Category: Basics

Hello, aspiring ethical hackers. In our previous blogpost, you learnt what is cybersecurity. In this blogpost, you will learn about network security which is one of the branches of cybersecurity.

What is Network Security?

Network security is the practice of protecting a computer network from cyber attacks like unauthorized access, insider threats, malware and other advanced threats. Network security includes various technologies, processes, tools and policies etc.

Different security technologies that are used in an organization to protect the network against cyber-attacks. Various devices and software come into play while protecting the organization from a variety of threats. Let’s learn about each of them.

1. Firewall:

A firewall is the most common defensive measure that is used in organizations against cyber attacks. It can be considered the first layer of defense against hackers. Just as its name implies, it works as a wall between two networks thus preventing malicious traffic from entering the network of the organization. Learn more about firewalls here.

2. Anti-Malware:

In one of our previous articles, you learnt about virus and malware. Anti virus protects the computers and other devices in the network from this malicious software. Learn more about Antivirus.

3. Intrusion Detection System (IDS):

An Intrusion Detection System (IDS) monitors the entire traffic of the network and as soon as it sees any traffic that it considers malicious, it raises an alert. Learn more about IDS.

4. Intrusion Prevention System (IPS):

An Intrusion Prevention System (IPS) is one step above IDS. It performs the functions just like an IDS, but whenever it detects malicious traffic, it tries to prevent the connection by dropping the packets. Learn more about Intrusion Prevention System (IPS).

5. Endpoint Detection & Response (EDR):

Endpoint Detection and Response is used to monitor end user devices on the network for malware and acts against them if needed.

6. Honeypot:

Sometimes, organizations need to understand what hackers would be interested in once they are in their network. A honeypot serves this purpose. A honeypot acts as a juicy target and attracts towards thus preventing them from hacking anything in the original network. A honeypot designed with a lot of vulnerabilities that can keep the hackers constantly interested. Learn more about honeypots.

7. Demilitarized Zone (DMZ):

A demilitarized zone is a network used to add an external layer of security to the organization’s network. Usually placed at the perimeter, it has access to the external network. It usually contains an external facing service.

8. Data-Loss Prevention (DLP):

Data Loss Prevention (DLP) ensures that no confidential data is being sent out of the organization’s network. Confidential data refers to data that once exposed to the internet can harm the security of the network.

9. Security Incident & Event manager (SIEM):

A security Incident & Event Manager raises an alert if it detects any malicious activity. That’s all about the various security technologies.

Hello aspiring Ethical Hackers. In this blogpost, you will learn about steganography. Before you learn what is it, you need to learn why are we learning about it. In Feb 2023, Red Eyes Hacking Group (APT37) used a jpg image as attachment in one of their spear phishing email. When victims clicked on this image, it triggered an exploit that ran shellcode on the victim’s computer to download and execute a malicious payload that is stored within the jpg file mentioned above. But how was the malicious payload was hidden inside the jpg image?

What is Steganography?

It is an art or technique of hiding secret or any precious information inside something that looks common & ordinary. This information is hidden in such a manner that its presence is not evident to the human inspection. The word stegano graphy came from Greek word steganographic, that is combination of words steganos (meaning hidden or concealed) and graphia (writing).

In ancient and medieval times, kings used steganography to forward messages secretly. Greeks were the fist to use it. Coming to modern times, hackers are using it to hide malicious code in images, text, files, audio, video film and any other medium that looks benign.

Types of Steganography

There are five types of stegano graphy. They are,

1. Text stegano graphy
2. Image stegano graphy
3. Video stegano graphy
4. Audio stegano graphy
5. Network Stegano graphy

1. Text Steganography::

In text steganography, the secret information is hidden in a piece of text. For example, let’s say a text contains “Indians love Unity”. This may look like an ordinary or normal text. But just take the first letter of these three words. That becomes “ILU” a shortcut for I Love You message used by youngsters.

2. Image Stegano graphy:

As you might have already expected, when the secret information is hidden in an image (digital image) it is known as Image steganography.

