Index

  1. Introduction to Information Security and Ethical Hacking
  2. Reconnaissance and Footprinting
  3. Scanning and Enumeration
  4. System Hacking
  5. Malwares
  6. Sniffing
  7. Social Engineering
  8. Evading IDS, Firewalls and Honeypots
  9. Denial of Service
  10. Session Hijacking
  11. Hacking Web Servers
  12. Hacking Web Applications
  13. Hacking Wireless Networks
  14. Hacking IoT and Mobile Platforms
  15. Pentesting
  16. Cloud Computing
  17. Cryptography

0. Introduction

Fundamental Security Concepts

The whole principle is to avoid Theft, Tampering and Disruption of the systems through CIA Triad (Confidentiality, Integrity and Availability).

Note: In addition, other properties, such as authenticity, accountability, non-repudiation and reliability can also be involved. (ISO/IEC 27000:2009)

Security, Functionality and Usability balance

There is an inter dependency between these three attributes. When security goes up, usability and functionality come down. Any organization should balance between these three qualities to arrive at a balanced information system.

Types of Hackers

Script Kiddie / Skiddies - Unskilled individual who uses malicious scripts or programs, such as a web shell, developed by others to attack computer systems and networks and deface websites.

State-Sponsored Hacker - Hacker that is hired by a government or entity related.

Hacktivist - Someone who hacks for a cause; political agenda.

Suicide Hackers - Are hackers that are not afraid of going jail or facing any sort of punishment; hack to get the job done.

Cyberterrorist - Motivated by religious or political beliefs to create fear or disruption.

Hacking Vocabulary

Threat Categories

Attack Vectors

Path by which a hacker can gain access to a host in order to deliver a payload or malicious outcome

Attack Types

1. Operating System

Attacks targeting OS flaws or security issues inside such as guest accounts or default passwords.

2. Application Level

Attacks on programming code and software logic.

3. Misconfiguration

Attack takes advantage of systems that are misconfigured due to improper configuration or default configuration.

4. Shrink-Wrap Code

Act of exploiting holes in unpatched or poorly-configured software.

Vulnerabilities

Vulnerability Categories

Pen test Phases (CEH)

  1. Pre-Attack Phase - Reconnaissance and data-gathering.
  2. Attack Phase - Attempts to penetrate the network and execute attacks.
  3. Post-Attack Phase - Cleanup to return a system to the pre-attack condition and deliver reports.

⚠️ For the exam, EC-Council brings his own methodology and that's all you need for the exam; you can check another pentesting methodologies here if you are interested; In case you are studying to become a professional pentester besides certification content, I recommend the OSSTMM (Open Source Security Testing Methodology Manual).

The Five Stages of Ethical Hacking

1. Reconnaissance

Gathering evidence about targets; There are two types of Recon:

2. Scanning & Enumeration

Obtaining more in-depth information about targets.

3. Gaining Access

Attacks are leveled in order to gain access to a system.

4. Maintaining Access

Items put in place to ensure future access.

5. Covering Tracks

Steps taken to conceal success and intrusion; Not be noticed.

Three Types of Active Defense

Information Assurance (IA)

Refers to the assurance of the Integrity, Availability, confidentiality, and authenticity of information and information systems during usage, processing, storage and transmission of information.

Information Security Management Program

Combination of policies, processes, procedures, standards, and guidelines to establish the required level of information security.

infosec

⚠️ IA focus on risk assessment, mitigation side of things; ⚠️ InfoSec focus on actually implementing security measures to safeguard systems.

EISA - Enterprise Information Security Architecture

Set of requirements, process, principles, and models that determines the structure and behavior of an organization's information systems.

Physical Security Controls

Most of security controls are preventive phase controls.

⚠️ Defense in Depth: Multiple layers of security controls; Provides redundancy in the event of a control failure. (e.g.: image below)

defense-in-depth

Types of Security Controls

Description Examples
Physical Guards, lights, cameras, fire extinguishers, flood protection
Administrative Training awareness, policies, procedures and guidelines to infosec
Technical IDS/IPS, Firewall, Encryption, Smart cards, Access control lists
Description Examples
Preventative authentication, alarm bells
Detective audits, backups
Corrective restore operations

Managing the Risk

Risk can be defined as a probability of the occurrence of a threat or an event that may damage, or cause loss or have other negative impact either from internal or external liabilities.

Risk matrix

A risk matrix is used during risk assessment to define the level of risk by considering the category of probability or likelihood against the category of consequence severity.

matrix

Risk Management

Is the identification, evaluation, and prioritization of risks followed by coordinated and economical application of resources to minimize, monitor, and control the probability or impact of unfortunate events or to maximize the realization of opportunities.

Phases of Risk Management

Threat Modeling

Is a risk assessment approach for analyzing the security of an application by capturing, organizing and analyzing all the information that affects the security of an application.

  1. Identify Objectives
  2. Application Overview
  3. Decompose Application
  4. Identify Threats
  5. Identify Vulnerabilities

Security Policies

  1. Policies - High-level statements about protecting information; Business rules to safeguard CIA triad; Security Policies can be applied on Users, Systems, Partners, Networks, and Providers.
  2. Procedures - Set of details steps to accomplish a goal; Instructions for implementation
  3. Guidelines - Advice on actions given a situation; Recommended, not mandatory

Security Policy - Examples

Security Policiy - Types

  1. Promiscuous Policy - This policy usually has no restrictions on usage of system resources.

  2. Permissive Policy - This policy begins wide open and only know dangerous services/attacks or behaviors are blocked. This type of policy has to be updated regularly to stay effective.

  3. Prudent Policy - This policy provides maximum security while allowing known but necessary dangers. This type of policy will block all services and only safe/necessary services are enabled individually. Everything is logged.

  4. Paranoid Policy - This policy forbids everything. No Internet connection or severely restricted Internet usage is allowed.

Security Policy - Creation Steps

  1. Perform a Risk Assessment
  2. Use security Standards and Frameworks as guide
  3. Get Management and Staff input
  4. Enforce the policy. Use penalties for non-compliance
  5. Publish final draft to entire org.
  6. Have all staff read/sign that they understood policy
  7. Employ tools to help enforce policy
  8. Staff training
  9. Review and update regularly

Incident Management Process

An incident is an event that could lead to loss of, or disruption to, an organization's operations, services or functions.

Incident management is a term describing the activities of an organization to identify, analyze, and correct hazards to prevent a future re-occurrence.

  1. Preparation: Select people, assign rules, define tools to handle the incident.
  2. Detection & Analysis: Determine an incident has ocurred (IDS, SIEM, AV, Someone reporting, etc).
  3. Classification and Prioritization:
  4. Notification: Identify minor and major incident; who and how to notify an incident.
  5. Containment: Limit the damage; Isolate hosts; Contact system owners.
  6. Forensic Investigation: Investigate the root cause of the incident using forensic tools; System logs, real-time memory, network device logs, application logs, etc;
  7. Eradicate & Recovery: Remove the cause of incident; Patch if needed. Recovery: get back into production; Monitor affected systems.
  8. Post-incident Activities: Document what happened and why; Transfer knowledge.

Incident Response Team Duties

  1. Managing security issues by taking a proactive approach towards the customer's security vulnerabilities
  2. Developing or reviewing processes and procedures that must be followed
  3. Managing the response to an incident and ensuring that all procedures are followed correctly in order to minimize and control the damage
  4. Identifying and analyzing what has happened during an incident, including impact and threat
  5. Providing a single point of contact for reporting seucirty incidents and issues
  6. Reviewing changes in legal and regulatory requirements to ensure that all processes and procedures are valid
  7. Reviewing existing controls and recommending steps and technologies to prevent future incidents
  8. Establishing relationship with local law enforcement agency, gov. agencies, key partners and suppliers

SIEM - Security Information and Event Management

Collects data points from network, including log files, traffic captures, SNMP messages, and so on, from every host on the network. SIEM can collect all this data into one centralized location and correlate it for analysis to look for security and performance issues, as well negative trends all in real time.

Most Popular SIEM Tools:



Identity and Access Management

Identification, Authentication, Authorization, and Accounting work together to manage assets securely.

1. Identification

The information on credentials identifies the user.

2. Authentication

“Prove you are the legitimate User". – Should always be done with Multifactor Authentication!

🛑 Multi-factor authentication *generally uses two of this examples (e.g. - Something you Know(1) and Something you Have(2)*, never on same category

3. Authorization concepts

What are you allowed to access – We use Access Control models, what and how we implement depends on the organization and what our security goals are.

4. Accouting

Trace an Action to a Subjects Identity:

Access Controls Models

⚠️ Access is defined by ACL, Access Control List. ⚠️ Implicity deny prevents access unless specifically permitted.

Data Loss Prevention (DLP)

Data Loss Prevention (DLP) is the practice of detecting and preventing data breaches, exfiltration, or unwanted destruction of sensitive data. Organizations use DLP to protect and secure their data and comply with regulations.

Organizations typically use DLP to:

Data Backup

Data backup plays a crucial role in maintaining business continuity by helping org. recover from IT disasters, security breaches, application failures, human error, etc.

All regulatory compliance such as COBIT, SSAE, SOCII, PCI-DSS, HIPPA, SOX, FINRA, FISMA, GDPR, etc. require business to maintain data backups of critical data for specified duration.

Backup Strategies

  1. Identifying the critical business data
  2. Selecting the backup media
  3. Selecting a backup technology
  4. Selecting the appropriate RAID levels
  5. Selecting an appropriate backup method

3 Backup methods

1. Cold backup 🔵

2. Warm backup 🟡

3. Hot backup 🔴

Penetration Test - Basics

This topic will be covered with details in Chapter 14 - Pentesting.

