Ethical Hacking

Hello everyone my name is vijay kumar Devireddy and I am glad to have you back on my episode 79 today we're going to discuss about In the last lesson, we talked about the concept of DNS poisoning.In this lesson, I want to cover the concept of ARP poisoning with you fairly quickly.Now ARP stands for the address resolution protocol,like you learned back in Network Plus,and it's used to convert an IP address into a MAC address.If you remember back from Network Plus and our OSI model lesson,as data moves down the OSI stack, it uses IP addresses to transmit packets all over the world from router to router.But once it finds the right router,that router converts that IP address into a MAC address and passes it on to the switches inside of its own network,and that is going to help it to deliver the information using frames inside the data link layer.Now ARP poisoning is going to exploit the way that an ethernet network works.It's going to enable an attacker to steal,modify, or redirect frames of information on the network.The concept here is that the attacker's going to associate their MAC address with the IP address of another device within the network.This way, whenever the router asks for the MAC address that's associated with that IP,they get the attacker's MAC address instead of the legitimate user's.This allows the attacker to essentially take over any session that would involve MAC addresses at the layer two of the OSI model.Also, if the attacker wanted to get really creative here,they could set up a man in the middle using this technique by taking over the MAC address first,then passing the data back and forth between the victim and the rest of the network.To prevent ARP poisoning,you should set up good VLAN segmentation within your network,and also set up DHCP snooping to ensure that IP addresses aren't being stolen and taken over by an attacker.

Hello everyone my name is vijay kumar Devireddy and I am glad to have you back on my episode 78 today we're going to discuss about DNS attacks.There are four different DNS attacks that you have to know for the security.There're DNS poisoning, unauthorized zone transfers,altered hosts files, and domain name kiting.Now, DNS poisoning occurs when the name resolution information is modified in the DNS server's cache.This modification of the data is done to redirect client computers to fraudulent or incorrect websites usually as part of follow-on attacks.The DNS system was designed without a lot of security embedded into it originally.This open architecture assumed a level of trust with all the other servers which I already told you is a pretty bad idea,but that has been taken advantage of by malicious attackers because trusting is a bad idea.Now, DNS poisoning usually occurs on a company's internal DNS servers instead of on public-facing DNS servers around the internet.With this type of attack, the internal client on the network has to make a request to go to a website like diontraining.com and whenever they make that request the client first checks with their local network's primary DNS server to see if it knows the IP address for that URL.If someone has gone there recently that IP address is already going to be stored in the local cache but if the cache was poisoned that user's now going to be redirected to a malicious website instead of the desired one.To counter act DNS poisoning, secure DNS also know as DNSSEC, has been created.DNSSEC uses encrypted digital signatures when passing DNS information between servers to help protect it from poisoning.You can also prevent your DNS servers from being poisoned by insuring that you're running the latest patches and the latest updates to make sure it's protected.Our next type of DNS attack is called an unauthorized zone transfer.DNS servers are normally configured to provide DNS data to a zone transfer which replicates information to other servers. With an unauthorized transfer though an attacker requests a copy of that zone transfer information and if they receive it they now have a list of all of your server names and IP addresses and this helps them plan for future attacks.Because of this, zone transfers should always be restricted between two known and trusted servers only and not let other people ask for zone transfers. The third type of DNS attack is focused on the client itself. Every computer and workstation has a file on it called the host file.The host file is a plain text file and it contains IP addresses and names.This is a reference that the operating system is going to check every time a DNS lookup is requested prior to going to a DNS server.So if the host file has a domain name being requested,it's simply going to provide the host file version of that DNS information instead of going out to a DNS server requesting it.So for example, one day my son was not doing his school work and it was really upsetting me.Instead I kept going up there and seeing he was watching YouTube.So, I logged into his computer and I added the URL for YouTube into his host list and I pointed that to the IP address for his school's website. Now, anytime my son typed in youtube.com instead of getting the DNS lookup for YouTube and getting redirected to their server he instead got the one from the host file that I maliciously put in there and it served up the home page for his school.Now, every time he tried to watch a video he was told hey you got to go to school, right? I think this is pretty funny and you may think it's funny too but he was not very happy about this change and he couldn't for the life of him figure out why YouTube wouldn't come up on his laptop.