3. Audio Steganography:

If the information we want to hide is hidden in an audio, it is known as audio steganography. Humans can hear sound that only contains certain frequencies. So, by altering the properties of audio like frequency, amplitude etc. secret messages can be hidden. However, to be able to receive and understand this secret information, the receiver needs to have smart listening devices to decipher the hidden information.

4. Video Steganography:

If the secret information is hidden in a video, it is called video steganography. A video is simply a representation of a sequence of consecutive images. So, we can say that this is an advanced version of Image steganography.

5. Network Steganography:

Considered to be more advanced and practically useful to Black Hat Hackers, in Network steganography information is hidden in network traffic. For example, it can be hidden in the TCP/IP headers etc.

Examples of Steganography attacks in hacking

1. In September 2022, researchers at ESET discovered a previously unknown Threat actor they named Worok hiding malicious payload in PNG files.
2. In 2019, researchers at Symantec observed a Russian cybersecurity group waterbug (also known as just the malicious) delivering a publicly known backdoor by hiding it in a WAV file.
3. In the same year, security researchers at Cylance observed a hacking campaign that was delivering XMRIG Monero CPU miner by hiding them in WAV files.
4. PLATINUM hacker group, that usually targets Governments of South Asia and South East Asia, embedded their malware commands in the HTML code of a website. They achieved this by encoding malware commands in a specific sequence of “TAB” and “SPACE” bar.

In future steganography is going to increase in cyber security.

Hello aspiring Ethical Hackers. In this blogpost, you will learn in detail about computer virus. In our previous article on malware, you have read that virus is one type of malicious software.

What is a VIRUS?

Virus stands for Vital Information Resources Under Seize (VIRUS). Once a computer virus infects any system it tries to seize is resources. Like it’s pathological name sake, a virus attaches itself to an executable or program to propagate or infect computers. VIRUS always requires human action or interaction to infect systems. Let’s now study about different types of Virus and what resources they affect.

Types of Computer VIRUS

1. Browser Hijacker:

Have you ever opened your browser and noticed that all of its settings have changed? These settings include but not restricted to the URL of the home page, favorites and even the default search engine. Well, this is the case of a Browser Hijacker. It is called so because it simply hijacks your browser to alter its settings and also redirect to a phishing site or to display advance.

Browser hijackers are used by hackers to earn some good amount of money. For example, a browser hijacker named CoolWebSearch infected victim’s browsers and redirected the homepage and search results to the links the hackers wanted. Every time a victim clicked on these links, the hacker was paid money.

2. Web scripting virus:

A web scripting is a virus that exploits vulnerabilities in browser to infect web pages or websites and inject malicious code. This virus is useful to send spam or for stealing cookies.

3. File Infector virus:

One of the most common viruses, file infector virus infects files and copies itself into other executable programs such as .COM and EXE files. Some file infecting viruses infect critical system files too thus affecting the operating system.

4. Macro virus:

Macro virus is a virus that is written in the language of Microsoft Office macros or Excel Macros. They are embedded into a Word document on Excel file

5. Direct Action virus:

Also known as Non-resident virus, this type of virus directly connects itself to executables like EXE and COM file. This virus is also known as Non-resident Virus as it doesn’t install itself on the target system. Direct Action Virus becomes active only when the victim executes the file.

6. Resident virus:

Resident virus install itself in the memory to the system and then from there, infects other files while they are opened by the users.

7. Boot Sector virus:

This type of virus infects the Master Boot Sector of the hard disk or a USB drive. Master Boots Record (MBR) is the boot sector that is located at the very beginning of partition table. It contains information about operating system’s location and how it can be booted. Once this section is infected, the infected system will face bootup problems etc.

8. Multipartite virus:

A virus that uses multiple methods to infect the target system is known as multipartite virus.

9. Polymorphic virus:

A polymorphic virus or metamorphic virus is a virus that constantly changes its appearance or signature files to avoid detection.

Hello, aspiring ethical hackers. This blogpost is intended to be a beginner’s guide to malware. This blogpost will teach you what is malware, its purpose, types of malware and functions of malware.