A penetration test, colloquially known as a pen test, pentest or ethical hacking, is an authorized simulated cyberattack on a computer system, performed to evaluate the security of the system.

⚠️ Not to be confused with a vulnerability assessment.

Law Categories

Laws and Standards:

OSSTM Compliance

"Open Source Security Testing Methodology Manual" maintained by ISECOM , defines three types of compliance.

PCI-DSS

"Payment Card Industry Data Security Standard" Standard for organizations handling Credit Cards, ATM cards and other POS cards.

ISO 27001

This International Standard has been prepared to provide requirements for establishing, implementing, maintaining and continually improving an information security management system.

ISO 27002 AND 17799

Based on BS799 but focuses on security objectives and provides security controls based on industry best practice.

HIPAA

"Health Insurance Portability and Accountability Act" a law that set's privacy standards to protect patient medical records and health information shared between doctors, hospitals and insurance providers.

SOX

"Sarbanes-Oxley Act" Law that requires publicly traded companies to submit to independent audits and to properly disclose financial information.

DMCA

"The Digital Millennium Copyright Act" is a 1998 United States copyright law that implements two 1996 treaties of the World Intellectual Property Organization. It criminalizes production and dissemination of technology, devices, or services intended to circumvent measures that control access to copyrighted works.

FISMA

"Federal Information Security Modernization Ac Of 2002" A law updated in 2004 to codify the authority of the Department of Homeland Security with regard to implementation of information security policies. (For GOV. agencies)

NIST-800-53

Catalogs security and privacy controls for federal information systems, created to help implementation of FISMA.

FITARA

"Federal Information Technology Acquisition Reform Act" A 2013 bill that was intended to change the framework that determines how the US GOV purchases technology.

COBIT

"Control Object for Information and Related Technology" IT Governance framework and toolset, created by ISACA and ITGI

GLBA

"U.S Gramm-Leach-Bliley Act" Law that protects the confidentiality and integrity of personal information that is collected by financial institutions.

CSIRT

"Computer Security Incident Response Team" CSIRT provided a single point of contact when reporting computer security incidents

ITIL

"Information Technology Infrastructure Library" - An operational framework developed in the '80s that standardizes IT management procedures

Essential Knowledge

OSI Model and TCP Model

Layer Device Type OSI Layer TCP/IP model TCP/IP New (actual) Protocols PDU
7 Gateway Application Application Application HTTP, FTP, POP, SMTP, DNS, RIP Data
6 - Presentation Application Application HTTP, FTP, POP, SMTP, DNS, RIP, MIME Data
5 - Session Application Application HTTP, FTP, POP, SMTP, DNS, RIP, SCP Data
4 - Transport Transport Transport TCP/UDP Segments
3 Router Network Internet Network IP, ARP, ICMP, IGMP Packets
2 Switch/bridge Data Link Link Data Link Ethernet, Token Ring Frames
1 Hubs/Repeater Physical Link Physical Ethernet, Token Ring Bits

TCP Handshake

The Three-way handshake

✅ TCP Connection establishment process

  1. Host A sends out a SYN (synchronize) packet with proposed initial sequence number to Host B.
  2. Host B receives SYN message, it returns a packet with both SYN and ACK flags (SYN-ACK) set in the TCP header.
  3. Host A receives the SYN-ACK, it sends back ACK (Acknowledgment) packet.
  4. Host B receives ACK and at this stage the connection is ESTABLISHED.

❌ TCP Connection termination

  1. Host A sends a FIN (finish) flag, indicating that is has finished sending the data.
  2. Host B who receives the FIN, doest not terminate the connection but enters into a "passive close" (CLOSE_WAIT) state and sends the ACK for the FIN back to the Host A.
  3. Host A enters into a (TIME_WAIT) state, and sends an ACK back to the Host B.
  4. Host B gets the ACK from the Host A and closes the connection.

⚠️ Sequence numbers increase on new communication. Example is computers A and B. A would increment B's sequence number. A would never increment it's own sequence.

TCP Flags

Flag Name Function
SYN Synchronize Set during initial communication. Negotiating of parameters and sequence numbers
ACK Acknowledgment Set as an acknowledgement to the SYN flag. Always set after initial SYN
RST Reset Forces the termination of a connection (in both directions)
FIN Finish Ordered close to communications
PSH Push Forces the delivery of data without concern for buffering
URG Urgent Data inside is being sent out of band. Example is cancelling a message

Port Numbers

Subnetting

1. Reconnaissance and Footprinting

⚡︎ This chapter have practical labs

Footprinting

Footprinting is a part of reconnaissance process which is used for gathering possible information about a target computer system or network.

When used in the computer security lexicon, "Footprinting" generally refers to one of the pre-attack phases; tasks performed before doing the actual attack. Some of the tools used for Footprinting are Sam Spade, nslookup, traceroute, Nmap and neotrace.

Footprinting Types: Active and Passive

Footprinting helps to:

Footprinting could be both passive and active. Reviewing a company’s website is an example of passive footprinting, whereas attempting to gain access to sensitive information through social engineering is an example of active information gathering.

During this phase, a hacker can collect the following information (only high-level information):

Can be:

Competitive Intelligence - information gathered by businesses about competitors

Alexa.com - resource for statistics about websites

Footprinting Objectives

Methods and Tools

Search Engines

Website Footprinting

Email Footprinting

DNS Footprinting

Network Footprinting

Usage example:

traceroute -I nsa.gov
traceroute to nsa.gov (104.83.73.99), 30 hops max, 60 byte packets
 1  192.168.63.2 (192.168.63.2)  0.194 ms  0.163 ms  0.150 ms
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  a104-83-73-99.deploy.static.akamaitechnologies.com (104.83.73.99)  42.742 ms  42.666 ms  25.176 ms

⚠️ Windows command - tracert ⚠️ Linux Command - traceroute

Other Relevant Tools

OSRFramework

⚡︎ OSRFramework has a practical lab

Uses open source intelligence to get information about target. (Username checking, DNS lookups, information leaks research, deep web search, regular expressions extraction, and many others).

Web Spiders

Obtain information from the website such as pages, etc.

Recon-ng

⚡︎ Recon-ng has a practical lab

Recon-ng is a web-based open-source reconnaissance tool used to extract information from a target organization and its personnel.

Provides a powerful environment in which open source web-based reconnaissance can be automated conducted, quickly and thoroughly.

Metasploit Framework

⚡︎ Metasploit has a practical lab

The Metasploit Framework is a tool that provides information about security vulnerabilities and aids in penetration testing and IDS signature development; This is a huge framework that provide Recon tools as well.

theHarvester

⚡︎ theHarvester has a practical lab

theHarvester is a OSINT tool; Useful for gathering information like:

Usage example:

theHarvester -d www.hackthissite.orgwww.hackthissite.org -n -b  google
table results already exists

*
*  _   _                                            _             *                                                                                        
* | |_| |__   ___    /\  /\__ _ _ ____   _____  ___| |_ ___ _ __  *                                                                                        
* | __|  _ \ / _ \  / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__| *                                                                                        
* | |_| | | |  __/ / __  / (_| | |   \ V /  __/\__ \ ||  __/ |    *                                                                                        
*  \__|_| |_|\___| \/ /_/ \__,_|_|    \_/ \___||___/\__\___|_|    *                                                                                        
*                                                                 *                                                                                        
* theHarvester 3.1.0                                         *                                                                                             
* Coded by Christian Martorella                                   *                                                                                        
* Edge-Security Research                                          *                                                                                        
* cmartorella@edge-security.comcmartorella@edge-security.com                                   *                                                                                        
*                                                                 *                                                                                        
*                                                                                        
                                                                                                                                                           
                                                                                                                                                           
[*] Target: www.hackthissite.orgwww.hackthissite.org 
                                                                                                                                                           
[*] Searching Google. 
        Searching 0 results.
        Searching 100 results.
        Searching 200 results.
        Searching 300 results.
        Searching 400 results.
        Searching 500 results.

[*] No IPs found.

[*] Emails found: 2
----------------------
ab790c1315@www.hackthissite.orgab790c1315@www.hackthissite.org
staff@hackthissite.orgstaff@hackthissite.org

[*] Hosts found: 7
---------------------
0.loadbalancer.www.hackthissite.org:
22www.hackthissite.org:
2522www.hackthissite.org:
253dwww.hackthissite.org:
www.hackthissite.org:137.74.187.104www.hackthissite.org:137.74.187.104, 137.74.187.100, 137.74.187.101, 137.74.187.103, 137.74.187.102
x22www.hackthissite.org:

[*] Starting active queries.
137.74.187.100
[*] Performing reverse lookup in 137.74.187.0/24
module 'theHarvester.discovery.dnssearch' has no attribute 'DnsReverse'

Sublist3r

Sublist3r enumerates subdomains using many search engines such as Google, Yahoo, Bing, Baidu and Ask. Sublist3r also enumerates subdomains using Netcraft, Virustotal, ThreatCrowd, DNSdumpster and ReverseDNS

Usage example:

python3 sublist3r.py -d hackthissite.org

                 ____        _     _ _     _   _____                                                                                                       
                / ___| _   _| |__ | (_)___| |_|___ / _ __                                                                                                  
                \___ \| | | | '_ \| | / __| __| |_ \| '__|                                                                                                 
                 ___) | |_| | |_) | | \__ \ |_ ___) | |                                                                                                    
                |____/ \__,_|_.__/|_|_|___/\__|____/|_|                                                                                                    
                                                                                                                                                           
                # Coded By Ahmed Aboul-Ela - @aboul3la                                                                                                     
                                                                                                                                                           
[-] Enumerating subdomains now for hackthissite.org                                                                                                        
[-] Searching now in Baidu..
[-] Searching now in Yahoo..
[-] Searching now in Google..
[-] Searching now in Bing..
[-] Searching now in Ask..
[-] Searching now in Netcraft..
[-] Searching now in DNSdumpster..
[-] Searching now in Virustotal..
[-] Searching now in ThreatCrowd..
[-] Searching now in SSL Certificates..
[-] Searching now in PassiveDNS..
[-] Total Unique Subdomains Found: 41
www.hackthissite.orgwww.hackthissite.org
admin.hackthissite.org
api.hackthissite.org
ctf.hackthissite.org
vm-005.outbound.firewall.hackthissite.org
vm-050.outbound.firewall.hackthissite.org
vm-099.outbound.firewall.hackthissite.org
vm-150.outbound.firewall.hackthissite.org
vm-200.outbound.firewall.hackthissite.org
forum.hackthissite.org
forums.hackthissite.org
git.hackthissite.org
irc.hackthissite.org
(...)

