Skip to content

"check for random user" may better be called "check for guest access" #53

@4elta

Description

@4elta

... because, i guess, this is the ultimate goal of this test: verify whether a non-existing user is mapped to the guest account.
the scan results (text, JSON, CSV) should then also reflect that:
session : random_user --> session : guest_access

When we connected as a user that doesn’t exist, the server was aware of it so it implicitly falls back to the guest account of the domain.

-- https://sensepost.com/blog/2024/guest-vs-null-session-on-windows/

see also smb.conf: map to guest

i could prepare a PR with the required changes if you want me to.

salut 🙂

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions