Searchbase

Security Tools for a Novice

<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<div class="separator" style="clear: both; text-align: center;">
<a href="http://core2.staticworld.net/images/article/2012/11/securepc_primar-100012393-large.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="214" src="http://core2.staticworld.net/images/article/2012/11/securepc_primar-100012393-large.jpg" width="320" /></a></div>
Here is a compilation of a few tools that we need to be aware of. The power, the performance and the capabilities of these tools are limited only to the creativity of the attacker. Let’s dig in to the list.</div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<strong>1. Maltego:</strong></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
Following the well-defined hacker cycle, let’s start off with reconnaissance tools. Maltego is a very well-known tool for information gathering. The tool comes with personal reconnaissance and infrastructure reconnaissance. With personal reconnaissance, a person is able to obtain another person’s profile from the email address, name, or phone number using the search engines. The Maltego framework comes in two versions – a commercial version and a community edition. Registration is mandatory for using this tool. Only the commercial version allows saving the output from the reconnaisance. With infrastructure reconnaissance a person can get information related to subdomains and servers of a network. This information is gathered using what we call transformations in Maltego. Various transformations give results depending on the way the results are manipulated, grepped, and translated into new search queries.</div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<strong>2. Metasploit:</strong></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
Following this, we move on to the exploitation tools. The most used exploit development framework is the Metasploit framework by Rapid 7. Initially developed as a game, it has evolved into one of the most powerful exploit development frameworks. It allows using custom exploits by using something called “porting of exploits”.</div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
Porting exploits involves taking a proof of concept exploit which just delivers some particular shellcode, commonly a calc.exe launcher or notepad launcher, and weaponizing it to be used in the framework with features. These features include things like custom payloads, encoders, and other benefits.</div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
The Metasploit framework is not just an exploit delivery vehicle. It also contains some tools for exploit development.<strong><em><br /></em></strong>It can also be used for generating offsets, writing exploits, and exploitation of different operating systems and architectures. It has various modules and exploits.</div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
A third party extension that provides a GUI is Armitage. The commercial has its own GUI, which is not included in the community edition.</div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
Backdooring executables can be carried out by a module named as msfpayload.</div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<strong>3. GHDB</strong></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
GHDB stands for Google Hacking DataBase. Google is the most powerful tool for a user to perform attacks. Specially crafted words given as input to Google are named as Dorks or Google dorks. These dorks can be used to reveal vulnerable servers on the Internet. They can be used to use to gather sensitive data, files that are uploaded, sub domains, and more. GHDB can make it easier to find the right Google dorks for your needs.<strong><em><br /></em></strong>Offensive Security maintains a <a href="http://resources.infosecinstitute.com/collection/" style="color: rgb(51, 51, 51) !important; text-decoration: none;" title="collection">collection</a> of Google dorks under a section called GHDB.</div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<strong>4. Social Engineering Toolkit:</strong></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
This tool is built into Backtrack. It presents the social engineering attacks in an automated fashion. Is it encoding of scripts, binding Trojans to legitimate files, creating fake pages, harvesting credentials? This tool is a one stop shop for all these requirements. It has the ability to use Metasploit based payloads in the attack, making the framework all the more lethal with all professional exploits from the Metasploit framework.</div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<strong>5. HULK – A web server DoS Tool</strong></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
Brainchild of Barry Steinman, this tool distinguishes itself from many of the other tools out in the wild. According to its creator, the tool was the result of his conclusion that most tools out there produce repeated patterns which can easily be mitigated. The principle behind HULK is to introduce randomness to the requests to defeat cache-ing and host identification technologies. This is to increase the load on the servers as well as evade the IDS/IPS systems.</div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<strong>6. Fear The FOCA</strong></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
The FOCA is a metadata harvesting tool. It can analyze meta data from various files like doc, pdf, ppt etc. From this data it can enumerate users, folders, emails, software used, operating system, and more. There are customization options available in the tool too. The crawl option allows you to search the related domain website for additional information. The meta data can be extracted from a single file or from multiple files. Thus FOCA is a great tool in the reconnaissance phase to extract information from the meta data.</div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<strong>7. W3af – Web application attack and audit framework</strong></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
This project is a web application attack framework sponsored by the same company that makes Metasploit. W3af is used to exploit web applications. It presents information regarding the vulnerabilities and supports in the penetration testing process. It is mainly divided into two parts: core and plugins. Currently it’s partnered with Rapid7, the team that maintains the Metasploit framework. There is a plugin for saving reports to disk for later reference. The plugins can be custom written. Communication between plugins can be automated.</div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<strong>8. EXIF Data viewers</strong></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
Smartphones and digital cameras use a standard to specify additional meta data for images and sounds that are recorded using them. This standard is called Exchangeable Image File Format. Various EXIF data viewers are available. The data recorded can include details about type of camera. More importantly, they can contain the geo-location information within them. In fact, by default all smartphones have the GPS setting switched ON. This can potentially leak your location when the image was taken. The accuracy is such that the latitude and longitude will be provided when extracting the EXIF data, thus leaking possibly private information.</div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<strong>Conclusion</strong></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
These are a few handy tools that a beginner in info-sec needs to be aware of. Other tools and their capabilities will be followed in the continuing posts.</div>
</div>

Security Tools for a Novice

Here is a compilation of a few tools that we need to be aware of. The power, the performance and the capabilities of these tools are lim...