What is Malware?

Malware stands for malicious software. So, any software that performs malicious actions on a computer or mobile is called as malware. These malicious actions include showing persistent popups, encrypting data, stealing data, deleting data, capturing sensitive information and making the target system completely unusable etc. Based on its functions, and purpose malware can be classified into various types.

Types of Malware

VIRUS

Often used interchangeably with malware, virus is the most popular malware you may encounter in cyber security. Just like its pathological namesake, virus attaches itself to an executable or program to propagate or infect computer. Virus always requires human action to infect system.

According to Discovery, the first virus is the Creeper program. It was created by Bob Thomas in 1971. It was actually designed as a security test to see if a self-replicating program will be successful. The function of Creeper was to just display a simple message on computer if infected.

The most popular (or should I say unpopular) virus should be ILOVEYOU virus. Released in 2000, ILOVEYOU infected over ten million Windows computers. It started spreading as an email message with subject line “I LOVE YOU” and contained an attachment with name “LOVE-LETTER-FOR-YOU.TXT.VBS. When the recipient clicked on this attachment, a Visual Basic script activated and over writes files on the infected system. Then, it sent itself to all the email addresses in the Windows Address Book. It is estimate that the cost of this simple virus was at least $15 billion.

WORM

A computer worm is a type of malware that unlike virus doesn’t need any human action or interaction to infect target systems. Usually a computer worm spreads by exploiting vulnerability on the target systems. They also have no need to attach themselves to any program or executable.

Morris worm is considered to be the first worm to spread over the internet. It was created by Robert Tappan Morris and it caused a loss of over $100,000 and $10,000,000. It infected over 2000 computers within 15 hours. Morris worm spread by exploiting vulnerabilities like holes in the debug mode of the Unix send mail program, a buffer overflow vulnerability in finger network service. Rexec and Rsh accounts with weak or no password at all.

The most unpopular worm should definitely be Stuxnet. Released in 2010 and accused of sabotaging nuclear program of Iran, Stuxnet was designed to target programmable logic controllers (PLCs).  These PLC’s allow automation of electromechanical process used by control machines and industrial processes (for example, gas centrifuge that are used to separate nuclear material). Stuxnet spread by exploiting 4 Zero-day vulnerabilities in Siemens setup7 software installed on Windows systems. Stuxnet infected almost over 2,00,000 computers and destroyed at least 100 machines.

TROJAN

A Trojan acts as some other file (usually benign, genuine and harmless) but performs malicious actions. The name is a reference to the Trojan horse (the large wooden horse) assumed by Trojans as gift given by Greeks to Troy. However, when the horse was let into the kingdom, Greek soldiers hiding inside the horse came out and ransacked Troy. (you should watch Troy movie).

Just like viruses, Trojans also need victims to click on Trojan to be activated and most users fall victim to trojans thinking that they are genuine files. ANIMAL, a program released in 1975 is generally considered the world’s first Trojan. It fooled victims by presenting itself as a simple game of 20 questions. When user clicked on it, it copied itself to shared directories to be found by other victims.

According to me, the most dangerous Trojan was Zeus. Zeus is a banking Trojan used to steal banking information. It is spread by drive by downloads and phishing in 2003. It is estimated that Zeus infected over 74,000 FTP accounts.

ADWARE

Adware stands for Advertising malware. Have you ever experienced you are viewing something in your favorite browser and you are being incessantly bombarded with ads, especially ads which you did not and never wanted? If you had that experience you have encountered adware and if you didn’t it is thanks to ad blockers enabled by almost all browsers. Note that Adware is sometimes genuine too.

SPYWARE

Spyware is short for spying software and now you know what it does. It spies and gathers information about a user or organization. Spyware may be present in even legitimate software. The first recorded spyware is considered to be a freeware game called “Elf Bowling” as it came bundled with tracking software.

