IT Data Security
Assignment-1
Task-
1. Discuss any 10 Cyber Security Tools in detail.
2. Demonstrate the use of any 5 tools by exploring them i.e. what are the
functionalities of the tool (by using them) and add the screenshot (how you have
used the tool and what functionalities you have performed) in the assignment.
Tools-
1. Wireshark-
Wireshark (earlier known as Ethereal) is an open source multi-platform
network protocol analyzer. It allows you to examine data from a live
network or from a capture file on disk. I helps the user to dig down into just
the level of packet detail the user needs. Wireshark has several powerful
features including, a display filter language and ability to view
reconstructed stream of a TCP session. It also supports hundreds of and
protocols and media types. A tcpdump-like console version named tshark is
also included. Wireshark lets the user put network interface controllers into
promiscuous mode, so they can see all the traffic visible on that interface
including unicast traffic not sent to that NIC’s MAC address. However, when
capturing with a packet analyzer in promiscuous mode on a port on a
network switch, not all traffic through the switch is necessarily sent to the
port where the capture is done, so capturing in promiscuous mode is not
necessarily sufficient to see all network traffic. Port mirroring or various
network taps extend capture to any point on the network. If a remote
machine captures packets and sends the captured packets to a machine
running Wireshark using the TZSP protocol or the protocol used by
OmniPeek, Wireshark dissects those packets, so it can analyze packets
captured on a remote machine at the time that they are captured.
Wireshark is available on Linux, Windows and Mac OS X.
2. Nmap-
Nmap ("Network Mapper") is a free and open source utility for network
discovery and security auditing. Many systems and network administrators
also find it useful for tasks such as network inventory, managing service
upgrade schedules, and monitoring host or service uptime. Nmap is famous
as the Swiss Army knife of network discovery and security auditing. Nmap
uses raw IP packets in novel ways to determine what hosts are available on
the network, what services (application name and version) those hosts are
offering, what operating systems (and OS versions) they are running, what
type of packet filters/firewalls are in use, and dozens of other
characteristics. It was designed to rapidly scan large networks, but works
fine against single hosts. Nmap is available for Linux, Windows and Mac OS
X. Nmap suite also includes Zenmap(nmap with GUI),Ncat(debugging
tool),Ndiff(utility for comparing scan results) and Nping(packet generation
and response analysis tool). Nmap also has its own unique scripting engine
which handles all the vulnerability and exploitation scans popularly known
as NSE(Nmap Scripting Engine). Nmap was named “Security Product of the
Year” by Linux Journal.
3. THC Hydra-
THC - The Hacker's Choice, also known as THC, is a non-commercial group
of hackers and security researchers. It was founded in 1995 in Germany and
has published more than 70 software releases and technical documents
covering one Wide range of aspects of the network and system security.
THC-Hydra is a fantastic open source tool that allows us to perform brute
force attacks in a very fast way and to a large number of protocols. It is a
fast network login cracker. In cryptography, brute force attack is the way to
recover a key by trying all possible combinations until finding the one that
allows access. The current services that Hydr recognizes are: Telnet (23,
992) Shell Remote Commands. Ftp (21, 990) File transfer. Pop3 (110, 995)
E-mail. Imap (143, 993) E-mail. Smb (139, 139) Windows SMB services such
as shared files and IPC$ access. Http (80, 443) Web Services. Https (n/a ,
443) Web Services through SSL. It is available on Linux, Windows and Mac
OS X.
4. Burp Suite-
Burp or Burp Suite is a graphical tool for testing Web application security.
The tool is written in Java and developed by PortSwigger Web Security.
The tool has three editions. A Community Edition that can be downloaded
free of charge, a Professional Edition and an Enterprise edition that can be
purchased after a trial period. The Community edition has significantly
reduced functionality. It was developed to provide a comprehensive
solution for web application security checks. In addition to basic
functionality, such as proxy server, scanner and intruder, the tool also
contains more advanced options such as a spider, a repeater, a decoder, a
comparer, an extender and a sequencer. The company behind Burp Suite
has also developed a mobile application containing similar tools compatible
with iOS 8 and above.
Burp Suite has the following tools-
HTTP Proxy- It operates as a web proxy server, and sits as a man-in-the-
middle between the browser and destination web servers. This allows the
interception, inspection and modification of the raw traffic passing in both
directions.
Scanner - A web application security scanner, used for performing
automated vulnerability scans of web applications.
Intruder - This tool can perform automated attacks on web applications.
The tool offers a configurable algorithm that can generate malicious HTTP
requests. The intruder tool can test and detect SQL Injections, Cross Site
Scripting, parameter manipulation and vulnerabilities susceptible to brute-
force attacks.
Spider - A tool for automatically crawling web applications. It can be used in
conjunction with manual mapping techniques to speed up the process of
mapping an application's content and functionality.
Repeater - A simple tool that can be used to manually test an application. It
can be used to modify requests to the server, resend them, and observe
the results.
Decoder - A tool for transforming encoded data into its canonical form, or
for transforming raw data into various encoded and hashed forms. It is
capable of intelligently recognizing several encoding formats using heuristic
techniques.
Comparer - A tool for performing a comparison (a visual "diff") between
any two items of data.
Extender - Allows the security tester to load Burp extensions, to extend
Burp's functionality using the security testers own or third-party code
(BAppStore)
Sequencer - A tool for analyzing the quality of randomness in a sample of
data items. It can be used to test an application's session tokens or other
important data items that are intended to be unpredictable, such as anti-
CSRF tokens, password reset tokens, etc.