BurpSuite Tutorial

<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">we are going to see another powerful framework that is used widely in pen-testing. Burp suite is an integration of various tools put together to work in an effective manner to help the pen-tester in the entire testing process, from the mapping phase to identifying vulnerabilities and exploiting the same.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir1.png" height="209" src="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir1.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">In the figure above, we see the various features of this tool, like proxy, spider, intruder, repeater, sequencer, decoder and comparer. As we move ahead in the tutorial, we shall learn how to make use of them seamlessly.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Burp-Proxy</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">This lets you intercept the traffic between the browser and target application. This option works like the man-in-the-middle attack vector. Below I shall show you one of my favorite examples in demonstrating this feature.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<img align="left" alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir2.png" height="164" src="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir2.png" style="border-style: none; display: inline; height: auto; margin-bottom: 10px; margin-top: 10px; max-width: 100%; vertical-align: top;" width="204" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;">Here, we are seeing a Wikipedia login form (dummyuser:dummypassword) and we shall see how the intercept is put. Initially we need to switch the intercept mode ON, in the suite. The FORWARD option allows you to send the packets coming from the source IP to the destination IP. The DROP option allows you to drop the packet if you feel it’s not a potential packet that needs analysis.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir3.png" height="256" src="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir3.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">In this figure, we see that the login credentials of en.wikipedia.org are being captured. The point here to note is that Wikipedia uses HTTP instead of HTTPs and thus, the login credentials are captured in clear text.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir4.png" height="277" src="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir4.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">The burp proxy listener is enabled on Port 8080 of the local host. There are various options for intercept set-up, like request methods, matching file extensions, and URL scope for the client requests. Other options like request type, content types, and URL scope in the server responses are available to be set-up based on the attack scenario.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">I have used Mozilla Firefox here. The same holds for any other browser.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: center;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir5.png" height="622" src="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir5.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">The following steps can be many from this phase. The capture can be dropped, or sent to spider, sequencer, comparer etc. There is an option of changing the request methods from GET to POST and so on.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Burp-site Map and Site Scope</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">In this section, we are seeing the Burp site maps and site scopes. This section shows us the various sections of a particular domain. Here, we can choose the scope of our security testing. We see a huge number of sub domains when we hit on<a href="http://www.google.com/" style="color: rgb(51, 51, 51) !important; text-decoration: none;">www.google.com</a>. The figure shows the site-map and site scope. We can also see the pages visited which are darkened, and unvisited pages are grayed.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir6.png" height="191" src="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir6.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">This particular instance in the screenshot shows the searches that are done by the user. I have searched for “Security research”, and using the key word finder, I have highlighted the word “security”.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<img align="left" alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir7.png" height="400" src="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir7.png" style="border-style: none; display: inline; height: auto; margin-bottom: 10px; margin-top: 10px; max-width: 100%; vertical-align: top;" width="177" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;">The figure to the left shows the site-map of Google. Google is just used here for a demo. The target web application can be anything under analysis.<strong><br /></strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Burp Spider</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">The spider tool is used to get a complete list of URLs and parameters for each site. The tool looks into each page that was manually visited and goes through every link it finds in the testing scope. Make sure when using spider tool that your proxy and interceptors are switched off. The more links you manually visit, the better spider you are going to get. It simply gives the spider a larger coverage area.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">Setting up the spider is done using the options menu. The two main things we need to set are the authentication and the thread count. The authentication field can be set with a username and password combination. The reason we set up this is because when the spider comes across a login page, it can go through the authentication process in an automated manner, giving more scope to spider the target.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: center;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir8.png" height="640" src="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir8.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="452" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">Thread count is the number of concurrent threads that are being used. For a local testing, this count can be high. A higher thread count would imply faster processing but also a larger load. Occasional pop-ups occur asking for changing the scope. Depending on the set up we can choose either a yes or a no.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">Once we are done spidering the target, we use the scanner. I am using a free edition of the Burp suite, so the scanner is disabled in this. The professional edition has fully functional scanners. The scanner is used to make tests. There are two types of tests: active and passive. Active tests send data and analyze the possibilities. Passive tests examine all traffic and determine the vulnerabilities present in the application. It’s left to the user’s discretion to choose the type of tests that need to be done on the target.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Burp-Intruder</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir9.png" height="226" src="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir9.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">The intruder has 4 panels as seen in the figure, namely target, positions, payloads and options.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Target: </strong>This panel is used to specify the target host (the URL), the port to use for the connection, and also it gives options for using SSL encryption depending on our scenario. The figure below shows the <strong>target</strong> panel.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: center;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir10.png" height="237" src="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir10.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Positions: </strong>This panel is very important in automating attack strings on the target. There are various kinds of attack vectors, such as sniper attack, battering ram attack, pitchfork attack and cluster bomb.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir11.png" height="235" src="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir11.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">On observing the figure, we see that the payload positions are automatically highlighted with a “§” character. This happens when you click on the auto button to the right. You can add markers and customize too. A clear option is used to clear all the markers on the page.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">A sniper attack is used as a single set of payload. Here, only one value is replaced in the entire payload positions, one after the other. Battering ram is also another form of single payload attack. This is used when a single value is needed in the payload position. The Battering ram works fine when the password quality rules, the policies set are allegedly weak in nature. A lot of enumeration has to be gone through before using this form of attack, since it works in a scenario where, for example, the username and password both would have the same values.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">A pitchfork attack, as we are going to see, is used when we need a multiple payload-set. A cluster bomb is another form of a multiple payload attack vector. In a cluster bomb attack, there are two lists; every word in the first list runs against every word in the second list. It is effectively used when the target has a login form which has to be breached.