The most popular spyware seen recently should be Pegasus spyware. This spyware developed by Israeli cyber arms firm NSO Group installs not just covertly but remotely on mobile phones running IOS and Android and that too using a Zero-click exploit. Once installed on a device, Pegasus can read text messages, snoop on calls, collect credentials, track location of the device, access device’s cameras and microphone and harvest information from apps installed on the target device.

KEYLOGGER

Keylogger is a malicious software that records keystrokes a user types into computer on mobiles. The first keylogger used in real world was allegedly distributed with Grand Theft Auto V mod in 2015. Recently, a keylogger named Snake keylogger was detected being distributed with Microsoft Excel sample. Snake keylogger first appeared in late 2020.

ROOTKIT

Rootkit is a malicious software that is designed to enable access to a computer in a way that is not usually possible to an authorized user. Simply put, Rootkit gives SYSTEM level access. As if this is not enough, Rootkit is undetectable once installed, unlike other types of malware. The term “Rootkit” is a combination of root (the most privileged account on Unix system and “kit”. This is because rootkits usually give ‘root’ level access to the target system.

The first malicious rootkit appeared in 1999 and it affected Windows NT OS.  In 2012, a rootkit named Flame was detected. Flame affected over 80 servers around the world and is considered one of the dangerous rootkits.

BACKDOOR

A backdoor is a type of malware that provides access to a system bypassing normal security measures that usually prevent access. For example, if you can access a system without providing any login or need of credentials, you have a Backdoor access. Usually, hackers install backdoor after gaining complete access to the system to have unhindered and continuous access in future.

In 1998, a U.S hacker group “Cult of the Dead cow” designed a backdoor named “Back Orifice” that enables a user to control a computer remotely. In 2014, multiple backdoors were detected in WordPress. These backdoors were WordPress plugins with an obfuscated JavaScript code.

BOT

A BOT is a shortcut for Robot and it is an automated piece of code that performs predefined tasks. Malicious Bots as normally used to infect a system and make them a part of a Botnet which can then be used to perform DDOS attacks.

In 2007, all botnet attack called Cutwail attacked Windows systems using a trojan named Pushdo which infected Windows systems to make them part of the Cutwail botnet. This botnet had over 1.5 to 2 million computers. The most famous BOT malware should be MIRAI. MIRAI is designed to infect smart devices that run on ARC processes.

RANSOMWARE

Ransomware is a malicious software that locks victim’s computers or encrypts the victim’s files or permanently block access to the victim’s system. Its called ransomware as the key to decrypt the data or access the system is not provided unless a ransom is paid.

The first known ransomware was AIDS Trojan. It’s payload hid the files on the victim’s hard drive and encrypted their names. The most dangerous & popular ransomware attack was WannaCry in 2017. WannaCry ransomware spread by exploiting EternalBlue vulnerability and it infected over 2,30,000 computers within one day.

This score depends on the additional work that has to be put by attacker to exploit the vulnerability. For example, exploiting EternalBlue does not need any additional work by attacker whereas to performing a Man-In middle attack requires additional work from the attacker. Usually, the additional work the attacker puts depends on factors which are out of control of the attacker.

CRYPTO MINER

Crypto mining malware or cryptojacker is a malicious software that targets computer sources and mines crypto currencies like Bitcoin. Cryptominers are rather new in the evolution of malware. Their growth directly grew with the growth in popularity of crypto currencies.

When learning cybersecurity, you will quickly encounter vulnerability reports containing numbers such as 5.3, 7.5 or 9.8. These numbers are designed to help security professionals understand how serious a vulnerability might be.

This process is known as vulnerability scoring. For beginners, vulnerability scoring can initially seem complicated. Terms such as CVE, CVSS, severity, exploitability and impact may appear together in security reports.

The good news is that the basic idea is simple. Vulnerability scoring helps security teams estimate the severity of a security weakness so they can prioritize which issues need attention first.

In this guide, we’ll explain vulnerability scoring in simple terms, introduce CVE and CVSS, explain severity levels and show how beginners can learn to interpret vulnerability scores.

What Is a Vulnerability?

