Author: kanishka10

Posted on by

Nim Malware and AV Evasion

Hello aspiring ethical hackers. In this article, you will learn about Nim malware and how hackers are using it to bypass Antivirus solutions.

New to Ethical Hacking?

Start your journey with The Beginner Ethical Hacker Starter Kit (2026 Edition).

Inside the free guide, you’ll learn:.

  • Ethical hacking fundamentals
  • Beginner cybersecurity roadmap
  • Essential hacking tools
  • Common vulnerabilities explained
Download the free starter kit and start learning ethical hacking today

“Cyber Security researchers at ProofPoint were tracking a hacking operation they named as TA800. TA800 had a common mode of operation. They send personalized phishing emails containing a link to a supposed PDF document. Users who visited that link, downloaded malware with a fake PDF icon. This Malware is a loader which once opened provides attackers control of victim’s Windows Systems. These hackers have been using a loader named Baz Loader since 2020. However, researchers noticed a new loader being used by these hackers on February 3, 2021. This loader which researchers named as Nimza Loader was built in Nim programming language.”

Nim is a programming language designed and developed by Andreas Rumpf. Originally named as nimrod (it was renamed Nim in 2008), Nim was created to be a language as fast as C, as expressive as Python and as extensible as Lisp.

Often, the most common programming languages used to make malware are C, C++, Java and Visual Basic.  But Malware authors often use a new programming language to beat Anti-Malware. Python Inspired syntax and a feature to compile directly to C , C++ etc makes Nim easy to use for developers and malware authors alike. It also has cross platform support. By writing malware in Nim, hackers can make it difficult for Anti-Malware to be able to detect their payloads since they have no updated detection systems for these new programming languages.

               In this tutorial readers will learn the process of creating Nim malware and test this malware to see if Anti Malware can detect these payloads or not. Unlike other popular programming languages, Nim is not installed by default in Kali Linux. It can be installed using the apt package manager as shown below.

sudo apt install nim

Nim is successfully installed. Just like any other programming language, Nim needs a compiler. Although it is compatible with many compilers, let’s install mingw-64 compiler as shown below.

sudo apt-get install mingw-w64

As Nim is installed, nimble will be available on the Kali Linux system. Nimble is the package manager of Nim language. To create malware using Nim we need some more libraries. Important among them is the Winim library, which contains Windows api, struct and constant definitions for Nim. This is important while creating Windows based malware. Zippy is used for compressing and decompressing payloads. Nimcrypto is Nim’s cryptographic library used to perform several cryptographic functions.

nimble install winim zippy nimcrypto

Since all the necessary libraries are installed, it’s time to create a  payload using Nim. A Github repository named Offensive Nim has many Nim payloads. We will download one Nim payload from there and compile it. We download the keylogger.nim payload from the Git repository and use the syntax below to compile it.         

The “-c” option specifies compiling the “-d” option is used to specify compiler. The “—app” option is used to specify the type of app to create. We can create four types of applications here: console, GUI, lib and staticlib. We will create a console app here. The “—cpu” option is used to specify the target processor. Since our target is a Windows system, we are specifying i386 option which can run on both 64bit and 32bit systems.

nim c -d=mingw –app=console –cpu=i386 <path to Nim payload>

This will create a Windows executable file with the same name as the .nim file. The payload is ready. Now lets test it. We copy it to the target system (Windows 7) running a third party Antivirus. As you can see, all the protection shields are active and the AV is updated.

As the payload is successfully copied to the target system, the Antivirus failed to detect it.

nim malware

Let’s try executing our payload and see the response of the Anti Virus. Even as our payload is running, the Antivirus failed to detect it.

Want to Learn Ethical Hacking Step-by-Step?

If you’re serious about learning cybersecurity, a structured roadmap makes the journey much easier.

Download The Beginner Ethical Hacker Starter Kit (2026 Edition) and discover:

✔ The ethical hacking learning path
✔ Beginner-friendly security concepts
✔ Essential tools ethical hackers use
✔ The most common vulnerabilities explained

Get the free starter kit here

This is good. But let’s try something meaningful. Let’s try to get a reverse shell on the target system. We downloaded a simple Nim reverse shell from here.

We change its LHOST and LPORT values and compile it in the same manner as above.

We start a Netcat listener on the Attacker system and execute the reverse shell payload on the target system.

As readers can see, we got a successful reverse shell connection and the Antivirus didn’t even blink.

Start Your Ethical Hacking Journey Today

Learning cybersecurity can feel overwhelming at first. The best way to start is with a clear roadmap and the right resources.

Download The Beginner Ethical Hacker Starter Kit (2026 Edition) and get instant access to:

✔ Ethical hacking fundamentals
✔ A beginner cybersecurity learning roadmap
✔ Essential hacking tools every beginner should know
✔ Common vulnerabilities explained simply

Get the free starter kit now and begin your ethical hacking journey
Posted on by

Driftnet: Network Sniffing Tool to Capture Images

Hello aspiring ethical hackers. In our previous blogpost, you have learnt about WireShark. In this article, you will learn about Driftnet, a network sniffing tool that captures images in the network. When data travels across a network, it doesn’t always move in a neat, protected package. On poorly secured or unencrypted networks, information can be observed, intercepted and reconstructed by anyone who knows where to look.