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">In this section, I am going to demonstrate a SQLi attack on the demo page of etopshop at the following URL: <a href="http://www.etopshop.com/demo/pcstore/admin.asp" style="color: rgb(51, 51, 51) !important; text-decoration: none;">http://www.etopshop.com/demo/pcstore/admin.asp</a></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong><a href="http://resources.infosecinstitute.com/sql-injection/" style="color: rgb(51, 51, 51) !important; text-decoration: none;" title="SQL injection">SQL injection</a> testing using Burp-intruder</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">After capturing the page as described, I custom chose my payload markers as Username fields and Password fields. From here, I deduced that since the attack requires two parameters, I need a multiple payload attack. I chose pitchfork attack vector from the dropdown menu. The figure shows the options being set for the attack. I chose the preset list for adding my SQL attack strings to be tried out at the target.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: center;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir12.png" height="640" src="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir12.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="608" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">In the figure, we see that we can add, save the preset list of payloads, etc. We have lot of options under the payload set. To mention a few, we have character based, number based, random characters based, brute force, dates, etc. As you can see, I have used the preset list.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir13.png" height="574" src="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir13.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">The figure shows the process of SQL injection, once you click on start-attack. The results tab shows the payloads being sent to the target. The request tab shows the HTML source and how the payloads are placed at our chosen markers.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">Another tab of interest is the response tab. Here, we see that the injection succeeded and we have been welcomed as the store manager when we analyze the HTML source. To see the web page, we can even click on render.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: center;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir14.png" height="407" src="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir14.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">In the figure, we see the successful penetration of the web application, using the famous SQL injection vulnerability. Similarly, XSS attack vulnerabilities can be checked, which I shall leave it to the intuition of the reader, on how to go about it.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Burp-Repeater</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">In this section, we shall see the Burp-repeater. This tool is generally used to manually modify the HTTP requests and test the responses given by the page. This can even lead to probing for vulnerabilities on the web-page. Basically, this is used to play back requests to the server.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Understanding XSS with Burp-Repeater</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">We shall use a vulnerable web application at:<a href="http://www.steve.org.uk/Security/XSS/Tutorial/simple.html" style="color: rgb(51, 51, 51) !important; text-decoration: none;">http://www.steve.org.uk/Security/XSS/Tutorial/simple.html</a> for understanding and analyzing XSS (Cross site scripting) Vulnerability in a webpage.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir15.png" height="361" src="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir15.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">In the figure, I have highlighted the attack spot on the webpage, which takes the input, and we will try probing for XSS vulnerabilities. Now, we pass a script tag, the attack string I use is a very simple JavaScript like:</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><em><iframe src=”javascript:alert(‘Xss’)”;</iframe></em><strong><br /></strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">We see that the iframe code is injected into the source of the web page. When checked on the browser to confirm, if there is a XSS bug present in the application, we see that there is a reflected XSS vulnerability on the target as shown in the figure.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: center;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir16.png" height="330" src="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir16.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Burp Sequencer</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">If we want to check for the extent of randomness in the session tokens generated by the web application, this is a tailor made tool to carry out such tests. Brute force attacks enumerate every possible combination for gaining authentication to the web application. This makes it a serious concern to have the high degree of randomness in the session token IDs. Let’s start with sending a request which contains a session token.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir17.png" height="330" src="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir17.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">In this figure you can see the token request to the site Google.com. The right side of the screen shot has the token start and token end expressions. We can either specify an expression like “Google” or even set the offset from where the token has to start. The same thing holds at the token end panel, where we can set the delimiter, or a fixed length for the capture to start. After fixing these parameters, we can click START CAPTURE.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir18.png" height="108" src="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir18.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">The start capture action panel looks like the screenshot above. It sends requests to the target and gives a detailed analysis of the randomness in the cookie tokens. We can pause/stop the analysis when we wish to. I stopped the scan mid-way to see the results of the analysis until the paused values. The screenshot below explains the results better.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir19.png" height="324" src="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir19.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">The scan components are as follows:</span></div>
<ol style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px;">
<li><span style="font-family: 'Bookman Old Style'; font-size: 12pt;">Overall result</span></li>
<li><span style="font-family: 'Bookman Old Style'; font-size: 12pt;">Effective Entropy</span></li>
<li><span style="font-family: 'Bookman Old Style'; font-size: 12pt;">Reliability</span></li>
<li><span style="font-family: 'Bookman Old Style'; font-size: 12pt;">Sample size considered</span></li>
</ol>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">Burp automatically analyses this aspect and generates this report in this sequencer tool. Other analysis types are character level analysis, which tells us the degree of confidence in the randomness of the sample through a graphical display. Similarly, the bit-level analysis is the analysis done at the bit level. You have the choice to pad characters in the options panel and also to decode in base64 if needed.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Burp Decoder</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">This tool enables you to send a request to the decoder. Within the decoder, we have multiple options to encode the request into various formats like base64, URL, etc. There are also options to convert the same to hashes like MD5, SHA-1, etc.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir20.png" height="136" src="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir20.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">The above screenshot shows the Burp decoder for a request. If we have an encoded request like the one in the following screenshot, then the upper part is a request encoded in the base64 format. The lower part is the request decoded in the clear text. I have encoded the entire request. We can also selectively choose a portion of the request to be decoded/encoded here.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir21.png" height="218" src="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir21.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">This aspect mainly comes in to use when there is a client side encryption of username and password in commonly used hashes or encoders. The username/password field can be selectively decoded and the contents can be viewed in clear text form.<strong><br /></strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Burp Comparer</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">Burp comparer is used when we have to compare between two sets of data. The two sets can be a comparison of responses received for two different requests. We can compare on the word scale or a byte scale. The comparison shown here is of two different requests to a website. The screen shot below shows the comparison.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir22.png" height="386" src="http://resources.infosecinstitute.com/wp-content/uploads/102912_1752_QuickandDir22.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">The comparison can be done in two ways – Bit-by-Bit comparison and word-by-word comparison. Burp automates this process for the user and compares the two requests or responses accordingly.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px; text-align: justify;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">This ends the tutorial on Burp-suite. The extent to which Burp-suite can be used can only be left to the imagination of the user. The scanner is not covered in this series because it’s not available in the free edition of Burp. In the commercial edition, the scanner module is fully functional, though with some false positives like any other application.</span></div>
</div>