DIRB

DIRB is a Web Content Scanner. It looks for existing (and/or hidden) Web Objects. It basically works by launching a dictionary based attack/brute force attack against a web server and analyzing the response.

Usage example:

dirb https://www.hackthissite.org/https://www.hackthissite.org/ /usr/share/wordlists/dirb/small.txt 

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

URL_BASE: https://www.hackthissite.org/https://www.hackthissite.org/
WORDLIST_FILES: /usr/share/wordlists/dirb/small.txt

-----------------

GENERATED WORDS: 959                                                           

---- Scanning URL: https://www.hackthissite.org/https://www.hackthissite.org/ ----
+ https://www.hackthissite.org/apihttps://www.hackthissite.org/api (CODE:200|SIZE:10)                                                                                                     
+ https://www.hackthissite.org/bloghttps://www.hackthissite.org/blog (CODE:200|SIZE:20981)                                                                                                 
+ https://www.hackthissite.org/cgi-bin/https://www.hackthissite.org/cgi-bin/ (CODE:403|SIZE:199)  

Maltego

⚡︎ Maltego has practical labs

Maltego is a powerful OSINT tool, you can extract a broad type of information through the network, technologies and personnel(email, phone number, twitter).

alt text

Social Engineering Framework (SEF)

It’s a open source Social Engineering Framework (SCRIPT) that helps generate phishing attacks and fake emails. and it’s includes phishing pages, fake email, fake email with file attachment and other stuff that helps you in Social Engineering Attack.

sef

Web Based Recon

NetCraft

Netcraft is a website analyzing server, with the help of this website we find basic and important information on the website like:

netcraft

Shodan

Shodan Unlike traditional search engines such as Google, use Web crawlers to traverse your entire site, but directly into the channel behind the Internet, various types of port equipment audits, and never stops looking for the Internet and all associated servers, camera, printers, routers, and so on.

shodan shodan2

Censys

Alternative for Shodan.

censys

2. Scanning and Enumeration

⚡︎ This chapter has practical labs for Scanning Networks (1) and Enumeration (2)

Network Scanning - Discovering systems on the network (can be hosts, switches, servers, routers, firewalls and so on) and looking at what ports are open as well as applications/services and their respective versions that may be running.

In general network scanning have three main objectives:

  1. Scanning for live devices, OS, IPs in use.
  2. Looking for Ports open/closed.
  3. Search for vulnerabilities on services scanned.

Connectionless Communication - UDP packets are sent without creating a connection. Examples are TFTP, DNS (lookups only) and DHCP

Connection-Oriented Communication - TCP packets require a connection due to the size of the data being transmitted and to ensure deliverability

Scanning Methodology

Identifying Targets

Port Discovery - Basic Concepts

Knocking the door:

Checking if Stateful Firewall is present:

⚠️ This can be easily achieved by using nmap only.


⚠️ Keep in mind the TCP Flags & TCP Three-way handshake before use nmap!

Flag Name Function
SYN Synchronize Set during initial communication. Negotiating of parameters and sequence numbers
ACK Acknowledgment Set as an acknowledgement to the SYN flag. Always set after initial SYN
RST Reset Forces the termination of a connection (in both directions)
FIN Finish Ordered close to communications
PSH Push Forces the delivery of data without concern for buffering
URG Urgent Data inside is being sent out of band. Example is cancelling a message

TCP-handshake


Nmap

⚠️ The CEH exam will definitely cover Nmap questions, about switches and how to perform a specific type of scan.

⚡︎ It is highly recommended to try out and explore the nmap in your own virtual environment; I made a couple practical labs[1] [2] [3] to help you understand the functionality of nmap.

Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. [+]

Nmap Scan Types:

Stealth Scan

Half-open scan or SYN scan - only SYN packets sent. Responses same as full.


Full connect

TCP connect or full open scan. The first two steps (SYN and SYN/ACK) are exactly the same as with a SYN scan. Then, instead of aborting the half-open connection with a RST packet, krad acknowledges the SYN/ACK with its own ACK packet, completing the connection.


TCP ACK scan / flag probe - multiple methods


NULL, FIN and Xmas Scan

⚠️ Uses FIN, URG or PSH flag.

⚠️ The key advantage to these scan types (NULL, FIN or Xmas scan) is that they can sneak through certain non-stateful firewalls and packet filtering routers.


IDLE Scan

uses a third party to check if a port is open


Spoofing

⚠️ Decoys will send spoofed IP address along with your IP address.


Firewall Evasion


Timing & Performance


UDP Scan

Most popular services runs over the TCP, but there are many common services that also uses UDP: DNS (53), SMTP (25), DHCP (67), NTP (123), NetBIOS-ssn (137), etc.

You also can specify which UDP port:

Also you can fire up both TCP and UDP scan with port specification:


List of Switches

Switch Description
-sA ACK scan
-sF FIN scan
-sI IDLE scan
-sL DNS scan (list scan)
-sN NULL scan
-sO Protocol scan (tests which IP protocols respond)
-sP or -sn Ping scan
-sR RPC scan
-sS SYN scan
-sT TCP connect scan
-sW Window scan
-sX XMAS scan
-A OS detection, version detection, script scanning and traceroute
-sV Determine only service/version info
-PI ICMP ping
-Pn No ping
-Po No ping
-PS SYN ping
-PT TCP ping
-oN Normal output
-oX XML output
-n Never do DNS resolution/Always resolve
-f --mtu : fragment packets (optionally w/given MTU)
-D IP address Decoy: <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
-T0 through -T2 Serial scans. T0 is slowest
-T3 through -T5 Parallel scans. T3 is slowest
-F Fast mode - Scan fewer ports than the default scan

Notes:

➕ More Useful Information about Nmap: ➕

Switch

Example

Description

-p

nmap 192.168.1.1 -p 21

Port scan for port x

-p

nmap 192.168.1.1 -p 21-100

Port range

-p

nmap 192.168.1.1 -p U:53,T:21-25,80

Port scan multiple TCP and UDP ports

-p-

nmap 192.168.1.1 -p-

Port scan all ports

-p

nmap 192.168.1.1 -p http,https

Port scan from service name

-F

nmap 192.168.1.1 -F

Fast port scan (100 ports)

--top-ports

nmap 192.168.1.1 --top-ports 2000

Port scan the top x ports

-p-65535

nmap 192.168.1.1 -p-65535

Leaving off initial port in range
makes the scan start at port 1

-p0-

nmap 192.168.1.1 -p0-

Leaving off end port in range

makes the scan go through to port 65535

 

2. Service and Version Detection

Switch

Example

Description

-sV

nmap 192.168.1.1 -sV

Attempts to determine the version of the service running on port

-sV --version-intensity

nmap 192.168.1.1 -sV --version-intensity 8

Intensity level 0 to 9. Higher number increases possibility of correctness

-sV --version-light

nmap 192.168.1.1 -sV --version-light

Enable light mode. Lower possibility of correctness. Faster

-sV --version-all

nmap 192.168.1.1 -sV --version-all

Enable intensity level 9. Higher possibility of correctness. Slower

-A

nmap 192.168.1.1 -A

Enables OS detection, version detection, script scanning, and traceroute

 

3. OS Detection

Switch

Example

Description

-O

nmap 192.168.1.1 -O

Remote OS detection using TCP/IP
stack fingerprinting

-O --osscan-limit

nmap 192.168.1.1 -O --osscan-limit

If at least one open and one closed
TCP port are not found it will not try
OS detection against host

-O --osscan-guess

nmap 192.168.1.1 -O --osscan-guess

Makes Nmap guess more aggressively

-O --max-os-tries

nmap 192.168.1.1 -O --max-os-tries 1

Set the maximum number x of OS
detection tries against a target

-A

nmap 192.168.1.1 -A

Enables OS detection, version detection, script scanning, and traceroute

 

4. Timing and Performance

Switch

Example input

Description

--host-timeout 

1s; 4m; 2h

Give up on target after this long

--min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout 

1s; 4m; 2h

Specifies probe round trip time

--min-hostgroup/max-hostgroup 

50; 1024

Parallel host scan group
sizes

--min-parallelism/max-parallelism 

10; 1

Probe parallelization

--scan-delay/--max-scan-delay 

20ms; 2s; 4m; 5h

Adjust delay between probes

--max-retries

3

Specify the maximum number
of port scan probe retransmissions

--min-rate 

100

Send packets no slower than  per second

--max-rate

100

Send packets no faster than  per second

 

5. NSE Scripts

NSE stands for Nmap Scripting Engine, and it’s basically a digital library of Nmap scripts that helps to enhance the default Nmap features and report the results in a traditional Nmap output.

