Author: kanishka10

Posted on by

Beginners guide to honeypots

Hello aspiring ethical hackers. In this blogpost, you will learn about Honeypots. A Honeypot is one of the security technologies that is useful in enhancing the security of an organization.

What is a Honeypot?

A Honeypot is a security mechanism that unlike other security technologies like Firewalls, IDS and IPS, that try to block malicious activity, attracts the hacker’s attacks to keep the organization secure. A honeypot which can be software or hardware, is made intentionally vulnerable so that hackers can hack it easily. By observing how hackers are compromising the Honeypot, cyber security teams can easily improve their security policies.

Types of Honeypots

Apart from being classified as hardware or software, honeypots are classified into two types based on their operation. They are,

  1. Production honeypot.
  2. Research honeypot.

Let’s learn about each of them in detail.

1. Production honeypot:

These types of honeypots are the most common type of honeypot deployed by organizations around the world. As their name implies, they are deployed in the organization’s production network. They are easier to deploy and give valuable information like the hackers IP address etc.

2. Research honeypot:

As their name implies, Research honeypots are used to gather more information about hackers and their method of hacking compared to production honeypots. Research honeypots collect information like hacker tactics and their methods. However, they are complex to be deployed.

Types of Honeypot deployments

Honeypots can be deployed in three ways. They are,

  1. Pure honeypot
  2. Low-Interaction honeypot
  3. High-Interaction honeypot.

1. Pure honeypot:

This honeypot is connected to the production network of the organization and completely mimics other production systems in the network.

2. Low-interaction honeypot:

As its name implies, low-interaction honeypot gives limited access to hackers. It may just simulate some services and protocols that can appear attractive to hackers. Nothing more than that. After some time, hackers may identify it as a honeypot.

3. High-interaction honeypot:

This is just the opposite of low interaction honeypot. Instead of just simulating some protocols and services, it is a real system with real vulnerabilities and services. Although a bit complex to deploy, this honeypot gives major access for hackers and they can help understand hacker intentions and tactics.

Posted on by

Common AntiVirus bypass techniques

Hello, aspiring ethical hackers. In this blogpost, you will learn about the antivirus bypass techniques used by hackers and pen testers alike in real -world. In our previous blogpost on Antivirus, you learnt about various techniques used by Antivirus to detect malware. Please read that article before to better understand the Antivirus bypass techniques explained here.

Why AntiVirus bypass is important?

In any organization nowadays, every computing device is protected by Antivirus nowadays. Hence, it is very important to understand various techniques of Antivirus bypass for pen testers and Blue Teams alike.

Techniques for AntiVirus bypass

Here are the various techniques used in Antivirus bypass.

  1. Encryption
  2. Obfuscation
  3. Packing
  4. Protectors
  5. Memory Injection

Let’s learn about each of these techniques in detail.

1. Encryption:

This is a technique that cryptographically changes the code of the payload. In our previous blogpost on encryption, you can learn in detail about cryptography & encryption and their role in cybersecurity. After the code of the payload is encrypted, a decrypting stub is created that decrypts and executes the code of that payload. Usually, this stub is hidden and it goes undetected by the AntiVirus.

The program that is used to encrypt the code of the payload is known as cryptor. Coding cryptors that create FUD payloads is a booming business in dark web.

2. Obfuscation:

Obfuscation is an evasion technique in which the code of the payload is changed and reorganized in such a way that it becomes difficult to understand. This made the reverse analysis of the payload difficult.

3. Packing:

Packing is the process in which the code of the payload is transformed into a different format. This reduces the size of the payload and makes a new binary.

4. Protector:

Software vendors use protection to prevent the code of the software from being reverse engineered. This is normally used to prevent software from being pirated. However, malware creators also use it to prevent the code of the payload from being reverse engineered.

5. Memory Injection:

If you have noticed, as soon as you drop a malicious payload on your system, (even msfvenom payload) the Antivirus immediately quarantines it. So, most malware creators code their payloads to run in memory instead of running on the hard disk to prevent Antivirus from detecting it.

Posted on by

Popular Firewall bypass techniques

Hello, aspiring ethical hackers. In this blogpost, you will learn about most common firewall bypass techniques used by hackers and pen testers in real world. In our previous blogposts on Firewalls and IDS and IPS, you learnt in detail what are firewalls, Intrusion Detection System (IDS), Intrusion Prevention System (IPS), types of Firewalls, IDS and IPS and various techniques used by them to do what they do best. Please read them first to better understand how firewall bypass techniques described below work.

Why do hackers and pen testers bypass Firewalls and IDS and IPS?

Before you learn about different techniques hackers and pen testers use to bypass firewalls, IDS ad IPS, you need to understand why it is important to bypass them. In real-world networks of organizations, firewall, IDS and IPS are the most common devices or software that are employed by organizations to keep their network secure. So, in order to reach the actual network, a penetration tester or hacker has to bypass the firewalls. The result of a successful pen test depends on the bypass techniques they use.