5. Snort-
Snort is a free open source network intrusion detection system (IDS) and
intrusion prevention system (IPS) created in 1998 by Martin Roesch, former
founder and CTO of Sourcefire. Snort is now developed by Cisco, which
purchased Sourcefire in 2013, at which Roesch is a chief security architect.
In 2009, Snort entered InfoWorld's Open Source Hall of Fame as one of the
"greatest [pieces of] open source software of all time". Snort's open source
network-based intrusion detection/prevention system (IDS/IPS) has the
ability to perform real-time traffic analysis and packet logging on Internet
Protocol (IP) networks. Snort performs protocol analysis, content searching
and matching. The program can also be used to detect probes or attacks,
including, but not limited to, operating system fingerprinting attempts,
semantic URL attacks, buffer overflows, server message block probes, and
stealth port scans. Snort can be configured in three main modes: sniffer,
packet logger, and network intrusion detection. In sniffer mode, the
program will read network packets and display them on the console. In
packet logger mode, the program will log packets to the disk. In intrusion
detection mode, the program will monitor network traffic and analyze it
against a rule set defined by the user. The program will then perform a
specific action based on what has been identified.
6. Social Engineering Toolkit-
The Social-Engineer Toolkit (SET) is specifically designed to perform
advanced attacks against the human element. SET was designed to be
released with the [Link] launch and has quickly
became a standard tool in a penetration testers’ arsenal. SET was written
by David Kennedy (ReL1K) and with a lot of help from the community it has
incorporated attacks never before seen in an exploitation toolset. The
attacks built into the toolkit are designed to be targeted and focused
attacks against a person or organization used during a penetration test.
This hacking method works perfectly with DNS spoofing or Man in the
Middle Attack method.
Here is an example usage of the Credential Harvester method from the
Social Engineering Toolkit-
1. Type setoolkit in terminal and go to Social Engineering attacks ->Website
Attack Vectors->Credential Harvester Method.
2. Select the option site cloner and then enter the ip address of the
attacker’s host and the target site to be cloned.
3. The IP address is shortened to a URL and sent to the target. The target
opens the URL and enters the credentials.
4. The credentials appear in the attacker’s terminal.
7. Stegsolve-
A simple steganography trick that is often used for watermarks instead of
outright steganography is the act of hiding nearly invisible text in images.
The text can be hidden by making it nearly invisible (turning down it's
opacity to below 5%) or using certain colors and filters on it. Although the
text is undiscernable to the naked eye, it is still there, and there are a
variety of tools which allow the text to be extracted. Stegsolve is an
immensly useful program for many steganography challenges, allowing you
to go through dozens of color filters to try to uncover hidden text.
This example is a demonstration of a question from a CTF in which I
participated-
Image with the hidden data-
Stegsolve lets you change the bits behind the image with ease:
This is the end result with the hidden message:
8. Rainbow Crack-
The RainbowCrack tool is a hash cracker. RainbowCrack uses time-memory
tradeoff algorithm to crack hashes. It differs from brute force hash crackers.
A traditional brute force cracker tries all possible plaintexts one by one in
cracking time. It is time-consuming to break complex password in this way.
The idea of time-memory trade-off is to do all cracking time computation in
advance and store the result in files so called “rainbow table”. A brute force
hash cracker generate all possible plaintexts and compute the
corresponding hashes on the fly, then compare the hashes with the hash to
be cracked. Once a match is found, the plaintext is found. If all possible
plaintexts are tested and no match is found, the plaintext is not found. With
this type of hash cracking, all intermediate computation results are
discarded. A time-memory tradeoff hash cracker need a pre-computation
stage, at the time all plaintext/hash pairs within the selected hash
algorithm, charset, plaintext length are computed and results are stored in
files called rainbow table. It is time consuming to do this kind of
computation. But once the one time pre-computation is finished, hashes
stored in the table can be cracked with much better performance than a
brute force cracker.
(Note- No implementation included because the file size of rainbow tables
is 20 GBs at minimum and cracking the hash will also tae quite a significant
time. Screenshots of the software with steps included).
w
9. Hping-
Hping is a command-line oriented TCP/IP packet assembler/analyzer. The
interface is inspired to the ping(8) unix command, but hping isn’t only able
to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP
protocols, has a traceroute mode, the ability to send files between a
covered channel, and many other features.
While hping was mainly used as a security tool in the past, it can be used in
many ways by people that don’t care about security to test networks and
hosts. You can perform firewall testing, advanced port scanning, network
testing, TOS, fragmentation, manual path MTU discovery, advanced
traceroute, remote OS fingerprinting, remote uptime guessing and TCP/IP
stack auditing through hping. The latest version of hping is hping3.
10. Angry IP-
Angry IP Scanner is widely-used open-source and multi-platform network
scanner. As a rule, almost all such programs are open-source, because they
are developed with the collaboration of many people without having any
commercial goals. Secure networks are possible only with the help of open-
source systems and tools, possibly reviewed by thousands of independent
experts and hackers alike. Certainly, there are other network scanners in
existence (especially single-host port scanners), however, most of them are
not cross-platform, are too simple and do not offer the same level of
extensibility and user-friendliness as Angry IP Scanner. The program’s
target audience are network administrators, consultants, developers, who
all use the tool every day and therefore have advanced requirements for
usability, configurability, and extensibility. However, Angry IP Scanner aims
to be very friendly to novice users as well.