Hello, aspiring ethical hackers. In this blogpost, you will learn what is OSINT. In our previous articles, you learnt about the 5 phases of ethical hacking, you learnt the importance of footprinting of ethical hacking. OSINT is a part of footprinting.

What is OSINT?

OSINT stands for Open Source Intelligence. OSINT is a method of gathering information from all open sources. Open sources are those which are publicly available and are free to access. OSINT is used by hackers, pen testers and Red-Team professionals to collect information about an organization or people that can be used in gaining access or performing social engineering.

These sources of OSINT can be social media sites like Instagram, LinkedIN etc, newspapers, news sites, blogs or shopping sites, search engines, metadata, Google docs, forums, etc.

For example, LinkedIN company pages reveal information about all the employees of the organization. These employees have their job description listed in their profile. Let’s say there is an employee whose role is “Solaris admin”. From this, you can say that the particular company is using Solaris as they have an employee for that job (unless that particular company is using ADVANCED TO THE POWER OF 100 trade craft to hide the original software they are using.

Now a hacker group creates a fake profile of a company on LinkedIN, connects with this user, sends a proposal for a job with increased salary for the same role. They ask his/her email for further communication.

Top OSINT tools

Here are some of the top OSINT Tools used by Cyber security professionals.

1. Maltego: Maltego is link analysis software that is used to gather real-world relationship between roles, groups, domains, email addresses, webpages, social media accounts etc. Learn more about this tool here.
2. Google Dorks: Often underestimated, Google dorks also can be useful to gather more information about a person or companhy. Learn more about it here.
3. Spiderfoot: Spiderfoot is an OSINT tool written in Python that queries over 100 public data sources to gather information about any IP address, domain name, names of person and email address.
4. Shodan: Popularly called the hackers search engine, Shodan lets users search for various or types of servers connected to the internet using a variety of filters.
5. Metagoofil: Metagoofil is tool used to extract metadata from publicly available documents like PDFs, DOC, XLS, PPTX, DOCX, PPTXS.

Hello, aspiring ethical hackers. In this blogpost, you will learn about Remote Code Execution (RCE) vulnerability. RCE is considered one of the most dangerous vulnerability that can impact systems or software.

What is remote code execution (RCE)?

Remote code execution vulnerability allows an attacker to execute code or commands on a remote machine. Code execution on the local system is itself dangerous. Consider hackers having remote access to the machine and about to execute arbitrary commands on the system. As it is a hacker, you can consider that the code being executed is always malicious. This code can be anything like malware, payloads etc.

Vulnerabilities that lead to remote code execution

Any vulnerability that can lead to hackers being able to execute code on the remote machine leads to remote code execution.

1. Local File execution
2. Buffer overflow
3. SQL Injection
4. Cross site scripting (XSS)
5. Deserialization
6. Command Injection
7. File upload
8. CSRF
9. Out of Bounds write
10. SSRF
    

Impact and execution

Remote code execution can have a dangerous impact that can lead to gaining access, privilege escalation etc. For this reason, it is always considered a CRITICAL vulnerability. Some of the examples of RCE vulnerabilities are,

1. ms08_067 vulnerability
2. EternalBlue
3. PrintNightmare
4. Log4shell.
5. Spring4shell.
6. Shellshock.

Hello aspiring ethical hackers. In this blogpost, you will learn about Honeypots. A Honeypot is one of the security technologies that is useful in enhancing the security of an organization.

What is a Honeypot?

A Honeypot is a security mechanism that unlike other security technologies like Firewalls, IDS and IPS, that try to block malicious activity, attracts the hacker’s attacks to keep the organization secure. A honeypot which can be software or hardware, is made intentionally vulnerable so that hackers can hack it easily. By observing how hackers are compromising the Honeypot, cyber security teams can easily improve their security policies.

Types of Honeypots

Apart from being classified as hardware or software, honeypots are classified into two types based on their operation. They are,

1. Production honeypot.
2. Research honeypot.

Let’s learn about each of them in detail.

1. Production honeypot:

These types of honeypots are the most common type of honeypot deployed by organizations around the world. As their name implies, they are deployed in the organization’s production network. They are easier to deploy and give valuable information like the hackers IP address etc.

2. Research honeypot:

As their name implies, Research honeypots are used to gather more information about hackers and their method of hacking compared to production honeypots. Research honeypots collect information like hacker tactics and their methods. However, they are complex to be deployed.

Types of Honeypot deployments

Honeypots can be deployed in three ways. They are,

1. Pure honeypot
2. Low-Interaction honeypot
3. High-Interaction honeypot.

1. Pure honeypot:

This honeypot is connected to the production network of the organization and completely mimics other production systems in the network.

2. Low-interaction honeypot:

As its name implies, low-interaction honeypot gives limited access to hackers. It may just simulate some services and protocols that can appear attractive to hackers. Nothing more than that. After some time, hackers may identify it as a honeypot.

3. High-interaction honeypot:

This is just the opposite of low interaction honeypot. Instead of just simulating some protocols and services, it is a real system with real vulnerabilities and services. Although a bit complex to deploy, this honeypot gives major access for hackers and they can help understand hacker intentions and tactics.

Hello, aspiring ethical hackers. In this blogpost, you will learn about the antivirus bypass techniques used by hackers and pen testers alike in real -world. In our previous blogpost on Antivirus, you learnt about various techniques used by Antivirus to detect malware. Please read that article before to better understand the Antivirus bypass techniques explained here.

Why AntiVirus bypass is important?

In any organization nowadays, every computing device is protected by Antivirus nowadays. Hence, it is very important to understand various techniques of Antivirus bypass for pen testers and Blue Teams alike.

Techniques for AntiVirus bypass

Here are the various techniques used in Antivirus bypass.

1. Encryption
2. Obfuscation
3. Packing
4. Protectors
5. Memory Injection

Let’s learn about each of these techniques in detail.

1. Encryption:

This is a technique that cryptographically changes the code of the payload. In our previous blogpost on encryption, you can learn in detail about cryptography & encryption and their role in cybersecurity. After the code of the payload is encrypted, a decrypting stub is created that decrypts and executes the code of that payload. Usually, this stub is hidden and it goes undetected by the AntiVirus.

The program that is used to encrypt the code of the payload is known as cryptor. Coding cryptors that create FUD payloads is a booming business in dark web.

2. Obfuscation:

Obfuscation is an evasion technique in which the code of the payload is changed and reorganized in such a way that it becomes difficult to understand. This made the reverse analysis of the payload difficult.

3. Packing:

Packing is the process in which the code of the payload is transformed into a different format. This reduces the size of the payload and makes a new binary.

4. Protector:

Software vendors use protection to prevent the code of the software from being reverse engineered. This is normally used to prevent software from being pirated. However, malware creators also use it to prevent the code of the payload from being reverse engineered.

5. Memory Injection:

If you have noticed, as soon as you drop a malicious payload on your system, (even msfvenom payload) the Antivirus immediately quarantines it. So, most malware creators code their payloads to run in memory instead of running on the hard disk to prevent Antivirus from detecting it.

Hello, aspiring ethical hackers. In this blogpost, you will learn about most common firewall bypass techniques used by hackers and pen testers in real world. In our previous blogposts on Firewalls and IDS and IPS, you learnt in detail what are firewalls, Intrusion Detection System (IDS), Intrusion Prevention System (IPS), types of Firewalls, IDS and IPS and various techniques used by them to do what they do best. Please read them first to better understand how firewall bypass techniques described below work.

Why do hackers and pen testers bypass Firewalls and IDS and IPS?

Before you learn about different techniques hackers and pen testers use to bypass firewalls, IDS ad IPS, you need to understand why it is important to bypass them. In real-world networks of organizations, firewall, IDS and IPS are the most common devices or software that are employed by organizations to keep their network secure. So, in order to reach the actual network, a penetration tester or hacker has to bypass the firewalls. The result of a successful pen test depends on the bypass techniques they use.

Common firewall bypass techniques

Pen tester or hackers employ various techniques to bypass firewalls, IPS and IDS. They are,

1. Spoofing the IP address.
2. Proxies.
3. Fragmenting packets.
4. Source routing.
5. Source port manipulation.

Let’s learn about each of these techniques in detail.

1. Spoofing the IP address:

If firewalls detect malicious traffic coming from a particular IP address or IP range, they just block the IP address to prevent malicious activity. This is one of the simplest functions of a Firewall or IPS. However, hackers or pen testers can bypass this by spoofing the source IP address. Learn more about IP address spoofing.

2. Proxies:

Hackers in real world and pen testers always hack their targets routing through another machine or computer. This is known as proxy. Hackers do this for covering tracks and do this to hide their activity. They also do this to bypass firewalls especially when the IP address is blocked by the firewall. They can also use proxy server for this purpose.

3. Packet fragmentation:

Data through network is transferred in the form of network packets. Each packet contains all the information needed for data transmission like the source IP address, destination IP address, source port and destination port etc. Firewalls and IDS analyses these packets for information. Each packet can be fragmented into small chunks and then transmitted. Fragmented packets are reassembled at the target machine. Reassembling the fragmented packets take lot of time and consume lot of resources. Most Firewalls and IPS are configured to ignore packets that are fragmented.

4. Source routing:

When a network packet is sent from the source system to the destination system, it hops through a number of devices before it reaches the destination machine. If a firewall or IDS is present in the route taken by the packet, it is blocked. So, hackers try to send this packet through a different route that doesn’t have a firewall or IDS. This is known as source routing.

5. Source port manipulation:

Firewalls allow traffic through some ports by default, say for example, HTTP port. If the source port is manipulated in the network packet, then it can bypass the firewall.