New to Ethical Hacking?

Start your journey with The Beginner Ethical Hacker Starter Kit (2026 Edition).

Inside the free guide, you’ll learn:.

  • Ethical hacking fundamentals
  • Beginner cybersecurity roadmap
  • Essential hacking tools
  • Common vulnerabilities explained
Download the free starter kit and start learning ethical hacking today

Driftnet is a classic example of a network sniffing tool that demonstrates just how much data can leak when encryption is missing. In this blog post, we’ll explore what Driftnet is, how it works, what it captures and why it’s often discussed in cybersecurity training and ethical hacking labs.

What is Driftnet?

Driftnet is an open-source network traffic analysis tool designed to monitor network packets and extract images (such as JPEGs, PNGs, and GIFs) as they pass through the network. Unlike full packet analyzers, Driftnet focuses on a very specific goal: rebuilding visual content from unencrypted traffic.

Originally created as a demonstration tool, Driftnet shows how attackers can passively observe data without actively breaking into systems. It listens quietly on a network interface and reconstructs images being transmitted in real time.

This makes it a powerful educational tool and presents a clear warning about the risks of unencrypted communications.

How Driftnet works?

Driftnet operates by putting a network interface into promiscuous mode, allowing it to capture packets not specifically addressed to the local machine. Here’s a simplified breakdown:

1. Packet Capture:

Driftnet can capture packets moving across the network using packet capture libraries. It doesn’t inject traffic. Like every sniffer, it only listens.

2. Traffic Filtering:

This tool scans network packets for recognizable image file signatures commonly used in HTTP traffic.

3. Image Reconstruction:

When any image data is detected, it reconstructs the image from packet fragments and displays it in a separate window or saves it locally.

4. Passive Monitoring:

As Driftnet does not modify traffic, it can remain invisible to users on the network. Simply put, if an image travels across the network without encryption, Driftnet may be able to capture and display it.

What Kind of Data Can Driftnet Capture?

Driftnet is limited in scope but still eye-opening. It can capture:

  • Images loaded on unsecured websites
  • Profile pictures from legacy web applications
  • Media from internal dashboards using HTTP
  • Images transmitted over poorly configured internal networks

It cannot capture:

  • Encrypted HTTPS traffic
  • VPN-protected traffic
  • Modern TLS-secured content
  • End-to-end encrypted communications

Real-World Scenarios Where Driftnet Matters

1. Public Wi-Fi Networks

Open Wi-Fi in cafés, airports or hotels is a classic environment where unencrypted traffic can still appear.

2. Internal Corporate Networks

Legacy systems, internal dashboards or test environments often run without encryption.

3. IoT and Embedded Devices

Some cameras, printers and dashboards transmit images without proper security.

A Practical Walkthrough for beginners

Now, let’s see driftnet in action. For this tutorial, we will be needing any program that requires images to be transferred in a network. To keep similarity with Real-world scenarios, we will use Netop Vision Pro Classroom Management Software for this purpose. A Free Trial can be downloaded from here. As its name implies, this is a Classroom Management Software used for distance learning. It has two modules: the Teacher module and Student module.

The Teacher module is installed on one system and the student module is installed on all the student systems. The computer running the Teacher module has complete control over the computer running the student module and the student has no or very small limited role. The Teacher can view the Desktop of the Student’s Desktop to make sure the student is on track.

We need a lab too. We will be using Basic Lab from our Hacking Labs blogpost. The only change is instead of two virtual machines, we need three virtual machines.

  1. Windows 7 (For installing Netop Vision Student Module)
  2. Windows 7 (For installing Netop Vision Teacher Module)
  3. Kali Linux (Attacker system)

Instead of Metasploitable 2, we need to have two Windows 7 systems. One for installing Netop Vision Student Module and another for running Netop Vision Teacher Module. The third system is Kali Linux which is the attacker system and used for sniffing images. Let’s setup the Lab first. Download the Netop Vision Pro software onto the first Windows 7 system and click on it. Select the “Run Installer” and click on “Next”.

Click on “I Accept The Terms in the license agreement” and click on “Next”.

Select the Vision Student Module and click on Next.

Select the option as a Windows Startup Service and click on Install.

Check the IP address of this system and restart it.

Here’s the Student’s Windows system. There is some program running on it.

Now, in the second Windows 7 system, install the Teacher module of Netop Vision.

When it prompts for the license key, click on “Next”.

Click OK to restart the computer.

Want to Learn Ethical Hacking Step-by-Step?

If you’re serious about learning cybersecurity, a structured roadmap makes the journey much easier.

Download The Beginner Ethical Hacker Starter Kit (2026 Edition) and discover:

✔ The ethical hacking learning path
✔ Beginner-friendly security concepts
✔ Essential tools ethical hackers use
✔ The most common vulnerabilities explained

Get the free starter kit here

After the computer (on which Netop Vision’s Teacher Module) reboots, open the Netop Vision application. This should open the class room manager window automatically. If that did not happen, open it from the File menu. Create a new classroom. Click on “New”.

Click on “Next”.

Add the student system. Click on “Add” and add the IP address of the student system as shown below. Then click on “translate addresses”. You will get the IP address translated to the name of the computer. Click “OK”.

Click “Next”.

Click on “Finish” to finish the installation.

