Ethical Hacking

hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 51 today we are discussing about Routers, now while switches operate at layer two of the OSI model by making their decisions based on MAC addresses,routers operate at layer three, making their decisions based on IP addresses.Routers are used to connect two or more network to form an internetwork. Such as when you connect your small office home office router, your internal network,out to the internet.It connects your office's network out to other office's network over the internet.Now, routers are devices that make routing decisions and they do this by using IP addresses. These layer three IP addresses are used to determine what network a particular host is on and what path the traffic should take to go across the wide area network until it reaches its destination network.Once the traffic reaches the destination network or the final router that's involved, that particular router will conduct ARP broadcast to locate the correct host on its local network and pass the traffic to it using its MAC address at the layer two which is known as that physical address.In addition to this important routing function,routers also provide us with some security functions too, access control lists or ACLs can be configured on the router's interface to control the flow of traffic into or out of a certain part of the network.ACLs are an ordered set of rules that will either permit or deny traffic based upon certain characteristics,like it's source or destination IP address,the source or destination port number associated with it and the application or service being run.Now in an effort to get past these access control lists,attackers will often conduct IP spoofing. If they can spoof the IP, they can trick the access control list to think they're on the approved list and let them in or let them out.Since routers are on the external interface for a network, they're commonly a target for attack as well. And so out of the box, routers tend to be very insecure and you need to configure them properly for security.This includes changing this like your default username and password, changing the default routing tables,and changing those default IP internal addresses.To help protect our routers and our internal networks,we use a lot of other network devices and technologies,such as firewalls, intrusion prevention systems,virtual private network connections, content filters,and access control lists.By layering all these defenses, we create a better defense in depth posture.Now, we're going to cover all of these protective devices and technologies throughout this course but for now, it's sufficient to realize that using these things helps add up our security.And that helps us to secure our routers from various attack methods.

hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 50 today we are discussing about Switches.Now hubs were originally used to connect devices on a network.All of the devices will be connected to a hub,and anytime something went into one port of the hub,it would then repeat that out all of the other ports.This was known as a broadcast message.Now this is because hubs were dumb.They had no intelligence.As networks got larger,hubs caused a lot of collisions and slowed down the network.To solve this problem,something came along called a bridge,and this was used to separate physical LANs or WANs into two logical networks,or connect two logical networks together.Now switches are the evolution of hubs and bridges.Essentially every single port on a switch acts as if it was a bridged hub on each one.This means that it improves the data transfer and security through the intelligent use of MAC addresses.Being able to figure out where a device is and only sending the information out that particular port of the switch and ignoring the rest.This reduces traffic and increases security.Now switches are subject to three main types of attack though.They are subject to MAC flooding, MAC spoofing,and physical tampering.This is because they're trying to overcome that logic and intelligence that the switch has.MAC flooding is an attempt to overwhelm the limited switch memory that's set aside to store the MAC addresses for each port,and this is known as the content addressable memory,or CAM table.Now if a switch is flooded, it can fail-open and begin to start acting like a hub and broadcasting data out every single port.This is a problem that can start causing confidentiality to be breached inside your local network.Now MAC spoofing, on the other hand,occurs when an attacker masks their own MAC address to pretend that they are having the MAC address of some other machine on the network.For example, wireless access points may use MAC filtering to prevent devices that are unknown from joining the wireless network.They do this my looking at their MAC address that's being reported,and if it's not inside their access control list,they'll block it from connecting.Now if I switch my MAC address to a known or allowed device,I can gain access to that network though by spoofing.I pretend that I am an authorized device using a known good MAC address,and I pass right through that ACL.MAC spoofing is also sometimes combined with ARP spoofing.ARP is an address resolution protocol,and it relies on the MAC addresses as a way of combining what MAC address goes to which IP,and which IP goes to which MAC address.So they often combine a MAC address spoof with an ARP spoof as an attempt to be able to have the attacker appear that they are the destination that somebody is trying to send information to,and use that as a way to steal that information.Now to prevent this,you have to configure your switch to accept limited numbers of static MAC addresses,limit the duration of time that an ARP entry is allowed on a host,and conduct ARP inspections.To keep track of what ARP is being used with which MAC address and which IPs.The third type of way to overwhelm a switch is to use physical tampering.Physical tampering occurs when an attacker attempts to gain physical access to the switch,because if you can touch a device,you can pretty much configure it to do whatever you want.Now to prevent physical tampering,the switch should be locked up in a network rack, or a network closet,or behind closed doors so that, that room is secure using good physical security practices.

hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 49 today we are discussing about The OSI Model.The Open Systems Interconnection,or OSI Model is used to explain how network communications occur between a host and a remote device over a local area network or a LAN.Now the OSI Model is very useful to help use categorize different communication protocols that are used in networks,and gives us a common lexicon that we can use to use to describe the functions of different devices.you probably remember the pneumonic of Please Do Not Throw Sausage Pizza Away.This represents the seven layers of the OSI Model,going from the bottom to the top.This is: Physical, Data Link, Network, Transport,Session, Presentation, and Application.The first layer is the physical Layer.This is the layer that represents the actual network cables and radio waves that are used to carry data over a network.Data carried over the network at the Physical Layer is known as bits.And they can be electrical signal or radio wave.Examples of some of the things that operate at the Layer One or Physical Layer,are the things like our network cables whether they're fiber optic,or copper, or coaxial.It could be radio waves like Wi-Fi and Bluetooth.It can be a hub or repeater,which are dumb devices that simply take inputs in and then repeat them out the other side.Our second layer is the Data Link Layer.This is the layer that describes how a connection is established, maintained and transferred over that physical layer.Addressing here is done using physical addresses.Like MAC addresses.Now, at this layer the bits are going to be grouped into frames and then sent over the network.Examples of some things that operate at Layer Two or the Data Link Layer, includes things like MAC addresses,switches and bridges.Now, bridges are an earlier device that have later on evolved into switches.Switches use MAC addresses as their form of physical addressing.This allows a switch to decide where to send that frame of information based on the MAC address it's designed to go to.And so, it's smarter than a hub because it will decide where that particular frame goes as opposed to just repeating it out every single port that it has.Now, as we move up the ladder we get to the third layer which is the Network Layer.This is the layer where logical addressing is actually performed.And this includes things like routing and switching information between hosts, the network and the internetworks.At this layer, the frames are now taken and grouped up into packets, so bits became frames, frames become packets.Now, examples of this include things like the addresses which are IP addresses.This allows us to tell where a piece of information,where a packet is going to be sent over our network.We also use things like Layer Three switches,which in addition to using MAC addresses to decide where things go,they can use the IP addresses at Layer Three.And of course routers which are by far the most common Layer Three device,because they're used to connect all of our networks together around the world.Our fourth layer is the Transport Layer.This layer manages and ensures transmission of the packets occur from the host to the destination it wants.This uses either a TCP, known as a Connection Full Protocol or UDP which is a Connection Less Protocol.You might remember from Network+,TCP has that three way handshake,and it says, hey I'm ready to send you something,okay I'm ready to be sent something.All right, let's start sending it.And then they send the information.

hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 48 today we are discussing about In this episode, we're going to talk about some of the different devices that make up our networks and some of the different attacks that are used against them.But before we do that, we're going to cover quickly the basics of the networks by going through the OSI model.Now in this section of the course,we're going to do this as a quick review because you should have already learned the OSI model and the basics of networking or not, the information contained in that curriculum is really important to understand so you can better understand the security that we're talking about throughout this week.

hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 47 today we are discussing about SQL Injection.What is SQL?SQL, or Sequel, stands for the structured query language.And it's the way that a web application communicates to a database server to ask for information.Because this is the language used to communicate with the databases and  the databases hold lotsof valuable information,this has become a popular target for attacks.This brings us to the concept of an SQL Injection,which is an attack consisting of the insertion or injection of an SQL query via input data form that the client sends to the web application.SQL injections are just a specific typeof code injection though.A generalized injection attack is the insertion of additional information or code through data input from a client to an application.This code injection can occur using any type of code though.But the most common are SQL, HTML,XML, and LDAP injections.By far though, SQL injections are by far the most common.And so we're going to talk about that in this lesson as we go through.Just as SQL injections are used to insert SQL statements into a web application, these other types of code injection can also be used as an attack method, too.And so keep that in mind.Now before we start to discuss how an SQL injection works,it's important to know how a normal SQL query or request is performed.Let's pretend that you wanted to log into this website.First, you have to enter your username.So, I'm going to enter jason as mine and then you have to enter your password.So I'm going to enter my oh so super secure password of pass123 for this example.With both of those entered in, I go and click on the Login button,and the website will send my username and password to the database to verify if the username matches the password stored in the database.This is done by sending a SQL or structured query that says select any records from the user table in the database where the user_id = 'jason',and the password = 'pass123'.So, if the query finds a record in the table that has both the username of jason and the password of pass123,it's going to return the value of true to the web application.And the web application can perform whatever the next action it's supposed to do in.In this case, it logs me into the website and displays whatever the authenticated user homepage is.Now, if the username and password combination weren't foundin that database table called users,then it's going to return false,and the web application would give me some kindof a message saying please enter your password again.This is how it's supposed to work.But how does it work with an SQL injection?Let's try logging into this website again.But this time, I'm going to perform an SQL injection.So, we go back to the Login page,and I'm going to enter the username of jason once more.Then instead of entering my password,I'm going to enter the Escape character,which is a backward single quote mark,and the statement, `OR 1=1;.Now, this isn't my password, obviously.But instead, this is some code that I'm trying to inject into the SQL statement that the web application is going to send to the database when I click Login.So, let's click the Login button,and you can now see the full SQL statement that the web application has generated and sent to the database.Select any records from the user table in the database where the user_id = 'jason'.So far this is the same as our earlier legitimate login attempt. And where the password = '` OR 1=1 ;'.What is happening here?Well, this is showing us that the statement is now being sent to the database,but when it reaches that Escape character,that backward single quote,it's going to treat every thing after it as a command to process.

hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 46 today we are discussing about The next two exploits we're going to discuss are types of web application vulnerabilities.These are known as cross-site scripting and cross site request forgery. Cross-site scripting occurs when an attacker embeds malicious scripting commands into a trusted website.When this occurs the attacker's trying to gain elevated privileges, steal information from the victims cookies or gain other information stored by the victims web browser.During a cross-site scripting attack,the victim is the user, not the web server.The web server's already been compromised possibly.A cross-site scripting attack exploits the trust that exists between a user's web browser,and the web server that they're visiting.This often happens because the attacker's able to insert some malicious code into a web page that's being delivered from the server to the victim or client.There are three types ofcross-site scripting attacks:stored and persistent, reflected, and DOM-based attacks.A stored and persistent cross-site scripting attack attempts to get data  provide by the attackerto be saved on to the web server by the victim.Now in a reflected cross-site scripting attack, the attempt here is to have a non-persistent effect which is activated by the victim clicking on a link on that site.In a DOM-based attack, this is going to attempt to exploit the victim's web browser itself and it's often called a clientside cross-site scripting attack.This comes from the fact that the user's document object model or DOM is vulnerable to the attack.The DOM is part of the user's web browser.To prevent cross-site scripting attacks,programmers should use output encoding of their web applications, to prevent codes from being injected into them during delivery and they should also use proper input validation to prevent the ability for HTML tags to be inserted by users when they're entering information on a web form. As a user, you can help protect yourself from cross-site scripting attacks by increasing the security settings from your cookie storage and disabling scripting language when you're browsing the web.Just like we talked about back in the webbrowser configuration lesson of application security. Whereas cross-site scripting focuses on exploiting the trust between a user's web browser and a website. Cross-site request forgery instead exploits the trust that a website has in a user.In a cross-site request forgery,the attacker forces the user to execute actions on a web server that they already have been authenticated to.For example, let's say that you've already logged into your banks website and provided your username and your password.At this point you're already authenticated and the website trusts you.If an attacker can send a command to the web server through your authenticating session,they are forging the request to make it look like it came from you.The attacker in this case will be unable to see the web server's response to his request or commands but he could still use this to transport funds from the victim, change their password or do a myriad of other requests on the victims behalf. To prevent cross-site request forgery from being successful, programers should require specialized tokens on web pages that contain forms.Such as captions, utilize special authentication and encryption techniques, scan any XML file submitted by a user, and requiring cookies to be submitted twice for verification to ensure they both match and have the proper integrity.

hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 45 today we are discussing about The next type of exploit that were going to cover is called a buffer overflow.A buffer overflow occurs when a process in a program stores data outside the memory range allocated by the developer.Now, this begs the question, what exactly is a buffer?Well, a buffer is simply a temporary storage area that a program uses to store its data. Let's pretend that you have a glass sitting on a table.It can hold a certain amount of water, right?If it's designed to hold 16 ounces of liquid,but you pour 20 ounces in, well, the cup is going to overflow with water and the table is going to get wet.In this example, the glass is our buffer,and when we overflow it with our data, in our case water,the extra is going to spill out onto the table and make a huge mess.Buffer overflows in the IT world can also create a big mess for us.In fact, 85% of the data breaches were caused by a buffer overflow attack being used as the initial attack vector.So, let's take closer look at how a buffer overflow attack really works.Let's pretend you wanted to store my phone number into your contacts list.Here in the United States, our phone numbers consistof 10 digits.The first three digits are for our area code,which represents the city we live in.And the last seven digits represent the person's unique phone number.Before we had cell phones,you would simply pick up the phone and dial seven digits of your phone number because the telephone company assumed you wanted to place a local call within your own city or area code.So, let's pretend that the person who designed the contact list application on your phone decided they wanted to save some memory space and they wanted to use the smallest buffer possible,so they decided to use an eight-digit buffer because they are going to assume that you don't need to store an area code because you're going to make local calls.So, let's store my made-up phone number, 555-1234,into an eight-digit buffer called A.When I do this, you'll see that it takes up the first seven boxes labeled zero through six,because computers always start counting with zero,like you learned back in binary classes at happens, though, if we try to enter a number that's too long?Well, Buffer A isn't the only memory buffer that your contact list application can use.Right after Buffer A is Buffer B and then Buffer C and so on.So, let's consider how we store a longer phone number.For example, let's say you're out on vacation and you meet somebody but they don't live in your city.Well in this case, you need to store the area code and the phone number, like 410-555-1234.Since this now includes the area code for Annapolis, Maryland, we now have ten digits we need to store, but each buffer is only eight digits long because our programmer didn't quite think though all of the different types of phone numbers that one might need to store in their list.So, our contact list  application tries to storethis ten-digit number in an eight-digit buffer.But the last two digits overflow Buffer A and go into Buffer B.This is exactly what happens with a buffer overflow.Now, why is this a bad thing? Well, to explain that, we have to get a little bit technical, so bear with me. Each program reserves a chunk of system memory when it's run.This allows it to have a place to store data that it needs during processing.

hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 44 today we are discussing about Software vulnerabilities and exploits. Now that we've covered how software should be securely coded,let's cover a few of the exploits that are used against improperly coded programs.First, we have backdoors. Backdoors consist of software code that's been placed in a computer programs to bypass on normal authentication and other securing mechanisms. These are often created by developers themselves in order to make it easier for them to update custom programs in the future. But, this is a horrible practice in terms of security.All secure coding and program methodologies consider backdoors a poor coding practice and they state that it should never be utilized by programmers.Because of this, most developers have phased out the use of backdoors. But some backdoors can be created in our systems by attackers, too.For example, if a system is infected with a remote access Trojan,this is also considered a backdoor into that system.The next type of exploit that we hav is what's called a directory traversal,which is going to exploit insecurely coded web applications and servers.A directory traversal is a method of accessing unauthorized directories by moving through the directory structure on a remote server.Let's pretend, for example, that my website Diontraining.com was poorly coded and was subject to this type of an exploit. Of course, we've gone ahead and secured our website against this type of vulnerability, so this is just going to be a theoretical discussion to explain the context of a directory traversal. Normally, you could access our website by going to www.kicktraveller.weebly.com Or, you might access it by going to a dynamic sub-page like diontraining.com/menus,or something like that.If you wanted to attempt a directory traversal,you're going to have to add something to the directory path that has an input variable inside the URL.Something like menu=../../../../etc/password.This attempts to move up four levels through the directory structure from the web server's public folder into it's root folder and then back down into the etc folder and then attempts to access the password file.If this was successful, the text based password file would be displayed inside your web browser.anytime you see that there's a series of ../ in them,you know that this is most likely a directory traversal and it's being used as part of an exploit.Often, a directory traversal is used as a way to access a file on a web server and sometimes you can even use it to conduct an arbitrary code execution on that server.Arbitrary code execution occurs when an attackeris able to execute or run commands on a victim computer. This might occur if someonewalks by your desk at work,sees you're logged into the computer,but you're away from your desk.They start running a program on your computer.This would be classified as an arbitrary code execution.This is pretty bad for security, as you can imagine.But, what's even worst, is a specialized type of arbitrary code execution called an RCE or remote code execution.A remote code execution occurs when the attacker is able to execute or run commands on a remote computer.Notice the key difference here between an arbitrary and a remote code execution.With a remote code execution,the attacker can run the commands remotely;such as through an interactive shell session or some other kind of attack.

hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 43 today we are discussing about In this lesson we're going to focus on the different testing methods that you may use to help your organization's developers secure their code.Most security analysts are not programmers themself,so the Security+ exam isn't focused on the specific types of code reviews like pair programming, over the shoulder reviews,and others.Instead the episode focuses on just a handful of testing methods that an entry level security analyst might conduct.The first type of testing is known as system testing.This comes in three varieties:black-box testing, white-box testing, and gray-box testing.Black-box testing occurs when a tester is not given any information about the system or program before beginning their test.For example, if I create a program and I wanted you to conduct this type of a test,I might simply hand you a copy of the executable program on a disk and then it's up to you to figure out how it functions, how to bypass any security I may have coded into it,and if you can crash it by entering in incorrect information.Essentially you're going to be getting your testing without any sense of what the program does or how it functions.As a tester, you're essentially blind to start with and you discover your way around the program or system through your testing.White-box testing on the other hand is the exact opposite.In white-box testing, the tester is given the details of the inner workings of the program or system.This may even include access to the full source code of that program, diagrams of the system,user access credentials, logons, and more.The third type of testing is called gray-box testing.This is a mixture of black-box and white-box where the tester is given some amount of information about the system and conducts his testing as if he doesn't have full access to it.For example, a gray-box tester might be given user level credentials to test a system,but not given administrative credentials.If you're testing a network system,you may be given some information like the IP address of different devices,but you're not given the version of the software that's running on each device.As a part of these system tests,you're often attempting to break the system by attempting to stress that system or create an exception.It's important that programmers have coded their applications to fail securely,and to ensure this happens you're going to purposely create error conditions to cause an error to occur and see how the system is going to react to it.If the program is running when the error occurs, the error is known as a runtime error.If the program fails to run because of a coding error,this is known as a syntax error.This is because the most common cause of this type of error in programming is when a programmer doesn't put the proper syntax expected by that programming language,such as leaving out a closing parenthese or missing a semicolon inside their code.As a security analyst, you're much more likely to experience a runtime error than a syntax error you're testing these things on a live environment.Now,when you create an error, this is also known as an exception,you need to be able to have a way to handle this properly and gather the details of the error and what caused it.

hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 43 today we are discussing about As we move through the seven phases of the software development lifecycle,it's important for not to forget the fundamentals of good security.Our developers should always remember the three tenets of the CIA triad:confidentiality, integrity, and availability.Remember, confidentiality ensures that only authorized users can access the data being processed by an application.The most common of ensuring confidentiality is to include the use of encryption to maintain the secrecy of the data being stored.Integrity is focused on ensuring the data is not modified or altered without permission. The two main ways that we do this as developers is by utilizing hash algorithms as a method of integrity check for the data or by using journaling and logging functions to create audit trail showing the integrity of the data has not been comprised.When developers are attempting to ensure availability,they're focused on ensuring that the data is available to authorized users when it's needed.The most common way of doing this is by creating redundancy in the overall system design,by ensuring their software code is error-free,or by ensuring that their software can conduct error handling appropriately to prevent crashes.During the testing phase, it's important to conduct an in-depth code review to ensure that there are no vulnerabilities that might affect the confidentiality, integrity,or availability of the software or the integrated system.These code reviews are generally performed by programmers, not by security analysts though.On the other hand, security analysts do help during the software development lifecycle by conducting threat modeling.Threat modeling helps to prioritize vulnerability identification and patching throughout the SDLC.By helping to prioritize the threats,the security analysts can help with the identification of applications or systems that should receive additional protections,which threats are more likely to affect them,and which ones have known vulnerabilities that exist.Based on this, additional effort and funding can be applied in the most efficient way to fix the issues before an attack happens or an attacker can exploit them.After all, there are a lot of threats out there and a lot of ways to attack a system if you want to breach an area of the CIA triad.To best protect applications, we should ensure that good security is programmed in from the beginning back during the requirements,analysis, and implementation phases.Numerous studies have proven that it's much cheaper to utilize secure coding practices and to conduct more thorough testing before releasing a product than to try to fix insecure code after releasing the product,as well as trying to clean up from the mess of an attack.What secure coding practices should our programmers use during development?First, we should ensure that we design our applications with the concept of least privilege.Least privilege means that user or processes should be run using the least amount of access necessary to perform the given function.Does your application require administrative permissions to run?If so, why?Developers should always try to use the lowest permission level when they're performing a function.So whenever it's possible, the program should be run as a user level person instead of an administrator or root level one.