# KRB Analyzer Pre-Auth Data

**URL:** <https://community.zeek.org/t/krb-analyzer-pre-auth-data/4850>\
**Category:** Development\
**Tags:** development\
**Created:** [May 19, 2017, 2:01pm UTC](https://community.zeek.org/t/krb-analyzer-pre-auth-data/4850 "2017-05-19T14:01:39Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![John\_Rollinson](https://avatars.discourse-cdn.com/v4/letter/j/e480ec/32.png) [@John\_Rollinson](https://community.zeek.org/u/John_Rollinson)\
**Post date:** [May 19, 2017, 2:01pm UTC](https://community.zeek.org/t/krb-analyzer-pre-auth-data/4850/1 "2017-05-19T14:01:39Z")

</div>

I am working on improving Bro’s ability to detect Kerberos attacks (specifically certain instances of Skeleton Key attacks and encryption downgrades) which requires adjusting what information Bro passes up to the scripting layer. Generic breakdown on some of the attacks and detection methods can be found here ([https://www.blackhat.com/docs/eu-15/materials/eu-15-Beery-Watching-The-Watchdog-Protecting-Kerberos-Authentication-With-Network-Monitoring-wp.pdf](https://www.blackhat.com/docs/eu-15/materials/eu-15-Beery-Watching-The-Watchdog-Protecting-Kerberos-Authentication-With-Network-Monitoring-wp.pdf)).

Currently, Bro treats the ETYPE\_INFO and ETYPE\_INFO2 parts of the KRB Error packets the same and only extracts the password salts (if they exist). Because all of the pre-auth data gets stored into the KRB::Type\_Value\_Vector data structure, making all of the data in the ETYPE\_INFO2 sections will likely require modifying the structure of how pre-auth data is stored and made accessible in scripts.

Is anyone currently using information from “pa\_data” in any scripts (especially the salt information from ETYPE\_INFO2 fields)? I’d like to understand how other people are using this data currently so that I can make sure I don’t break use cases in the process.

Also, are there any recommendations for other parts of Bro’s code to study as good examples of passing back highly variable data structures?

-John

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/krb-analyzer-pre-auth-data/4850/2 "2022-05-06T15:44:57Z")

</div>