Buffer Overflow

The ability to remain stealth during a penetration exercise is what separates a sophisticated hacker from a script kitty. The phrase “The Quieter You Become, The More You Are Able to Hear” holds true, especially in the field of hacking. Being able to perform Ani-forensics and avoid detection is critical to the success of hacking and penetration testing and understanding these methods is beneficial, even for white hat hackers, as there will be times in a penetration where the system is already compromised. In such cases, understanding what the attacker is doing in order to cover their tracks can help determine the sophistication of the attack or bring prosecution to the attacker. All hacks begin with system enumeration and nmap is one of the best tools to use during this discovery phase. However, as I explained in Scanning With nmap blog, port scanning a bunch of IP Addresses or every port on a target system is noisy and can cause denial of service conditions (very bad if you are ...

It should be no surprise that the cloud can be just as vulnerable as in-house servers; after all the cloud is just data centers with servers connected to the internet. Cloud data centers such as Amazon, Microsoft, and Google do have top notch security such as physical controls like concrete barriers and utilize the most recent and secure network protocols such as IPv6. However, this does not stop users of the cloud from poorly implementing security configurations or writing bad code for the sites a cloud may host. Even more interesting, it has been found that the cloud vendors themselves have vulnerabilities.  Let’s delve into some of these issues and how they may be addressed. 0day vulnerabilities in the cloud vendors themselves do exist. Azure, in example, did have a 0day Cross-Site Scripting (XSS) vulnerability. Chris Dale, a penetration tester, found a command injection flaw that allowed him to set environment variables of a process using an XSS payload. The command injec...

Hello all, This post is going to take a different direction from the previous posts which focused mainly on technical knowledge and tools and talk about one of the most important tasks in cybersecurity, information gathering. Not information gathering as in port scanning a client or doing google searches on a target (though the concepts in this post can be used for that), information gathering as in making sure one is pulling data from valid sources and avoiding disinformation. As a cyber-security professional its important to have a list of sources that are well vetted and/or backed by an organization or government agency. Given the vast amount of organizations, agencies, and institutions involved in Cybersecurity; finding a legitimate information source that covers a topic specific to your need can be difficult. Let’s start with some major organizations that come to mind when discussing Cyber-security. According to Cybercrime Magazine there are 33 cybersecurity industry associ...

nmap is the defacto for scanning networks by system administrators and penetration testers. It also provides countless community supported nse (nmap scripting engine) scripts which can perform a range of tasks from discovering services to discovering vulnerabilities within those services. Let's take a look at nmap and some of its features. nmap's manual is huge. On linux, it can be viewed by executing the terminal command: man nmap |more If you're like me though, scrolling through this gets to be a bit of a hassle (I love Ctrl+F). Thankfully, there is a way to export the manual to a text file. It may be done with this command: man nmap > nmap.txt As of this writting, there are currently 1,736 lines of text. So its probably easier just to port this to a text file and do a search. nmap is huge and powerful, and it is possible to cause yourself a lot of headache if you are not careful. Take for instance the following command: nmap --stats-every 5m -p- 192.168.1....

Kali Linux is the defacto for pen testing. While any linux distro (or OS) can work for backdooring into networks, its quickest to just download a Kali Linux iso. It comes with most of the pen testing tools (some of them cost money but most are free) to get you up and running: https://www.kali.org/downloads/   Lets not waste time, we have a windows machine to administer (or connect to for nefarious purposes). Let's say the windows machine is behind a firewall with all inbound connections blocked as shown below: This will prevent us from doing a bind shell with windows, but not a reverse shell. To create a reverse shell, let's have our kali linux machine listen on an unused well known port, 443:  ncat -lvp 443 --ssl The -lvp command means listen verbosely on port 443. --ssl will encrypt all incoming traffic (note ssl is deprecated as of ncat 7.6. To use this option, ncat 7.5 should be installed). By encrypting our traffic, it will make it difficult, albeit not i...

The last two weeks we learned python and xpaths. We are now going to combine the two lessons in an attempt to write a web crawler. The following code below was initially written by Umer Javed, you can crawl to his link below ;) from lxml import html import requests class AppCrawler:     def __init__(self, starting_url, depth):         self.starting_url = starting_url         self.depth = depth         self.current_depth = 0         self.depth_links = []         self.apps = []     def crawl(self):         app = self.get_app_from_link(self.starting_url)         self.apps.append(app)         self.depth_links.append(app.links)         while self.current_depth < self.depth:             current_links = []           ...

Last week we looked at a light introduction to Python. This week we are going to take a look at XPaths. We need to learn xpaths if we are to build a web crawler which can be used to scrape data from websites. XPaths are fairly straightforward and easy to learn. Follow these steps: 1. Download the chrome browser and open it. 2. The default page should be Google so right-click on the "Google" icon 3. Select inspect . You should get the Developer Console to pop up as shown below: 4. Right-click on the highlighted element 5. Select Copy >> Copy XPath 6. Paste the path into any text editor, it should be this: //*[@id="hplogo"] There are two types of xpaths, absolute and relative. The xpath shown above is relative. The absolute xpath of the Google logo is: /html[1]/body[1]/div[1]/div[8]/span[1]/center[1]/div[1]/img[1] XPaths are subject to constant change so it is always good to use a relative xpath whenever possible. Breaking down the syntax for...