In this video, you will understand what exactly is credential
harvesting and how it can be leveraged by both hackers
and even paint recent testers.
So let's iPhone in
so you're probably wondering what exactly is credential harvesting
and why do we even need to collect it?
To put simply credential harvesting is a type of
cyber talk which is commonly performed by an
attacker. Let's see a black heart attacker
or even an ethical hacker with the intent
to obtain sensitive into Mission such as
long credentials or even any
sort of personal identification numbers or let's
say pins from a Target such as
an employee or even persons from a particular
organization.
This type of information is typically obtained through various
types of social engineering attacks
such as fishing scams redirecting users
to malicious websites or even injecting
or planting malware on the
victim system.
Once our attacker has obtained the credentials
they can use these credentials to gain unauthorized
access to confidential or
even sensitive systems and steel valuable
information.
There are various techniques that can be used by let's see
apentuation tester to perform credential
harvesting. For instance. We can
use phishing attacks which is a type of
social engineering attack on wood fishing attack. This
is a common technique which is used by attackers who
send specially crafted emails or
even messages that appear to be from a
legitimate Source such as a bank or
even some type of other financial institution or
even an e-commerce organization.
The idea of this attack is to Simply trick the recipient
of the message into providing their loan credentials
or any sort of sensitive details that
could be used on Leverage to compromise that
person's account.
Furthermore we can use malware.
Where there are taka can use malware such as
keyloggers or remote access tools to
Simply capture login credentials or
even sensitive information that can
be used to gain or notice access
into a system or a device.
Another common technique social engineering with social
engineering this technique enables our
talker to use psychological manipulation to
trick the victim or the intended victim
into revealing their login credentials or
any sort of sensitive details that will
allow the attacker to compromise the victim's account.
Furthermore we can use Network base attacks such
as man in the middle attacks with this
type of attacker.
Simply intercepts any sort of communication between
the victim and their destination
for instance if the victim is connected
to let's say their banking website the attacker
can simply intercept the network traffic between the
user and Banks website with intent
to actually capture any sort of user credentials
that may be exchange over the wire in plain
text.
There's also the militia's websites where attackers
can set up fee websites to mimic legitimate
once
The intent of this type of attack is to trick the
individual into providing their logon credentials when the
attempting to log into a malicious website or
to the fee website.
There's also credential stuffing and this
type of attack simply is a form
of automation where the attacker uses a
large number of already obtained usernameson
password combinations to automatically try
to login into different websites.
With credential stuffing the attacker can
determine which credentials work or the actual
combination credentials? Which work and which ones did not
work?
These are just some of the most common techniques an attacker
can use to actually obtain credentials
and leverage his credentials for their benefit.
During the courses video. We took a look at understanding what
exactly is credential harvesting and various techniques
that could be used by a penetration tester
on ethical hacker to Leverage The obtain
data to gain or notice access into a
Target system.
In the next video, we'll take a look at password harsh
extraction from a windows-based system.
I hope this video has been informative for you. I'll see
you in the next one.