Cybersecurity – Page 3 – CY – Technical Memory extension

CEH Module2 – Footprinting and Recon

Footprinting is the first step of any attack on information systems in which an attacker collects information about a target network to identify various ways to intrude into the system.

Passive	Active
without direct interaction	with direct interaction

Information Obtained in Footprinting

Organization Information	Network Information	System Information
– Employee details – phone numbers – location details – organization background – web technologies – News articles, press release etc	– domain, sub-domain – network blocks – topology, trusted routers, firewall – IP addresses of reachable systems – whois – DNS	– Webserver OS – location of webserver – publicly available email usernames and passwords
– The information is available on its website. – query whois database to get information	– whois database analysis – trace routing	– network – DNS – website and emails footprinting

Footprinting techniques

Footprinting through Search Engines
– Advanced Google hacking techniques

– Google hacking database and google advanced search
https://www.exploit-db.com – The Exploit Database is a Common Vulnerabilities and Exposures (CVE) compliant archive of public exploits and corresponding vulnerable software, developed for use by penetration testers and vulnerability researchers.

– Video, Meta, FTP and IoT search engines

Techniques	Tools
Google advanced search	– Google advanced search
Advanced image search	– Google advanced image search
Reverse image search	– Google image search – TinEye reverse image search – Yahoo image search
Video Search engines	– Youtube metadata – Youtube dataviewer
Meta search engine	– Startpage – MetaGer
FTP search engine	– NAPALM FTP indexer – FreewebFTP files search
IoT search engine	– Shodan.io – Censys – Thingful (pay)

Footprinting through Web services
– People search services

Facebook.com

Spokeo.com

theHarvester – theHarvester – d microsoft – 1 200 -b linkedin (search people)
theharvester -d microsoft . com -1 200 -b baidu (search email)

Job sites are also good source of information about what technology the organization is using

– Financial Services and Job Sites
– Deep and Dark web footprinting
– Competitive Intelligence and Business Profile sites

– Determine the OS

netcraft.com – information about the site

shodan.io – searches the Internet for connected devices (routers, servers, and loT.

censys.io – monitors the infrastructure and discovers unknown assets anywhere on the Internet. It provides a full view of every server and device exposed to the Internet.

– Finding Top level domain and sub-domains

Google / Bing – Powerful search engines

netcraft.com – provides Internet security services, including anti-fraud and anti-phishing services, application testing, and PCI scanning.

Sublist3r – Sublist3r is a Python script designed to enumerate the subdomains of websites using
OSINT

https://pentest-tools.com – Find Subdomains is an online tool used for discovering subdomains and their IP addresses, including network information and their HTTP servers.

technique	tools
Location of the target	– Google earth – google map – wikimapia
Gathering financial Information	– Google finance – MSN money – Yahoo finance
Gathering information from business profile sites	– opencorporates – crunchbase – corporationwiki – linkedln
Monitoring targets using alerts	– google alerts, X(twitter) – Mention, online reputation tool
Gathering information from groups, forums and blogs	– Google groups – yahoo groups
Gathering information from NNTP Usenet Newgroup	– newshosting – eweka – supernews
Public source code repositories	Recon-ng

Footprinting through Social media sites
– social engineering

Sherlock – search a vast number of social networking sites for a target username. This tool helps the attacker locate the target user on various social networking sites, along with the complete URL. pytthon3 sherlock victim

sociaI-searcher.com – search for content on social networks in real time and provides deep analytics data.

– social media sites

buzzsumo.com – advanced social search engine finds the most shared content for a topic, author, or domain. It shows the shared activity across all the major social networks including Twitter, Facebook, Linked In, Google Plus, and Pinterest.

https://followerwonk.com – Followerwonk helps you explore and grow your social graph: Dig deeper into Twitter analytics: Who are your followers? Where are they located? When do they tweet?

– analyzing social network graphs

https://gephi.org – visualization and exploration tool for all types of graphs and networks. It allows
the easy creation of social data connectors to map community organizations and small world networks.

Website footprinting
Looking for Software used and its version, OS used, Sub-directories and parameters, Filename, path, database field name or query, scripting platform, technologies used, contact details, CMS details.

Burp Suite – platform for performing security testing of web applications. Its various tools work together to support the entire testing process, from initial mapping and analysis of an application’s attack surface to finding and exploiting security vulnerabilities.