Before understanding vulnerability scoring, you need to understand what a vulnerability is. A vulnerability is a weakness in software, hardware, configuratio on a system that could potentially be used to compromise security.

Vulnerabilities can exist in:

• Operating systems
• Web applications
• Network devices
• Databases
• Cloud services
• Desktop software
• Authentication systems

For example, outdated software might contain a publicly known security weakness. A vulnerability does not automatically mean that a system has been compromised. It simply means that a weakness exists that could potentially create security risk.

What Is Vulnerability Scoring?

Vulnerability scoring is a method of assigning a numerical or categorical rating to a security vulnerability based on characteristics such as its potential impact and exploitability. The purpose is prioritization.

Imagine a security team discovers 500 vulnerabilities across an organization’s infrastructure. It would be difficult to fix all 500 immediately. Instead, the team can use vulnerability scores and other contextual information to determine which issues deserve immediate attention.

What Is CVE?

One of the first terms beginners should understand is CVE. CVE stands for Common Vulnerabilities and Exposures. A CVE identifier provides a standardized reference for a publicly known cybersecurity vulnerability.

A CVE usually looks something like:

CVE-2026-XXXX

The identifier itself does not tell you how dangerous the vulnerability is. It provides a way for security professionals, vendors, researchers and security tools to refer to the same vulnerability consistently. Think of CVE as the identity of a vulnerability, rather than its severity score.

What Is CVSS?

The most widely recognized vulnerability scoring system is CVSS or the Common Vulnerability Scoring System. CVSS provides a standardized method for describing the severity of vulnerabilities.

Scores range from:

0.0 to 10.0

A higher score generally indicates greater severity. However, beginners should remember that a CVSS score is not the same thing as the actual risk to every organization. The importance of a vulnerability depends on the environment in which it exists.

Understanding CVSS Severity Levels

CVSS scores are commonly grouped into four major severity categories. They are,

None:

0.0

No severity is assigned.

Low:

0.1-3.9

The vulnerability generally has relatively limited security impact.

Medium:

4.0-6.9

The vulnerability presents a more significant security concern and may deserve attention depending on the affected system.

High:

7.0-8.9

The vulnerability can represent a serious security risk and generally deserves timely remediation.

Critical:

9.0–10.0

These vulnerabilities represent the highest severity category and often require urgent attention.

However, severity categories should be treated as a starting point rather than the final decision about what an organization should fix first.

What Factors Influence Vulnerability Scores?

CVSS considers several characteristics of a vulnerability. Beginners don’t need to memorize every metric immediately but understanding the major concepts is useful.

Attack Vector:

This describes how an attacker would reach the vulnerable component. For example, a vulnerability that can be exploited remotely across a network may present different characteristics from one requiring local access.

Attack Complexity:

This considers how difficult exploitation may be. A vulnerability requiring complicated conditions may receive a different assessment from one that can be exploited under relatively straightforward conditions.

Privileges Required:

Some vulnerabilities require an attacker to already have an account or certain permissions. Others may not require authentication or existing privileges.

User Interaction:

Some vulnerabilities require a victim to perform an action. Others can potentially be exploited without user interaction.

Confidentiality Impact:

This considers the potential effect on the confidentiality of information. For example, could exploitation allow unauthorized access to sensitive data?

Integrity Impact:

This considers whether exploitation could allow unauthorized modification of information or systems.

Availability Impact:

This considers whether exploitation could affect the availability of a system or service. For example, could it cause a service to become unavailable?

Why a High Score Doesn’t Always Mean “Fix This First”

This is one of the most important lessons for beginners.

Suppose a vulnerability has a CVSS score of 9.8. That sounds extremely serious. But imagine the vulnerable system is an isolated laboratory server with no sensitive data and no connection to important business systems. Now consider another vulnerability with a score of 7.5 affecting an Internet-facing server responsible for an organization’s most important application.

The second vulnerability could deserve immediate attention despite having a lower CVSS score. This is why security teams consider business context, exposure, asset importance and existing controls alongside vulnerability scores.

