When an attacker gains access to the network there are many ways to cover their tracks so they cannot
be detected by security equipment and forensics.
In this section we are going to cover the different methods that attackers can use to limit their exposure
on a network encryption and tunneling are the most common tricks that attackers use to hide their actions.
VPN and S-sh protocols can be used to encrypt data which can be impossible to decrypt for security devices
like IP asses and firewalls.
If an attacker wanted to leak stolen data outside of a network they could simply form an encrypted tunnel
back to their network with no one knowing it.
There are many hacker tools out there.
In addition to VPN and S-sh clients that can be used for secure tunneling like the LAN turtle
when security appliances like an IPX are overloaded it may cause them to fail open and let traffic bypass
without inspection by executing a Diosa attack.
A system's resources could be exhausted which could trigger a fail open scenario.
The best way to prevent resource exhaustion is to make sure that your security devices are set to throttle
traffic within standby thresholds.
Let's hop in the Kayley lab and I'll show you an example of a tool that can be used to cause resource
exhaustion on a system.
First we need to download the slower us or however use it.
Application.
So just google slow loris download go to get a job and then it gives us instructions on what we need
to download first and then how to execute the slow loris script.
So first I'll run through these apt get commands
get a terminal open.
Once that finishes will install Perl
Perle's a programming language that will be used by slow learners.
Case we got Perl and we just need to install these next two modules.
Now we just need to download this perl script and download the zip file
going to extract the perl script and then I'll just extract it to my desktop so it's easy to find.
All right so now that we have the file extracted and we know the location opened up our terminal go
to the path where our perl script is so we can launch it.
Now we'll launch a terminal navigate to my desktop directory and then I'll paste in the string to run
the attack.
I'm going to put in an IP address on my lab not work
and then hit enter.
And here you can see what it's doing is it's building as many sockets as it can to that server on port
80 to try to exhaust the resources of that server.
So here I've browsed to that server's web page and I can't even see any of the images that I would normally
see for this web page.
So clearly it's resources are being exhausted from our slow loris attack and you're mostly logged into
the server that's being attacked around the nets that command.
So as you can see our attacking station at IP address 10.0 that 11. 11 has opened up a ton of port 80
sockets to the server to try to exhaust its resources.
Our next evasion method is traffic fragmentation when data is sent to our networks.
It can be sent with different byte sizes if data is larger than what's called the maximum transmission
unit for an interface and needs to be fragmented traffic fragmentation is undesirable on networks for
optimization reasons and it is even worse for security.
Attackers can intentionally fragment data certain ways to trick security equipment like eyepieces to
bypass inspection
network communication is not possible without using protocols.
Protocols are used to standardize how data is exchanged between network devices.
Security devices inspect protocol data based on industry standards and if an attacker modifies protocol
behavior it could trigger security devices and make it difficult to inspect data
traffic substitution in insertion can also be used to evade security sensors traffic substitution and
insertion as one data sent in a different format than expected and can cause an IPX to miss malicious
payloads.
The last evasion method I want to cover is pivoting.
Pivoting means to attack systems with the intention of jumping to other systems on the same network
to prevent pivoting now work and points should be segmented to only have access to required services
for a wired wireless and VPN access.