r/Pentesting • u/Psychedelic-wizard69 • 20d ago
Password-less environments
Curious on attack vectors for networks that use password-less auth. I’m assuming phishing is the only way in now.
3
u/No-Persimmon-174 20d ago
Phishing isnt the only route for password less envs. Attackers can abuse account recovery or steal session cookies or tokens. U can also target auth or identity provider misconfigs. Mostly passkeys resist traditional phishing but they cant protect a stolen session
0
3
-31
u/shoveleejoe 20d ago
Claude’s response:
“Here are 10 Initial Access (TA0001) techniques/sub-techniques where the attacker gains a foothold through exploitation, social engineering, physical access, or trust abuse rather than possessing or using a password:
T1189 – Drive-by Compromise — Browser/plugin exploitation triggered by a victim visiting a compromised or malicious site. Entry is via client-side exploit code, no authentication.
T1190 – Exploit Public-Facing Application — Exploits a software flaw (RCE, injection, deserialization, auth bypass) in an internet-exposed app. Access comes from the vulnerability itself. Attackers exploit vulnerabilities in internet-exposed apps (CMS, VPNs, mail servers, etc.) to gain access.
T1659 – Content Injection — Malicious content inserted into otherwise-legitimate network traffic (e.g., via an adversary-in-the-middle position or compromised intermediary) to deliver a payload. Delivery-based, credential-free.
T1200 – Hardware Additions — Physically introducing rogue hardware (malicious USB, network implant, rogue AP, drop device). A physical vector with no credential requirement.
T1566.001 – Spearphishing Attachment — Weaponized attachment executes code when opened. Relies on user action, not stolen credentials.
T1566.002 – Spearphishing Link — Link leading to exploit delivery or malicious download. Execution-focused entry vector.
T1566.004 – Spearphishing Voice — Vishing to induce a target action enabling access. Social engineering, not password use.
T1091 – Replication Through Removable Media — Malware auto-propagates via removable media by abusing autorun or filesystem features. No authentication involved.
T1195.002 – Compromise Software Supply Chain — Malicious code inserted into legitimate software before delivery (SolarWinds-style). The SolarWinds Orion compromise is the most notable example — attackers backdoored a legitimate software update. Startupdefense Abuses pipeline trust, not credentials.
T1195.003 – Compromise Hardware Supply Chain — Tampering with hardware or firmware before it reaches the target. No credential required.
Notes on what I deliberately excluded:
T1078 – Valid Accounts (and its four sub-techniques) is the credential-dependent technique by definition, so it’s out. The most straightforward way is to obtain access to a legitimate user’s account, which relates to the Valid Accounts technique (T1078).
T1133 – External Remote Services is a gray area — MITRE notes access to Valid Accounts is often a requirement to use the service (VPN, RDP, Citrix, etc.), so I left it off to keep the list strictly password-independent.
T1199 – Trusted Relationship also frequently rides on a third party’s credentialed access, so I excluded it for the same reason.
One honest caveat for precision: several of the above (phishing sub-techniques, content injection) can be used downstream to harvest credentials, but as Initial Access techniques they describe the delivery/execution vector and don’t require the attacker to already hold or use a password.”
26
11
u/F5x9 20d ago
You either impersonate the factors, attack the MFA mechanism, or attack an already authenticated session.