Pem7@Pem713 күн бұрын

  • If I need to download blocked files, I simply wget, or curl them.

    @Serpensin@Serpensin17 күн бұрын

  • Classic host file trick

    @rainbowdoesinfosec@rainbowdoesinfosec17 күн бұрын

  • Just disable it in Edge settings.

    @RyderCragie@RyderCragie4 күн бұрын

  • Invoke-webrequest?

    @Peccavi75@Peccavi7516 күн бұрын

  • " yES"

    @user-ow1vi4op4u@user-ow1vi4op4u16 күн бұрын

  • Not recommended, but good to know.

    @FusionDeveloper@FusionDeveloper17 күн бұрын

  • Nice no more Meet circle crap.

    @sussteve226@sussteve22617 күн бұрын

  • John thought on youtube was being hacked

    @crunchied8@crunchied817 күн бұрын

  • Bloodhound😂

    @cybersecadventures01123@cybersecadventures0112317 күн бұрын

  • Isn't the hosts file a bad option nowadays, because Windows regularly reset hosts files?

    @onemoreguyonline7878@onemoreguyonline787817 күн бұрын

  • please tell how to bypass verify browser from Cloudflare

    @sameulbasheer2006xpc@sameulbasheer2006xpc17 күн бұрын

    • You don't

      @Sammysapphira@Sammysapphira17 күн бұрын

    • You won't see it up here as a KZhead tutorial, because Cloudflare is way more serious. If you're able to bypass Cloudflare, then they would likely pay a good amount of money for you to tell them how. Or it might get sold to a government for even more money than Cloudflare would pay, in which case it would be even better kept under wraps.

      @mollthecoder@mollthecoder17 күн бұрын

  • what if a new malware turned off smartscreen using this to then download other malware.

    @Boxersteavee@Boxersteavee8 күн бұрын

  • Brave browser ftw.

    @grimsquirrels@grimsquirrels17 күн бұрын

  • I could see a scammer using this. If they get the local user to run a script or command to modify the host file, they can then have them download malicious files.

    @unknownentity5354@unknownentity535417 күн бұрын

    • If they get the user to run a malicious script with administrator privileges then there's no need to convince the user to download more files from their browser - the script itself could download any necessary files.

      @mollthecoder@mollthecoder17 күн бұрын

  • Maybe you could use this for a man in the middle attack, though if you already have a man in the middle thing going, I think there might be worse things you can do.

    @m4rt_@m4rt_17 күн бұрын

  • this is not an issue, it's a feature

    @brbl415@brbl41510 күн бұрын

  • Smartscreen blocking downloaded files from opening is dead simple to get around with some DIR /R shenanigans too. Just modify the zone datastream to a 1, or delete it altogether and problem solved 🤣

    @wardrich@wardrich17 күн бұрын

  • I am still waiting for xz video

    @BunnyKhatri-pd8zm@BunnyKhatri-pd8zm17 күн бұрын

  • great video ! , 10 hours later its patched XD

    @harze6818@harze681816 күн бұрын

  • The fact that Microsoft blocked their own website is beyond me

    @themirrazz@themirrazz16 күн бұрын

    • Wdym

      @paillat@paillat16 күн бұрын

  • You might want to change thumbnail It looks like the video is banned

    @SocialIPO@SocialIPO17 күн бұрын

  • microsoft try to not mess with their users challenge (impossible)

    @thesoftone@thesoftone17 күн бұрын

  • 1

    @cleitongbr@cleitongbr17 күн бұрын

  • Doing a MITM or honey pot would allow you to block those as well.

    @robottwrecks5236@robottwrecks523617 күн бұрын

  • Hey don't be mad at google, bloodhounds are good boyyyys! 🐶

    @DavidAlvesWeb@DavidAlvesWeb17 күн бұрын

  • no1 would need to do this esp a victum pointless video!

    @JNET_Reloaded@JNET_Reloaded17 күн бұрын

    • Maybe if you watched the first five minutes of the video, you'd know what use cases it's for?

      @nordgaren2358@nordgaren235817 күн бұрын

  • starts @5:00 mins boring bs needs to be cut out!

    @JNET_Reloaded@JNET_Reloaded17 күн бұрын

  • China is using strong firewall to protect its cyberspace.. How can we enter or control chinese internet ? I wish you make video about that

    @infinite_flesh@infinite_flesh13 күн бұрын
KZhead