CVSS vs Real-World Risk

Think of CVSS as a standardized measurement of vulnerability severity. Risk is broader.

Organizations may consider the following things while fixing a vulnerability:

• Is the system Internet-facing?
• Does it contain sensitive information?
• Is the vulnerable service business-critical?
• Is exploitation occurring in the wild?
• Is a working exploit publicly available?
• Are compensating security controls present?
• How difficult is remediation?

This additional context helps security teams prioritize vulnerabilities more effectively.

Vulnerability Scoring During Security Assessments

Vulnerability scanners can identify potential security weaknesses and often include severity ratings.

A typical assessment workflow might look like:

Discover → Scan → Identify → Score → Prioritize → Remediate → Verify

The scanner may identify a vulnerability and associate it with a CVE and CVSS score. The security professional then investigates the finding and determines its relevance to the environment. This human analysis is extremely important.

False Positives

Automated vulnerability scanners aren’t perfect. A scanner might report a vulnerability that doesn’t actually exist because of:

• Incorrect version detection
• Configuration differences
• Missing information
• Environmental factors

This is called a false positive. Security professionals should validate important findings before making major decisions.

Vulnerability Prioritization

Once vulnerabilities have been identified and scored, security teams need to decide what to fix first. A simple prioritization model might consider the following things:

1. Severity:

How serious is the vulnerability according to the scoring system?

2. Exposure:

Can the affected system be reached from the Internet or an untrusted network?

3. Asset Importance:

How important is the affected system to the organization?

4. Exploitation Activity:

Is the vulnerability actively being exploited?

5. Remediation Availability:

Is a patch or mitigation available?

Combining these factors produces a much more useful risk picture than looking at the CVSS score alone.

Common Beginner Mistakes

Treating CVSS as a Complete Risk Rating:

A CVSS score provides valuable information but it doesn’t understand your organization’s business context.

Assuming 9.8 Means Automatic Compromise:

A critical vulnerability may still require specific conditions before exploitation is possible.

Ignoring Medium-Severity Vulnerabilities:

A medium-severity vulnerability on an important exposed system can still create significant risk.

Trusting Scanner Results Blindly:

Always investigate and validate important findings.

Focusing Only on Numbers:

Security is about understanding systems, not just reading scores.

How Beginners Can Practice Vulnerability Scoring

You don’t need access to a corporate environment to learn these concepts.

Create a safe cybersecurity lab using:

• Virtual machines
• Deliberately vulnerable systems
• Vulnerable web applications
• Vulnerability assessment tools

Study publicly documented vulnerabilities and compare:

• CVE identifiers
• CVSS scores
• Severity ratings
• Attack characteristics
• Potential impact
• Recommended remediation

The goal is to learn why a vulnerability receives a particular rating rather than simply memorizing scores.

A Simple Learning Path

If you’re new to vulnerability scoring, follow this progression:

Step 1: Learn what vulnerabilities are.

Step 2: Understand CVE identifiers.

Step 3: Learn the purpose of CVSS.

Step 4: Understand severity categories.

Step 5: Study CVSS metrics.

Step 6: Learn about false positives.

Step 7: Practice interpreting vulnerability reports.

Step 8: Learn how organizations prioritize vulnerabilities using business context.

This foundation will make vulnerability scanners and security reports much easier to understand.

Conclusion

Vulnerability scoring is an essential skill for anyone learning cybersecurity. It helps security teams organize large numbers of vulnerabilities and determine which weaknesses deserve closer attention.

For beginners, remember the difference between the major concepts:

CVE identifies a vulnerability.

CVSS helps describe its severity.

Risk considers the vulnerability within a real-world environment.

The most important lesson is not to become obsessed with the number attached to a vulnerability.

Instead, learn to ask better questions:

What is vulnerable? How can the vulnerability be reached? What could happen if it were exploited? How important is the affected system? Is the vulnerability being actively exploited? How can it be fixed?

Once you can answer those questions, vulnerability scoring becomes much more than a number. It becomes a practical tool for understanding, prioritizing and reducing cybersecurity risk.