One of the best things about NSE is its ability to let users write and share their own scripts, so you’re not limited to relying on the Nmap default NSE scripts. [+]

Switch

Example

Description

-sC

nmap 192.168.1.1 -sC

Scan with default NSE scripts. Considered useful for discovery and safe

--script default

nmap 192.168.1.1 --script default

Scan with default NSE scripts. Considered useful for discovery and safe

--script

nmap 192.168.1.1 --script=banner

Scan with a single script. Example banner

--script

nmap 192.168.1.1 --script=http*

Scan with a wildcard. Example http

--script

nmap 192.168.1.1 --script=http,banner

Scan with two scripts. Example http and banner

--script

nmap 192.168.1.1 --script "not intrusive"

Scan default, but remove intrusive scripts

--script-args

nmap --script snmp-sysdescr --script-args snmpcommunity=admin 192.168.1.1

NSE script with arguments

 

Useful NSE Script Examples

Command

Description

nmap -Pn --script=http-sitemap-generator scanme.nmap.org

http site map generator

nmap -n -Pn -p 80 --open -sV -vvv --script banner,http-title -iR 1000

Fast search for random web servers

nmap -Pn --script=dns-brute domain.com

Brute forces DNS hostnames guessing subdomains

nmap -n -Pn -vv -O -sV --script smb-enum*,smb-ls,smb-mbenum,smb-os-discovery,smb-s*,smb-vuln*,smbv2* -vv 192.168.1.1

Safe SMB scripts to run

nmap --script whois* domain.com

Whois query

nmap -p80 --script http-unsafe-output-escaping scanme.nmap.org

Detect cross site scripting vulnerabilities

nmap -p80 --script http-sql-injection scanme.nmap.org

Check for SQL injections

 

hping

⚡︎ Check the hping3 practical lab

Hping3 is a scriptable program that uses the Tcl language, whereby packets can be received and sent via a binary or string representation describing the packets.

Switch Description
-1 Sets ICMP mode
-2 Sets UDP mode
-8 Sets scan mode. Expects port range without -p flag
-9 Listen mode. Expects signature (e.g. HTTP) and interface (-I eth0)
--flood Sends packets as fast as possible without showing incoming replies
-Q Collects sequence numbers generated by the host
-p Sets port number
-F Sets the FIN flag
-S Sets the SYN flag
-R Sets the RST flag
-P Sets the PSH flag
-A Sets the ACK flag
-U Sets the URG flag
-X Sets the XMAS scan flags

Evasion Concepts

⚡︎ Check the IP Address Decoy practical lab using nmap

Banner Grabbing

Banner grabbing can be used to get information about OS or specific server info (such as web server, mail server, etc.)

Vulnerabilities

Vulnerability Categories:

Vulnerability Assessment - Scans and tests for vulnerabilities but does not intentionally exploit them.

Vulnerability Management Life-cycle

The Vulnerability Management Life Cycle is intended to allow organizations to identify system security weaknesses; prioritize assets; assess, report, and remediate the weaknesses; and verify that they have been eliminated.

vuln-assess

  1. Discover: Inventory all assets across the network and identify host details including operating system and open services to identify vulnerabilities. Develop a network baseline. Identify security vulnerabilities on a regular automated schedule.
  2. Prioritize Assets: Categorize assets into groups or business units, and assign a business value to asset groups based on their criticality to your business operation.
  3. Assess: Determine a baseline risk profile so you can eliminate risks based on asset criticality, vulnerability threat, and asset classification.
  4. Report: Measure the level of business risk associated with your assets according to your security policies. Document a security plan, monitor suspicious activity, and describe known vulnerabilities.
  5. Remediate: Prioritize and fix vulnerabilities in order according to business risk. Establish controls and demonstrate progress.
  6. Verify: Verify that threats have been eliminated through follow-up audits.

Vulnerability Scanning

Can be complex or simple tools run against a target to determine vulnerabilities.

CVSS and CVE

ProxyChains ⛓

proxychains

ProxyChains is open-source software that is available free and most of Linux distro it is pre-installed. If you are using the latest version of Kali Linux it is pre-installed in it.

ProxyChains is a tool that redirects the TCP (Transmission Control Protocol) connection with the help of proxies like TOR, HTTP(S), and SOCKS, and it creates a proxy chain server.

ProxyChains Features:

Enumeration Concepts

Enumeration is the process of extracting user names, machine names, network resources, shares, and services from a system, and its conducted in an intranet environment.

In this phase, the attacker creates an active connection to the system and performs directed queries to gain more information about the target. The gathered information is used to identify the vulnerabilities or weak points in system security and tries to exploit in the System gaining phase.

SNMP Enumeration

⚡︎ Check the SNMP Enumeration practical lab

SNMP enumeration is the process of enumerating the users accounts and devices on a SNMP enabled computer.

Attackers enumerate SNMP to extract information about network resources such as hosts, routers, devices, shares(...) Network information such as ARP tables, routing tables, device specific information and traffic statistics.

Windows System Basics

NetBIOS Enumeration

Enumerating NetBIOS:

nbtstat displays protocol statistics and current TCP/IP connections using NetBIOS over TCP/IP.

f

Code Type Meaning
<1B> UNIQUE Domain master browser
<1C> UNIQUE Domain controller
<1D> GROUP Master browser for subnet
<00> UNIQUE Hostname
<00> GROUP Domain name
<03> UNIQUE Service running on system
<20> UNIQUE Server service running

Linux System Basics

⚠️ Linux architecture and commands will be cover later on next module.

LDAP Enumeration

sudo nmap -sT -O <target IP address>

PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap <--------------------------------------
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl <--------------------------------------
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
49154/tcp open  unknown
49155/tcp open  unknown
49157/tcp open  unknown
49158/tcp open  unknown
49159/tcp open  unknown
MAC Address: 00:00:11:33:77:44
Running: Microsoft Windows 2012
OS CPE: cpe:/o:microsoft:windows_server_2012:r2
OS details: Microsoft Windows Server 2012 or Windows Server 2012 R2
Network Distance: 1 hop

NTP Enumeration

Nmap example for NTP enumeration:

nmap -sU -pU:123 -Pn -n --script=ntp-monlist <target>

PORT    STATE SERVICE REASON
123/udp open  ntp     udp-response
| ntp-monlist:
|   Target is synchronised with 127.127.38.0 (reference clock)
|   Alternative Target Interfaces:
|       10.17.4.20
|   Private Servers (0)
|   Public Servers (0)
|   Private Peers (0)
|   Public Peers (0)
|   Private Clients (2)
|       10.20.8.69      169.254.138.63
|   Public Clients (597)
|       4.79.17.248     68.70.72.194    74.247.37.194   99.190.119.152
|       ...
|       12.10.160.20    68.80.36.133    75.1.39.42      108.7.58.118
|       68.56.205.98
|       2001:1400:0:0:0:0:0:1 2001:16d8:dd00:38:0:0:0:2
|       2002:db5a:bccd:1:21d:e0ff:feb7:b96f 2002:b6ef:81c4:0:0:1145:59c5:3682
|   Other Associations (1)
|_      127.0.0.1 seen 1949869 times. last tx was unicast v2 mode 7

SMTP Enumeration

nmap -p25 --script smtp-commands <target IP>

PORT   STATE SERVICE
25/tcp open  smtp
| smtp-commands: WIN-J83C1DR5CV1.ceh.global Hello [10.10.10.10], TURN, SIZE 2097152, ETRN, PIPELINING, DSN, ENHANCEDSTATUSCODES, 8bitmime, BINARYMIME, CHUNKING, VRFY, OK, 
|_ This server supports the following commands: HELO EHLO STARTTLS RCPT DATA RSET MAIL QUIT HELP AUTH TURN ETRN BDAT VRFY 

Nmap done: 1 IP address (1 host up) scanned in 0.86 seconds

Some SMTP Commands:

Command Description
HELO It’s the first SMTP command: is starts the conversation identifying the sender server and is generally followed by its domain name.
EHLO An alternative command to start the conversation, underlying that the server is using the Extended SMTP protocol.
MAIL FROM With this SMTP command the operations begin: the sender states the source email address in the “From” field and actually starts the email transfer.
RCPT TO It identifies the recipient of the email
DATA With the DATA command the email content begins to be transferred; it’s generally followed by a 354 reply code given by the server, giving the permission to start the actual transmission.
VRFY The server is asked to verify whether a particular email address or username actually exists.
EXPN asks for a confirmation about the identification of a mailing list.

Other tools:

3. System Hacking

⚡︎ This chapter has practical labs

Goals:

  1. Gaining Access - Uses information gathered to exploit the system
  2. Escalating Privileges - Granting the account you've hacked admin or pivoting to an admin account
  3. Executing Applications - Putting back doors into the system so that you can maintain access
  4. Hiding Files - Making sure the files you leave behind are not discoverable
  5. Covering Tracks - Cleaning up everything else (log files, etc.)

Password Attacks

⚡︎ Check out the practical labs on Dumping and Cracking SAM hashes [1], Rainbow Tables Basics [2] and LLMNR/NBT-NS [3].

Non-electronic - Non-technical attacks.

Active online - done by directly communicating with the victim's machine.

Passive online - Sniffing the wire in hopes of intercepting a password in clear text or attempting a replay attack or man-in-the-middle attack

⚠️ Services/Protocols that uses Clear text:

Service Port
FTP 20/21
TELNET 23
SMTP 25
HTTP 80
POP3 110
IMAPv4 143
NetBIOS 139,445
SNMP 161,162
SQLnet 1521

Offline - when the hacker steals a copy of the password file (Plaintext or Hash) and does the cracking on a separate system.

⚠️ rtgen, winrtgen - Tools for generate your own rainbow tables.

⚠️ SAM (Security Account Manager) is a database file present in Windows machines that stores user accounts and security descriptors for users on a local computer. It stores users passwords in a hashed format (in LM hash and NTLM hash). Because a hash function is one-way, this provides some measure of security for the storage of the passwords.

⚠️ /etc/shadow is where hashed password data is stored in Linux systems (only users with high privileges can access).

⚠️ Password attack countermeasures:

Authentication

Windows Security Architecture

LM Hashing

Ntds.dit

Database file on a domain controller that stores passwords

Kerberos for Active Directory Domain Services (AD DS)

kerberos

⚠️ Uses TCP/UDP Port 88

Registry

registry

MMC

mmc

Sigverif.exe

Linux Security Architecture

Linux Directory Structure

linux-architecture

Linux Common Commands

Command Description
adduser Adds a user to the system
cat Displays contents of file
cp Copies
ifconfig Displays network configuration information
kill Kills a running process
ls Displays the contents of a folder. -l option provides most information.
man Displays the manual page for a command
passwd Used to change password
ps Process status. -ef option shows all processes
rm Removes files. -r option recursively removes all directories and subdirectories
su Allows you to perform functions as another user (super user)

Privilege Escalation and Executing Applications

⚡︎ Check out the practical lab on PrivEsc

Vertical - Lower-level user executes code at a higher privilege level (e.g.: common user to root/administrator).

Horizontal - executing code at the same user level but from a location that would be protected from that access

Covert data gathering

Keyloggers - record keys strokes of a individual computer keyboard or a network of computers.

Spywares - watching user's action and logging them without the user's knowledege.

Defending against Keyloggers and Spywares

Hiding Files

⚡︎ Check out the practical labs(2) on Hiding Files using NTFS streams and Steganography

Steganography

Rootkits

Covering Tracks

Clearing logs is the main idea behind covering tracks.

  1. Find and clear the logs.
  2. Falsify/Modify logs.

On Linux:

Most common logs on Linux:

On Windows:

In Windows, you need to clear application, system and security logs.

⚡︎ Check out the practical lab on Auditpol

Conclusion on Covering Tracks

4. Malwares

⚡︎ This chapter has practical labs

- What is Malware?

Any software intentionally designed to cause damage to a computer, server or computer network. The code is described as computer viruses, worms, Trojan horses, ransomware, spyware, adware, and scareware, among other terms. Malware has a malicious intent, acting against the interest of the computer user.

Types of Viruses and Worms 🐛

️⚠️ - Viruses needs help/interaction to propagate; Worms self propagates

Major characteristics of viruses:

  1. Infecting other files
  2. Alteration of data
  3. Transforms itself
  4. Corruption of files and data
  5. Encrypts itself
  6. Self-replication

Stages of Virus Lifecycle:

  1. Design
  2. Replication
  3. Launch
  4. Detection
  5. Incorporation - A.V. figures out the virus pattern & builds signatures to identify and eliminate the virus
  6. Execution of the damage routine - A.V. to the rescue

Malware Basics

Basic components of Malware

  1. Crypters - use a combination of encryption and code manipulation to render malware undetectable to security programs; protects from being scanned or found during analysis.

  2. Downloader - Used to download additional malware.

  3. Dropper - Used to install additional malware into the target system.

  4. Exploit - Malicious code used to execute on a specific vulnerability.

  5. Injector - Used to expose vulnerable processes in the target system to the exploit.

  6. Obfuscator - Used to conceal the true purpose of the malware.

  7. Packers - Used to bundle all of the malware files together into a single executable.

  8. Payload - Used to take over the target machine.

  9. Malicious Code - Used to define the abilities of the malware.

Exploit Kits - help deliver exploits and payloads

Trojans 🐴

Infection Process:

  1. Creation of a Trojan using Trojan Construction Kit
  2. Create a Dropper
  3. Create a Wrapper
  4. Propagate the Trojan
  5. Execute the Dropper

Trojan Port Numbers:

Trojan Name TCP Port
Death 2
Senna Spy 20
Blade Runner, Doly Trojan, Fore, Invisble FTP, WebEx, WinCrash 21
Shaft 22
Executor 80
Hackers Paradise 31,456
TCP Wrappers 421
Ini-Killer 555
Doom, Santaz Back 666
Silencer, WebEx 1001
DolyTrojan 1011
RAT 1095-98
SubSeven 1243
Shiva-Burka 1600
Trojan Cow 2001
Deep Throat 6670-71
Tini 7777
Dumaru.Y 10000
SubSeven 1.0-1.8, MyDoom.B 10080
VooDoo Doll, NetBus 1.x, GabanBus, Pie Bill Gates, X-Bill 12345
Whack a Mole 12361-3
NetBus 17300
Back Orifice 31337,8
SubSeven, PhatBot, AgoBot, Gaobot 65506

⚠️ - Its not necessary to know every possible trojan port in the history for the CEH exam, it's good for understanding.

Trojan Countermeasures

  1. Avoid cicking on unusual or suspect email attachments
  2. Block unused ports
  3. Monitor network traffic
  4. Avoid downloading from unstrusted sources
  5. Install & updated anti-virus software
  6. Scan removable media before use
  7. Validate file integrity of all externally sourced software
  8. Enable auditing
  9. Configure Host-Based firewalls
  10. Use IDS

Techniques

Malware Analysis

Malware analysis is the study or process of determining the functionality, origin and potential impact of a given malware sample such as a virus, worm, trojan horse, rootkit, or backdoor.

Types of Malware analysis:

  1. Static (Code Analysis) - performed by fragmenting the binary file into individual elements that can be analyzed without executing them.

  2. Dynamic (Behavioral Analysis) - performed by executing the malware to see what effect it has on the system.

Steps

  1. Make sure you have a good test bed
  2. Analyze the malware on the isolated VM in a static state
  3. Run the malware and check out processes
  4. Check and see what files were added, changed, or deleted

Rootkits

5. Sniffing

⚡︎ This chapter has practical labs

Sniffing is the process of monitoring and capturing all the packets passing through a given network using sniffing tools. It is a form of “tapping phone wires” and get to know about the conversation. It is also called wiretapping applied to the computer networks.

Active and Passive Sniffing

Basics

Protocols Susceptible

Some of the protocols that are vulnerable to sniffing attacks.

ARP

IPv6

IPv6 Address Type Description
Unicast Addressed and intended for one host interface
Multicast Addressed for multiple host interfaces
Anycast Large number of hosts can receive; nearest host opens
IPv6 Scopes Description
Link local Applies only to hosts on the same subnet (Address block fe80::/10)
Site local Applies to hosts within the same organization (Address block FEC0::/10)
Global Includes everything

Wiretapping

Wiretapping, also known as telephone tapping, is the process of monitoring telephone and Internet conversations by a third party, often by covert means.

MAC Flooding

Switch port stealing

Tries to update information regarding a specific port in a race condition

  1. ARP Flood
  2. Attacker now intercepts victim traffic
  3. Attacker stops flooding
  4. Victim reclaims port
  5. Attacker retransmits captured data
  6. Attacker repeats flooding

ARP Poisoning

arp ARP spoofing is a type of attack in which a malicious actor sends falsified ARP (Address Resolution Protocol) messages over a local area network. This results in the linking of an attacker's MAC address with the IP address of a legitimate computer or server on the network.

DHCP Starvation

Is an attack that targets DHCP servers whereby forged DHCP requests are crafted by an attacker with the intent of exhausting all available IP addresses that can be allocated by the DHCP server.

Spoofing

Sniffing Tools

Wireshark

Wireshark is the world’s foremost and widely-used network protocol analyzer. It lets you see what’s happening on your network at a microscopic level.

tcpdump

Tcpdump is a data-network packet analyzer computer program that runs under a command line interface. It allows the user to display TCP/IP and other packets being transmitted or received over a network to which the computer is attached.

tcptrace

Other Tools

Defending and Countermeasures techniques against Sniffing:

6. Social Engineering

⚡︎ This chapter has practical labs

Social Engineering is the art of manipulating a person or group into providing information or a service they would otherwise not have given.

Phases

  1. 🔍 Research target company
  2. 🎯 Select the victim
  3. 💬 Build a relationship
  4. 💰 Exploit the relationship

Principles

  1. Authority
  2. Intimidation
  3. Consensus / Social proof
  4. Scarcity
  5. Urgency
  6. Familiarity
  7. Trust

Behaviors

Companies Common Risks:

Social Engineering Attacks:

Human-Based Attacks 👥

Computer-Based Attacks 💻

Can begin with sites like Facebook where information about a person is available; For instance - if you know Bob is working on a project, an email crafted to him about that project would seem quite normal if you spoof it from a person on his project.

Tools

Mobile-Based Attacks

Physical Security Basics

Prevention

7. Evading IDS, Firewalls and Honeypots

IDS/IPS - Basic Concepts

Intrusion Prevention System (IPS) - ACTIVE monitoring of activity looking for anomalies and alerting/notifiying AND taking action when they are found.

Intrusion Detection System (IDS) - PASSIVE monitoring of activity looking for anomalies and alerting/notifying when they are found.

Deployment Types - HIDS & NIDS & WIDS:

  1. Host based - Monitors activity on a single device/host by being installed lcoally.

  2. Network based - Monitors activity across a network using remote sensors that reprot back to a central system. Often paired with a security Information & SIEM system for analysis. Often Reverse ARP or Reverse DNS lookups are used to discover the source

Knowledge & Behavior-Based Detection:

  1. Knowledge Based (Signature Based | Pattern Matching) - Most common form of detection. Uses a database of profiles, or signatures to assess all traffic against.

