Category: Uncategorized

Hello, aspiring ethical hackers. In our previous blogpost, you learn what is steganography, its significance and types of steganography to cybersecurity. In this blogpost you will learn in detail about image steganography. But first, let’s see its significance in cybersecurity.

In April 2024, a hacker group being tracked as TA558 has widely used image steganography to deliver malware such as Agent Tesla, FormBook, Remcos RAT, LokiBOT, GuLoader, Snake keylogger and Xworm etc. The malware code embedded in the images contained VBS, PowerShell.

Now that you have understood the importance of image steganography, its time to learn about various images steganography techniques. In cybersecurity, It is a very good thing to learn about various image steganography techniques used to hide data in an image.

Types of image steganography

Image steganography techniques can be primarily divided into Spatial Domain techniques and Transform Domain techniques.

Spatial Domain techniques

Let’s study about various Spatial Domain steganography techniques first.

1. Least Significant Bit (LSB) steganography technique:

In this type of steganographic technique, the secret data is stored in pixels of an image. This is done by replacing the least significant bit of the image.

2. Pixel Value Differencing (PVD) steganography technique:

Pixel Value Differencing (PVD) is a steganography techniques in which secret data is embedded into images using the differences in pixel Value between adjacent pixels.

3. Exploiting Modification Direction (EMD) steganography technique:

In this type of steganographic technique, the secret data is embedded into a group of pixels of an image.

Transform Domain techniques

Now let’s learn about various Transform Domain image steganography techniques. In Transform Domain image steganography techniques, secret data is hidden in the transform domain coefficient of an image.

1. Discrete Cosine Transform (DCT) steganography technique:

In this steganographic technique, 8*8 blocks of an image are transformed into 64 DCT coefficients. Then, the LSB of each DCT coefficient is replaced with a bit of secret data.

2. Discrete Wavelet Transform (DWT) steganography technique:

In this steganographic technique, secret data is hidden by modifying the wavelet coefficient of the image.

3. Fast Fourier Transform (FWT) steganography technique:

In this steganography technique, the secret data is expressed as a Fourier series and then coefficients are added to the images.

Learn how to hide secret data in an image using steghide.

Hello, aspiring ethical hackers. In our previous blogpost on data link layer attacks, you learnt what is a hub, What is a switch, how they both work, what is a MAC address, what is a CAM table and different types of LAN attacks etc. In this blogpost, you will learn about one such attack, MAC flooding attack.

What is MAC flooding?

MAC flooding attack is an attack on the network switch that floods the network switch with fake MAC addresses. The purpose of this attack is to consume memory of the network switch. Once the CAM table of the network switch becomes full, the MAC addresses of the legitimate devices are purged out of the CAM table.

The network switch can no longer save new MAC addresses sent to the switch and it soon falls into a fail-open mode in which it will broadcast the incoming data to all the ports of the switch instead of transferring it to the intended device. Typically, the switch here functions like a network hub.

Since the data is now being broadcast to all the devices connected to the network, hackers can sniff on data belonging to all the devices in the network.

There are many ways to perform MAC flooding. One such method is to using a too named macof. Macof is a tool that comes with dsniff package. macof is used to flood the local network with random MAC addresses. It is installed by default in Kali Linux. The default way to flood the switch with macof is to specify the interface as shown below.

sudo macof -i eth0

This will create multiple random MAC addresses. You can even specify the number of packets you want to create as shown below.

sudo macof -i <interface> -n <number of packets to create>

You can even specify the source IP address from where these random MAC address should originate from.

sudo macof -i <interface> -s <IP address> -n <number of packets to create>

You can also specify the MAC address or physical address of the target device you want to flood with random MAC addresses.

sudo macof -i <interface> -e <Physical address of target> 

Hello, aspiring ethical hackers. In this blogpost, you will learn about DNS spoofing attack. Also known as DNS poisoning or DNS cache poisoning, in this attack a fake or wrong value are entered into the DNS cache. To understand this in detail, you have to first understand what is DNS, DNS server and DNS cache etc.

What is DNS?

Domain Name System (DNS) is a system that associates domain names with their IP addresses. For example, you want to go to a website named Alkapulka.com. When you open the browser and enter the domain name in the URL, your query first goes to a server that keeps a record of domain names and their IP addresses. Then this server takes you to the IP address associated with the alkapulka.com. This server is called the Domain Name System (DNS) server. A DNS server stores domain names and the IP addresses associated with these domain names in a cache known as DNS cache. Hence it is also known as DNS cache poisoning.

What is DNS spoofing?

Just imagine the IP address of the website alkapulka.com is xyx.xyz.xyx.xyz. Somehow the hacker takes control of the DNS server and registers the IP address of alkapulka.com to xyz.xyz.xyz.xyz where I am hosting a different website that looks similar to that of alkapulka.com. Now, when someone tries to visit alkapulka.com, instead of going to the original website, he will be redirected to the duplicate website controlled by the hacker.

Impact of DNS Spoofing

A hacker performs DNS spoofing to make unsuspecting users visit a malicious website. Once the user is one the malicious website, a lot of hacking attacks are possible. Some of them are,

1. Phishing:

Hackers may take unsuspecting users to a phishing website. Phishing is an act of presenting a fake page resembling the original webpage you intend to visit with the sole intention of stealing your credentials. Learn more about phishing.

2. Infecting with malicious software :

The website the users are redirected to may contain malware that can infect the user systems. Malware or malicious software is any software that performs malicious actions on a computer or mobile.

