Hello aspiring ethical hackers. In this blogpost, you will learn about Honeypots. A Honeypot is one of the security technologies that is useful in enhancing the security of an organization.
What is a Honeypot?
A Honeypot is a security mechanism that unlike other security technologies like Firewalls, IDS and IPS, that try to block malicious activity, attracts the hacker’s attacks to keep the organization secure. A honeypot which can be software or hardware, is made intentionally vulnerable so that hackers can hack it easily. By observing how hackers are compromising the Honeypot, cyber security teams can easily improve their security policies.
Types of Honeypots
Apart from being classified as hardware or software, honeypots are classified into two types based on their operation. They are,
Production honeypot.
Research honeypot.
Let’s learn about each of them in detail.
1. Production honeypot:
These types of honeypots are the most common type of honeypot deployed by organizations around the world. As their name implies, they are deployed in the organization’s production network. They are easier to deploy and give valuable information like the hackers IP address etc.
2. Research honeypot:
As their name implies, Research honeypots are used to gather more information about hackers and their method of hacking compared to production honeypots. Research honeypots collect information like hacker tactics and their methods. However, they are complex to be deployed.
Types of Honeypot deployments
Honeypots can be deployed in three ways. They are,
Pure honeypot
Low-Interaction honeypot
High-Interaction honeypot.
1. Pure honeypot:
This honeypot is connected to the production network of the organization and completely mimics other production systems in the network.
2. Low-interaction honeypot:
As its name implies, low-interaction honeypot gives limited access to hackers. It may just simulate some services and protocols that can appear attractive to hackers. Nothing more than that. After some time, hackers may identify it as a honeypot.
3. High-interaction honeypot:
This is just the opposite of low interaction honeypot. Instead of just simulating some protocols and services, it is a real system with real vulnerabilities and services. Although a bit complex to deploy, this honeypot gives major access for hackers and they can help understand hacker intentions and tactics.
Hello, aspiring ethical hackers. In this blogpost, you will learn about the antivirus bypass techniques used by hackers and pen testers alike in real -world. In our previous blogpost on Antivirus, you learnt about various techniques used by Antivirus to detect malware. Please read that article before to better understand the Antivirus bypass techniques explained here.
Why AntiVirus bypass is important?
In any organization nowadays, every computing device is protected by Antivirus nowadays. Hence, it is very important to understand various techniques of Antivirus bypass for pen testers and Blue Teams alike.
Techniques for AntiVirus bypass
Here are the various techniques used in Antivirus bypass.
Encryption
Obfuscation
Packing
Protectors
Memory Injection
Let’s learn about each of these techniques in detail.
1. Encryption:
This is a technique that cryptographically changes the code of the payload. In our previous blogpost on encryption, you can learn in detail about cryptography & encryption and their role in cybersecurity. After the code of the payload is encrypted, a decrypting stub is created that decrypts and executes the code of that payload. Usually, this stub is hidden and it goes undetected by the AntiVirus.
The program that is used to encrypt the code of the payload is known as cryptor. Coding cryptors that create FUD payloads is a booming business in dark web.
2. Obfuscation:
Obfuscation is an evasion technique in which the code of the payload is changed and reorganized in such a way that it becomes difficult to understand. This made the reverse analysis of the payload difficult.
3. Packing:
Packing is the process in which the code of the payload is transformed into a different format. This reduces the size of the payload and makes a new binary.
4. Protector:
Software vendors use protection to prevent the code of the software from being reverse engineered. This is normally used to prevent software from being pirated. However, malware creators also use it to prevent the code of the payload from being reverse engineered.
5. Memory Injection:
If you have noticed, as soon as you drop a malicious payload on your system, (even msfvenom payload) the Antivirus immediately quarantines it. So, most malware creators code their payloads to run in memory instead of running on the hard disk to prevent Antivirus from detecting it.