Hello everyone my name is vijay kumar Devireddy and I am glad to have you back on my episode 77 today we're going to discuss about Transitive attacks.Transitive attacks aren't really an actual type of attack but more of a conceptual method.It gets its name from the Transitive Property we learned back in mathematics.Essentially, the Transitive Property says that if A equals B and B equals C,then by all logic, A also equals C.Now, when it comes to Security ,and they talk about the idea of a transitive attack,they're really focusing on the idea of trust.If one network trusts a second network and that second network trusts a third network, then that first network really trusts the third network, and so, if an attacker can get into any one of those three networks,he can then get into the other two as well.This is based on that transitive trust.This is really important in the world of security because whoever you trust,you're also trusting everyone else that they've ever trusted. Whenever you connect your network to somebody else's network using a trust relationship, you're inherently assuming all of the risk of their security posture or the lack of their security posture in addition to your own security posture.Now, often in large enterprise networks, we reuse trust relationships between different domain controllers because this helps us minimize the amount of times that someone has to authenticate over and over for a resource,but, remember, whenever you sacrifice security in order to afford yourself better or quicker operations,there is a risk associated with it.So if your organization wishes to maintain a strong security posture,your systems should not assume trust but instead, should question and re-question every device and network that it wishes to connect to.

Hello everyone my name is vijay kumar Devireddy and I am glad to have you back on my episode 76 today we're going to discuss about Replay attacks.A replay attack is a network-based attack where valid data transmissions are fraudulently or maliciously re-broadcast,repeated or delayed.This works a lot like a session hijack but it's a little bit different.With a session hijack,the attacker is trying to modify the information being sent and received at real time but with a replay attack,we're simply trying to intercept it,analyze it and decid whether or not to let it be passed on later again.Now, for example, if I were able to capture the session that occurs when you went in to log into your bank with your username and password,I could then replay that session to the bank later on in an attempt to log in as you.That's the idea of a replay attack.Now, to combat a replay attack,you should ensure that websites and devices are using session tokens to uniquely identify when an authentication session is occurring.Also, if you use multi-factor authentication,this can help prevent the ability of a log on session to be replayed because it doesn't have that token that has that random data that's changed every 30 to 60 seconds if you're using something like a one-time use password as part of your multi-factor authentication.One place where replay attacks have been used quite successfully though is in the world of wireless authentication.By capturing a device's handshake onto the wireless network,you can replay it later to gain access to that network yourself as if you were them.This is extremely common in the older protocols,especially the wired equivalent privacy or WEP when using a wireless network. So, you should be using the latest protocols like WPA2 to help prevent and minimize your risk.