BurpSuite Tutorial

we are going to see another powerful framework that is used widely in pen-testing. Burp suite is an integration of various tools put toget...

Exploitation with Metasploit

<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">Metasploit is an exploit development framework that facilitates penetration testing of IT systems. This tool initially started off as a game and was taken over by Rapid 7 for maintenance and further development. The main objective of this article is to learn the basics of exploitation with Metasploit and then climb the ladder gradually to the advanced level. Metasploit is a ruby driven environment. It allows us to develop exploits in ruby language and integrate them with existing repositories. Ruby language also allows us to use the existing exploits within its file system to carry out an attack. With this in mind, let’s brush up the key terms needed for this article.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Threat</strong>: An undesirable event that has not yet taken place but can cause serious damage.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Exploit</strong>: The use of scripts and frameworks to attack a target system.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Payload</strong>: At its most basic definition, “payload” refers the action taken after the initial exploitation. It’s a piece of code usually bundled up with the exploit.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Countermeasure</strong>: Patching existing vulnerabilities to prevent future attacks.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">Let’s start off with a basic exploitation of a Windows system using an exploit. The table below explains the general commands used in Metasploit.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px;">
<table border="0" style="border-collapse: collapse;"><colgroup><col style="width: 319px;"></col><col style="width: 319px;"></col></colgroup><tbody valign="top">
<tr><td style="border: 0.5pt solid black; padding-left: 7px; padding-right: 7px;"><div style="margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Command</strong></span></div>
</td><td style="border-bottom-color: black; border-bottom-width: 0.5pt; border-right-color: black; border-right-width: 0.5pt; border-style: solid solid solid none; border-top-color: black; border-top-width: 0.5pt; padding-left: 7px; padding-right: 7px;"><div style="margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Meaning</strong></span></div>
</td></tr>
<tr><td style="border-bottom-color: black; border-bottom-width: 0.5pt; border-left-color: black; border-left-width: 0.5pt; border-right-color: black; border-right-width: 0.5pt; border-style: none solid solid; padding-left: 7px; padding-right: 7px;"><div style="margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">search <pattern></span></div>
</td><td style="border-bottom-color: black; border-bottom-width: 0.5pt; border-right-color: black; border-right-width: 0.5pt; border-style: none solid solid none; padding-left: 7px; padding-right: 7px;"><div style="margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">Searches for a particular match of pattern given. For ex: “search abc” searches for all occurrences of “abc” in the results.</span></div>
</td></tr>
<tr><td style="border-bottom-color: black; border-bottom-width: 0.5pt; border-left-color: black; border-left-width: 0.5pt; border-right-color: black; border-right-width: 0.5pt; border-style: none solid solid; padding-left: 7px; padding-right: 7px;"><div style="margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">use <exploit name></span></div>
</td><td style="border-bottom-color: black; border-bottom-width: 0.5pt; border-right-color: black; border-right-width: 0.5pt; border-style: none solid solid none; padding-left: 7px; padding-right: 7px;"><div style="margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">This command tells the msf to use that particular exploit</span></div>
</td></tr>
<tr><td style="border-bottom-color: black; border-bottom-width: 0.5pt; border-left-color: black; border-left-width: 0.5pt; border-right-color: black; border-right-width: 0.5pt; border-style: none solid solid; padding-left: 7px; padding-right: 7px;"><div style="margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">show options</span></div>
</td><td style="border-bottom-color: black; border-bottom-width: 0.5pt; border-right-color: black; border-right-width: 0.5pt; border-style: none solid solid none; padding-left: 7px; padding-right: 7px;"><div style="margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">Allows us to view any fields that must be set up prior to carrying out an exploit.</span></div>
</td></tr>
<tr><td style="border-bottom-color: black; border-bottom-width: 0.5pt; border-left-color: black; border-left-width: 0.5pt; border-right-color: black; border-right-width: 0.5pt; border-style: none solid solid; padding-left: 7px; padding-right: 7px;"><div style="margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">SET parameter</span></div>
</td><td style="border-bottom-color: black; border-bottom-width: 0.5pt; border-right-color: black; border-right-width: 0.5pt; border-style: none solid solid none; padding-left: 7px; padding-right: 7px;"><div style="margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">Sets the value for a particular parameter.</span></div>
<div style="margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">Modifications: SETG sets that value to the parameter globally, which saves time and prevents us from having to re-set the parameter again and again.</span></div>
</td></tr>
<tr><td style="border-bottom-color: black; border-bottom-width: 0.5pt; border-left-color: black; border-left-width: 0.5pt; border-right-color: black; border-right-width: 0.5pt; border-style: none solid solid; padding-left: 7px; padding-right: 7px;"><div style="margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">exploit</span></div>
</td><td style="border-bottom-color: black; border-bottom-width: 0.5pt; border-right-color: black; border-right-width: 0.5pt; border-style: none solid solid none; padding-left: 7px; padding-right: 7px;"><div style="margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">Performs the attack on the target system</span></div>
</td></tr>
</tbody></table>