Hello, aspiring ethical hackers. In this blogpost, you will learn about most common firewall bypass techniques used by hackers and pen testers in real world. In our previous blogposts on Firewalls and IDS and IPS, you learnt in detail what are firewalls, Intrusion Detection System (IDS), Intrusion Prevention System (IPS), types of Firewalls, IDS and IPS and various techniques used by them to do what they do best. Please read them first to better understand how firewall bypass techniques described below work.
Why do hackers and pen testers bypass Firewalls and IDS and IPS?
Before you learn about different techniques hackers and pen testers use to bypass firewalls, IDS ad IPS, you need to understand why it is important to bypass them. In real-world networks of organizations, firewall, IDS and IPS are the most common devices or software that are employed by organizations to keep their network secure. So, in order to reach the actual network, a penetration tester or hacker has to bypass the firewalls. The result of a successful pen test depends on the bypass techniques they use.
Common firewall bypass techniques
Pen tester or hackers employ various techniques to bypass firewalls, IPS and IDS. They are,
Spoofing the IP address.
Proxies.
Fragmenting packets.
Source routing.
Source port manipulation.
Let’s learn about each of these techniques in detail.
1. Spoofing the IP address:
If firewalls detect malicious traffic coming from a particular IP address or IP range, they just block the IP address to prevent malicious activity. This is one of the simplest functions of a Firewall or IPS. However, hackers or pen testers can bypass this by spoofing the source IP address. Learn more about IP address spoofing.
2. Proxies:
Hackers in real world and pen testers always hack their targets routing through another machine or computer. This is known as proxy. Hackers do this for covering tracks and do this to hide their activity. They also do this to bypass firewalls especially when the IP address is blocked by the firewall. They can also use proxy server for this purpose.
3. Packet fragmentation:
Data through network is transferred in the form of network packets. Each packet contains all the information needed for data transmission like the source IP address, destination IP address, source port and destination port etc. Firewalls and IDS analyses these packets for information. Each packet can be fragmented into small chunks and then transmitted. Fragmented packets are reassembled at the target machine. Reassembling the fragmented packets take lot of time and consume lot of resources. Most Firewalls and IPS are configured to ignore packets that are fragmented.
4. Source routing:
When a network packet is sent from the source system to the destination system, it hops through a number of devices before it reaches the destination machine. If a firewall or IDS is present in the route taken by the packet, it is blocked. So, hackers try to send this packet through a different route that doesn’t have a firewall or IDS. This is known as source routing.
5. Source port manipulation:
Firewalls allow traffic through some ports by default, say for example, HTTP port. If the source port is manipulated in the network packet, then it can bypass the firewall.
Hello, aspiring ethical hackers. Payloads play a very important role in ethical hacking. In this blogpost, you will learn everything about Metasploit payloads beginning from what is a payload, how many types of payloads are there and various functions of payloads etc.
What is a payload?
A payload in cyber security is a piece of code that is executed after successfully running an exploit to take advantage of a vulnerability. When a Proof Of Concept (POC) for a vulnerability is disclosed, this allows most hackers around the world to execute their chosen payloads. This payload can be anything from malware, reverse shell, RAT, ransomware etc or their own custom payload.
For example, ms08_067 vulnerability was exploited in real-world to deploy Conficker worm, but while pen testing, a meterpreter payload is used most probably.
Types of Metasploit payloads
Payloads in Metasploit can be classified into three types based on their function. They are.
Staged payloads or stagers.
Stageless or Non-staged (Inline) payloads or Single payloads.
Stages
1. Single or Stageless / Non-staged or Inline payload:
A single payload s self-contained as it contains in itself all the code required to do what it does. This is one of the easiest payloads to create but its size is a bit large. This may increase suspicions.
2. Stager payload:
Stager payloads also known as stagers set the stage for another payload. Their purpose is to establish a network connection between the target system and attacker system.
3. Stages:
This is the payload that is downloaded by stager payload.
