Reconnaissance or information gathering attacks precede any other phase of the
hacking cycle, you're going to collect as much information as you possibly can about
the target prior to launching even a single packet.
So you can spend lots of time performing reconnaissance through social engineering,
port scanning, DNAS footprinting, ping sweeping, etc.
Our network scanning.
Network scanning is again running a series
of crafted probes eliciting a response from the target system, and you gather
lots and lots of useful information through network scanning.
So IPSs, OSs, open ports on those IPS, and vulnerabilities in live hosts.
Our DNA's footprinting, DNA's records.
There's two flavors of DNA's footprinting.
The first of which is running DNA's queries proper against a DNA server,
retrieving A records, M X records, MS records, C names, startup authority, etc.
Then you've got DNS zone file transfers,
which you always request every so often you get lucky and you get one.
They're usually denied, but every so often you get lucky and you get one.
That's a good portion of your network
footprint right there with a single zone file transfer.
All right, so dns footprinting, querying specific dns servers for specific
resources in both the public zone files and probably much more interesting, the
internal zone files of your target network.
Packet sniffing, process of monitoring and capturing all packets passing through a
given network using a software application or hardware device.
That is, capturing traffic on the network, usually traffic that is not your traffic,
otherwise why it wouldn't be so interesting, right?
It allows you to access directly anything that's clear texted nature.
And then you can also gather things like
passwords, challenge can't shake off the indications for leveraging active attacks.
Man in the middle attack is defined as an
attacker sitting between the victim and the victim's
target, whatever that is, or victim's resource, and it's unknown to both sides.
The victim sends data to the attacker who
forwards it to the web server and vice versa.
This sends up a man in the middle, but
both sides are unaware of the fact the attacker is listening in.
Several different examples of man in the middle tax.
You've got layer 2, layer 3, layer 7.
We'll talk a little bit more about those in proxy poisoning and art poisoning and
route or imperson, and that thing a little bit later in the course.
Our DNA is Poisoning.
Dna is Poisoning is miss resolving DNA
request, misleading your victims into connecting to a non legitimate resource.
Lots of different ways to go about this,
but the DNA is Poisoning is either utilizing local resources, cash poisoning,
or manipulating and intercepting and manipulating
responses through intermediary DNA servers.
Our domain hijacking is where you're
actually taking over the domain ownership of a target domain, and you're changing
its resource records to point to that the attacker.
So everything in DNS poisoning is for the purpose of misleading victims
to a malicious copy of the site or malicious resource.
Arp spoofing attacks are layer two attacks
used to intercept traffic on a switch network.
You're impersonating ARP responses and
you're achieving a man in the middle attack by poisoning the ARP caches of your
victim and a lot of times the router or another victim on the network.
A DHCP starvation attack is where you cause a denial service attack on the
network by impersonating or maliciously falsifying
DHCP client discover request for purposes of consuming an address scope.
So over and over and over again, you request, request, request.
The DHCP server keeps serving up address
leases, and eventually it runs out of leases, DHCP starvation attack.
A DHCP spoofing attack is where I
impersonate a legitimate DHCP server, and I do that to miss address clients,
miss configure clients with wrong gateways, wrong DNS servers, or wrong IP
addresses and cause a denial service attack.
All right, max spoofing, duplicating or Cloning.
Okay, Spoofing.
We really haven't introduced that term yet.
Spoofing is falsifying information, period.
So I could spoof my IP address, I could spoof my MAC address,
I could spoof this, I could spoof that, which means I'm modifying, I'm using
something other than my legitimate information.
Mac spoofing would typically be used to circumvent filtration controls on a
wireless access point or for the attacker to hide their actual physical address, do
a detection, investigating a DHCP server log file or something like that.
We'll talk more about that in our wireless discussions, most definitely.
All right, MAC flooding is one way to sniff a switch network by flooding the
switches cam table with misaddressed frames, flushing out legitimate entries
and making the switch basically turn itself back into a hub.