Hello everyone my name is vijay kumar Devireddy and I am glad to have you back on my episode 75 today we're going to discuss about Hijacking, next we have hijacking which is the exploitation of a computer session in an attempt to gain unauthorized access to data,services, or other resources on a computer or server.There are eight types of session hijacking that can be performed.Session theft, TCP/IP hijacking, blind hijacking,clickjacking, Man-in-the-Middle,Man-in-the-Browser, the watering hole attack and cross-site-scripting attacks.The first type of hijacking is known as session theft.With session theft the attacker is going to guess the session ID for a web session and that enables them to takeover the already authorized and established session of that client.Each session is uniquely identified with a random string but if the attacker can determine or guess that string they can take over the authenticated session with the server.And this example, you can see this is occurring at the session layer of the OSI model but it can also occur at the network or transport layer too.Now when it does it's called TCP/IP hijacking.Because it occurs when an attacker takes over a TCP session between two computers without the need of a cookie or other host access.Because TCP sessions only authenticate during the initial three-way handshake the attacker can jump into the session at any time they want if they can guess the next number in the packet sequence.This can also be used to create a denial of service attack against the initial host that way they can take it over and not let that person jump back into the session.Now, the next type of hijacking is called blind hijacking because it occurs when the attacker blindly injects data into a communication stream and won't be able to see the results whether they're successful or not.Clickjacking is our next type.This attack uses multiple transparent layers to trick a user into clicking on a button or link on a page when they were intending to click on something else.Basically the hyperlink to the malicious content is hidden under some legitimate clickable content.So you think you're clicking on an image and you're actually clicking on some link that takes you elsewhere.Now a Man-in-the-Middle attack is probably the attack you've heard most before.This is also one that is commonly used in session hijacking.A Man-in-the-Middle attack causes data to flow through the attacker's computer where it can then be intercepted or manipulated as it passes through.This is considered an active type of interception.So let's pretend that you've got some kind of malware on your computer and now all of your traffic is going to route through this attacker's machine. Well, if you wanted to transfer $50 from your bank account to your friend's but the attacker changes the amount and the destination of the account you may now be sending $5000 to the attacker instead of the $50 to your friend.This is the idea of a Man-in-the-Middle.Since the attacker is sitting right in the middle of that connection they can see and manipulate any data as it's being sent back and forth.Now a Man-in-the-Browser is very similar to the Man-in-the-Middle except it's limited to your browser's web communication instead of looking at the entire communication.This can occur because you have a Trojan that's infected your vulnerable web browser and it modifies web pages or transactions that are being done within that browser.To prevent this you should insure you have a good anti-malware solution installed and you have the latest security updates for your web browser because this will pretty much eliminate the Man-in-the-Browser attack.Next you have a watering hole.And a watering hole is something that we described all the way back in the beginning of this course.It occurs when malware is laced on a website that the attacker knows his potential victims are going to access.

Hello everyone my name is vijay kumar Devireddy and I am glad to have you back on my episode 74 today we're going to discuss about Spoofing, spoofing is a category of network attacks that occur when an attacker masquerades as another person by falsifying their identity.Just like a person uses a mask to cover up their face to hide their true identity,spoofing is the electronic equivalent.We have briefly discussed spoofing a few times already,such as in the case of the DNS amplification attack when attempting a distributed denial of service by spoofing the IP address of the victim's server when making that request.Or we've talked about it before when we talked about fishing,where an attacker is trying to get you to click on a link in an email by falsifying their identity to trick you into clicking that link thinking that it's trusted.Anything that identifies a user or system can be spoofed, though.For example, each network interface card has a unique MAC address that's assigned to it,but MAC spoofing allows the attacker to change their MAC address to pretend that they're using a different device.IP addresses are also commonly used to identify a system, but with IP spoofing, the attacker can use somebody else's IP address as part of their attacks.So, how do we prevent spoofing from being effectively used against our systems?Well, the best way is to proper authentication,preferably multi-factor.Now when you use proper authentication,you're going to be able to identify a system or user more accurately and prevent the spoofing.If you can do this,you're going to be able to detect and stop spoofing quite easily.

Hello everyone my name is vijay kumar Devireddy and I am glad to have you back on my episode 73 today we're going to discuss about We talked about a denial of service attack involving the continual flooding of a victim system with a request for services that causes a system to crash and run out of memory.Now, this usually happens when you're talking about one system attacking one system.But that wasn't enough with modern computers,so we moved up to the distributed denial of service attack,where hundreds or thousands of people target a single server to take it down.Now, in March of 2018, the website GitHub was actually hit by the largest DDoS that we've clocked to date.This is where tens of thousands of unique endpoints conducted a coordinated attack to hit that server with a spike in traffic,and the spike in traffic went up to 1.35 terabits per second.This took the website offline for all of five minutes.So you can see how these DDoSes are really hard on a server and can take them down,but not for very long if you can stop 'em.So your real question probably is,how can you survive one of these attacks?And how can you prevent it from taking down your organization's servers? Well, we have a couple of techniques.The first one is called blackholing or sinkholing.This technique identifies attacking IP addresses and routes all of their trafficto a non-existent server through a null interface.This effectively will stop the attack.Unfortunately, the attackers can move to a new IP and restart the attack all over again,and so this is only a temporary solution.Intrusion prevention systems can also be used to identify and respond to denial of service attacks.This can work for small scale attacks against your network,but you're not going to have enough processing power to handle a large scale attack or a big DDoS.Now, one of the most effective methods to utilize is to have an elastic cloud infrastructure.If you've built your infrastructure so that it can scale up when demand increases,you can ride out a DDoS attack.Now, the problem with this strategy, though,is that most service providers are going to charge you based on the capacity and resources that you used, so when you scale up,you're going to get a much larger bill from that service provider than you normally were expecting.And you're not getting a return on this investment,because this traffic was all wasted.It wasn't generating any revenue for you.So there's actually some specialized cloud providers out there that have taken on this challenge.People like Cloudflare and Akamai are designed to help you ride out these DDoS attacks.They provide web application filtering and content distribution on behalf of your organization. These service providers are focused on ensuring that you have highly robust, highly available networks that can ensure that they can ride out these DDoS attacks and these high bandwidth attacks.This is going to also give you additional layer defenses throughout your OSI model, and it's going to help provide you additional protections.