</div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<br /></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo1.png" height="441" src="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo1.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>The figure shows the output for all the commands mentioned.</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">In the above figure, we used the search command to look for a pattern like “netapi”. Once this pattern is located, we executed the “use” command. This command brought us to the local area of the exploit, and we executed the commands with respect to the exploit. Here, we followed with “show options command” to get the required values that need to be input using the “set” command.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">Here, we see that the RHOST ( emote host IP address) needs to be specified. Once we set the RHOST, we define the payload as shown in the following screenshot.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo2.png" height="442" src="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo2.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Setting up of a payload and listing of options for the particular payload</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">In the above screenshot, we observe that the RHOST is set and the payload is a Meterpreter shell. Meterpreter is a module of Metasploit that works on the principle of DLL injection. The bind_tcp module of the Meterpreter shell helps us get shell access to the system and we can run a huge list of Meterpreter commands, which we will explore further in this article.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo3.png" height="228" src="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo3.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>The Meterpreter shell opened for us to “own” the target.</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Vulnerability Information:</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">In this section, I would like to share the details regarding the vulnerability used to exploit the target Windows XP machine that had the most up-to-date service pack installed on it. The code for this vulnerability is ms08_067_netapi. This name indicates that the vulnerability was discovered in the year 2008, and that it is a Microsoft product (in this case a Windows product) in the netapi module. According to Microsoft, this vulnerability in the Windows XP, 2003 based systems, allows the attacker to run malicious codes over the RPC without any authentication. The attack is done on the TCP port 445, which is used for SMB over TCP connections. The above attack is performed assuming that the victim doesn’t have any firewall and any antivirus in his system.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>After the Exploitation – Stealing Windows Passwords and Decrypting Them!</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">What can we do after exploitation? This is the fundamental question asked every time after we compromise a system. Well, the answer depends on the creativity of the attacker. In this case, I would demonstrate the process for stealing credentials of the Windows login after the initial attack.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">Stealing login credentials is helpful in the privilege escalation phase when the attacker doesn’t have any privilege to carry out “important” post-exploitation steps. Thus, he would try to get all the information regarding the login credentials. This will also help the attacker to update his dictionary of passwords for later attacks. We use the command called “hashdump” to dump all the Windows login hashes into the text file. We have the following screenshot demonstrating the same:</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo4.png" height="280" src="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo4.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>The hashdump command.</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">Following this, we have lot of privilege escalation tools like hashcat, John the Ripper of the backtrack machine. In this article, I shall demonstrate John the Ripper tool for cracking these hashes.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<br /></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo5.png" height="217" src="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo5.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>John the Ripper crack’s the password.</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">In the above screenshot, the hashes are copied to the hash_text.txt file. Then we run the command as shown in the figure to obtain the cracked passwords. We see that these passwords were not salted and thus, easy to crack.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">With this short demonstration we have seen how we can escalate privileges on the victim machine. In this part, we have looked at a victim PC that had no firewall protection. In the following section, we’ll review how to attack a victim PC when the Windows firewall is switched ON and how to later kill the firewall entirely.<strong><br /></strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Attacking a Victim Behind Windows Firewall:</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo6.png" height="362" src="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo6.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">In the screenshot above, we can notice that, the windows firewall is turned ON. Now, let’s test the previously described attack method to see if we can bypass this firewall without any new steps.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo7.png" height="181" src="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo7.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>The connection timed out due to the presence of the firewall.</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">So, now we have seen that, it’s not possible to run a Meterpreter shell and exploit the target via a direct method since we have the firewall ON. We need to look for alternative ways.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Metasploit Auxiliary Modules!</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">Metasploit comes with a bundle of auxiliary modules that can be also be used to perform attacks and compromise a system. As you all know, there is no patch for human stupidity; we need to exploit the human mind and gain access to target systems by bypassing the firewall. Is it simple? Let’s see in the next section.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">I shall be using the module named as “browser_autopwn” to socially engineer the victim and make him click on the link that I provide him with. The success of this attack depends on a rigorous, information-gathering phase and also on the most creative social engineering methods. Creativity falls within the purview of the specific attacker, and he or she can use any methods to lure the victim to click on the link. Let’s see how this works:</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo8.png" height="371" src="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo8.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>This figure shows the options available in this module.</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">In the above screenshot, we see that, LHOST needs to be setup to be the attacker machine, as the listening server is launched on the attacker machine. The victim’s PC needs to be able to know where to connect back once the exploitation is complete. SRVHOST and other parameters can be set as default. Let’s set the SRVPORT to be 80 because 8080 port may raise the victim’s suspicion. We need to set URIPATH to “/” for the attack. After completing the settings, let’s see what actually happens with this module when we launch an exploit:</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo9.png" height="438" src="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo9.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Browser_autopwn in action.