diff --git a/red-teaming/bloodhound/Handy-BloodHound-Cypher-Queries.md b/red-teaming/bloodhound/Handy-BloodHound-Cypher-Queries.md index d428c7b..43525c5 100644 --- a/red-teaming/bloodhound/Handy-BloodHound-Cypher-Queries.md +++ b/red-teaming/bloodhound/Handy-BloodHound-Cypher-Queries.md @@ -400,7 +400,7 @@ MATCH (o:OU)-[:Contains]->(c) RETURN o.name,o.guid, COUNT(c) ORDER BY COUNT(c) D - Retrieves nodes having particular juicy keywords in their name or description properties: ``` -UNWIND ["admin", "amministratore", "contrase", "empfidlich", "geheim", "hasło", "important", "azure", "MSOL", "Kennwort", "parol", "parola", "pass", "passe", "secret", "secreto", "segreto", "sekret", "sensibil", "sensibile", "sensible", "sensitive", "wrażliw"] AS word MATCH (n) WHERE (toLower(n.name) CONTAINS toLower(word)) OR (toLower(n.description) CONTAINS toLower(word)) RETURN word, n.name, n.description ORDER BY n.name +UNWIND ["admin", "amministratore", "contrase", "empfindlich", "geheim", "hasło", "important", "azure", "MSOL", "Kennwort", "parol", "parola", "pass", "passe", "secret", "secreto", "segreto", "sekret", "sensibil", "sensibile", "sensible", "sensitive", "wrażliw"] AS word MATCH (n) WHERE (toLower(n.name) CONTAINS toLower(word)) OR (toLower(n.description) CONTAINS toLower(word)) RETURN word, n.name, n.description ORDER BY n.name ``` - Retrieves nodes that contain UNC paths to SMB shares in their description fields: @@ -480,4 +480,4 @@ DOMAIN USERS@WINDOMAIN.LOCAL - AdminTo -> SECWWKS1000000.WINDOMAIN.LOCAL - Gener - Hausec - https://hausec.com/2019/09/09/bloodhound-cypher-cheatsheet/ - Jeffmcjunkin - https://gist.github.com/jeffmcjunkin/7b4a67bb7dd0cfbfbd83768f3aa6eb12 -- seajaysec - https://gist.github.com/seajaysec/c7f0995b5a6a2d30515accde8513f77d \ No newline at end of file +- seajaysec - https://gist.github.com/seajaysec/c7f0995b5a6a2d30515accde8513f77d