Hello, aspiring ethical hackers. In this blogpost, you will learn about various Data-Link Layer attacks (various hacking attacks that take place on the Data-Link layer).
The Data-link layer is the second layer of the seven-layer OSI model. This layer is the protocol layer that transports data between network nodes in a wide Area Network or nodes in the same Local Area Network (LAN). It is responsible for ensuring and confirming that the bits and bytes received are similar to the bits and bytes being transmitted. In this layer, data is transferred in frames and communication takes place using MAC addresses instead of IP addresses. The attacks in the Data-link Layer take place in a LAN.
What is a Network Hub?
A network hub is a hardware device that connects multiple devices to a network and allows them to communicate with each other and share resources.
Just imagine, you have a router with 5 LAN ports. Using LAN cables, you can connect 5 devices to this router. Now, what if you want to connect 10 devices to the same network. This is where the use of network hub comes. You can connect a network Hub to one of the ports of a router. Let’s say this network hub has 10 LAN ports. So you can connect 10 computer devices to the same network. Similarly you can connect Network Hub to all ports of the routers to extend the network.
Network Hub Image Source: Wikipedia
The only disadvantage with Hub is that it sends traffic intended to be between two machines to all the devices of the network. Other than consuming bandwidth, it also poses security threats like sniffing.
For example, let’s say someone from machine “B” in a network is logged into telnet server on machine “A”. You have seen in our packet sniffing blogpost that in telnet protocol, data is transferred in plain text format. So in a Hub based network, the network traffic intended to be between “A” and “B” will even go to another machine in the network “C”. If a hacker is on machine “C” he can view the telnet credentials by sniffing.
What is a Network Switch?
Fig: Network Switch Image source: Wikipedia
The above reasons are why, network Hubs have been replaced by Network Switches. A Switch, similar to a Network Hub in a hardware device that connects all the device of a network. The only difference in switch sends the traffic to the intended device instead of all the devices in the network
What is a MAC address?
Just now, you have read that communication between devices in a LAN takes place using MAC addresses. But what is a MAC address? Every computing device on Internet (Desktop, Laptop and Mobiles etc) has a Network Interface Card (NIC). This Network Interface Card (NIC) is a hardware circuit in the computing devices that enables the devices to be able to connect to a network.
Each NIC is given a unique hardware address that is also popularly known as a Media Access Control (MAC) address. A MAC addresses is a 48-bit number consisting of six groups of two hexadecimal digits. To learn how MAC addresses are assigned to devices and how to find MAC address of your device, you can read this blogpost.
Types of Data-Link layer attacks
Since now you have understood how Data-Link layer works and what is a MAC address, let’s learn about various Data-link layer attacks.
Although every computing device has its unique MAC address, it can be spoofed. Normally, when a MAC address of a device (say A) is spoofed to that of another device (say B) all the traffic that is intended to move toward device B goes to device A and the attacker can view all the traffic belonging to device B.
2. MAC flooding:
You have just now learnt about what is a Hub and what is a Switch and the differences between a Hub and Switch. You also learnt about CAM table or ARP table. In a MAC flooding attack, the CAM table is bombarded with a number of fake MAC addresses disabling the Switch’s ability to detect which MAC address belongs to which port.
To overcome this problem, a network Switch uses its broadcast address to transmit frames to the intended destination. In typical sense, the network switch here behaves like a Hub and you know about the dangers of using a Hub. A hacker already in the network can monitor the network traffic he wants via packet sniffing.
3. ARP spoofing and poisoning:
In this type of attack, the attacker sends fake ARP packets to the network from the attacker-controlled system (System A). Here, the attacker-controlled system acts as the gateway. This leads to all other devices querying the attacker-controlled system resulting in the attackers using packet sniffing again to sniff on traffic.
4. DNS spoofing:
This attack requires ARP spoofing to work. In this type of attack, attacker responds to DNS queries of the target system instead of the legitimate DNS server.