</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">On launching the exploit command, we see that the module has loaded 24 modules of exploits. Now, as expected, when the user clicks on the link, it launches a Meterpreter shell and opens a channel to connect to the victim.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo10.png" height="144" src="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo10.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Victim clicking on the link provided and is welcomed with a blank page.</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo11.png" height="184" src="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo11.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong><br /></strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>When the victim is welcomed by a blank screen, the channel is open for exploitation.</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">In the previous two screenshots, we see that, the victim lands on a blank page from the client side. But, in the server side (attacker machine) we see that a lot of activity is going on, and the module is detecting a suitable exploit to launch itself and open a Meterpreter shell. We also observe that, on launching the exploit, the browser closes at the victim site and the whole exploit self migrates to a new process and runs in the background.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo12.png" height="335" src="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo12.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Successful attack and Meterpreter opened.</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">In the above screenshot, we see the process migration and sessions to notepad. Additionally, we interact with the channel by mentioning the channel ID and using the attribute –i. We also observe the “getuid” command which allows our current privilege to be administrator privilege. As all of us are aware, the Windows super-user privilege is to the SYSTEM user.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">The cmd shell needs to be executed to know the type of firewall running on the target system. We use the “execute –f cmd.exe –c –H” command to execute a shell to interact with and channel it using the –c attribute. We also use the –H to hide it from prompting on the desktop of the victim.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo13.png" height="387" src="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo13.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Checking for the status of the firewall on the target system.</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">We run a command called as “netsh firewall show opmode” to view the status of the firewall. The above screenshot shows the same in action. Now, to disable the firewall remotely in the victim PC, we just need to run a command “netsh firewall set opmode mode=DISABLE”.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo14.png" height="430" src="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo14.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Firewall disabled in the victim PC remotely.</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo15.png" height="358" src="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo15.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong><br /></strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Cross verifying the settings using Backtrack machine.</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">In this section, we have seen that running netsh commands with appropriate attributes and performing client side attacks using Classical social engineering tactics can allow us to evade firewalls and bypass firewall security. In the above demonstration, we have seen all this in action.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Finally, Clearing Logs in the Victim PC:</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">As we all know, it’s not a good idea to leave our footprints after the exploitation process. Let’s just briefly see the simplest way to clear the footprints in the victim PC remotely using Meterpreter. By now, you all have learned that Meterpreter is very powerful tool, which comes with a few well-defined scripts in ruby to carry out processes for an attacker. Lets first look in to the event logs in the victim PC:</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo16.png" height="305" src="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo16.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>A quick look at the event logs of the victim PC.</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">As we see in the above screenshot, the victim PC is keeping track of three different of logs: application, security, and system. These logs note every event that happens on the computer. When someone goes through the logs, it is possible that the attacker’s tracks will be found here and traced back to the individual attacker. To avoid this, we clear all the event logs in one shot using the Meterpreter module. The command used is “clearev”. This command basically clears all the three logs, when specified without any attributes. Let’s see this in action:</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<img alt="" class="lazy " data-original="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo17.png" height="168" src="http://resources.infosecinstitute.com/wp-content/uploads/070912_1448_SystemExplo17.png" style="border-style: none; display: inline; height: auto; max-width: 100%; vertical-align: top;" width="640" /><span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><br /></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Wiping off records from logs.</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">As we see in the above screenshot, all the event logs are deleted by this command. We can now relax and maintain access to the system through techniques like backdooring, rootkits, etc. Metasploit is particularly useful for backdooring executables when you embed a malicious executable in the victim’s PC. Once you’ve embedded this executable, you can maintain access to the PC as long as the executable remains undistributed on the victim PC.</span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;"><strong>Conclusion:</strong></span></div>
<div style="background-color: white; color: #747474; font-family: 'PT Sans', Arial, Helvetica, sans-serif; font-size: 13px; line-height: 20px; margin-bottom: 20px;">
<span style="font-family: 'Bookman Old Style'; font-size: 12pt;">In this article we have seen various modules of Metasploit. We started off with basic exploitation of a target system without a firewall, and then gradually advanced to attacking a victim behind a firewall and evading it. Following this, we even reviewed how to kill a firewall remotely by spawning cmd shells stealthily. Finally, we saw how to clear traces in one shot using inbuilt Meterpreter functions. By now, it’s very clear that Metasploit is a very powerful tool when used with proper technique and proper analysis of the scenario. The usage of the tool has no limits as long as the attacker remains innovative in his use of social engineering and attack methodology. Experience and practice with the tool makes things a lot easier, so get your hands dirty with this amazing tool and play it safe.</span></div>
</div>