We have set up a new classroom. From the classroom manager, open the new classroom you just created.

We can see the Desktops of connected Student computers. Since we have connected only one student computer, only one system is shown.

As you already read above, The Teacher module is used to keep track of Student computers. For this, there is a live transmission of Desktop images from Student Computer to Teacher computer. The target is ready. On the Kali Linux system, install the Driftnet tool using command shown below.

sudo apt-get install driftnet
mitm attack

Check the name of the network interface.

Now all we have to do is to start the driftnet tool on that interface.

sudo driftnet -i eth0

A small window will open as shown below.

When you maximize the window, you can see the live capture of the images of the Student’s Desktop. These images of the student computer are being captured by the teacher module. These images are captured at regular short intervals and transmitted in real time to the Teacher computer.

But how are these images being sniffed by Driftnet? Just like in the case of plain text protocols, these images are being transmitted in the network without any encryption. Hence, driftnet has been able to capture them by sniffing on the network.

How to Defend Against Driftnet-Style Attack?

1. Use HTTPS Everywhere:

TLS encryption prevents packet sniffers from reading the captured content.

2. Enforce VPN Usage:

A VPN encrypts traffic even on hostile networks.

3. Secure Internal Applications:

Never assume internal traffic is safe by default.

4. Avoid Open Wi-Fi:

Always prefer WPA2/WPA3 secured networks or mobile hotspots.

5. Monitor for Promiscuous Interfaces:

Use Network monitoring tools that detect suspicious sniffing behavior. Driftnet may look simple, but it delivers a powerful lesson: unencrypted data is visible data. While modern encryption has reduced its effectiveness on today’s internet, the tool remains relevant for understanding passive attacks, network visibility and why security fundamentals still matter. If an image can be seen, it can be stolen. And if traffic isn’t encrypted, someone is always watching.

Start Your Ethical Hacking Journey Today

Learning cybersecurity can feel overwhelming at first. The best way to start is with a clear roadmap and the right resources.

Download The Beginner Ethical Hacker Starter Kit (2026 Edition) and get instant access to:

✔ Ethical hacking fundamentals
✔ A beginner cybersecurity learning roadmap
✔ Essential hacking tools every beginner should know
✔ Common vulnerabilities explained simply

Get the free starter kit now and begin your ethical hacking journey
Posted on by

Digital Forensics with Autopsy (Beginners guide)

Hello aspiring Cyber Forensic Investigators. In our previous blogpost, you learnt in detail about Computer Forensics. In this article, you will learn about one of the tools mentioned in that article, Autopsy. In the world of digital forensics, investigators rely on powerful tools to uncover hidden evidence, reconstruct user activity and understand what really happened on a device. While many enterprise-grade forensics suites come with hefty price tags, one tool stands out as both free and incredibly capable: Autopsy. Built on top of The Sleuth Kit (TSK), Autopsy delivers a graphical and user-friendly interface that transforms complex forensic tasks into something really simple, even for beginners.

New to Ethical Hacking?

Start your journey with The Beginner Ethical Hacker Starter Kit (2026 Edition).

Inside the free guide, you’ll learn:.

  • Ethical hacking fundamentals
  • Beginner cybersecurity roadmap
  • Essential hacking tools
  • Common vulnerabilities explained
Download the free starter kit and start learning ethical hacking today

What exactly is Autopsy?

Autopsy is an open-source digital forensics platform designed to examine hard drives, memory cards, mobile phones and disk images. It takes the raw power of TSK which is an industry-standard command-line forensics engine and wraps it in a clean graphical interface with modules, dashboards, timelines and reporting features. The result is a forensic workbench that feels modern, intuitive and surprisingly powerful for a free tool. Law enforcement agencies, cybersecurity teams and researchers around the world use Autopsy for investigations ranging from cybercrimes and fraud to incident response and breach analysis. But its ease of use also makes it perfect for students and cybersecurity beginners.

Why Autopsy is so popular?

Autopsy gained massive popularity in computer forensic investigations because it strikes a rare balance: it’s completely free yet rivals the functionality of expensive commercial tools. Here’s why investigators and analysts love it:

1. A User-Friendly GUI for Sleuth Kit

TSK is excellent but it’s all command-line. Autopsy brings visual clarity with:

  • A clear file explorer
  • Tabs for artifacts and timelines
  • Keyword search windows
  • Convenient reporting options

For beginners, this alone is a game-changer.

2. Built-In Forensics Modules

Autopsy includes modules for:

  • File recovery
  • Web browser artifact extraction
  • Email parsing
  • Registry analysis
  • Keyword indexing
  • Hash set matching
  • EXIF and image metadata

You simply check the modules you want to enable for each case.

3. Enterprise-Level Features Without the Cost

Autopsy supports:

  • Case management
  • Multi-user collaboration
  • Timeline analysis
  • Hash databases (like NSRL)
  • Custom ingest modules

These features make it scalable from classroom use to real-world investigations.

How Autopsy works?

Autopsy uses a workflow which is same in professional forensic processes.

Step 1: Create a Case

You start by giving a name to your investigation, setting a folder for output and adding case details.