Hello everyone my name is vijay kumar Devireddy and I am glad to have you back on my episode 72 today we're going to discuss about In the last lesson we discussed the concept of a denial of service attack,and we went over all of the different types of them, but most modern systems can't be taken down by a single machine attempting a denial of service anymore,so attackers got smarter and they created a distributed denial of service, or DDoS.Now a distributed denial of service attack,instead of using a single attack targeting one server they use hundreds or even thousands of machines to launch an attack simultaneously against a single server,and force it offline to create that denial of service condition.Usually these machines that conduct the attack don't even realize that they're a part of it though.Generally these machines have become zombies or bots inside a large bot net and then when they receive that command to attack,they all simultaneously send all their payloadsagainst a single victim.Now, in addition to most basic forms of DDoS attacks,there is one specific type of DDoS attack called a DNS amplification attack that could be performed.This specialized DDoS allows an attacker to generate a high volume of packets that's intended to flood a victim's website by initiating DNS requests from a spoof version of the target's IP address.This causes the DNS servers to respond to that request and send the response back to the server thinking that it's valid, because a DNS request uses very little bandwidth to send,but the response usually takes up a lot more bandwidth,this allows the attack to be amplified against the victim's server.Also if this is happening because thousands of simultaneous requests are being made by a bunch of zombies and a bot net on behalf of your victim's server,you can easily become overwhelmed with a lot of information and eat up lots of bandwidth pretty quickly causing that denial of service condition to occur.

Hello everyone my name is vijay kumar Devireddy and I am glad to have you back on my episode 71 today we're going to discuss about we're going to focus on the concept of a Denial of Service attack.Now, a Denial of Service attack isn't a specific attack in and of itself,but instead is this category or type of attack that's carried out in a number of different ways.Essentially, the term Denial of Service is used to describe any attack which attempts to make a computer or service resources unavailable,but it can also be extended to network devices,like switches and routers as well.There are five subcategories of Denial of Service attacks,Flooding Attacks, the Ping of Death, the Teardrop,the Permanent Denial of Service attack, and the Fork Bomb.The first category is called a Flood Attack.This is a specialized type of Denial of Service which attempts to send more packets to a single server or host than it can handle.So, in this example,we see an attacker sending 12 requests at a time to a server.Now, normally a server wouldn't be overloaded with just 12 requests,but if I could send 12 hundred or 12,000 that might allow me to flood that server and take it down.Now, under a Flood Attack we have a few different specialized varieties that you're going to come across The first is called a Ping Flood,this attack is going to happen when somebody attempts to flood your server by sending too many pings.Now a ping is technically an ICMP echo request packet,but they like to call it a ping Because a Ping Flood has become so commonplace though,many organizations are now simply blocking echo replies,and simply having the firewall dropping these requests whenever they're received.This results in the attacker simply getting a request timed out message,and the service remains online,and the Denial of Service is stopped.Next we have a Smurf Attack.This is like a Ping Flood,but instead of trying to flood a server by sending out pings directly to it,the attacker instead tries to amplify this attack by sending a ping to a subnet broadcast address instead,using the spoofed IP of the target server.This causes all of the devices on that subnet to reply back to the victimized server with those ICMP echo replies,and it's going to eat up a lot of bandwidth,and processing power.Now, you can see how this looks here,with the attacker sending the ping request with the IP of that server being spoofed into the request,and now the destination is sent to the broadcast of that subnet.In this example, all three PCs in the subnet are going to reply back to that ping request thinking it's from the server,and the server gets three times the amount of ping replies than if the attacker had sent it to them directly.Now, this allows that attack to be amplified,especially if the attacker can get a large subnet,like a /16 or a /8 used in this attack.The next kind of Flood Attack is what we call Fraggle.Fraggle is a throwback reference to the kids show Fraggle Rock from the 1980s,which aired around the same time as the Smurf TV show.So you can guess that Fraggle and Smurf are kind of related.Well with Fraggle, instead of using an ICP echo reply,Fraggle uses a UDP echo instead.This traffic is directed to the UDP port of seven,which is the echo port for UDP, and the UDP port of 19,which is the character generation port.This is an older attack,and most networks don't have this vulnerability anymore,and both of these ports are usually closed,'cause again, they're unnecessary.Notice that I didn't have them in your port memorization chart either.Now, because of this,Fraggle attacks are considered very uncommon today.That said, a UDP Flood Attack,which is a variant of Fraggle,is still heavily used these days.It works basically the same way as a Fraggle attack,but it uses different UDP ports.

