The network is the first thing we think about when we imagine computers getting hacked.
Right?
And it's the Pentesters playground.
It's both the first step and the final frontier of compromising a computer.
It's also what makes the compromise of a single computer effectively and the compromise of an entire
building full of computers.
It's fitting.
Then we continue our journey with a discussion about compromising the network and using its own power
and weaknesses to inform the PEN test.
The first step is getting on the network and there are human architectural and protocol factors that
make the more presence of an attacker on the network potentially devastating.
For this reason, defenders often deploy network access control NAC systems.
The intents of these systems is to detect and prevent an intrusion on the network by identifying and
authenticating devices on the network.
In this section, we will review some of the methods employed by the Nazis and demonstrate practical
methods of bypassing these controls.
Now, let's get started by the learning of bypassing media access, control, filtering and things to
consider for the physical assessor.
An attacker needs to be aware of the methods for the remote compromise.
Attacking the VPN wireless infiltration from a distance, using a high gain antennas and so on.
However, Pentester can never forget the big picture.
This is a field where it is very easy to get caught up and in the highly specific technical details
and amidst the human element of security design, there is a design flow concept that pentesters like
to call the candy bar model.
This simply refers to a network that is a thought and crunchy on the outside, but gooey on the inside.
In other words, it's a model that emphasizes the threats of the outside world when designing the security
architecture while assuming that someone who is physically inside the company facilities had been vetted
and therefore trusted.
The mindset here dates back many years.
In the earlier days of what became the Internet, the physical access points to the network were inside
highly secure facilities.
Packets coming in over the network were safely assumed to be from a secure environment and sent by an
authorized individual.
In today's world, a packet hitting the border of a company's network could be from an authorized individual
on a business trip, or it could be a very clever teenager on the other side of the planet, eager to
try out some newly learned tricks.
The candy bar model will come up in a later lectures when we discuss other network attacks.
Once you crack the outer shell, you will often find that the path forward seems paved, especially
for you.
And the successful compromise will inform your client of the devastating consequences of this mistaken
assumption.
Feel free to treat yourself to an actual candy bar.
Upon successful compromise, you deserve it.
How to Social engineer Your target is a subject for another section altogether.
But for the purposes of this discussion, let's assume that you have a physical access to network drops.
Not all the physical access is the same though.
But if you convince your target to hire your as a full time employee, then you will have constant physical
access, right?
They will even hand you a computer.
However, what's more likely is that you have exploited a small gap in their physical security stance,
and your presence can be undetected or tolerated for only a short period of time.
We have snuck in through the smoker store after striking up some conversation with an unwitting employee
or you have been given permission to walk around for an hour with an unconvincing looking contractor,
uniform and clipboard, or which is my personal favorite.
You have earned trust and affection by bringing in a big box of donuts for the people expecting an auditor's
visit based on a well scripted phone call.
And my client is still shaking after this test and will ask whether the donuts were real.
And for now we will demonstrate how to set up a Kali box to function as a rogue wireless access point
while impersonating the media access Control address of a voice over Internet protocol Phone.