Step 2: Add Data Sources

Next step is to add the forensic image on which you want to perform your investigation. Autopsy can ingest:

  • Disk images in various formats (.dd, .img, .E01)
  • Physical drives
  • Memory dumps
  • Logical folders
  • Mobile phone extractions (via modules)

Step 3: Enable required modules

This determines what Autopsy scans for. For example:

  • File Analysis: lists, categorizes and recovers files
  • Web Artifacts: extracts browsing histories and cookies
  • Keyword Search: finds specific words or patterns
  • Hash Lookup: matches known-good or known-bad files

Step 4: Review Findings

Results appear in categories such as:

  • Recent documents
  • Web activity
  • Installed programs
  • User accounts
  • Images and media
  • Deleted items

You can pivot into deeper analysis, open files in viewers, inspect metadata and even bookmark evidence.

Step 5: Generate a Report

Autopsy exports clean reports in various formats like HTML, CSV and Excel, perfect for documenting conclusions in a professional investigation.

A Beginners Lab

Let’s now see the working of Autopsy practically. For this, we need a forensic image and we will use an Encase Image provided by CFReDS, a portal that provides documented digital forensic images and datasets for use in the digital forensics community. The image we are using Autopsy is of a Dell Latitude laptop named “Hacking Case” that can be downloaded from here. You need to download two Encase Images. The two images we are looking for are,

https://cfreds-archive.nist.gov/images/4Dell%20Latitude%20CPi.E01
https://cfreds-archive.nist.gov/images/4Dell%20Latitude%20CPi.E02

Here is a feel real back story about this forensic image.

“On 09/20/04, a Dell CPi notebook computer, serial # VLQLW, was found abandoned along with a wireless PCMCIA card and an external homemade 802.11b antennae. It is suspected that this computer was used for hacking purposes, although cannot be tied to a hacking suspect, G=r=e=g S=c=h=a=r=d=t. (The equal signs are just to prevent web crawlers from indexing this name; there are no equal signs in the image files.) Schardt also goes by the online nickname of “Mr. Evil” and some of his associates have said that he would park his vehicle within range of Wireless Access Points (like Starbucks and other T-Mobile Hotspots) where he would then intercept internet traffic, attempting to get credit card numbers, usernames & passwords. Find any hacking software, evidence of their use, and any data that might have been generated. Attempt to tie the computer to the suspect, G=r=e=g S=c=h=a=r=d=t. A DD image and a EnCase image of the abandoned computer have already been made.”

The mission for us is to analyze this Encase Image and answer around 20 questions that solve this case. The questions are also provided by the same people who provided this “Hacking Case” to us. Let’s start analyzing this image and solve the case. Once the program is installed, open it and click on “New Case”.

autopsy

Give a name to the case. We have named it “Hacking_Case”.

Assign a number to the case and provide the name of the Forensic investigator. Our case number is 00 and the investigator is Luke_Reckah.

Next, select the type of source. Select “Disk Image”.

Select the Data Source. Select the first part of the Encase image downloaded.

Next, select all the ingest modules you want to run. Ingest modules are all the tests that can be run on the image to gather information about it. These ingest modules include tests like hash lookup, email parsing etc. We selected all for this.

Autopsy will start analyzing the image. It may take some time to completely analyze the image. However, it will start displaying findings as soon as it finds them. Let the image analysis finish.

After the image analysis is finished, all the extracted information can be found on the left side of the program window.

It’s time to start answering questions related to the case now.

1. What is the image hash? Does the acquisition and verification hash match?

In Digital Forensics, as soon as a image is acquired to perform analysis on it, a hash is calculated to check if the file integrity is intact and not compromised. If the acquisition and verification hash do not match, it means our forensic analysis has changed the image which is not at all intended. The image hash is “AEE4FCD9301C03B3B054623CA261959A”. It is found in the File Meta data section.

2. What operating system was used on the computer?

The operating system information can be found in the “Operating System Information” of the extracted content.

The operating system being used by this laptop is Windows XP.

3. Who is the registered owner?

The information about the registered owner of the computer is found in the same operating system info section in extracted content.

The name of the owner of this computer is “Greg Schardt”.

4. When was the install date?

The installation date can be found in the same operating system info section just below the OS information.

The OS on the computer was installed on 19-08-2004 22:48:27.

5. What is the computer account name?

The computer account name on this computer is found in the same section.

The computer account name is N-1A9ODN6ZXK4LQ.

Want to Learn Ethical Hacking Step-by-Step?

If you’re serious about learning cybersecurity, a structured roadmap makes the journey much easier.

Download The Beginner Ethical Hacker Starter Kit (2026 Edition) and discover:

✔ The ethical hacking learning path
✔ Beginner-friendly security concepts
✔ Essential tools ethical hackers use
✔ The most common vulnerabilities explained

Get the free starter kit here

6. How many user accounts are recorded?

The information about the user accounts is found in the “Operating System User Account” section.

There are total five user accounts on the target computer. They are Administrator, Mr. Evil, SUPPORT_388945a0, Guest and HelpAssistant.

7. What is the account name of the user who mostly uses the computer?

 In the same section as above, the count section shows how many times the user logged in.

The user Mr. Evil has logged in 15 times while the others didn’t even log in once. So, Mr. Evil is the user who mostly uses the computer.

8. Who was the last user to logon to the computer?

The information about the last user to logon to this computer can be found from the Date accessed column of the user account.

The last user to logon to this computer is Mr. Evil.

