Category: Uncategorized

Hello, aspiring ethical hackers. In this blogpost, you will learn about Remote Code Execution (RCE) vulnerability. RCE is considered one of the most dangerous vulnerability that can impact systems or software.

What is remote code execution (RCE)?

Remote code execution vulnerability allows an attacker to execute code or commands on a remote machine. Code execution on the local system is itself dangerous. Consider hackers having remote access to the machine and about to execute arbitrary commands on the system. As it is a hacker, you can consider that the code being executed is always malicious. This code can be anything like malware, payloads etc.

Vulnerabilities that lead to remote code execution

Any vulnerability that can lead to hackers being able to execute code on the remote machine leads to remote code execution.

1. Local File execution
2. Buffer overflow
3. SQL Injection
4. Cross site scripting (XSS)
5. Deserialization
6. Command Injection
7. File upload
8. CSRF
9. Out of Bounds write
10. SSRF
    

Impact and execution

Remote code execution can have a dangerous impact that can lead to gaining access, privilege escalation etc. For this reason, it is always considered a CRITICAL vulnerability. Some of the examples of RCE vulnerabilities are,

1. ms08_067 vulnerability
2. EternalBlue
3. PrintNightmare
4. Log4shell.
5. Spring4shell.
6. Shellshock.

Hello aspiring ethical hackers. In this blogpost, you will learn about Honeypots. A Honeypot is one of the security technologies that is useful in enhancing the security of an organization.

What is a Honeypot?

A Honeypot is a security mechanism that unlike other security technologies like Firewalls, IDS and IPS, that try to block malicious activity, attracts the hacker’s attacks to keep the organization secure. A honeypot which can be software or hardware, is made intentionally vulnerable so that hackers can hack it easily. By observing how hackers are compromising the Honeypot, cyber security teams can easily improve their security policies.

Types of Honeypots

Apart from being classified as hardware or software, honeypots are classified into two types based on their operation. They are,

1. Production honeypot.
2. Research honeypot.

Let’s learn about each of them in detail.

1. Production honeypot:

These types of honeypots are the most common type of honeypot deployed by organizations around the world. As their name implies, they are deployed in the organization’s production network. They are easier to deploy and give valuable information like the hackers IP address etc.

2. Research honeypot:

As their name implies, Research honeypots are used to gather more information about hackers and their method of hacking compared to production honeypots. Research honeypots collect information like hacker tactics and their methods. However, they are complex to be deployed.

Types of Honeypot deployments

Honeypots can be deployed in three ways. They are,

1. Pure honeypot
2. Low-Interaction honeypot
3. High-Interaction honeypot.

1. Pure honeypot:

This honeypot is connected to the production network of the organization and completely mimics other production systems in the network.

2. Low-interaction honeypot:

As its name implies, low-interaction honeypot gives limited access to hackers. It may just simulate some services and protocols that can appear attractive to hackers. Nothing more than that. After some time, hackers may identify it as a honeypot.

3. High-interaction honeypot:

This is just the opposite of low interaction honeypot. Instead of just simulating some protocols and services, it is a real system with real vulnerabilities and services. Although a bit complex to deploy, this honeypot gives major access for hackers and they can help understand hacker intentions and tactics.

Hello, aspiring ethical hackers. In this blogpost, you will learn about the antivirus bypass techniques used by hackers and pen testers alike in real -world. In our previous blogpost on Antivirus, you learnt about various techniques used by Antivirus to detect malware. Please read that article before to better understand the Antivirus bypass techniques explained here.

Why AntiVirus bypass is important?

In any organization nowadays, every computing device is protected by Antivirus nowadays. Hence, it is very important to understand various techniques of Antivirus bypass for pen testers and Blue Teams alike.

Techniques for AntiVirus bypass

Here are the various techniques used in Antivirus bypass.

1. Encryption
2. Obfuscation
3. Packing
4. Protectors
5. Memory Injection

Let’s learn about each of these techniques in detail.

1. Encryption:

This is a technique that cryptographically changes the code of the payload. In our previous blogpost on encryption, you can learn in detail about cryptography & encryption and their role in cybersecurity. After the code of the payload is encrypted, a decrypting stub is created that decrypts and executes the code of that payload. Usually, this stub is hidden and it goes undetected by the AntiVirus.

The program that is used to encrypt the code of the payload is known as cryptor. Coding cryptors that create FUD payloads is a booming business in dark web.

2. Obfuscation:

Obfuscation is an evasion technique in which the code of the payload is changed and reorganized in such a way that it becomes difficult to understand. This made the reverse analysis of the payload difficult.