Common firewall bypass techniques

Pen tester or hackers employ various techniques to bypass firewalls, IPS and IDS. They are,

  1. Spoofing the IP address.
  2. Proxies.
  3. Fragmenting packets.
  4. Source routing.
  5. Source port manipulation.

Let’s learn about each of these techniques in detail.

1. Spoofing the IP address:

If firewalls detect malicious traffic coming from a particular IP address or IP range, they just block the IP address to prevent malicious activity. This is one of the simplest functions of a Firewall or IPS. However, hackers or pen testers can bypass this by spoofing the source IP address. Learn more about IP address spoofing.

2. Proxies:

Hackers in real world and pen testers always hack their targets routing through another machine or computer. This is known as proxy. Hackers do this for covering tracks and do this to hide their activity. They also do this to bypass firewalls especially when the IP address is blocked by the firewall. They can also use proxy server for this purpose.

3. Packet fragmentation:

Data through network is transferred in the form of network packets. Each packet contains all the information needed for data transmission like the source IP address, destination IP address, source port and destination port etc. Firewalls and IDS analyses these packets for information. Each packet can be fragmented into small chunks and then transmitted. Fragmented packets are reassembled at the target machine. Reassembling the fragmented packets take lot of time and consume lot of resources. Most Firewalls and IPS are configured to ignore packets that are fragmented.

4. Source routing:

When a network packet is sent from the source system to the destination system, it hops through a number of devices before it reaches the destination machine. If a firewall or IDS is present in the route taken by the packet, it is blocked. So, hackers try to send this packet through a different route that doesn’t have a firewall or IDS. This is known as source routing.

5. Source port manipulation:

Firewalls allow traffic through some ports by default, say for example, HTTP port. If the source port is manipulated in the network packet, then it can bypass the firewall.

Posted on by

Beginners guide to Metasploit payloads

Hello, aspiring ethical hackers. Payloads play a very important role in ethical hacking. In this blogpost, you will learn everything about Metasploit payloads beginning from what is a payload, how many types of payloads are there and various functions of payloads etc.

What is a payload?

A payload in cyber security is a piece of code that is executed after successfully running an exploit to take advantage of a vulnerability. When a Proof Of Concept (POC) for a vulnerability is disclosed, this allows most hackers around the world to execute their chosen payloads. This payload can be anything from malware, reverse shell, RAT, ransomware etc or their own custom payload.

For example, ms08_067 vulnerability was exploited in real-world to deploy Conficker worm, but while pen testing, a meterpreter payload is used most probably.

Types of Metasploit payloads

Payloads in Metasploit can be classified into three types based on their function. They are.

  1. Staged payloads or stagers.
  2. Stageless or Non-staged (Inline) payloads or Single payloads.
  3. Stages

1. Single or Stageless / Non-staged or Inline payload:

A single payload s self-contained as it contains in itself all the code required to do what it does. This is one of the easiest payloads to create but its size is a bit large. This may increase suspicions.

2. Stager payload:

Stager payloads also known as stagers set the stage for another payload. Their purpose is to establish a network connection between the target system and attacker system.

3. Stages:

This is the payload that is downloaded by stager payload.

Posted on by

Beginners guide to pen testing

Hello, aspiring ethical hackers. In this blogpost, you will learn about what is pen testing, types of pen tests, the purpose of a pen test etc.

What is pen testing?

Pen testing also known as penetration testing is the testing done to exploit the vulnerabilities and weakness in the applications, system, device and network. The aim of pen testing is to find out about any vulnerabilities in the target and patch or fix them so that malicious hackers cannot exploit them and compromise the security of the organization.

Different approaches to pen testing

Pen tests can be classified based on the information that is provided to the pen testers. They are,

1. Black Box Pen test:

In a Black box pen test, no information about the target is provided to the pen tester. This pen test is performed to simulate the Real-World Black Hat hacking attacks that usually start from the phase of reconnaissance.

2. Grey Box Pen test:

In a Grey Box pen test, the pen tester is provided limited information about the target network or organization. For example, this information is something like that gives basic login access to the pen tester. This pen test saves the elaborate time that takes to perform a Black box pen test.

3. White Box Pen test:

In this type of pen test, the maximum information needed about the target is provided to the pen tester as much as possible. This test is done to simulate the hacking attack in which the hacker knows about the target organization, someone like an internal employee. This test saves time and expenses.

Based on the location of the pen test being done, pen tests are classified as Internal & External pen tests.

4. Internal Pen testing:

This pen test is performed from inside the organization. This is to simulate the inside threats, who have extensive knowledge about the organization and its resources.

5. External Pen testing:

As you might have already expected, this pen test is performed from outside the organization. This test is usually performed to test the perimeter security of the network.

Types of pen testing

There are different types of pen tests. They are,

  1. Network Penetration Testing.
  2. Wireless Penetration Testing.
  3. Social engineering Pen test.
  4. Physical pen test.
  5. Red Team pen test.
  6. Web app pen test.
  7. Mobile Pen test.
  8. IOT Pen test.
  9. Cloud Pen test.