Exploitation with Metasploit

Metasploit is an exploit development framework that facilitates penetration testing of IT systems. This tool initially started off as a ga...

Social Media Security Threats

<div dir="ltr" style="text-align: left;" trbidi="on">
<h1 style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 29px; font-weight: 400; line-height: 33px; margin: 0px 0px 6px; outline: 0px; overflow: hidden; padding: 0px; text-rendering: optimizelegibility; vertical-align: baseline;">
<div style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; font-size: 14px; line-height: 22px; margin-bottom: 12px; margin-top: 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
<img alt="5 Threats To Your Security When Using Social Media" class="aligncenter size-full wp-image-51846" height="395" src="http://www.mediabistro.com/alltwitter/files/2013/11/security-locks.jpg" style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; display: block; height: auto; margin: 0px auto; max-width: 100%; outline: 0px; padding: 0px; vertical-align: baseline;" width="600" /></div>
<div style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; font-size: 14px; line-height: 22px; margin-bottom: 12px; margin-top: 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
Social networking has changed the way we interact with friends and associates. While social networks, like Facebook, Twitter, YouTube, FourSquare, and Google+, play a significant role in our lives, they are also a high risk for security threats.</div>
<div style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; font-size: 14px; line-height: 22px; margin-bottom: 12px; margin-top: 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
<span id="more-51841" style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"></span>With hundreds of millions of users online, these tools not only attract friends and family wanting to stay in touch, but they also attract people wanting to know about you for the wrong reasons. Be aware of the top five security threats currently out there to help you stay safe online.</div>
<div style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; font-size: 14px; line-height: 22px; margin-bottom: 12px; margin-top: 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
<b style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">1. Having Your Identity Stolen</b></div>
<div style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; font-size: 14px; line-height: 22px; margin-bottom: 12px; margin-top: 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
Identity thieves gather <a href="http://resources.infosecinstitute.com/social-media-security-risk/" style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; color: #0088cc; margin: 0px; outline: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;">personal information</a> from social media sites. Even if you have your account on the highest security settings, there are still ways for an identity thief to get your information. Most social network sites have information that is required, such as email address or birthday. It’s common for an identity thief to hack an email account by using social information. For example, a common technique to get personal information is by clicking on “forgot password” and trying to recover the information through email. Once the thief has access to your email account, they then have access to all information on your social networking sites.</div>
<div style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; font-size: 14px; line-height: 22px; margin-bottom: 12px; margin-top: 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
So what can you do to protect yourself? You don’t have to delete all your social profiles or hide from the real world; just take these precautions.</div>
<ul style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; font-size: 14px; line-height: 22px; list-style: square outside; margin: 0px 0px 0px 15px; outline: 0px; padding: 0px; vertical-align: baseline;">
<li style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><b style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Have a strong password</b>. The stronger your password, the harder it is to guess. Use special characters like symbols and capital letters when creating your password. Also, don’t use “common” passwords, like your birthday or your child’s name.</li>
<li style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><b style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Be careful with your status updates</b>. Often, we innocently post status updates that would give an identity thief information they need to steal our identity. For example, you may post “Happy birthday to my mother!” and then tag her in the post. Likely, your mother’s maiden name will be associated with that tag now. A popular security question is “What is your mother’s maiden name?” and if you share that online, you run the risks of identity thieves getting the answer to this commonly used question.</li>
<li style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><b style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Don’t reveal your location.</b> You can use a fake location or make one up from another city and state. You may even be able to leave this information blank. Be cautious and never use a city and state where you live.</li>
</ul>
<div style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; font-size: 14px; line-height: 22px; margin-bottom: 12px; margin-top: 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
<b style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">2. Getting Your Computer Or Social Profile Hacked</b></div>
<div style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; font-size: 14px; line-height: 22px; margin-bottom: 12px; margin-top: 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
Hackers love social networking, going right to the source to interject malicious code. The codes<a href="http://www.networkworld.com/news/2011/053111-social-media-security.html" style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; color: #0088cc; margin: 0px; outline: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;">hackers</a> use can steal your identity, inject viruses to your computer, and obstruct bank account information, to name a few. Shortened URLs, such as those created on bit.ly, are especially susceptible to hackers. Shortened URLs can trick users into visiting harmful sites where personal information can be compromised because the full URL is not seen.</div>
<div style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; font-size: 14px; line-height: 22px; margin-bottom: 12px; margin-top: 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
The best advice is to never click on a link until you are sure of the source. To tell if a link is safe, you can:</div>
<ul style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; font-size: 14px; line-height: 22px; list-style: square outside; margin: 0px 0px 0px 15px; outline: 0px; padding: 0px; vertical-align: baseline;">
<li style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><a href="http://www.pcworld.com/article/248963/how_to_tell_if_a_link_is_safe_without_clicking_on_it.html" style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; color: #0088cc; margin: 0px; outline: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;"><b style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Hover over the link</b></a><b style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">.</b> If you hover over a link without clicking, you’ll see the full URL in the lower corner of your browser. If this is a website you recognize, go ahead and click.</li>
<li style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><b style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Try a link scanner.</b> A link scanner is a website that lets you enter the URL of a link you suspect might be suspicious to check for safety. Try <a href="http://www.urlvoid.com/" style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; color: #0088cc; margin: 0px; outline: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;">URLVoid</a> or <a href="http://www.pcworld.com/article/231795/wot_web_of_trust.html" style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; color: #0088cc; margin: 0px; outline: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;">MyWOT</a> as possible options.</li>