9. Find 6 installed programs that may be used for hacking?

The programs installed on the computer system can be found out from the “Installed programs” section of the extracted content.

There are total 32 programs installed on the computer and from them, there are seven programs that can be used for hacking. They are Ethereal 0.10.6 v.0.10.6, Network Stumbler 0.4.0, Look@LAN 2.50 Build 29, 123 Write All Stored Passwords, CuteFTP, Cain & Abel v2.5 beta45 and Anonymizer Bar 2.0.

10. Perform a Anti-Virus check. Are there any viruses on the computer?

Malicious files (if any), are found in the “Interesting Items” section of the extracted content.

There is one malware file present on the computer system. It is a zip bomb.

11. When was the last recorded computer shutdown date/time?

The last recorded shutdown date and time can be found out in the following file in Windows. 

“C:\WINDOWS\system32\config\software\Microsoft\WindowNT\CurrentVersion\Prefetcher\ExitTime”

digital forensics

The shutdown date and time is 2004/08/27 10:46:27.

12. List the network cards used by this computer?

The information about the network cards on this computer can be found in the Windows file   “C:\WINDOWS\system32\config\software\Microsoft\WindowNT\CurrentVersion\NetworkCards”

There are two network cards on this system. One is a Compaq WL 110 Wireless LAN PC Card and another is Xircom CardBus Ethernet 100 + Modem 56 (Ethernet Interface).

13. A search for the name of “G=r=e=g S=c=h=a=r=d=t” (The equal signs are just to prevent web crawlers from indexing this name; there are no equal signs in the image files) reveals multiple hits. One of these proves that G=r=e=g S=c=h=a=r=d=t is Mr. Evil and is also the administrator of this computer. What file is it? What software program does this file relate to?

The file that reveals all this information is “C:\Program Files\Look@LAN\irunin.ini”

This file belongs to the program Look@LAN.

14. This time file reports the IP address and MAC address of the computer. What are they?

The IP address of this machine is 192.168.1.111 and the MAC address is 0010a4933e09. The LAN user is Mr. Evil. This confirms that Mr. Evil and Greg Schardt are one and the same.

15. An internet search for vendor name/model of NIC cards by MAC address can be used to find out which network interface was used. In the above answer, the first 3 hex characters of the MAC address report the vendor of the card. Which NIC card was used during the installation and set-up for LOOK@LAN?

Media Access Control (MAC) address or the physical address is a 12 digit hexadecimal number hardcoded to the NIC card. The first 3 hexadecimal characters reveal the vendor of the NIC card. There are many websites which offer this service of knowing the vendor of the NIC card. Pasting the MAC address of the computer reveals the vendor.

The Vendor of this NIC card is XIRCOM.

16. What is the SMTP email address for Mr.Evil?

SMTP or Simple Mail Transfer Protocol is a protocol used to send emails. The SMTP email address if present on the system can be found in “C:\Program Files\Agent\Data\AGENT.INI file“.

The SMTP email address is “whoknowsme@sbcglobal.net”.

17. What are the NNTP (News Server) settings for Mr.Evil?

This information can be found in the same file as above.

The news server being used is “news.dallas.sbcglobal.net”.

18. What two installed programs show this information?

We searched for local settings of all programs and found the information about this news server in the local settings of Outlook Express.

We found this information in the “Documents and settings” file (and above shown path) of user Mr. Evil.

19. List 5 newsgroups that Mr.Evil has subscribed to?

We can find this information in the same file as above.

User Mr. Evil subscribed to over 23 news groups. The news groups subscribed by the user Mr. Evil are,

  1. Alt.2600.phreakz  2. Alt.2600  3. Alt.2600.cardz    4. Alt.2600codez  5. Alt.2600.crackz   6. Alt.2600.moderated  7. Alt.binaries.hacking.utilities 8. Alt.stupidity.hackers.malicious   9. Free.binaries.hackers.malicious   10. alt.nl.binaries.hack   11. Free.binaries.hacking.talentless.troll_haven   12. alt.hacking 13. free.binaries.hacking.beginner  14. alt.2600.programz   15. Free.binaries.hacking.talentless.troll-haven   16. alt.dss.hack   17. free.binaries.hacking.computers   18. free.binaries.hacking.utilities 19. alt.binaries.hacking.websites   20. alt.binaries.hacking.computers   21. alt.binaries.hacking.websites  22.           alt.binaries.hacking.beginner   23. alt.2600.hackerz

20. A popular IRC (Internet Relay Chat) program called MIRC was installed. What are the user settings that were shown when the user was online in a chat channel?

We can find this information in the .ini file of the installed program MIRC. The path to this program is in “C:\Program Files\mIRC\mirc.ini”

The user settings that were shown when the user was online and in a chat channel are                        
user = Mini Me                        
email = none@of.ya                        
nick = Mr                         
anick = mrevilrulez

21. This IRC program has the capability to log chat sessions. List 3 IRC channels that the user of this computer accessed?

This information can be accessed from C:\Program Files\mIRC\logs file.

