Ethical Hacking

Hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 59 today we're going to discuss about Honeypots and honeynets.Honeypots and honeynets are used to attract and trap potential attackers to counteract any attempts at unauthorized access to your organization's network.Now, a honeypot is generally a single computer,but it could also be a file, a group of files, or an area of unused IP address space that might be considered attractive to a would-be attacker.A honeynet, on the other hand,is one or more computers, servers,or an area of the network.And often, this is used when a single honeypot is not deemed to be sufficient for your purposes.Now, why would we use honeynets and honeypots in our network?Well, this is usually used as a form of research,to try to learn about attackers.For example, the Honeynet Project at honeynet.org is a well-known honeynet that's in use today.It's used to learn the tools, tactics,and motives involved in computer and network attacks.And then they share what they learned with all of the different organizations out there.Your organization likely isn't going to put up a honeypot on it's own, unless you're part of a security operation center for a large company who's trying to develop better countermeasures.For example, security researchers at companies like Microsoft, Google, and Apple might run a honeypot or a honeynet to try to better be prepared in the defense of their systems,and better understand the bad guys' techniques and tactics.But for most of us,honeypots and honeynets are just something we have to memorize.

Hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 58 today we're going to discuss Proxy Servers.A proxy server is a device that acts as a middle man for your clients.For example, if you're at work and you wanted to connect to ,your work computer's likely going to go from itself, to a proxy server within your company's LAN.And then, that proxy server makes the connection to Dion Training to get the information that you requested.And then it will hand it back to you.This middle man approach allows the company to log everything that's being requested,who made them, and to filter out things they don't want you to access.There are four types of proxies in use today.IP Proxy, Caching Proxy, Content Filter,and Web Security Gateways.An IP Proxy is used to secure a network by keeping machines behind it anonymous.When your work computer decides to connect to through the proxy in my example above,my server doesn't know which particular computer is actually connected to it from your company's network.All I see is the proxy server itself.This is because your proxy is using NAT to translate your request from your machine into a request from the proxy.If you had 20 different computers on there tryin' to access my web server,it would still just look like one machine to my server, not 20.The next type is called a Caching Proxy.Caching Proxies are used to attempt to serve client requests without actually connecting to the remote server each time.Let's say that you went to my website at diontraining.com,and then your coworker,five minutes later, tried to go to diontraining.com,just like you did.Well, the proxy, if it's using a cache,is going to be able to keep a copy of my webpage from the first time it fulfilled your request.Then, when your coworker requested it,it would simply give it from its cache instead of going and getting a new copy from my site.This will allow your company to save on bandwidth costs,and increase the speed of delivery for your coworker, because it already has it locally,inside your network.The most common caching proxy is known as an HTTP Proxy,which attempts to cache the web pages that are visited by users, such as the example I just gave you.Caching proxies are not as effective as they used to be, though,because we all live in a Web 2.0 world with lots of customized content being served up to us.So, for example, if you went to Facebook.com and your coworker went to Facebook.com,both of your Facebook feeds look drastically different, don't they?This is because you each get different information based on your friends and your likes and your desires.So caching here isn't very helpful because of this Web 2.0 structure.Also, most caching proxies only keep a copy of the information they get for about 24 hours.And after 24 hours, they're going to go back out and request a new copy to ensure that they get the latest information.Now, to simplify the installation and configuration of a caching proxy in your web browser,there's a special type of file called a PAC, a Proxy Auto-Configuration file.This file contains the settings needed for a host to connect to the proxy server.Unfortunately though,these files are subject to modification, and could be used to redirect the user to an attacker's control proxy instead of your organization's.For this reason, it is better to disable the PAC files, and manually configure your proxy settings on your host machines, or you can push these out using a global policy object, or GPO update.Now, the third type of proxy is called an Internet Content Filter.These are used in large organizations as a way to prevent users from getting to stuff that they don't want you to access at work..

Hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 58 today we're going to discuss Firewalls. Firewalls are primarily used to section off and protect one network from another.Now when we talk about firewalls, there's three main types.There's software-based, hardware-based,and embedded firewalls.Software-based firewalls are run as a piece of software on a host or a server.In fact, if you're running a Windows server,those have a built-in Windows Firewall that you can enable.Hardware firewalls, on the other hand,are a standalone device that's actually an appliance that's installed into your network.It looks like another switch or another router that goes into your network stack.The third type of firewall is known as an embedded firewall.Embedded firewalls work as a single function out of many on a single device.So if you have a small office home office router or a unified threat management device,these are examples of an embedded firewall.It's one piece of the larger device that does many different functions.Firewalls can operate in many different ways.The first one is packet filtering.Packet filtering is going to inspect each packet as it passes through the firewall, and it'll accept it or reject it based on the rules that it's been given.This relies on the firewall's configuration and the access control list that's been installed.If I'm running a web server, for example,I would configure my firewall to allow traffic inbound on port 80 and port 443 but close all of the other ports because port 80 gives web traffic,and port 443 gives secure web traffic,and so, those are expected to be used.There are two types of packet filtering,stateless and stateful.With stateless packet filtering,it's simply going to accept or reject packets based on the IP address and the port number that was requested.So if I'm running a web server and you requested to come in on port 80,I would allow that,but if you requested to come in on port 53,I would deny it because it's not in my access control list.Now a stateful packet filter, on the other hand,is going to keep track of requests that leave through the firewall.So if I make a request from a host through the firewall,it will temporarily open up a port number that I made the request from,some random high port number like 50,000 or 56,000.By using stateful packet inspection,you can almost entirely eliminate IP spoofing as a threat because the firewall is going to inspect the header of each packet being received.It's then going to compare that against what it was expecting based on the request that recently went out,and then, it's going to make its accept or reject decisions based on this addition information.This is a much more in-depth inspection than a stateless one does.Now, NAT filtering is another type of filtering we can do.This is going to filter traffic according to the port,whether it's a TCP or UDP port.This filtering can be done by simply checking the endpoint connections, by matching the incoming traffic to the requesting IP,and by matching the incoming traffic to the requesting IP address and port.Now, the next one we have is an application-layer gateway,or ALG.This is going to apply security mechanisms to specific applications such as FDP or Telnet.Now, instead of blocking traffic based on the Telnet port of port 23, instead, it's going to inspect each packet and determine which application it was meant for,and if it finds out that it was meant for Telnet,it would block it because that was unauthorized.This is a resource-intensive process,but it is a powerful layer of security that can be added on into your network.These are also known as Layer 7 firewalls because they operate at the application layer..Now, once that connection is established,the packets can then be sent or received without any further inspection or checks because all of that was done during the session establishment.

Hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 56 today we are discussing about Telephony devices.Telephony is a term that's used for a device that provides voice communication to your end users.Originally, telephony was used in networks to make connections with the outside world such us through your modem.So a modem was this old device that we used to use that would allow us to modulate and demodulate digital information into an analog signal that could transmit over a standard dial-up connection. So if you used AOL as a dial-up connection way back in the day,you would put your phone line into your computer,it would take your ones and zeros,convert them into signals of sound and transmit that over the phone line.Now, modems were a great attack vector though from the security perspective.And for the Security you need to know the concept of war dialing.War dialing is simply when an attacker starts dialing random phone numbers to see if any modems would answer on the other side. So a lot of servers back in those days will have dial-up modems so that remote technicians could dial into the server,gain access and make changes to due support.Well, if I was an attacker and I started dialing random numbers like 555-1234,nobody there.555-1235 and just keep adding numbers,eventually, I'll find some server that answers.And if they do, I now have a way into that network. So how do we protect modems in our systems for any dialog resources that we may have from this type of thing like war dialing?Well, one of the main things to do is use a callback feature.If you still have modems, which most of us don't in our networks anymore, but if you do,you want to make them set so that when somebody calls in,they would then hang up and the modem, if it recognize that phone number based on caller ID will then call them back and initiate the connection.This will verify that the person is who they think they are and who they say they are.Now, you always want to also use some form of authentication,like a username or password.But preferably, you want to use something more complex like two factor or multi-factor authentication.The best practice though is to do what most of us have done,and that's eliminate modems where possible and switch to remote access to using things like an SSH connection over VPN tunnels.Now, while it's great to try to eliminate all your modems,sometimes, you still have old systems and you simply can't do that.If you have to maintain a dial-up modem for some reason,you want to make sure you keep that dial-up number a secret.And so somebody's going to have to work hard to be able to find it and be able to get into your system.Again, if you have a dial-up modem,you want to use good authentication.You want to be able to use things that will help prevent it like callbacks and other things to help secure it,because these are prime targets for attackers.Now, the next type of telephony equipment I want to talk about is a PBX system. A PBX equipment is something you're going to find much more often in your networks than you are going to find modems.A PBX system stands for a Public Branch Exchange.Essentially, this is the telephone system that runs all of the internal phone lines for your company.If you're sitting in your office and you want to call your accountant inside the office and you dial the last four digits of his phone number only to get him, that internal call is being routed through your PBX system,through that public branch exchange.

Hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 56 today we are discussing about Network Address Translation Network Address Translation or NAT is the process of changing an IP address while it transits across a router.Now, in network plus we discussed how this was used because we wanted to conserve public IP addresses because they were limited in IPv4.In security plus though we are going to gain an additional benefit when we use NAT,we can actually hide our internal networks from attackers.Now, the most commonly used type of NAT is what we call Port Address Translation or PAT.This is where we have a single public IP address assigned to a router and all of the private IP addresses that are assigned inside to our host.In your small office, home office network,this is most likely what you are using.Now, when a host wants to communicate out over the WAN,it's going to send the request to the router and the router is then going to forward the request out to the internet to the server that its trying to get to,on behalf of the host.And when it does this, it keeps track of the translation it does by using a unique random high port number for each request. This means if the attacker is getting your network from the outside,they are only going to see that single public IP address of the router and they are not going to see the fact that you have one, five ten or 100 hosts inside of your network, and they are not going to be able to exactly know how many devices there are or what kind they are.So, for the Security plus exam,in addition to knowing about NAT and PAT,you should remember that there is public and private IP scopes.Now, when you start talking about private IP ranges,you should have learnt those back in A plus and Network plus.If you didn't, I'm going to give you a quick review.Class A is anything that starts with a 10, so 10.0.0.0 all the way up through 10.255.255.255 Now in class B, we have IP address that start with 172.16.0.0 all the way up through 172.31.0.0 Essentially anything that starts with a 172.16 all the way up through 172.31 Class C is really easy to remember as well,and its probably what you are using at home its 192.168.0.0 all the way up to 192.168.255.255 So if its starts with a 192.168,it is also a private IP address.Remember, private IP addresses cannot be transmitted over the internet So instead, once they hit your external router,it's going to use either PAT or NAT to give it a public IP address and a port number to send the information out to the internet and then receive it back.

Hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 55 today we are discussing about Subnetting.Subnetting is the act of creating subnetworks logically through the manipulation of IP addresses.So if I take a large chunk of IPs,like a 256 block, I can break it down into four blocks of 64 IPs,or eight blocks of 32 IPs, however you want to break it down in your subnetting,which you learned back in Network Plus.Now, subnetting has some benefits to our network. First, it allows us to more efficiently use the IP address space that we've been given,and it's going to reduce the broadcast traffic and the number of collisions,because there's less hosts on any given network.But it also can increase our security by making our networks more compartmentalized and allows them to be in smaller sections.Any time information wants to go from one subnet to another,it has to be routed through. And that gives us an additional place to place access control lists and other things to our router to give us additional security.Now, you can use subnets to help secure your network by doing a couple of different things.First, you want to assign different policies to each subnet.For example, I might have a subnet that's associated with my printers,and those have different policies than the ones associated with my servers,and those have different policies than the ones associated with my office workers' desktop computers. Each of those can have different policies for each subnet. Also, you want to be able to monitor all of your subnets and check the traffic that's going into and out of them.By using subnets, we can help isolate an attack, as well,because all traffic has to be routed before it can enter or exit a subnet.And therefore, if somebody breaks into say,the secretary's computer, they're going to be trapped in that subnet, unless they have permission to go into some of the other more secured subnets that we have out there.Each time it goes through a router again,it's going to be checked by the access control list, and that secretary's laptop may not have access to the database server, for example,which has more confidential and secured information.So they're going to be limited in what they can do once they've broken in.

Hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 54 today we are discussing about Switches can also provide the ability to create virtual local area networks.This adds a layer of separation to our networks without requiring us to buy additional switches that have to be configured and installed on the network.VLANs are implemented to segment our network,reduce collisions, organize our networks,boost performance and increase security.Unfortunately attackers have created VLAN hopping which allows them to break out of our VLANs and access other VLAN data though.There's a couple of mechanisms to do this. The first method is known as switch spoofing. In this attack, an attacker essentially configures their device to pretend that it's a switch and they connect to a switch port to negotiate a trunk link and break out of the VLAN. To prevent this, you can disable dynamic trunking protocol or DTP on all your switch ports,place all your unplugged ports into an unused VLAN,explicitly forward frames and avoid default VLAN names.The second method is what's known as double tagging.As traffic goes across a switch,it reads the outermost VLAN tag first,strips it off and then routes the trafficto the proper VLAN.In double tagging though,an attacker actually adds two VLAN tags,an outer tag and an inner tag,so as traffic goes through the first switch,it removes the outer tag and is then forwarded to the destination of the inner tag.You can prevent this by moving all the ports out of the default VLAN group.Double tagging can also be prevented by upgrading your switch's firmware,utilizing an unused VLAN as the default VLAN and redesigning the VLAN structures.

Hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 53 today we are discussing about Network Access Control Network Access Control or NAC is used to protect your network from both known and unknown devices.With NAC, a device is scanned to determine its current state of security prior to it being allowed access to your network.Now, NAC can be used for computers that are within your internal network that are physically located in your buildings and connected to it or it can be applied to devices that are connected into your network remotely through a VPN.When a device attempts to connect to the network,it's placed into a virtual holding area while it's being scanned.Now, the device here can be checked for a number of different factors,including its antivirus definitions to make sure they're up to date,the status of its security patching,and other items that might introduce security threats into the network if you allowed it to connect.Now, if a device passes this examination,it's allowed to enter and receive access to all of the organizational resources that are provided by your network.If the device fails the inspection, though,it's instead placed into a digital quarantine area.And it awaits remediation. While it's in this area, the device can receive its antivirus updates,it can get its operating system patches,and any other security configurations and services it needs. But it can't logically communicate with other portions of the network.That's why it's been placed in quarantine.Like a bad child, the device has been placed in time out until it can be rehabilitated and meet the requirements of the initial NAC examination.Once it successfully meets those requirements,it's then moved into the network and receives full access, again,to your organizational resources.Now, NAC's solutions can be run either using Persistent or Non-Persistent Agents.Persistent Agents are a piece of software that's installed on a device that's requesting access to the network.This works well in a corporate environment because the organization owns all the devices and controls their software baselines,but it doesn't work really well if you're using an environment where people bring their own devices.Instead, you might want to use a Non-Persistent Agent for this.A Non-Persistent Agent solution was developed and is very popular in college campuses where people bring their own devices in.These solutions require the users to connect to the network, usually over wifi,and then they go to a web-based portal for log in,and they have to click a link.When they click that link, the link then downloads an Agent onto their computer, scans the device for compliance,and deletes itself from the user machine once it's done.Network Access Control can be offered as a hardware or a software solution.One of the most commonly used Network Access Control mechanisms is called the IEEE Standard 802.1x and it's used in port-based Network Access Control.Now, most NAC is actually built on top of this 802.1x standard.We're going to discuss the 802.1x standard in more detail in a future lesson, though.

hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 52 today we are discussing about Network Zones When considering the architecture of your internal network,it's important to consider breaking your network up into multiple security zones.These can be further broken up into sub-zones through the use of subnetting,ACLs, firewall rules,and other isolation methods that will help us prevent or shape the flow of data between thedifferent portions of our network.Most networks are segmented into at least three different zones:the LAN, the WAN, and the DMZ.LANs can be secured using private IPs,using anti-malware programs,and by placing your clients behind a router and its associated ACLs.WAN connections, on the other hand,should be monitored and firewalled to secure your networks against the threats of those contained.The Internet is the world's largest WAN.And traffic crossing across the Internet should be tunneled through a virtual private network when you want to keep it safe from prying eyes.This will increase your confidentiality.In fact, the TLS tunnels that are used inHTTPS connections are a type of VPN.So any time you're going to a website and you see that secure lock,there's actually a VPN being used between your web browser and the web server you're visiting.In addition to our LAN and our WAN,the most most common security zone that we use is what's known a DMZ, or a De-Militarized Zone.This zone is focused on providing controlled access to publicly-available servers that are hosted within your organizational network.For example, if you're self-hosting your web serverand email servers inside your organization,it's a best practice to place them within your DMZ,and this is a tightly controlled zone with proper access control rules.This allows you to maintain precise control of the traffic that's going to be allowed between the inside, your LAN; the outside, the WAN,and the DMZ portions of the network.To create a DMZ, multiple interfaces are used on your organization's firewall. You'll have a strict set of access control list rules that are going to be applied to those interfaces,and a public IP address is required for each server hosted within your DMZ.The purpose of creating security zones like a DMZ is to create this separation of critical assets.Not all devices in your network require the same level of protection.Some resources, such as file servers,are going to contain confidential information,like employee data, and this is going to require additional security being placed there.Instead of protecting every device to the same high level,we can create sub-zones inside of our networks based on the level of protection required.In addition to these internal sub-zones,there may be also be additional external zones that you need to create, such as an Extranet.Now, an Extranet is a specialized type of DMZ that's created for your partner organizations to access over a wide area network.It acts much like a DMZ, but it's not publicly accessible.This Extranet is also placed under additional network monitoring and scrutiny.For example, I access an Extranet every time I need to go to Excelous to order exam vouchers for my students in my ITIL and Prince2 courses.It's a part of their network that only their externalpartners, training partners like us,can have access to, and not the general public.Conversely, on the other side,we have what's known as an Intranet.An Intranet is something that allows you to expand your internal network within your organization across multiple areas.This is usually done using VPN tunnels.So for example here, I have a couple of employees who work on the other side of the world.If they need to get access to our file servers, they can do that by logging in to our Intranet and get access to it through that secure connection.