<li style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><b style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Check shortened links.</b> A shortened link is popular on sites like Twitter where character length matters. Some shortened link sites include bit.ly, Ow.ly, and TinyURL. Use a service like <a href="http://sitecheck.sucuri.net/scanner/" style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; color: #0088cc; margin: 0px; outline: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;">Sucuri</a>to determine if the real link is secure.</li>
</ul>
<div style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; font-size: 14px; line-height: 22px; margin-bottom: 12px; margin-top: 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
<b style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">3. Inadvertently Letting Stalkers Find You</b></div>
<div style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; font-size: 14px; line-height: 22px; margin-bottom: 12px; margin-top: 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
When you use social networking sites, you are posting <a href="http://www.fbi.gov/about-us/investigate/counterintelligence/internet-social-networking-risks" style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; color: #0088cc; margin: 0px; outline: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;">personal information</a>. Once information is posted online, it’s no longer private and can fall into the wrong hands. The more you post, the more vulnerable you become to those who may wish to harm you. Even with the highest security settings, friends, associates, and even the brands you “like” on your networking sites, can inadvertently leak information about you. The websites you subscribe to, the apps you download, and the games you play on social networking sites all contain personal information about you. Every time you browse a website, companies can put invisible markers on your computer called cookies. In theory, no two cookies are alike. When you are online, these cookies track your activity as you move from site to site.</div>
<div style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; font-size: 14px; line-height: 22px; margin-bottom: 12px; margin-top: 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
To keep sites from tracking your activity, click on the “Do Not Track” feature. Most websites have an option for you to opt out of tracking. You can also clear the cache and cookies on your browser regularly to help prevent any problems.</div>
<div style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; font-size: 14px; line-height: 22px; margin-bottom: 12px; margin-top: 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
<b style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">4. Letting Burglars Know Your Whereabouts</b></div>
<div style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; font-size: 14px; line-height: 22px; margin-bottom: 12px; margin-top: 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
Telling the online world where you’re going and when you aren’t at home is inviting burglars to your house.  Did you know that a run-of-the-mill burglar can break into your home in less than 60 seconds and spend <a href="http://www.safewise.com/you-got-robbed" style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; color: #0088cc; margin: 0px; outline: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;">less than 10 minutes</a> stealing your possessions? By telling the world you are on <a href="http://daol.aol.com/articles/never-say-this-on-facebook-or-twitter/" style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; color: #0088cc; margin: 0px; outline: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;">vacation</a> in Europe, you’re letting potential thieves know where you are, how long you’ll be gone, and where you live. Burglars are fond of constant updates, especially about your travel plans. You wouldn’t stand up in the middle of a crowd and announce you’re going on vacation for a week, would you? Of course not, but that’s what you do when you post your vacation pictures and plans online.</div>
<div style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; font-size: 14px; line-height: 22px; margin-bottom: 12px; margin-top: 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
When you go on vacation:</div>
<ul style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; font-size: 14px; line-height: 22px; list-style: square outside; margin: 0px 0px 0px 15px; outline: 0px; padding: 0px; vertical-align: baseline;">
<li style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Avoid posting specific travel plans. Never post when, where, or how long you’ll be gone.</li>
<li style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Wait until you are home to post pictures to a vacation album.</li>
<li style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Use highest privacy control. Only let certain groups, like a family group, view your photos.</li>
<li style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Be selective with the status updates. You can use an audience-selector dropdown menu on Facebook to choose certain groups to see your status updates.</li>
<li style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Stay offline. You’re on vacation, after all. Relax and forget about the online world for a few days.</li>
</ul>
<div style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; font-size: 14px; line-height: 22px; margin-bottom: 12px; margin-top: 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
<b style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">5. Becoming Overconfident</b></div>
<div style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; font-size: 14px; line-height: 22px; margin-bottom: 12px; margin-top: 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
One of the biggest threats to online security is overconfidence. Whether at home or at work, many users believe as long as they have a firewall and an antivirus installed, there is no threat to security. Many people also believe that they don’t have anything worth hacking so there’s no need to worry about security. With today’s technology, we are more connected to each other than ever before. When you neglect security, you not only put yourself at risk, but others are at risk as well.</div>
<div style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; font-size: 14px; line-height: 22px; margin-bottom: 12px; margin-top: 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
To keep yourself and your information safe, pay careful attention to your online activity. Avoid posting information including:</div>
<ul style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; font-size: 14px; line-height: 22px; list-style: square outside; margin: 0px 0px 0px 15px; outline: 0px; padding: 0px; vertical-align: baseline;">
<li style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Travel plans (see point 4)</li>
<li style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Bank account information</li>
<li style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Your full address and birthdate</li>
<li style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Your children’s’ names, school, and birthdates</li>
<li style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Location information, such as the name of your work place</li>
<li style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Your daily schedule</li>
</ul>
<div style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: 0px; font-size: 14px; line-height: 22px; margin-bottom: 12px; margin-top: 12px; outline: 0px; padding: 0px; vertical-align: baseline;">
You can still use social networks for all they were meant to accomplish, but you need to take extra precautions to make sure your personal information doesn’t get in the wrong hands. Know what threats you are most vulnerable to and take steps to protect yourself and your networks.</div>
</h1>
</div>

Social Media Security Threats

Social networking has changed the way we interact with friends and associates. While social networks, like Facebook, Twitter, YouTube, ...

Searchbase

Translate

[Widget_title][combine][recent][5]

Security Tools for a Novice

BurpSuite Tutorial

Exploitation with Metasploit

Social Media Security Threats

Popular Posts

Comments

Blog Archive