Injection flaws.
An injection is any insertion of unexpected code through any an input field
or API or listener or a procedure call endpoint or whatever.
A lot of times this is done in a web application, things like SQL injection,
command injection, LDAP injection, X path injection, etc.
Lots of different types of injection attacks.
Now come back to CEH for more on that topic.
We do plenty of cool labs on different types of injection.
You actually have a lab on a sequel injection in this course as well.
Cross site scripting attacks.
Cross site scripting is sending
unsanitized user supplied input in a web submission of some sort.
It gets reflected back in a response page and the script executes.
This is due to lack of sanitization of
user supplied input, which there's a lot of that.
The core issue with a lot of these web app attacks is the lack of standardization.
If you just check the input before it was passed back for processing,
we catch a lot of this stuff down its tracks.
Parameter tampering.
If a parameter exists in the URL, for example, profile IDs, etc,
you can manipulate that parameter and maybe you get access
to another user account or a mail box or something like that.
So anytime you can manipulate any variables, you could potentially produce
an unexpected insecure response, and that's the nature of parameter tampering.
Direct to traversal attacks are attacks on
the navigation of the file structure on a web server by using dot, dot slash in the
request, which means go up a directory, go up a directory.
So you can use trial and error to navigate
outside the root directoryand access sensitive information on the system.
And they always love to give examples of obfuscation
attacks using a unicode or alternative in coding.
Cross site request forgery attack is a
situation where you hold an active session, you visit a malicious page, a
script executes, and it sends a transaction or request as
part of your authenticated session that you didn't authorize.
Imagine you're logged in your bank, you visit a malicious site, it then
transfers the script, it transfers funds to the attacker.
That would be an example of cross site
request forgery, which sounds very similar to cross site scripting.
Dns amplification attack.
I mentioned this earlier in our Denial of Service or DDOS slide.
Amplification is where you get more back in response to your original request.
When I request a zone file transfer from a DNA server nine times out of 10, I'm going
to get rejected, but there's always that one time.
That zone file transfer that comes back to
that initial request is definitely a lot more voluminous than the initial request.
So in an amplification reflection attack,
I send zone transfers with the client's IP address spoofed as the requ.
The zone transfers get sent back to the
requesting IP, which I've spoofed, which is that of the victim.
So it's reflective and amplified.
Any application level DOS attack consumes application resources, and you've got
loading up of active connections, processes, resources, and so forth.
So this is more along the lines of disabling a specific app on a specific
system than necessary to bring in the entire system down.
There's a bunch of examples of web application attacks.
We're going to reference a couple of these.
We'll spend a little time on some of them.
But X ML external entity injection is a
flavor of server side request forgery attack when a misconfigured Parser allows
XML applicationsto parse input from an unreliable source.
Again, it's an unauthorized request or
source and you're injecting into some input field or vector.
Watering a hole attack is where you attack
a website that you know is frequent by your victim.
Let's say your victim loves Facebook.
You find a weakness in Facebook and you
compromise and you wait for them to log in.
Facebook is generally not going to have those type of glaring issues.
But
other high profile sites are a lot more subjected to having a lot more flaws.
Facebook is pretty rigorously tested.
We do find vulnerabilities periodically.
But imagine your victim is a stamp collector.
You've got this specific stamp collecting site or whatever.
It's got a vulnerability.
You install a keystroke logger for download or something on the site, you
know that your victim is going to eventually access that site.
It's a watering hole attack.
Application level session hijacking session replay attacks.
A session replay attack is where you steal a session token from an authenticated user
and you replay it to the web server as if you were that user.
An authentication token is generated after you log in.
If I steal your authentication token and I
flash that to the website, as far as the website is concerned, I'm you.
So a session replay or session hijacking attack involves replaying a captured
session token from a compromised user session.
Our application programming interface attacks.
The APIs in general are meant to be
accessed by programming or software versus humans.
Whenever you need to attack anything, the first thing you have to do is figure out
how you can talk to it and be able to get to that input field.
You've got user login forms, parameters
and URLs, hidden post request and web pages, etc.
They also have API listeners that are meant for programmatic interface.
These guys are subject to a lot of the same types of vulnerabilities
fuzzing, unvalidated input attacks, injection, insecure configuration, etc.
But again, they're meant to be accessed by software versus a human, more or less.