The IRC channels that this user accessed are          
Ushells.undernet.log                                             
Elite.hackers.undernet.log          
Mp3xserv.undernet.log                                         
Chataholics.undernet.log          
Cybercafé.undernet.log                                         
M5tar.undernet.log          
Thedarktower.afternet.log                                     
Funny.undernet.log          
Luxshell.undernet.log                                            
Evilfork.efnet.log          
Iso-warez.efnet.log                                                
Houston.undernet.log

22. Ethereal, a popular “sniffing” program that can be used to intercept wired and wireless internet packets was also found to be installed. When TCP packets are collected and re-assembled, the default save directory is that users\My Documents directory. What is the name of the file that contains the intercepted data?

After going through the Documents folder, we found the file that contains the intercepted data. It’s name is “interception”.

23. Viewing the file in a text format reveals much information about who and what was intercepted. What type of wireless computer was the victim (person who had his internet surfing recorded) using?

Viewing the file “interception” in text format revealed that the victim was using Windows CE Pocket PC wireless computer.

24. What websites was the victim accessing?

Even this information can be obtained from the same file “interception” which is a packet capture file. We found two websites the victim was accessing, Mobile.msn.com and MSN Hotmail Email.

25. Yahoo mail, a popular web based email service, saves copies of the email under what file name?

Yahoo mail saves copies of email under the file name “ShowLetter[1].htm” which is in the temporary internet files folder of the user’s “Documents and Settings”.

26. Search for the main user’s web based email address. What is it?

This information can be found out in the same file. The main user’s web based email address is “mreveilrulez@yahoo.com”.

27. How many executable files are in the recycle bin?

The contents in the Recycle bin can be found in the RECYCLER folder.

There are in total four executable files in the Recycle bin.

28. Are these files really deleted?

As most of our readers already know, the files that go to the Recycle Bin are not permanently deleted. They are only deleted temporarily and can be restored easily to their actual location in Windows.

29. How many files are actually reported to be deleted by the file system?

This information can be found out from the INFO2 file.

The actual files deleted are three.

On being asked to find out any evidence that this laptop was used for hacking, we found in our forensic investigation that this laptop belonged to Greg Schardt who also has a online persona “Mr. Evil”. We found his operating system as Windows XP and he was running Ethereal, a packet interception program to capture network traffic. Apart from Ethereal, his system had six other programs which were used for hacking. He was active among many hacking related IRC channels and NEWS groups. Corroborating this evidence with what his associates said about him, we can come to a conclusion that this laptop belonged to Greg Schardt and he was involved in hacking activities. This case can be closed now. Read how to perform forensics on a PDF File.

Start Your Ethical Hacking Journey Today

Learning cybersecurity can feel overwhelming at first. The best way to start is with a clear roadmap and the right resources.

Download The Beginner Ethical Hacker Starter Kit (2026 Edition) and get instant access to:

✔ Ethical hacking fundamentals
✔ A beginner cybersecurity learning roadmap
✔ Essential hacking tools every beginner should know
✔ Common vulnerabilities explained simply

Get the free starter kit now and begin your ethical hacking journey
Posted on by

Beginners guide to Evil Twin Attack

Hello aspiring Ethical Hackers. In our previous blogpost, you learnt about WiFi Hacking. In this article, you will learn about a different kind of wireless attack called Evil Twin attack. Have you ever used Public Wi-Fi?

New to Ethical Hacking?

Start your journey with The Beginner Ethical Hacker Starter Kit (2026 Edition).

Inside the free guide, you’ll learn:.

  • Ethical hacking fundamentals
  • Beginner cybersecurity roadmap
  • Essential hacking tools
  • Common vulnerabilities explained
Download the free starter kit and start learning ethical hacking today

Nowadays Public Wi-Fi is everywhere. It’s in airports, cafés, coworking spaces, malls, railway stations and hotels. We love it because it’s convenient. Attackers love it because it’s vulnerable. Among the most effective and least-detected wireless attacks today is the Evil Twin Attack, a method where a hacker clones a trusted Wi-Fi network to lure users into connecting. Once connected, victims unknowingly hand over passwords, messages, corporate accounts and even entire session cookies. In this blog post, you’ll learn what an Evil Twin is, how the attack works, the tools used and most importantly how to stay safe from this attack.

What is an Evil Twin Attack?

An Evil Twin is a rogue Wi-Fi access point created by an attacker to impersonate a legitimate wireless network. It uses the same network name (SSID), similar configuration and stronger signal strength to trick users into connecting .

To the victim, it looks like this:

  • He visits a cafe, orders a coffee and searches for Wi-Fi.
  • He sees a wireless network with SSID “Café_Free_WiFi.”
  • He connects to it.
  • But unknown to him, he connected to the hacker’s hotspot, not the café’s router.

Now, the hacker can eavesdrop, redirect, modify or steal his data.

How an Evil Twin Attack works?

The Evil Twin attack typically follows a simple lifecycle as shown below.

1. Reconnaissance:

The attacker scans for nearby Wi-Fi networks using tools like:

They identify the target SSID, network channel they are broadcasting on , MAC address and encryption type they are using. For example, let’s say our target SSID is “Shunya”.

2. Creating the Clone:

Next, the attacker sets up a fake access point (Evil Twin) using tools such as:

The Evil Twin broadcasts the same SSID (Shunya) and often uses a stronger signal so the victim’s device automatically prefers it over the original AP.