Hello everyone my name is vijay kumar Devireddy and I am glad to have you back on my episode 70 today we're going to discuss about Unnecessary ports.As we've already discussed,there are a lot of ports available for use by your computers and your networks.We started out with 65,536 ports available back in our ports and protocol lesson.Then, we narrowed it down to 35 port that you just had to memorize in the last lesson.But does that mean that all 35 of those are necessary for your computer to function? Well, the answer is no.When it comes down to it,you aren't using all of those services,at least not all of the time.Also, if you're running a server,you wouldn't want to have all 35 of those ports open either.Why?Because many of them are unnecessary.Now, that begs the question, what makes a port unnecessary? Well, an unnecessary port is simply one that's associated with a service or a function that you don't need or is considered non-essential.For example, if you have a server whose entire function is to act as a mail relay server,all it's designed to do is send mail out,then the only thing it needs is a couple of ports open.It needs port 25 for SMTP and port 465 or 587 for SMTP over SSL and TLS.Now, every other port on that server can be shut or disabled or closed and you wouldn't care,because only those three ports are the ones you need.Remember, every open port represents an unnecessary vulnerability being left exposed if you didn't need to have that port open.So you want to close anything you're not using.Because of this, security professionals and analysts routinely scan their servers,their routers, and their firewalls to ensure that they understand exactly what ports are open in their networks and which ones they can disable or close.For example, this is a result from one of my scans and you can see there's three hosts that have ports 139 and 445 open in the network.Now, thinking back to our last lesson where you memorized all the ports,can you guess which services these machines might be running?Well, port 139 is used for net bios and port 445 is used for SMB.This means these three machines are most likely running the Windows operating system and they have file sharing enabled over the local network.Now, if these machines don't need to have file sharing enabled over the local network,we can disable these ports and remove the possible vulnerabilities that are inherent within the Windows file-sharing system.To close an unnecessary port,there are three methods you can use.First, you can stop the service that uses that port from the operating system's graphical user interface.To do that in Windows, simply open up the computer management console,select Services and Applications,and then select Services.From here, you double-click on the particular service that you want to turn off,and it's going to open up a dialog box as shown here.Now, in this example, I've stopped the Windows update service in Windows 10 from running,which will also prevent any associated open ports from remaining open because of this service running.The second method is to do this from the command line interface.As I showed you back in our operating system hardening lessons,you can turn off a service by using the net stop command and the name of the service.On a Linux server, you can do this by entering sudo stop and the name of the service at the command line.Now, the third way to do this is to block the ports at your firewall,whether this is a software or hardware-based firewall,or on the server itself.Now, usually, a firewall's going to block ports by default,and it requires you to open the port when you want to install a particular service or function.Now, for example, let's say you installed the Apache web server at one point,and this opened up port 80 on your firewall.