One Day Sec

What is SharpSniper and what prerequisite is needed to use it?

SharpSniper is a tool that locates the IP address of a specified domain user in a domain environment. It requires permissions to read domain controller logs, as it queries Event ID 4624 (login) events. For more details, see the Analysis of SharpSniper Exploitation.
SharpSniperdomain controller logsEvent ID 4624domain user IP

Browse all Q&A →