Burp Proxy allows attackers to intercept all requests and responses between the browser and the
target web application and obtain information such as web server used, its version, and webapplication-related vulnerabilities.

Examining the HTML source code – indentifying CMS

Examining Cookies – identifying software running, scripting platform

– Web spidering

Webspiders – Web data extractor, Parsehub

– Website mirroring

HTTrack Web Site Copier – offline browser utility. It downloads a website from the Internet to a local directory and recursively builds all the directories including HTML, images, and other files from the web server on another computer.

https://archive.org – Internet Archive Wayback Machine that explores archived versions of websites.

Photon to retrieve archived URLs of the target website from archive.org
– python photon.py -u -1 3 -t 200 –wayback
– python photon.py -u – 1 3 -t 200 -only-urls

Extracting Website links	– octoparse – netpeak spider – link extractor
gathering wordlist from the target website	– CeWL cewl http://www.certifiedhacker.com
Extracting metadata from public documents	– ExifTool – Web data extrator – metafoofil
Monitoring webpages for updates and changes	– Website-watcher – visual ping – follow that page
Searching for contact info, email address, telephone etc	– target website
Searching for webpage posting patterns and revision numbers	– websearch
Monitoring website traffic of the target company	– web-stat – ranktracker – goingup.com – opentracker – google analytics

Email footprinting
– Tracking Email communications
Collecting information from the email header

infoga – for gathering email account information (IP, hostname, country, etc.) from different public sources (search engines, pgp key servers, and Shodan), and it checks if an email was leaked using the haveibeenpwned.com API
– python infoga.py –domain microsoft.com –source all –breach -v2 –report . . /microsoft .txt
– python infoga .py –info m4ll0k@protorunail . com –breach -v 3 -report . . /m4110k.txt

eMailTrackerPro – analyze email headers and extract information such as the sender’s geographical location, IP address, and so on. It allows an attacker to review the traces later by saving past traces.

DNS footprinting
– DNS interrogation – These tools can extract a range of IP addresses using IP routing lookup.

SecurityTrails – advanced DNS enumeration tool capable of creating a DNS map of the
target domain network. It can enumerate both current and historical DNS records such as
A, AAAA, NS, MX, SOA, and TXT, which helps in building the DNS structure.

– Reverse DNS lookup

DNSRecon – perform a reverse DNS lookup on the target host:
dnsrecon -r 162.241 . 216 . 0-162.241.216.255

Reverse Lookup – performs a reverse IP lookup by taking an IP address and locating a DNS PTR record for that IP address

Network footprinting
– locate network range
– traceroute

ARIN – enter the server IP into the SEARCH Whois text box. This yields the network range of the target network.

Traceroute – Finding the route of the target host on the network is necessary to test against man-in-the-middle attacks and other related attacks.
ICMP traceroute
TCP traceroute
UDP traceroute

Path Analyzer Pro – performs network route tracing with performance tests, DNS, Whois, and network resolution to investigate network issues.

Visualroute.com – is a traceroute and network diagnostic tool. Attackers use VisualRoute to identify the geographical location of routers, servers, and other IP devices in the target network.

Footprinting through social engineering
– Eavesdropping
– Shoulder surfing
– Dumpster diving
– Impersonation

Maltego – automated tool that can be used to determine the relationships and realworld links between people, groups of people, organizations, websites, Internet infrastructure, documents, etc.

Recon-ng– reconnaissance framework with independent modules for database interaction that provides an environment in which open-source web-based reconnaissance can be conducted.

FOCA – find metadata and hidden information in the documents that its scans. FOCA is capable of
scanning and analyzing a wide variety of documents, with the most common ones being Microsoft Office, Open Office, or PDF files.

OSRFramework – related to username checking, DNS lookups, information leaks research, deep web search, and regular expression extraction.

Recon-Dog – all-in-one tool for all basic information gathering needs. It uses APls to collect information about the target system.

Bill Cipher – information gathering tool for a website or IP address. It can work on any
operating system that supports Python 2, Python 3, and Ruby. This tool includes various
options such as DNS lookup, Whois lookup, port scanning, zone transfer, host finder, and
reverse IP lookup, which help to gather critical information.