3. Forcing Disconnections:

Until now, all the new users connectng to original “shunya” may connect to evil twin “shunya”. In some cases, attackers perform deauthentication attacks to disconnect the users already connected to the original “shunya” network. This involves sending deauth packets to connected users, forcing them offline. When victims or his devices try to reconnect, their devices usually choose the Evil Twin because:

  • It has a stronger signal.
  • It appears identical.
  • Devices prefer previously “trusted” SSIDs.

4. Capturing Data:

Once connected to the Evil Twin, the attacker intercepts traffic. Depending on the attacker’s goal, they may:

  • Launch a captive portal phishing page to steal passwords.
  • Collect WPA/WPA2 handshakes for cracking.
  • Perform man-in-the-middle (MITM) interception.
  • Steal session tokens (e.g., Gmail, Facebook).
  • Redirect to malicious downloads or malware sites.

5. Credential Harvesting:

The most common goal is credential theft. Hackers display fake login pages resembling:

  • Office 365
  • Google login
  • Café Wi-Fi login
  • Hotel portals

Once the user enters their password, the attacker immediately receives it. Let’ s see it practically using a tool called Wifiphisher because it’s the simplest one. Our Attacker system is Kali Linux. Wifiphisher can be installed on Kali Linux as shown below.

sudo apt install wifiphisher

Once installation is finished, Wifiphisher can be started using command shown below.

sudo wifiphisher

Wifiphisher starts scanning for nearby wifi networks. Then the tool will prompt you to select the Wi-Fi Access Point of which you want to create an Evil twin as shown below.

For this tutorial as always (OK, most of the time) I will select the Wi-Fi network “Hack_Me_If_You_Can” as my target.

The tool will prompt you the available phishing scenarios available. For this case, OAuth Login Page attack is available.

The OAuth Login Page attack creates a fake login page asking for credentials of the users who want to connect. Note that while creating a fake access point, it is created as an open network unlike the one we are targeting. I select the OAuth Login Page attack and the attack starts. Our Evil Twin is ready.

So just imagine while we are running this Fake access point, some mobile user is looking for available Wi-Fi networks to connect to. He will see two networks with the same name and gets confused. Once he selects our Evil Twin to connect to, he will be prompted with a login page as shown below.

evil twin attack

Here, he is being asked to submit his Facebook credentials of course by dangling the carrot of free internet. The login page is so believable even to me. And if the user falls for the trick (or carrot) and submits his credentials as shown below.

Want to Learn Ethical Hacking Step-by-Step?

If you’re serious about learning cybersecurity, a structured roadmap makes the journey much easier.

Download The Beginner Ethical Hacker Starter Kit (2026 Edition) and discover:

✔ The ethical hacking learning path
✔ Beginner-friendly security concepts
✔ Essential tools ethical hackers use
✔ The most common vulnerabilities explained

Get the free starter kit here

On Kali Linux, the activity is recorded as shown below.

and the credentials are captured successfully.

Why Evil Twin Attacks are so effective?

Evil Twin attacks work because people trust Wi-Fi more than they should. Some reasons include:

Auto-connect Behavior:

Wireless devices automatically connect to familiar wireless network names without verifying legitimacy.

Public Wi-Fi Culture:

Rise of Public Wi-Fi and its usage increases the chances of this attack.

Lack of HTTPS Everywhere:

Although HTTPS is secure and is widely used now, attackers can still:

  • Downgrade HTTPS connections
  • Redirect traffic
  • Harvest non-encrypted requests
  • Steal session cookies.

HTTPS Everywhere is not implemented in all cases.

Low Detection by Victims:

Most people cannot differentiate between a real Access Point and its Evil Twin.

Although any Access Point can be targeted with Evil Twin attack, there are a few locations where they are highly probable. These are,

  • Airport Wi-Fi: Travelers connect without thinking.
  • Corporate Lobbies: Attackers clone the office guest Wi-Fi.
  • Coffee Shops: High foot traffic + distracted users.
  • Hotels: Many floors, inconsistent signal — perfect for rogue AP placement.
  • Tech Conferences: Thousands of users looking for free Wi-Fi.

In several red team assessments, companies discovered that employees connected to rogue Wi-Fi inside their own office buildings — highlighting how devastatingly effective this technique remains.

How to Protect Yourself

1. Avoid Public Wi-Fi for Sensitive of Confidential Tasks:

Never log into banking, email, corporate or other sensitive portals while using a public Wi-Fi.

2. Use a VPN:

A VPN encrypts traffic even over malicious access points like Evil Twins.

3. Turn Off Auto-Connect:

Disable auto-connect for public networks on phones and laptops.

4. Check for HTTPS:

While visiting any website, ensure your browser shows:

  • Lock icon
  • Valid certificate
  • HTTPS

5. Prefer Mobile Hotspots:

Your phone’s hotspot is far safer than unknown public Wi-Fi.

For Companies:

6. Enforce WPA2 Enterprise:

WPA2-Enterprise with certificate-based authentication makes Evil Twin attacks significantly harder.

7. Use a Wireless Intrusion Detection system (WIDS) :

A Wireless Intrusion Detection System (WIDS) detects:

  • Rogue Access Points
  • Deauth attacks
  • SSID spoofing

Evil Twin attacks are simple for attackers to execute but extremely difficult for average users to notice. As long as public Wi-Fi remains popular, this attack vector will continue to be one of the easiest ways for hackers to steal credentials and perform MITM attacks. Security-conscious users and especially cybersecurity professionals must understand how this attack works and adopt strong defensive measures.

