Final Exam Flashcards
Reconnaissance
To investigate the target using publicly available information. One key objective is to have a list of the target’s IP.
Scanning
To look for openings of target’s system.
Port Scanning
Output is a list of open ports and potential services running on the target.
Exploitation
Using password cracking and other techniques to gain administrative control over the target machine, but the access may be temporary and non-persistent.
Maintaining Access
Creating a more permanent backdoor for subsequent access to the system.
Active Reconnaissance
Interacting directly with the target. The target may record your IP address and log your activity.
Passive Reconnaissance
Makes use of the vast amount of information available on the web. You do not directly interact with the target and as such, the target has no way of knowing, recording, or logging your activity.
Google as a Reconnaissance Tool
Search the Google cache rather than the target’s web site to reduce your digital footprints on the target’s server, and to gain access to files that have been removed from the target’s web site.
theharvester
A program to collect email addresses from the Web using google, bing, etc.
Theharvester is intergated into kali.
Username can be used in brute force password cracking.
Interrogating DNS Server
Networks may need multiple DNS servers for the sake of redundancy (fault tolerance) or load balancing. These DNS servers need to stay in sync by doing zone transfer (a.k.a. AXFR or Asynchronous Full Transfer Zone), where one DNS server will send all its host-to-IP mappings to another DNS server.
Hackers may attempt zone transfer to acquire all IP address for subsequent scanning.
Defence: Interrogating DNS Server
Allow “zone transfer” only for legitimate users such as secondary DNS.
DNS records should not contain operating system type and version information. DO NOT keep host information and text records (HINFO and TXT).
METAGooFIL
Microsoft documents such as Word or a PowerPoint contain metadata that describes the file name, the file size, file owner, username, and path of location.
MetaGooFil scours a specific target for such files, download them, and extract useful metadata.
Port scanning: Nmap
A port scanner (e.g. Nmap) sends a packet to each port to determine which ports are open.
Xmas Scan & Null Scan
X-mas Scan sends packets with FIN, URG and PUSH flags turned on, but SYN,ACK, & RST off.
Null Scan sends a packet with no TCP flags set.
Closed port responds with RESET, and live port sends nothing.
Specially Crafted Probes
A specially crafted packet that the remote system can’t understand or deal with
e.g. a packet longer than the expected packet size (548 byte) and thus causes buffer overflow
Defense Against Port Scanning
All unneeded ports and their related services must be shut off. Periodically use Nmap to scan (across network) for open ports on each host, and closed all unused ports (e.g. TCP 25 for SMTP on Web server).
Vulnerability Scanners and Common Vulnerabilities
Vulnerability scanners keep a database of vulnerabilities of many systems, and automate the process of checking across the network to see if any of these known vulnerabilities are present on the target. Common vulnerabilities are:
(1) Poor configuration settings leave various openings for an attacker to gain access. e.g. files not properly protected
(2) Weak default configuration security settings such as default accounts and passwords.
(3) Well-known system vulnerabilities and new security holes are discovered and published on the Internet, but patching may be slow to catch up.
Nessus (pre-installed on kali)
Nessus is a vulnerability scanner. It automates the process of connecting to the target, and checking for:
(a) backdoors, vendor specific vulnerabilities (Cisco, Windows, etc.)
(b) loopholes that let attackers gain command-line access or super-user access remotely
(c) vulnerable cgi (also asp, jsp, php, etc) scripts
(d) misconfigured firewall
(e) missing patching
Vulnerable CGI Scripts
Run on the Web-server side to process user input. Many widely used CGI scripts include flaws that accept inputs with embedded malicious commands. The CGI script then allow the attacker to send the embedded malicious commands directly to the command line for execution.
Exploitation
Attackers gaining access through Program loopholes (e.g. stack-based buffer overflows attack) password attacks Sniffing network traffic Or through Web exploitation SQL injection Web application attacks
Stack-Based Buffer Overflows Attack
stack = a special reserved area for storing information on subroutines and functions
A program writing more data (i.e. exceeding the allocated buffer) to a memory address in the stack causes this data to overflow and corrupt adjacent data on the stack.
Attackers enters input data (containing attack code) into a program through a GUI, or command line. The input data corrupts the stack and cause executable attack code to be run.
NOP Command
A command telling the processor to do nothing and move on.
Administrators’ Defense Against Stack-Based Buffer Overflows Attack
Keep systems patched. The computer underground and security professionals are constantly discovering new vulnerabilities.
Use a nonexecutable stack (i.e. only read and write). If the system is configured to refuse to execute instructions from the stack, most stack-based buffer overflows won’t work.
Software developers must be trained to understand what buffer overflows are and how to avoid them. Computer code should check size of input against buffer size before writing.
Metasploit: an Exploitation Platform
Manually crafting an exploit tool to take advantage of a flaw (e.g. buffer overflow) is a painstaking process. Loading the attack machine code and calculating the return pointer require great care.
Metasploit provides a platform for mass production of exploits.
Metasploit is installed in kali