Secure Sockets or stripping is a method of
turning an encrypted web session into an unencrypted web session.
And usually it's redirecting to a non SSL version of the site.
You can also use certificate spoofing to set up a man in the middle attack.
But this would be used when you're trying
to sniff an SSL or TLS session by typically a man in the middle type of
attack where you're then redirecting to a non SSL version of the site.
All right, malicious code or script execution.
In our previous chapter, we talked about fileless exploits, fileless malware.
So PowerShell and Python, those are both typically authorized system utilities.
But when you're using malicious codes or
scripts, they become a way to execute malware.
So PowerShell we talked about, Python we didn't really reference in fileless
malware, but you could definitely put it in the same category.
But malicious coder scripts are every bit
as deadly as malicious exes because, again, they're like scripting interfaces.
So PowerShell and Python, lots of very
powerful functionality on both of those command line scripting engines.
All right, password cracking.
Password cracking happens in two flavors.
You've got offline and you've got online
and then you've got how do I determine what password to try next?
Dictionary, hybrid, brute forcing attacks.
We also have something called rainbow tables.
So in a nutshell, in password cracking, you are guessing over and over again
until you get your correct response, whatever that is, whether I log in or if I
create the same hash output for hash password.
But password cracking techniques are used to attack single factor authentication.
Although type 1 authentication is the weakest type
of authentication that we have, it's still the most widely used.
Lots of weak passwords out there, lots of password crackers.
Dictionary, brute force, or rule based attacks are just really how you determine
what the next password you try because it's a lot of trial and error.
A dictionary attack will take a dictionary
of words or passwords and try them one at a time.
A brute force attack will try every
possible combination of characters one after the other.
And a rule based attack will only try
passwords that match the requirements dictated by the system.
So upward and lower case, minimum number of characters, that thing.
A hash injection or pass the hash attack.
A hash injection is where when you log into a Windows system, your password hash
and credentials are stored in an access token.
That access token contains your username
and your password hash, and that can actually be rewritten.
So if, say, there was another domain admin
logged onto the same system and I was able to read their password authentication
token, their hash token, I could actually copy that and rewrite my own.
That's a hash injection or pass the hash pass the hash attack.
There's a couple of different flavors of
that, but it typically requires a elevated level of access and another user of a
higher privilege logged on to the same system.
A rainbow table attack is a
precomputed hash table that expedites the cracking process because you've already
done all the math, at least that's the idea.
So rather than trying each individual
password one at a time, over and over and over again, you've already done it.
You've created a table of passwords and hashes.
When it's time to crack the password hash, all you do is match it to the pre existing
table and it identifies the password that was used to create the hash.
In a nutshell, you do your password crack
ahead of time, saving you time later, but it also takes a considerable amount of
time and storage space to create it to begin with.
A buffer overflow is an attack on the absence of bounds checking for specific
functions, typically in the C programming language.
In a nutshell, you're allowed to submit
overly long input that floods into adjacent memory locations out of the
receive buffer and overrides sensitive areas of memory.
Typically, this is more like the OS level C sharp C programming languages, but you
do have buffer overflows of other varieties as well.
Privile escalation. When you escalate privilege, you typically
power up, but you can also escalate privilege horizontally.
Once I've compromised a system, if I don't have the privilege required to perform
whatever nefarious activity I want to perform, then I need to up
the credits a bit, either vertically or horizontally to gain access to a far
folder object of another user with the same privilege.
Privilege escalation, again, if you don't have what it takes to
do whatever you want, you try to escalate up or escalate sideways.
Again, two flavors, horizontal and vertical privilege escalation.
Dll hijacking or injection is where you're using...
Okay, malicious DLs are just that.
They're malicious in nature.
You have system DLs
that are called by an application, but if the application doesn't use a fully
qualified path when loading a DL, you can actually get
them to accept a rogue DL or malicious DL and run that instead.
The idea is you're impersonating a
legitimate system dynamic link library because it doesn't get actually checked in
the full system 32 path or wherever it's stored.
Driver Manipulation.
Drivers in general are dangerous because
they typically run as part of the OS kernel.
There's a couple of different flavors of driver manipulation.
You have refactoring and application
shimming, which are modifications of how the driver executes.
Then drivers, route kits in general are typically drivers.
If you have the ability to install a system driver in Windows, you typically
have the ability to install a system route kit.