Start Your Ethical Hacking Journey Today

Learning cybersecurity can feel overwhelming at first. The best way to start is with a clear roadmap and the right resources.

Download The Beginner Ethical Hacker Starter Kit (2026 Edition) and get instant access to:

✔ Ethical hacking fundamentals
✔ A beginner cybersecurity learning roadmap
✔ Essential hacking tools every beginner should know
✔ Common vulnerabilities explained simply

Get the free starter kit now and begin your ethical hacking journey
Posted on by

Process Ghosting Explained

Hello aspiring ethical hackers. In this article, you will learn about Process Ghosting, a technique used by hackers to bypass AV/EDR. As soon as an executable file lands on a Windows system, the endpoint Anti Malware opens the file for analysis. After the analysis is complete, the executable starts a process. The Anti Malware routinely detects malicious executables in this manner.

New to Ethical Hacking?

Start your journey with The Beginner Ethical Hacker Starter Kit (2026 Edition).

Inside the free guide, you’ll learn:.

  • Ethical hacking fundamentals
  • Beginner cybersecurity roadmap
  • Essential hacking tools
  • Common vulnerabilities explained
Download the free starter kit and start learning ethical hacking today

However, there is a small gap of time between the executable launching and the starting of a process. What if the executable is in delete pending state during this time gap? The Anti Malware cannot scan it as the file is in delete-pending state and its later attempts to scan it also fail as the file is already deleted. However, the malicious payload gets executed without being detected. Process Ghosting is a technique used by hackers when creating malware for Windows Operating Systems to avoid detection by Antivirus software including the Windows Defender. This technique takes advantage of a gap between process creation and when Antivirus software is notified of the process creation. This gap allows the malware developers a chance to alter the executable before it is scanned by the antivirus software.   
Process Ghosting is built on three major techniques (used to evade Antivirus software detection) used by malware developers; They are,

1. Process Herpaderping

In Process herpaderping, an existing file handle is used in order to overwrite executable with decoy PE. Hence it leaves a camouflaged malware on the disk which is different from the actual process which is running.

2. Process Re-Imaging

Process Re-imaging takes advantage of a cache synchronization problem found in the Windows OS kernel. It causes a mismatch between executable file’s path and the reported path for image sections created from the executable. It loads a DLL at a camouflaged malware path, unloads it and then loads it from a new path.

2. Process Doppel-ganging

In this antivirus detection evasion technique, a malware takes advantage of the Windows Transactional NTFS mechanism. The mechanism allows applications to carry file system operations as a single transaction which if rolled back is not visible to the underlying file system.

Now, let us see step by step how to perform process ghosting. In this tutorial, we will use Process Ghosting to make the executable file of mimikatz undetectable by AV /EDR. Mimikatz can be downloaded from here. To perform process ghosting, we will use a tool called KingHamlet tool designed by IkerSaint. It can be downloaded from here.

This is how the process of process ghosting works with any tool.

1. Download the executable file. In this case, mimikatz.exe.
2. Put file to a delete-pending state using NtSetInformationFile(FileDispositionInformation).
3. Write the payload executable to the file. The content isn’t persisted because the file is already delete-pending. The delete-pending state also blocks external file-open attempts.
4. Create an image section for the file.  
5. Close the delete-pending handle, deleting the file.  
6. Create a process using the image section.  
7. Assign process arguments and environment variables.  
8. Create a thread to execute in the process.

Want to Learn Ethical Hacking Step-by-Step?

If you’re serious about learning cybersecurity, a structured roadmap makes the journey much easier.

Download The Beginner Ethical Hacker Starter Kit (2026 Edition) and discover:

✔ The ethical hacking learning path
✔ Beginner-friendly security concepts
✔ Essential tools ethical hackers use
✔ The most common vulnerabilities explained

Get the free starter kit here

As you all know, mimikatz is easily detected by Windows Defender as malware. Let’s see the above steps practically. We fire up the King Hamlet tool in Windows to encrypt the executable file. We use the below commands.

kinghamlet.exe  <payload.exe> <encryption key>

This will create the encrypted payload named mimikatz.exe.khe as show below.

Then we run another command to run the encrypted payload as a legitimate process.

kinghamlet.exe <encrypted.exe.khe> <encrypt key> <targetfile.exe>

This is to make sure the process runs as a legitimate executable.

This will run mimikatz.exe on the system as shown below.

process ghosting

Now, open Task Manager and see what process is running with ID 336.

In this case, we ran mimikatz.exe as Bandicam.exe. So our payload decoys itself as a Windows Problem Reporting process which is a Windows core process in the Windows Operating System. When we run the encrypted executable using King Hamlet tool, the Windows Defender detects no current malicious activity as shown below.

Start Your Ethical Hacking Journey Today

Learning cybersecurity can feel overwhelming at first. The best way to start is with a clear roadmap and the right resources.

Download The Beginner Ethical Hacker Starter Kit (2026 Edition) and get instant access to:

✔ Ethical hacking fundamentals
✔ A beginner cybersecurity learning roadmap
✔ Essential hacking tools every beginner should know
✔ Common vulnerabilities explained simply

Get the free starter kit now and begin your ethical hacking journey