  2. Behavior Based (Statistical | Anomaly | Heuristic) - Starts by creating a baseline of behavior for the monitored system/network and then comapres all traffic against that looking for deviations. Can be labeled an AI or Expert system.


Types of IDS Alerts


Firewalls - Basic Concepts

Firewalls are often seen as NAC devices. Use of rule sets to filter traffic can implement security policy.

Firewalls types:

Proxy Types:

⚠️ An application-level proxy is one that knows about the particular application it is providing proxy services for; it understands and interprets the commands in the application protocol. A circuit-level proxy is one that creates a circuit between the client and the server without interpreting the application protocol.

⚠️ Only uses rules that implicitly denies traffic unless it is allowed.

⚠️ Oftentimes uses network address translation (NAT) which can apply a one-to-one or one-to-many relationship between external and internal IP addresses.

⚠️ Private zone - hosts internal hosts that only respond to requests from within that zone

Honeypots 🍯

Honeypots are decoy systems or servers deployed alongside production systems within your network. When deployed as enticing targets for attackers, honeypots can add security monitoring opportunities for blue teams and misdirect the adversary from their true target.

Types of Honeypots:

  1. Low-interaction ---> Simulates/imitate services and systems that frequently attract criminal attention. They offer a method for collecting data from blind attacks such as botnets and worms malware.
  2. High interaction ---> Simulates all services and applications and is designed to be completely compromised
  3. Production ---> Serve as decoy systems inside fully operating networks and servers, often as part of an intrusion detection system (IDS). They deflect criminal attention from the real system while analyzing malicious activity to help mitigate vulnerabilities.
  4. Research ---> Used for educational purposes and security enhancement. They contain trackable data that you can trace when stolen to analyze the attack.

Evading with Nmap

Useful switches for Evading and Stealthy:

Nmap Switch Information
-v Verbose level
-sS TCP SYN scan
-T Time template for performing the scan
-f Use fragmented IP packets
-f --mtu Use fragmented packets & set MTU
-D IP address Decoy: <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
-S Spoof the source IP address
--send-eth Ensures that we use Ethernet level packets. bypassing the IP layer and sends raw Ethernet frames within the flow
--data-length Specify the length of data/frame
--source-port Specify a randomized port that you want to comunicate

Example:

• Sends IPv4 fragmented 50-byte packet size; The packets are too small to send data and to detect as a Probe/Scanning technique:

nmap -v -sS -f -mtu 32 --send-eth --data-length 50 --source-port 8965 -T5 192.168.0.22

⚠️ Fragmentation is the heart of the IDS/Firewall Evasion techniques.


Using SNORT

SNORT is an open source network intrusion detection system (NIDS). Snort is a packet sniffer that monitors network traffic in real time, scrutinizing each packet closely to detect a dangerous payload or suspicious anomalies.

SNORT basics commands:

Operational modes:

Example of usage:

Basic commands: Flag | Information -|- -A | Set alert mode: fast, full, console, test or none -b | Log packets in tcpdump format (much faster!) -B <mask> | Obfuscate IP addresses in alerts and packet dumps using CIDR mask -c <rules> | Use Rules file -C | Print out payloads with character data only (no hex) -l | Specifies the logging directory (all alerts and packet logs are placed in this directory) -i <interface number> | Specifies which interface Snort should listen on -K | Logging mode (pcap[default], ascii, none) -? | Lists all switches and options and then exits

SNORT Rules

SNORT has a rules engine that allows for customization of monitoring and detection capabilities.

Breaking down a Snort rule:

alert icmp any any -> &HOME_NET any (msg:"ICMP test"; sid:1000001; rev:1; classtype:icmp-event;)

Rule part Information
alert icmp any any -> $HOME_NET any Rule Header ⬇️
alert Rule action. Snort will generate an alerta when the set condition is met.
any (1st) Source IP. Snort will look at all sources
any (2nd) Source port. Snort will look at all ports
-> Direction. From source to destination; (source -> destination)
&HOME_NET Destination IP. We are using the HOME_NET value from the snort.conf file which means a variable that defines the network or networks you are trying to protect.
any (3rd) Destination port. Snort will look at all ports on the protected network
(msg:"ICMP test"; sid:1000001; rev:1; classtype:icmp-event;) Rule Options ⬇️
msg:"ICMP test" Snort will include this message with the alert
sid:1000001 Snort rule ID. Remember all numbers < 1,000,000 are reserved, this is why we are starting with 1000001 (you may use any number, as long as it's grater that 1,000,000)
rev:1 Revision number. This option allows for easier rule maintenance
classtype:icmp-event Categorizes the rule as an "icmp-event", one of the predefined Snort categories. This options helps with the rule organization

Rules Examples:

alert tcp 192.168.x.x any -> &HOME_NET 21 (msg:"FTP connection attempt"; sid:1000002; rev:1;)

alert tcp $HOME_NET 21 -> any any (msg:"FTP failed login"; content:"Login or password incorrent"; sid:1000003; rev:1;)

alert tcp !HOME_NET any -> $HOME_NET 31337 (msg : "BACKDOOR ATTEMPT-BackOrifice")

Example output

Evasion Concepts and Techniques

⚠️ Slow down - Faster scanning such as using nmap's -T5 switch will get you caught. Pros use -T1 switch to get better results

Tools for Evasion

Firewall Evasion

How to detect a Honeypot

Probe services running on them; Ports that show a service is available, but deny a three-way handshake may indicate that the system is a honeypot.

⚠️ The exam will not cover every information presented, but is good to have a general idea.

8. Denial of Service

⚡︎ This chapter has practical labs

DoS

A Denial of Service (DoS) is a type of attack on a service that disrupts its normal function and prevents other users from accessing it. The most common target for a DoS attack is an online service such as a website, though attacks can also be launched against networks, machines or even a single program.

DoS attacks can cause the following problems:

DDoS

A distributed denial of service (DDoS) attack is launched from numerous compromised devices, often distributed globally in what is referred to as a botnet.

dos

Goal:

Botnet

Network of zombie computers a hacker uses to start a distributed attack.

botnet

Three Types of DoS / DDoS

1. Volumetric attacks

2. Protocol Attacks

3. Application Layer Attacks

Attacks explanation

IP Fragmentation attacks

TCP state-exhaustion attack

Slowloris attack

Is an application layer attack which operates by utilizing partial HTTP requests. The attack functions by opening connections to a targeted Web server and then keeping those connections open as long as it can.

SYN attack

SYN flood (half-open attack)

ICMP flood

Smurf attack

Fraggle

Ping of Death

Teardrop

Peer to peer

Multi-vector attack

Phlashing / Permanent DoS

LAND attack

DoS/DDoS Attack Tools:

Mitigations

9. Session Hijacking

⚡︎ This chapter has practical labs

The Session Hijacking attack consists of the exploitation of the web session control mechanism, which is normally managed for a session token. [+]

The Session Hijacking attack compromises the session token by stealing or predicting a valid session token to gain unauthorized access to the Web Server.

Session Hijacking using XSS

The session token could be compromised in different ways; the most common are:

Predictable session token

Session Sniffing

Cross-site scripting (XSS)

CSRF - Cross-Site Request Forgery

Session Fixation

Man-in-the-browser attack

Man-in-the-middle attack

Other attacks

⚠️ SPDY protocol manipulates HTTP traffic, with particular goals of reducing web page load latency and improving web security.

Network Layer Attacks

Tools

Countermeasures

IPSec

10. Hacking Web Servers

Web Server Attack Methodology

Web Server Architecture

Web Server Attacks

11. Hacking Web Applications

Web Organizations

OWASP Web Top 10

The OWASP Top 10 is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to web applications.

WebGoat - project maintained by OWASP which is an insecure web application meant to be tested

Web Application Attacks


SQL Injection

Injecting SQL commands into input fields to produce output

SQL injection usually occurs when you ask a user for input, like their username/userid, and instead of a name/id, the user gives you an SQL statement that you will unknowingly run on your database.

SQL Syntax - Basics:

SQL Command Info.
SELECT extracts data from a database
UPDATE updates data in a database
DELETE deletes data from a database
INSERT INTO inserts new data into a database
ALTER TABLE modifies a table
DROP TABLE deletes a table
CREATE INDEX creates an index (search key)
DROP INDEX deletes an index
UNION is used to combine the result-set of two or more SELECT statements.

SQL Injection in action:

⚠️ Basic test to see if SQL injection is possible is just inserting a single quote ( ' )

Bypassing authentication:

Enumerating:

Load/Reading a file:

Writing a file:

Fuzzing - inputting random data into a target to see what will happen

Tautology - using always true statements to test SQL (e.g. 1=1)

In-band SQL injection - uses same communication channel to perform attack

Out-of-band SQL injection - uses different communication channels (e.g. export results to file on web server)

Blind/inferential - error messages and screen returns don't occur; usually have to guess whether command work or use timing to know


Broken Authentication

Broken Authentication usually occurs due to the issues with the application’s authentication mechanism;

An attacker can gain control over user accounts in a system. In the worst case, it could help them gain complete control over the system.


Command Injection

Execution of arbitrary commands on the host operating system via a vulnerable application.

Example:

--- 127.0.0.1 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 3999ms
rtt min/avg/max/mdev = 0.023/0.056/0.074/0.021 ms

uid=0(root) gid=0(root) groups=0(root)

Sensitive Data Exposure

When the web application doesn’t adequately protect sensitive information like session tokens, passwords, banking information, location, health data, or any other similar crucial data whose leak can be critical for the user.

Examples:

  1. *An application stores credit card numbers in a database without encryption*. If an attacker gets access to the database through SQL injection, he could easily get the credit card numbers.

  2. An application store passwords in the database using unsalted or simple hashes. An attacker can expose the unsalted hashes using Rainbow Table attacks.

  3. A website that doesn’t enforce TLS or uses weak encryption. An attacker could monitor network traffic and downgrade the connections from HTTPS to HTTP. Then, they can intercept the requests and steal the user’s session cookie


XEE - XML External Entities

Is a type of attack against an application that parses XML input. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser.

Example:

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
  <!ELEMENT foo ANY >
  <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
<foo>&xxe;</foo>

RFI - Remote File Inclusion

Is a method that allows an attacker to employ a script to include a remotely hosted file on the webserver. The vulnerability promoting RFI is largely found on websites running on PHP. This is because PHP supports the ability to ‘include’ or ‘require’ additional files within a script;

Vulnerable PHP Example:

$incfile = $_REQUEST["file"]; include($incfile.".php");


LFI - Local File Inclusion:

is very much similar to RFI. The only difference being that in LFI, in order to carry out the attack instead of including remote files, the attacker has to use local files (e.g: files on the current server can only be used to execute a malicious script).

Examples:


Directory Traversal

An attacker can get sensitive information like the contents of the /etc/passwd file that contains a list of users on the server; Log files, source code, access.log and so on

Examples:

Similarly, an attacker may leverage the Directory Traversal vulnerability to access log files (for example, Apache access.log or error.log), source code, and other sensitive information. This information may then be used to advance an attack.


XSS (Cross-site scripting)

Inputting JavaScript into a web form input field that alters what the page does.

Types of XSS:

  1. Stored XSS (Persistent or Type-I) - stores the XSS in a forum or like for multiple people to access.

  2. Reflected XSS (or also called a non-persistent XSS); when an application receives data in an HTTP request and includes that data within the immediate response in an unsafe way.

  3. DOM Based XSS (or as it is called in some texts, “type-0 XSS”) is an XSS attack wherein the attack payload is executed as a result of modifying the DOM “environment” in the victim's browser used by the original client side script, so that the client side code runs in an “unexpected” manner.

Examples of XSS payloads:

Note: they vary regarding the filtering, validation and WAF capabilities.


HTML Injection

This vulnerability occurs when user input is not correctly sanitized and the output is not encoded. An injection allows the attacker to send a malicious HTML page to a victim.


LDAP Injection

Exploits applications that construct LDAP statements


SOAP Injection

Inject query strings in order to bypass authentication


Buffer Overflow

Attempts to write data into application's buffer area to overwrite adjacent memory, execute code or crash a system


Cross-Site Request Forgery (CSRF)

Forces an end user to execute unwanted actions on an app they're already authenticated on


Session Fixation

Attacker logs into a legitimate site and pulls a session ID; sends link with session ID to victim. Once victim logs in, attacker can now log in and run with user's credentials


HTTP Response Splitting

Adds header response data to an input field so server splits the response


Insecure direct object references (IDOR)

Is a common vulnerability that occurs when a reference to an internal implementation object is exposed without any other access control. The vulnerability is often easy to discover and allows attackers to access unauthorized data.


Countermeasures

Input scrubbing for injection, SQL parameterization for SQL injection, input validation and sanitization for injections, keeping patched servers, turning off unnecessary services, ports and protocols

12. Hacking Wireless Networks

Concepts and Terminology

BSSID

Basic Service Set Identifier (BSSID) - MAC address of the wireless access point

SSID

Service Set Identifier (SSID) - Is a name of a network; text word (<= 32 char) that identifies network; provides no security.

ESSID

Extended Service Set Identifier (ESSID) - An extended basic service set (ESS) consists of all of the BSSs in the network. For all practical purposes, the ESSID identifies the same network as the SSID does. The term SSID is used most often.

DSSS and FHSSS spectrums:

dsss

Wireless Standards:

Wireless Standard Operating Speed (Mbps) Frequency (GHz) Modulation Type
802.11a 54 Mbps 5 GHz OFDM
802.11b 11 Mbps 2.4 GHz DSSS
802.11g 54 Mbps 2.4 GHz OFDM and DSSS
802.11n 600 Mbps 2.4-5 GHz OFDM
802.11ac 1000 Mbps 5 GHz QAM

Authentication

⚠️ RADIUS is a networking protocol, operating on port 1812, that provides centralized Authentication, Authorization, and Accounting (AAA or Triple A) management for users who connect and use a network service.

Antenna Types:

Wireless Encryption Schemes

Wireless Security

WEP - Wireless Equivalency Privacy

⚠️ Very old and insecure

WPA - Wi-Fi Protected Access

About TKIP - Temporal Key Integrity Protocol

WPA2 - Wi-Fi Protected Access v2

Wireless Standard Encryption IV Size (Bits) Key Length (Bits) Integrity Check
WEP RC4 24 40/104 CRC-32
WPA RC4 + TKIP 48 128 Michael/CRC-32
WPA2 AES-CCMP 48 128 CBC-MAC (CCMP)

Wireless Hacking

Wireless Attacks

Wireless Encryption Attacks

WEP Cracking

WPA/WPA2 Cracking

Tools:

Bluetooth Attacks

Wireless Sniffing

Protecting Wireless Networks - Best practices

⚠️ Warnings of Public / Free Wi-Fi

13. Hacking Mobile Platforms and IoT

A) Mobile Platform Hacking



Mobile Platforms

Mobile Attacks

All other attacks presented on previous chapter are suceptible to mobile devices too attacks like session hijacking, browser vulnerabilities, XSS, email, SMS, phone, OS/Apps bugs, excessive permissions and so on. Vulnerabilities on connection (Bluetooth, WiFi, NFC), encryption.

Bluetooth:

Improving Mobile Security

⚠️ Companies should use MDM policies to accomplish mobile security.

B) IoT Architecture

- What is IoT?

The Internet of Things (IoT) describes the network of physical objects—“things”—that are embedded with sensors, software, and other technologies for the purpose of connecting and exchanging data with other devices and systems over the internet.

Methods of Communicating

IoT connectivity boils down to how things connect to each other. Can be wired, wireless, 4G LTE, Bluetooth, GPS, LoRa, mesh networking, RFID, WiFi, Zigbee and Z-wave.

⚠️ Zigbee and Z-Wave is a wireless mesh networking protocol popular in home automation.

Edge Computing

Edge Computing is a distributed computing paradigm in which processing and computation are performed mainly on classified device nodes known as smart devices or edge devices as opposed to processed in a centralized cloud environment or data centers.

⚠️ Edge computing handling data by pushing into the cloud. Fog Computing is more like keep things locally.

Multi-Layer Architecture of IoT

IoT Technology Protocols

IoT Operating Systems

Geofencing

Uses GPS and RFID technologies to create a virtual geographic boundary, like around your home property. A response is then triggered any time a mobile device enters or leaves the area.

Grid Computing

Reduces costs by maximizing existing resources. This is accomplished with multiple machines together to solve a specific problem.

Analytics of Things (AoT)

Industrial IoT (IIoT)

iiot

The industrial internet of things (IIoT) refers to the extension and use of the internet of things (IoT) in industrial sectors and applications. With a strong focus on machine-to-machine (M2M) communication, big data, and machine learning, the IIoT enables industries and enterprises to have better efficiency and reliability in their operations.

IoT Vulnerabilities and Attacks:

OWASP Top 10 IoT Vulnerabilities (2014)


OWASP Top 10 IoT Vulnerabilities (2018)


Common IoT Attack Areas

  1. Device memory containing credentials
  2. Device / Ecosystem Access Control
  3. Device Physical Interfaces / Fimrware extraction
  4. Device web interface
  5. Device Firmware
  6. Device network services
  7. Devices administrative interface(s)
  8. Unencrypted Local data storage
  9. Cloud interface(s)
  10. Device update mechanism(s)
  11. Insecure API's (vendor & thir-party)
  12. Mobile application
  13. Confidentiality and Integrity issues across the ecosystem
  14. Network traffic

IoT Threats

  1. DDoS Attack
  2. HVAC System attacks - Attacks on HVAC systems
  3. Rolling code attack - Used to steal cars; The ability to jam a key fob's communications, steal the code and then create a subsequent code
  4. BlueBorne attack - Attacks against Bluetooth devices
  5. Jamming attack
  6. Remote access via backdoors
  7. Remote access via unsecured protocols such as TELNET
  8. Sybil attack - Uses multiple forged identities to create the illusion of traffic; happens when a insecure computer is hijacked to claim multiple identities.
  9. Rootkits / Exploit kits
  10. Ransomware

⚠️ Other attacks already enumerated in other sections still apply such as MITM, ransomware, side channel, replay attack etc.

IoT Hacking Methodology

Steps:

  1. Information Gathering - gathering information about the devices;

  2. Vulnerability Scanning - same as normal methodology - looks for vulnerabilities

  3. Launching Attacks

  4. Gaining Access - same objectives as normal methodology

  5. Maintaining Access - same objectives as normal methodology


Countermeasures to help secure IoT devices:

  1. Firmware updates
  2. Block ALL unecessary ports
  3. Disable insecure access protocols such as TELNET
  4. Only use encrypted communication protocols
  5. Use strong passwords
  6. Encrypt ALL data and communications coming into, being stored in and leaving the device
  7. Use account lockout
  8. Configuration management and baselining of devices along with compliance monitoring
  9. Use multi-factor authentication
  10. Disable UPnP

14. Pentesting

A penetration test, colloquially known as a pen test, pentest or ethical hacking, is an authorized simulated cyberattack on a computer system, performed to evaluate the security of the system.

Security Assessments:

InfoSec Teams 🗡🛡

Types of Pen Tests

External assessment - Analyzes publicly available information; conducts network scanning, enumeration and testing from the network perimeter.