Spyse – collect and analyze information about devices and websites available on the Internet. It probes every public IP address, crawls every website, curates and enriches the resulting data, and makes the data intelligible through an interactive search engine and application programming interface (API).

Footprinting Countermeasures

Develop and enforce security polices

Restrict zone transfer

Disable directory listings

Educate social engineering tricks and risks

privacy Whois Lookup database

Avoid domain-level cross linking

Encrypt and password-protect sensitive information

Place critical documents offline

Train employee of social engineering and attacks

Hide the direct contact details

Disable geo-tagging functionality

Avoid reviewing location or travel plans

Turn off geolocation access

Ensure no critical information on notice boards

CEH Module1 – Intro, Concepts, Standards

Elements of Information Security – CIA

Confidentiality	Assurance that the information only to those authorized to have access
Integrity	The trustworthiness of data and resources in terms of preventing improper or unauthorized changes
Availability	Assurance that the systems reponsible for delivering, storing and procress information are accessible when required by the authorized users
Authenticity	Refers to the characteristic of a communication, document or any data that ensures the quality of being genuine
Non-Repudiation	A guarantee that the sender of a message cannot later deny having sent the message and that the recipient cannot deny having received the message

Classification of Attacks

Passive	– do not tamper with the data and involve intercepting and monitoring network traffic and data flow on the target network – Sniffing and eavesdropping
Active	– tamper with data in transit or disrupt the communication or services between the systems to bypass or break into secured systems – DoS, Man in middle, session hijacking, SQL injection
Close in	– performed when attacker is in close physical proximity with the target systems or network in order to gather, modify or disrupt access to information – eavesdropping, shoulder surfing, dumper diving
Insider	– using privileged access to violate rules or intentionally cause a threat to the organization’s information or information systems – theft of physical devices, planting keyloggers, back door and malware
Distribution	– tamper with hardware or software prior to installation – tamper hardware or software at its source or in transit

Information Warfare

C2	possess a compromised systems or network
Intelligence-based	sensor-based
Electronic	radio-electronic and cryptographic techniques
Psychological	Propaganda and terror to demoralize
Hacker	shutdown systems, data errors, theft of services, false messaging, system monitoring access to data – used virus, logic bombs, Trojan horses, and sniffers to perform these attacks
Economic	affect economy of a business by blocking flow of information
Cyber	use of information systems against the virtual personas of individuals or groups

CEH Hacking Methodology (CHM)

Cyber Kill Chain Methodology

Tactics, Techniques, and Procedures (TTPs)

Tactics	Techniques	Procedures
way an attacker preforms the attack	technical methods used by an attacker	organizational approaches that threat actors follow
tactics for information gathering to perform initial exploitation, privilege escalation, and lateral movement, and to deploy measures for persistent access to the system and other purposes	Initial exploitation, setting up and maintaining command and control channels, accessing the target infra, covering tracks of data exfiltration	the number of actions usually differs depending on the objectives of the procedure and threat actor group

Adversary Behavioral Identification

Internal Reconaissance	enumeration of systems, hosts, processes, execute commands to get local user context, system config, hostname, IP address, active remote systems and programs running.
Use of powershell	automating data exfiltration and launching further attacks.
Unspecified proxy activities	adversary create and configure multiple domains pointing to the same host, allowing them to switch quickly between domains to avoid detection
Use of Command line interface	interact with the target system, browse files, read file content, modify files, create new users, connect to remote systems, download and install malicious code.
HTTP User Agent	The server identifies the connected HTTP client using the user agent field. Adversary can modify the content of the HTTP user agent field to communicate with the compromised system and to carry further attacks.
Command and control server	communicate remotely with compromised system through encrypted session. Using this encrypted channels to steal data, delete data and launch further attacks
Use of DNS tunneling	Use to obfuscate malicious traffic in the legit traffic carried by common protocols. Use for communication with c2 server, bypass security controls and perform data exfiltration
Use of web shell	manipulate the webserver by creating a shell within a website. Use to gain remote access to functionalities of a server, data exfiltration, file transfer and uploads.
Data staging	techniques to collect and combine as much data possible.

Indicators of Compromise (IoCs)

Email	email service to send malicious data
Network	C2, malware delivery and identifying details of the OS, browser type and other computer specific information
Host-Based	filenames, file hashes, registry keys, DLLs and mutex
Behavioral	identify specific behavior related to malicious activities such as code injection into the memory or running the scripts of an application.