That's one way to perform active sniffing on a switch network.
Ip address spoofing.
Can I spoof my IP address?
Absolutely.
Can I spoof my IP address and get an interactive response from a remote system?
Well, no. Wait a minute.
They'd send it back to the IP address you spoofed.
Exactly.
So in a one sided attack, IP address spoofing, no problem.
In a two sided attack, it becomes a little bit trickier.
You have to use something like active sniffing, be on the same network,
but you can definitely spoof your IP address.
No doubt about it.
Denial service attack or DOS.
Dos with 1D versus DOS with 2D. All right, real quick mnemonic device here.
1d, one attacker, potentially one victim.
2ds, two or more attackers, one victim, typically hundreds or thousands.
In our first module, we talked about botnets.
Botnets are used to perform distributed denial service attacks.
Here's a little bit more information than we saw in the previous
module, but we talked about secondary victims attacking a primary target.
The zombies being the secondary victims, the agents or the bots being installed on
the zombies participating in the collective attacking a primary target.
The attacker controls the bots through a
command and control channel or CNC channel.
Call that the handler.
The handler controls the bots.
The bots attack the primary target.
A single DOS could be something as basic as locking a user out of their account
or unplugging their network cable, et cetera, et cetera.
Distributed, again, typically takes
hundreds or thousands of nodes working in concert.
A distributed, reflective denial service attack.
This involves a reflection off of intermediary servers.
In a nutshell, I spoof my IP address with the IP address of the primary target.
I send requests to intermediary victims .
The secondary victims are compromised.
They send request to intermediary victims.
They spoof the IP address of the primary
target, and those responses are reflected back to the primary target.
Reflection in general is spoofing the IP
address of the target, and then that IP address being used as a
response, that's reflection versus me sending a request from my IP address.
And then there's typically a degree of amplification involved as well.
When you look at things like SMRF and
FRAGGLE, you send requests to the broadcast address of the network,
or any situation where you get more data back like a zone file transfer for DNS.
Those are examples of amplification.
All right, malware attacks.
We had a malware discussion in the
previous modules, so again, we're going to retouch on a couple of concepts here.
But malware attacks are, again, lots of different flavors of malware.
Trojans, worms, viruses, et cetera, et cetera.
We had our initial introduction in the last module.
Advanced persistent threats can be a flavor of malware, but they're
also a specific group of highly skilled, highly motivated attackers.
All right, so two definitions.
An APT is an unknown compromise system on
a network that continues to provide access for an extended period of time, or a
ultra skilled hacker group moving or working towards a common goal.
The idea is you infect the system internally, it remains undetected for a
period of time and keeps sending information back to the attacker.
That's the basic definition of an advanced persistent threat.
Physical attacks. Would it be...
Let me guess, physical? Yeah.
There's a couple really cool gadgety
devices out there you can buy along the lines of a keystroke injection circuitry.
A malicious USB cable can actually...
The circuitry is so small, you don't see it.
It can be used to send key strokes to the attacker system.
It's got a potentially WiFi controller, so it can be accessed.
This stuff is getting really small form factor and just by plugging in a sync
cable, you could be installing a malicious piece of hardware on your device.
Malicious flash drive, enough said, road Apple attacks, baiting attacks.
You leave a flash drive laying around with malicious executables on it.
Somebody comes across it, they plug it into their system.
Hey, what's this? They run it.
Card cloning.
Lots of different examples of card
cloning, duplicating credit cards, things like that.
Then skimming is using physical card readers to steal credit card information.
Lots of cool hardware devices you might
get into as an attacker or play around with as a security analyst.
But gadgets are cool, no doubt about it.
Adversarial artificial intelligence.
Adversarial AI is a new technology tack vector.
It's designed by attackers with malicious intent to mislead machine learning models.
Machine learning and AI,
we're going to see lots of integration for intrusion detection and response.
But this is used to attack those machine
learning systems so that attacks go unnoticed, more or less.