3. Packing:

Packing is the process in which the code of the payload is transformed into a different format. This reduces the size of the payload and makes a new binary.

4. Protector:

Software vendors use protection to prevent the code of the software from being reverse engineered. This is normally used to prevent software from being pirated. However, malware creators also use it to prevent the code of the payload from being reverse engineered.

5. Memory Injection:

If you have noticed, as soon as you drop a malicious payload on your system, (even msfvenom payload) the Antivirus immediately quarantines it. So, most malware creators code their payloads to run in memory instead of running on the hard disk to prevent Antivirus from detecting it.

Hello, aspiring ethical hackers. In this blogpost, you will learn about most common firewall bypass techniques used by hackers and pen testers in real world. In our previous blogposts on Firewalls and IDS and IPS, you learnt in detail what are firewalls, Intrusion Detection System (IDS), Intrusion Prevention System (IPS), types of Firewalls, IDS and IPS and various techniques used by them to do what they do best. Please read them first to better understand how firewall bypass techniques described below work.

Why do hackers and pen testers bypass Firewalls and IDS and IPS?

Before you learn about different techniques hackers and pen testers use to bypass firewalls, IDS ad IPS, you need to understand why it is important to bypass them. In real-world networks of organizations, firewall, IDS and IPS are the most common devices or software that are employed by organizations to keep their network secure. So, in order to reach the actual network, a penetration tester or hacker has to bypass the firewalls. The result of a successful pen test depends on the bypass techniques they use.

Common firewall bypass techniques

Pen tester or hackers employ various techniques to bypass firewalls, IPS and IDS. They are,

1. Spoofing the IP address.
2. Proxies.
3. Fragmenting packets.
4. Source routing.
5. Source port manipulation.

Let’s learn about each of these techniques in detail.

1. Spoofing the IP address:

If firewalls detect malicious traffic coming from a particular IP address or IP range, they just block the IP address to prevent malicious activity. This is one of the simplest functions of a Firewall or IPS. However, hackers or pen testers can bypass this by spoofing the source IP address. Learn more about IP address spoofing.

2. Proxies:

Hackers in real world and pen testers always hack their targets routing through another machine or computer. This is known as proxy. Hackers do this for covering tracks and do this to hide their activity. They also do this to bypass firewalls especially when the IP address is blocked by the firewall. They can also use proxy server for this purpose.

3. Packet fragmentation:

Data through network is transferred in the form of network packets. Each packet contains all the information needed for data transmission like the source IP address, destination IP address, source port and destination port etc. Firewalls and IDS analyses these packets for information. Each packet can be fragmented into small chunks and then transmitted. Fragmented packets are reassembled at the target machine. Reassembling the fragmented packets take lot of time and consume lot of resources. Most Firewalls and IPS are configured to ignore packets that are fragmented.

4. Source routing:

When a network packet is sent from the source system to the destination system, it hops through a number of devices before it reaches the destination machine. If a firewall or IDS is present in the route taken by the packet, it is blocked. So, hackers try to send this packet through a different route that doesn’t have a firewall or IDS. This is known as source routing.

5. Source port manipulation:

Firewalls allow traffic through some ports by default, say for example, HTTP port. If the source port is manipulated in the network packet, then it can bypass the firewall.

Hello, aspiring ethical hackers. Payloads play a very important role in ethical hacking. In this blogpost, you will learn everything about Metasploit payloads beginning from what is a payload, how many types of payloads are there and various functions of payloads etc.

What is a payload?

A payload in cyber security is a piece of code that is executed after successfully running an exploit to take advantage of a vulnerability. When a Proof Of Concept (POC) for a vulnerability is disclosed, this allows most hackers around the world to execute their chosen payloads. This payload can be anything from malware, reverse shell, RAT, ransomware etc or their own custom payload.

For example, ms08_067 vulnerability was exploited in real-world to deploy Conficker worm, but while pen testing, a meterpreter payload is used most probably.

Types of Metasploit payloads

Payloads in Metasploit can be classified into three types based on their function. They are.

1. Staged payloads or stagers.
2. Stageless or Non-staged (Inline) payloads or Single payloads.
3. Stages

1. Single or Stageless / Non-staged or Inline payload:

A single payload s self-contained as it contains in itself all the code required to do what it does. This is one of the easiest payloads to create but its size is a bit large. This may increase suspicions.

2. Stager payload:

Stager payloads also known as stagers set the stage for another payload. Their purpose is to establish a network connection between the target system and attacker system.

3. Stages:

This is the payload that is downloaded by stager payload.