Cyber Security Attack & Defense

Resolve a given name. If it resolves, server exists. If not "not found" will be returned.

Brute Force: automated process by running a script through a complete list of DNS names

Resolve ip address.

Brute Force: automated process by running a script that finds out all the hosts in a particular domain. Host names will give clues on the use of specific servers (smpt.gmail.com)

Misconfigured DNS server. It is the equivalent to telling the hacker what the network topology is.

Configurations should separate internal DNS namespace and external DNS namespace into different unrelated zones.

- nontechnical method of breaking into a system or network by deceiving the user of a system and convince them to perform acts that are useful to the attacker (reveal sensitive information)

Human-Based:

- Person to person interaction to retrieve desired information.

- Examples: Caling helpdesk to find out password, impersonating an employee, posing as important user, shoulder surfing, dumpster diving

Computer-based:

- uses software that attempts to retrieve the desired information

- Example: phishing, email attachments, popup windows, URL Obfuscation

Good policies and security awareness programmes that are taught and reinforced to employees.

One advantage of a strong security policy is that it helps the employee decide how to respond to hackers requests.

NetBIOS enumeration:

SNMP enumeration:

SMTP enumeration:

- Learn more about targets and find openings by interacting with the target.

- Hacker continues to gather information regarding the target network and its individual hosts

- Information gathered in this phase help hacker to determine which exploit to use

Network Sweeping:

- Identify live hosts in the target network by sending probe packets to all addresses in target range

Network Tracing:

- Determine the topology of a network to draw a network map using the results of the sweep.

Port Scanning:

- Find openings by listening to TCP and UDP ports. Specific numbers give hints to what services could be running

OS Fingerprinting:

- Determine OS based on network behaviours.

Version Scanning:

- Determine versions of services and protocols by interacting with open TCP and UDP ports

Vulnerability Scanning:

- Determine a list of potential vulnerabilities in the target environment

technique of dialing telephone numbers to find an open modem connection that provide remote access to a network

- do ping sweep of an address range

- systems that respond with a ping reply are live

- can run parallel

- all systems can be scanned at the same time

packets with incremental TTL values are sent to the target. using the TTL behaviour the addresses of routers between attacker and target can be determined

- Verification of the existence of the system

- Check for open ports that accept connection

- ports reveal what types of services are running and therefore aid in the attack by providing the attacker with info on which vulnerabilities to look for

–Initiating (gain approval for project, let client know whats included/excluded, identify stakeholders)
–Planning (duration of project, size of team, cost of project, resources needed)
–Executing (attacks are conducted)
–Closing (final documents released to client, contractual agreement concluded, closing process)
–Monitoring and Controlling (watch out for changes that need to be managed)

As penetration testing is a project itself, the standardized project management practices of PMBOK are of great help when performing pen testing.

Phase 1: Planning & Preperation (exchange information, plan and prepare for the test)

Phase 2: Apply layers to the following targets: Networks, Hosts, Applications, Databases.

Phase 3: Generating reports and securing data that was obtained during the test.

•Advantages
–Does not assume previous knowledge.
–Provides examples of penetration test tool use.

•Disadvantages
–Out of date quickly.
–Penetration test tool examples are not extensive.
–Last update: May 2006

Blind: Analyst no knowlede of defenses, assets or channels. Target is prepared.

Double Blind: Analyst no knowledge of defenses, assets or channels. Target is not notified in advance.

Grey Box: Analyst limited knowledge of defenses and assets, full knowledge of channels. Target is prepared

Double Grey Box: Analyst limited knowledge of defenses and assets, full knowledge of channels. Target is notified about scope and time frame, but not channels and vectors.

Tandem: Analyst and Target both prepaired knowing all the details.

Reversal: Analyst full knowledge. Target no knowledge.

False Positive:

Taret response indicates state as true, but in reality is not true.

False Negative:

Target response indicates state as no true, but in reality is true.

Gray Positive:

Target response indicates state as true, however target is designed to always respond with this state.

Gray Negative:

Target response indicates state as not true, however target is designed to always respond with this state.

Specter:

Target response indicates state as true or not true, but in reality it cannot be known.

Indiscretion:

Target response indicates state as true or false but only during particular time.

Entropy Error:

Target response cannot indicate state as true or false due to a high noise to signal ratio.

Falsification:

Target response indicates state as either true or false although in reality it is dependent on largely unknown variables.

•Advantages
–More flexibility for Pentesters.
–Frequent updates.
•Disadvantages
–Assumes tester have necessary knowledge beforehand.
–Latest version requires paid subscription.

- gather information from public sources (people and culture, terminology, technical infrastructure)

- identify patterns of behaviour of people or system

- process of creating a map of network and systems of target organisation

Whoisdatabases contains:
–Technical, administrative, and billing contact names
–Phone numbers and e-mail addresses
–Domain Name Servers
–Other juicy tidbits

To ensure only a single organisation uses a specific domain name

Whois lookup: done on domain name

Whois reverse lookup: done on ip address

site
Searches a specificwebsite or domain.

filetype
Search for a particularfile type.

link
Searches within hyperlinks for a specific term.

cache
Identifies the versionof a web page.

intitle
Searches for a termwithin the document title.

inurl
Searches only within the URL of a document.

maps domain names to ip addresses