MITRE ATT&CK Framework

Diamond Model of Intrusion Analysis

Additional Event Meta-Features

Adversary	Hacker
Victim	Target
Capability	strategy, methods, procedure, malware, tools
Infrastructure	hardware and software connection

Timestamp	time and date of the event
Phase	progress of the attack
Result	outcome of the event
Direction	direction of the attack, route to victim
Methodology	techniques used to perform the attack
Resource	tools/ technology used to perform the attack
Socio-political	relationship between the adversary and victim
Technology	relationship between infra and capability

Continual/ Adaptive Security Strategy

Defense-in-Depth

Risk Level

Risk level	Consequence	Action
Extreme or High	Serious or imminent danger	– immediate measures are required – identify and impose controls to reduce the risk to a reasonably low level
Medium	moderate danger	– immediate action is not required but action should be implement quickly – identify and impose controls to reduce the risk to a reasonably low level
Low	Negligible	– Take preventive steps to mitigate the effects of the risk

Risk Matrix

Risk Management

Risk Identification	identifies the sources
Risk Assessment	Assess the organization’s risk
Risk Treatment	Selects and implements appropriate controls
Risk Tracking	Ensures appropriate controls are implemented
Risk Review	Evaluates the performance

Cyber Threat Intelligence

Strategic	High-level information on changing risks	High level executives and management
Tactical	Information on attackers TTP	IT service and SOC managers and Administrators
Operational	information on specific incoming attack	Consumed by Security managers and network defenders
Technical	information on specific indicators of compromise	SOC staff and IR team

Threat Intelligence Lifecycle

Threat Modeling

Incident Management

Incident Handling and Response

Role of AI and ML in Cyber Security

Information Security Laws and Standards

Payment Card Industry Data Security Standard (PCI DSS)	– Information security standard for organization – applies to all entitles involved in payment card processing
1S0/IEC 27001:2013	– establishing, implementing, maintaining information security management system – many types of use
Health Insurance Portability and Accountability Act (HIPAA)	– use the same health care transactions, code sets and identifiers – federal protections for the personal health information – confidentiality, integrity, and availability of electronically protected health information – standard transaction – administration simplification rules
Sarbanes Oxley Act (SOX)	protect investors and the public -1 public company accounting oversight board -2 auditor independence -3 corporate responsibility -4 enhanced financial disclosures -5 analyst conflict of interest -6 commission resources and authority -7 studies and reports -8 corporate and criminal fraud accountability -9 white collar crime penalty enhancement -10 corporate tax returns -11 corporate farud accountability
The Digital Millennium Copyright Act (DMCA) and the Federal	– World intellectual property organization – defines the legal prohibitions
Information Security Management Act (FISMA)	– effectiveness of information security controls
General Data Protection Regulation (GDPR)	– data privacy and security standard especially on cloud
Data Protection Act 2018 (DPA)	– protects individuals – personal data to be processed lawfully – conferring rights to obtain and process and to require inaccurate personal data to be rectified – conferring functions on the commissioner, giving holder of that office responsibility to monitor and enforce their provisions

Cybersecurity Tools

RED Kali Linux – pen testing OS

nmap – recon, scan for ip, services, host and ports

dirb – Scan the web server for directories using a dictionary file
ffluf – Scan the web server for directories using a dictionary file

linpeas – access elevation
pspy64 – process snooping

Searchsploit – if the application or webapp use this to look for exploits
exploit-db – webversion of seachsploit

Metasploit – payload, listener for exploits
MSFvenom

crack the zip folder by using the FCrackZip tool
fcrackzip -v -u -D -p /usr/share/wordlists/rockyou.txt save.zip’

showmount -e <IP address> – showmount tool to check if there are any files that has been shared in the network.

ssh -I id_rsa username@<IP address> – using rsa to remote

zip exploit Run zip with the command “sudo zip 1.zip raj.txt -T –unzip-command=”sh -c /bin/bash”

BLUE Analysis
FLARE VM – windows environment sandbox
REMNUXS – Linux environment sandbox

https://app.any.run/ – analyse malware
https://www.virustotal.com/gui/home/upload – online scanner

https://gchq.github.io/CyberChef/ – hashes