Internal Assessment - Performed from within the organization, from various network access points.

Pentesting boxes:

Pen test Phases

  1. Pre-Attack Phase - Reconnaissance and data-gathering.
  2. Attack Phase - Attempts to penetrate the network and execute attacks.
  3. Post-Attack Phase - Cleanup to return a system to the pre-attack condition and deliver reports.

⚠️ For the exam, EC-Council brings his own methodology and that's all you need for the exam; you can check another pentesting methodologies here if you are interested; In case you are studying to become a professional pentester besides certification content, I recommend the OSSTMM (Open Source Security Testing Methodology Manual).

Security Assessment Deliverables

Terminology

Vulnerabilities

15. Cloud Computing

Cloud Computing Basics

Tech stack Type
Software SaaS
Apps PaaS
OS IaaS
Virtualization managed by provider
Storage/Networking managed by provider

Cloud Deployment Models

NIST Cloud Architecture

The NIST cloud computing reference architecture (NIST SP 500-292) define five major actors; Each actor is an entity (a person or an organization) that participates in a transaction or process and/or perform tasks in cloud computing.

⚠️ - FedRAMP - regulatory effort regarding cloud computing

⚠️ - PCI DSS - deals with debit and credit cards, but also has a cloud SIG

Five characteristics of cloud computing

The National Institute of Standards and Technology (NIST) defines cloud computing as it is known today through five particular characteristics.

  1. On-demand self-service

  2. Broad network access

  3. Multi-tenancy and resource pooling

  4. Rapid elasticity and scalability

  5. Measured service

Threats:

Attacks:

  1. Service hijacking via Social engineering & network sniffing
  2. Session hijacking using XSS
  3. DNS attacks
  4. Side channel attacks - (e.g.: Using an existing VM on the same physical host to attack another)
  5. Cross VM attacks
  6. SQL injection
  7. Cryptanalysis attacks
  8. Wrapping attacks - performed during the translation of SOAP messages in the TLS layer; attackers duplicate the body of the message and send it to the targeted server impersonating the legitimate user.
  9. DoS/DDoS attack
  10. Main-in-the-Cloud attacks - abuse of cloud file synchronization services br tracking the user into installing malicious software that places the attacker's synchronization token for the service ton their machine, allowing the attacker to steal the user's token and gain access to their files.

OWASP Top 10 Application Security Risks

  1. Injection - Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.

  2. Broken Authentication - Application functions related to authentication and session management are often implemented incorrectly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities temporarily or permanently.

  3. Sensitive Data Exposure - Many web applications and APIs do not properly protect sensitive data, such as financial, healthcare, and PII. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data may be compromised without extra protection, such as encryption at rest or in transit, and requires special precautions when exchanged with the browser.

  4. XML External Entities (XXE) - Many older or poorly configured XML processors evaluate external entity references within XML documents. External entities can be used to disclose internal files using the file URI handler, internal file shares, internal port scanning, remote code execution, and denial of service attacks.

  5. Broken Access Control - Restrictions on what authenticated users are allowed to do are often not properly enforced. Attackers can exploit these flaws to access unauthorized functionality and/or data, such as access other users’ accounts, view sensitive files, modify other users’ data, change access rights, etc.

  6. Security Misconfiguration - is the most commonly seen issue. This is commonly a result of insecure default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information. Not only must all operating systems, frameworks, libraries, and applications be securely configured, but they must be patched/upgraded in a timely fashion.

  7. Cross-Site Scripting XSS - occur whenever an application includes untrusted data in a new web page without proper validation or escaping, or updates an existing web page with user-supplied data using a browser API that can create HTML or JavaScript. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.

  8. Insecure Deserialization - often leads to remote code execution. Even if deserialization flaws do not result in remote code execution, they can be used to perform attacks, including replay attacks, injection attacks, and privilege escalation attacks.

  9. Using Components with Known Vulnerabilities - Components, such as libraries, frameworks, and other software modules, run with the same privileges as the application. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover. Applications and APIs using components with known vulnerabilities may undermine application defenses and enable various attacks and impacts.

  10. Insufficient Logging & Monitoring - Insufficient logging and monitoring, coupled with missing or ineffective integration with incident response, allows attackers to further attack systems, maintain persistence, pivot to more systems, and tamper, extract, or destroy data. Most breach studies show time to detect a breach is over 200 days, typically detected by external parties rather than internal processes or monitoring.

Additional Attacks

  1. Directory Traversal (../) - An attacker can get sensitive information like the contents of the /etc/passwd file that contains a list of users on the server; Log files, source code, access.log and so on
  2. Cross-site Request Forgery (CSRF) - Forces an end user to execute unwanted actions on an app they're already authenticated on

Cloud Security Control Layers

Problem with cloud security is what you are allowed to test and what should you test; Another concern is with a hypervisor, if the hypervisor is compromised, all hosts on that hypervisor are as well.

  1. Applications - SDCL (Software development cycle), WAF (web application firewall)

  2. Information - DLP, encryption

  3. Management - GRC, IAM , Patch & Configuration

  4. Network - NIDS/NIPS, DNSSEC, QoS

  5. Trusted Computing Model - attempts to resolve computer security problems through hardware enhancements

  1. Computer & Network Storage - Encryption, Host-based firewall, HIDS/HIPS

  2. Physical - Guards, Gates, Fences etc.

Tools

16. Cryptography

The goals of Cryptography:

Basic Terms & Concepts

Where to Encrypt & Decrypt?

Encryption Algorithms

Symmetric Encryption

One key is used to encrypt and decrypt the data.

Cryptosystem

Defines key properties, communication requirements for the key exchange; actions through encryption and decryption process.

e.g.: Using asymetric encryption to exchange Session keys after that communicate using Symmetric encryption.

Symmetric Cryptosystems:

Algorithm Block or Streaming Block Size Rounds Key Size Notes
DES Block 64-bit 16 56 bits Uses five modes of operation: ECB, CBC, CFB, OFB and CTR.
Blowfish Block 64-bit 16 32-448 bits Public domain algorithm.
Twofish Block 128-bit 16 128, 192 and 256 bits Public domain algorithm.
3DES Block 64-bit 16 168 bits (56 x 3) Repeats DES process 3 times.
AES Block 128-bit 10, 12, or 14 128, 192 or 256 bits Encryption standard for the US Gov.; Used in WPA2
RC4 Streaming N/A 1 40-2048 bits Used in WEP, SSL and TLS; largely deprecated in current;technologies.
IDEA Block 64-bit 8 128 bits Made for replacement for the DES

Asymmetric Encryption

Uses a Key pair:

Hashes

Hash Algo.
MD5 128 bit hash
SHA-1 160 bit hash
SHA256 256 bit hash

Examples:

String: hello world!

MD5 Hash: FC3FF98E8C6A0D3087D515C0473F8677
SHA-1 Hash: 430CE34D020724ED75A196DFC2AD67C77772D169
SHA256 Hash: 7509E5BDA0C762D2BAC7F90D758B5B2263FA01CCBC542AB5E3DF163BE08E6CA9

⚠️ If you change a single character, the entire Hash value changes. See the example below, changing the last character '!' to '.'

Message digest

A message digest or hash, can be used to verify the integrity of a message by comparing the original hash to one generated after receipt of the message. If the two match, then integrity is assured. If they do not match, then the message was altered between transmission and receipt.

⚠️ Message digests are also called:

Hashing Algorithms

MD5 - Message Digest Algorithm

⚠️ Collision - occurs when two or more files create the same output

⚠️ Key space - Represents the total number of possible values of keys in a cryptographic algorithm or other security measure, such as password

⚠️ DUHK Attack (Don't Use Hard-Coded Keys) - allows attackers to access keys in certain VPN implementations; affects devices using ANSI X9.31 with a hard-coded seed key

⚠️ Rainbow Tables - contain precomputed hashes to try and find out passwords

SHA - Secure Hash Algorithm

SHA-1

SHA-2 Family

SHA-3

HMAC

Hash Message Authentication Code - Used in conjunction with symmetric key both to authenticate and verify integrity of the message.

RIPEMD

RACE Integrity Primitives Evaluation Message Digest.

Keystretching

Combine a very long salt and a huge number of hashing iterations to make cracking even more harder. (e.g Hashing the hashed password N times)

Two most popular Key stretching libraries/ functions:

Example:

Password: 123456
Hash:
rYoSDg62evyzhE1+lWBa9A==:YaeMu71c8KU3H0RYFPle0Q==
Password: 123456
Hash:
$2b$10$vES9mCPsE10//vOc1u01XeUVmJrZyHGMPaRfo39OIUoJ2g7iPtDnu

⚠️ Key streaming - involves sending individual characters of the key through an algorithm and using a mathematical XOR function to change the output.

Cryptographic nonce

Cryptographic randomization schemes

Initialization vectors (IV)

Digital Signatures

⚠️ Digital Signature Standard (DSS):

PKI System

Public Key Infrastructure (PKI) - structure designed to verify and authenticate the identity of individuals

Digital Certificates

Registration Authority

Certificate Authority

Certificate Revocation List (CRL)

Validation Authority

Trust Model

Cross-Certification

Single-authority system

Hierarchical trust system

Key Wrapping and Key Encryption Keys (KEK)

⚠️ Protocols such as SSL, PGP, and S/MIME use the services of KEKs to provide session key confidentiality, integrity, and sometimes to authenticate the binding of the session key originator and the session key itself.

Full Disk Encryption - FDE

Encrypted Communication

Cryptography Attacks

Cryptographic attacks approaches that seek to exploit one or more vulnerabilities in a cryptosystem to break it; Note: Patterns Kill! and it's all about the key!

Tools

How to defeat attack: