Cyber Security Attack & Defense

False Positive:

Taret response indicates state as true, but in reality is not true.

False Negative:

Target response indicates state as no true, but in reality is true.

Gray Positive:

Target response indicates state as true, however target is designed to always respond with this state.

Gray Negative:

Target response indicates state as not true, however target is designed to always respond with this state.

Specter:

Target response indicates state as true or not true, but in reality it cannot be known.

Indiscretion:

Target response indicates state as true or false but only during particular time.

Entropy Error:

Target response cannot indicate state as true or false due to a high noise to signal ratio.

Falsification:

Target response indicates state as either true or false although in reality it is dependent on largely unknown variables.

•Advantages
–More flexibility for Pentesters.
–Frequent updates.
•Disadvantages
–Assumes tester have necessary knowledge beforehand.
–Latest version requires paid subscription.

- gather information from public sources (people and culture, terminology, technical infrastructure)

- identify patterns of behaviour of people or system

- process of creating a map of network and systems of target organisation

Whoisdatabases contains:
–Technical, administrative, and billing contact names
–Phone numbers and e-mail addresses
–Domain Name Servers
–Other juicy tidbits

To ensure only a single organisation uses a specific domain name

Whois lookup: done on domain name

Whois reverse lookup: done on ip address

site
Searches a specificwebsite or domain.

filetype
Search for a particularfile type.

link
Searches within hyperlinks for a specific term.

cache
Identifies the versionof a web page.

intitle
Searches for a termwithin the document title.

inurl
Searches only within the URL of a document.

maps domain names to ip addresses

It contains all resource records for a domain (mapping between domain names and ip addresses)

•A: Address Record
–Maps a domain name into IP address.

•SOA: Start of Authority Record
–Indicates that a server is authoritative for that DNS zone.

•NS: Name Server Record
–Indicates the name servers associated with a given domain.

•MX: Mail Exchange Record
–Identifies the mail servers for a given domain.

•CNAME: Canonical Name Record
–Indicates aliases and alternative names for a given host.

•PTR: Pointer for inverse lookups records (Reverse Record)
–Indicates an IP address to domain name mapping.

•SRV: Service Records
–Identifies services such as directory services.

- passing information gathering uses non intrusive methods to gather information (most information can be obtained publicly)

- active information gathering uses more intrusive methods to gather information (like actively interacting with the target without dropping to the level of scanning)

Process of locating all the DNS servers in a target organisationand retrieving corresponding records from them

Resolve a given name. If it resolves, server exists. If not "not found" will be returned.

Brute Force: automated process by running a script through a complete list of DNS names

Resolve ip address.

Brute Force: automated process by running a script that finds out all the hosts in a particular domain. Host names will give clues on the use of specific servers (smpt.gmail.com)

Misconfigured DNS server. It is the equivalent to telling the hacker what the network topology is.

Configurations should separate internal DNS namespace and external DNS namespace into different unrelated zones.

- nontechnical method of breaking into a system or network by deceiving the user of a system and convince them to perform acts that are useful to the attacker (reveal sensitive information)

Human-Based:

- Person to person interaction to retrieve desired information.

- Examples: Caling helpdesk to find out password, impersonating an employee, posing as important user, shoulder surfing, dumpster diving

Computer-based:

- uses software that attempts to retrieve the desired information

- Example: phishing, email attachments, popup windows, URL Obfuscation

Good policies and security awareness programmes that are taught and reinforced to employees.

One advantage of a strong security policy is that it helps the employee decide how to respond to hackers requests.

NetBIOS enumeration:

SNMP enumeration:

SMTP enumeration:

- Learn more about targets and find openings by interacting with the target.

- Hacker continues to gather information regarding the target network and its individual hosts

- Information gathered in this phase help hacker to determine which exploit to use

Network Sweeping:

- Identify live hosts in the target network by sending probe packets to all addresses in target range

Network Tracing:

- Determine the topology of a network to draw a network map using the results of the sweep.

Port Scanning:

- Find openings by listening to TCP and UDP ports. Specific numbers give hints to what services could be running

OS Fingerprinting:

- Determine OS based on network behaviours.

Version Scanning:

- Determine versions of services and protocols by interacting with open TCP and UDP ports

Vulnerability Scanning:

- Determine a list of potential vulnerabilities in the target environment

technique of dialing telephone numbers to find an open modem connection that provide remote access to a network

- do ping sweep of an address range

- systems that respond with a ping reply are live

- can run parallel

- all systems can be scanned at the same time

packets with incremental TTL values are sent to the target. using the TTL behaviour the addresses of routers between attacker and target can be determined

- Verification of the existence of the system

- Check for open ports that accept connection

- ports reveal what types of services are running and therefore aid in the attack by providing the attacker with info on which vulnerabilities to look for