3. Gaining initial access:

Hackers can use multiple techniques to gain initial access on the system of the user. Learn more about gaining access.

How DNS spoofing attack can take place?

DNS spoofing can be achieved using many techniques like

1. Man in the Middle attack:

When attacker gets between the web browser and the DNS Server, he can perform DNS spoofing. Learn more about MiTM attack.

2. DNS server compromise:

If the DNS Server is compromised due to any vulnerability, then attacker gains access to the DNS cache, which he can manipulate as he want.

Hello, aspiring ethical hackers. In this blogpost, you will learn about a tool named MAC changer. In your ethical hacking journey there may be one day a need arise to change your MAC addresses. Although you can change your MAC addresses manually, mac changer is a tool that helps you to change it automatically. In our previous data link layer attacks, you learnt that communication in a LAN takes place with MAC addresses.

In our previous article on Data-link layer attacks, you have learnt what is a MAC address and its uses. Now, let’s see how to change your MAC addresses using MAC changer tool. To be able to change your MAC address first, you need to know your present MAC address. You can find out the MAC address of your machine using the command shown below.

ip a

You can see the current version of mac changes installed using the ‘-V’ option as show below.

You can see that each network adapter (NIC) attached to the system has one unique MAC address. You can also see your the MAC address of your device using MAC changer with the “-s” option.

macchanger -s <network interface>

If you want to see all the vendors that provide MAC addresses, using mac changer, the option is ‘-l’ as shown below.

macchanger -l

Before changing the MAC address of a adapter, make sure you disable that adapter using command as shown below.

sudo ip link set eth0 down

After making changes, you can enable the adapter using command shown below.

sudo ip link set eth0 up

Now, let’s see the different ways in which MAC addresses can be changed using mac changer. To give a random MAC address to a particular network adapter, say to the “eth0” adapter, the option we need to use is “-r”.

macchanger -r <interface>

To assign a random vendor MAC address of the same kind with mac changer, the option to use is “a”.

macchanger -a <interface>

To give a random MAC address of any kind, we can use the “-A” option.

macchanger -A <interface>

Every vendor has a unique MAC address that starts with unique vendor bytes. Using this tool, you can also change the MAC address without changing the vendor bytes using the “-e” option.

macchanger -e <interface>

You already know that MAC address is hardcoded to a hardware NIC card. Using this tool, you can also make your changed MAC addresses pretend as the burned in address of the NIC.

macchanger -b -r <interface>

That’s all about mac changer tool.

Hello, aspiring ethical hackers. In our previous blogposts, you learnt about Windows hacking techniques, Linux hacking techniques etc. In this blogpost, you will learn about BeEF tool that focuses on exploiting a software or program extensively used in both Linux and Windows operating systems. We are talking about web browser. BeEF is short for “The Browser Exploitation Framework”. It is a penetration testing tool focusing on the web browser.

In the noise of ever increasing cases of web server hacking and web application hacking, one that is often ignored is the exploitation of web clients, aka browser. Browsers once compromised, provide a easy way of gaining access to hackers. No doubt, attacks targeting web clients are on the rise. BeEF helps pen testers to understand the security posture of web browsers in an organization.

Let’s see how to use it. BeEF is present in the repositories of Kali Linux. We will be using the same for this tutorial. It can be installed on Kali as shown below.

After BeEF is successfully installed, don’t forget to run it with root privileges. Otherwise, it will not start.

After running for the first time, BeEF will ask you to setup a new password. Set it. Once you set it, it will start a web interface by default. Before that, it will display a hook as shown below.

Before you use BeEF further, you need to understand two terms related to it. They are,

1. Hook: A hook is something used to trap a browser.
2. Zombie: A trapped browser is known as a Zombie.

Once the web interface of BeEF opens, login with username “beef” and the password you set earlier.

Once you login, you will be greeted with the dashboard of BeEF. The interface can be divided into two parts. On the left, you will see hooked browsers section. All those browsers that are compromised by BeEF are shown here. On the right, you can see the general interface of BeEF.

It has three tabs. The “Logs” tab show all the activity happening with BeEF.

The “Zombies” tab, as you expected will display all the compromised browsers.

BeEF also has “Getting started” tab. Now, let’s see how to hook a browser. Browsers can be hooked by using the hooks shown at the beginning. You have to somehow make users click on this hook script. Of course, this requires social engineering.

For demonstration purpose, BeEF has two demo pages that work as hooks. One is basic and advanced. They can be found in “Getting Started” tab as highlighted in the above image. Here is the basic demo page and advanced demo page.

All we have to do is copy the links of the pages and make target users click on these links. As soon as they do it, the browser gets hooked as shown below.

When you click on the IP, the “current browser” tab opens, displaying general information about the target OS on which that browser is installed.

The “Current browser” tab opens a few sub-tabs of itself. You have seen about the “details” tab above. The “Logs” sub-tab shows all the logs belonging to the current browser.

The most powerful part of BeEF in its command section.

This section includes all the commands that can be executed on the target system.

For example, let’s execute a command “Detect Antivirus” as shown below. This command as its name suggests tries to detect if Antivirus is installed on target system or not. We can execute this module by clicking on “Execute” as shown below.

To see the result of the executed command, click on the command in history. It will display the result in command results window to the right.

In our case, it’s true that Antivirus is not installed on the target system. If you click on the “Zombies” tab you have learnt above earlier, your hooked browser can be seen, as shown below.