ESSENTIALS OF

ETHICAL HACKING
REDTEAM HACKER ACADEMY

CONTENT AT A GLANCE

1. NETWORK AND IT INFRASTRUCTURE

2. LINUX FOR HACKERS

3. CYBERSECURITY 101

4. ANONYMITY AND VPN

5. OPEN SOURCE INTELLIGENCE TOOLS

6. ART OF SCANNING

7. WIRELESS SECURITY

8. WEB APPLICATION SECURITY

9. VULNERABILITY ASSESSMENT AND PENETRATION TESTING

2
REDTEAM HACKER ACADEMY

NETWORK AND IT INFRASTRUCTURE

3
REDTEAM HACKER ACADEMY

1.1 OBJECTIVE

Well in order to begin your journey in the field of hacking networking knowledge is needed.
Let’s begin with the basics.

1) Next you need to know about networking protocols like TCP and UDP. How connections
are generally established over protocols and how data is being transferred over networks.
Authentication over protocols etc. Cause the better understanding you have over protocols,
the quicker you can establish or create fake authentication points.

2) Next comes segmentation of TCP or UDP protocols because each and every segment has
its own significance.

3) Next comes the IP thing. Like if you are searching for an open port on devices connected
to a wireless network you need to know the IP ranges ,so that the scanner can give or list all
the open port available on that network and then you will be able to connect through that port
(open port is necessary in order to remotely connect to the victim device or server).

4) Next comes the osi model. Before you go to hack you need to know how data is flowed in
a network. The osi reference model is the best way to understand data flow in a network.

1.2 NETWORK

A network is a collection of computers, servers, mainframes, network devices, peripherals, or

other devices connected to one another to allow the sharing of data and control. Today
computer networks are everywhere. You will find them in homes, offices, factories, hospitals
etc. But how are they created? What technologies do they use?

Before we begin discussing networking with any depth, we must define some common terms
that you will see throughout this book. These terms will be expanded upon in the appropriate
sections that follow:

● Connection: In networking, a connection refers to pieces of related information that are

transferred through a network. This generally infers that a connection is built before the data
transfer (by following the procedures laid out in a protocol) and then is terminated at the end
of the data transfer.

● Packet: A packet is the most basic unit that is transferred over a network. When
communicating over a network, packets are the envelopes that carry your data (in pieces)
from one end point to the other.

● Network Interface: A network interface can refer to any kind of software interface to
networking hardware. For instance, if you have two network cards in your computer, you can
control and configure each network interface associated with them individually. A network

4
REDTEAM HACKER ACADEMY

interface may be associated with a physical device, or it may be a representation of a virtual

interface. The "loopback" device, which is a virtual interface to the local machine.

1.3 TYPES OF NETWORKS

1.3.1 LOCAL AREA NETWORK (LAN)

A local area network is a computer network that interconnects computers within a limited
area such as a residence, school, laboratory, university campus or office building (SOHO).

1.3.2 WIRELESS LOCAL AREA NETWORK (WLAN)

Functioning like a LAN, WLANs make use of wireless network technology, such as Wi-Fi.
Typically seen in the same types of applications as LANs, these types of networks don’t
require that devices rely on physical cables to connect to the network.

1.3.3 WIDE AREA NETWORK

WAN means a network that is much more extensive than a LAN. While WAN is the relevant
term to use to describe large, dispersed networks in general, it is usually meant to mean the
internet, as a whole.

TYPES OF WAN

• Intranet: Private Network

• Internet: Public Network
• Extranet: VPN

WAN

5
REDTEAM HACKER ACADEMY

1.4 Networking Devices

Networks allow people to communicate, collaborate, and interact in many ways. Networks
are used to access web pages, talk using IP telephones, participate in video conferences,
compete in interactive gaming, shop using the Internet, complete online coursework, and
more. Different networking devices have different roles to play in a computer network. In this
topic, we will talk about different networking devices like a switch, router, and hub.

Hub

Hub is a networking device that is used to connect multiple network hosts. So when a host
sends a data packet to a network hub, the hub copies the data packet to all of its ports
connected to. The hub is not so secure and safe.

Switch

As a hub, a switch is also a networking device, a switch is more intelligent than a hub. Switch
does 'filter and forwarding' which is a more intelligent way of dealing with the data packets.
Its works on the basis of the MAC address. Which uses a CAM (Content Address Memory)
table contains the mac address of connected devices.

Router

A router connects one network to another network. The router is responsible for the delivery
of packets across different networks. The destination of the IP packet might be a web server
in another country or an email server on the LAN.

1.4.3 HUB V/S SWITCH V/S ROUTER

6
REDTEAM HACKER ACADEMY

1.5 BASIC TERMINOLOGIES

● Protocol: A protocol is a set of rules and standards that basically define a language that
devices can use to communicate. There are a great number of protocols in use extensively in
networking, and they are often implemented in different layers.

Some low-level protocols are TCP, UDP, IP, and ICMP. Some familiar examples of
application layer protocols, built on these lower protocols, are HTTP (for accessing web
content), SSH, TLS/SSL, and FTP.

● Port: A port is an address on a single machine that can be tied to a specific piece of
software. It is not a physical interface or location, but it allows your server to be able to
communicate using more than one application.

● Firewall: A firewall is a program or device that decides whether traffic coming into a server
or going out should be allowed. A firewall usually works by creating rules for which type of
traffic is acceptable on which ports. Generally, firewalls block ports that are not used by a
specific application on a server.

● NAT: NAT stands for network address translation. It is a way to translate requests that are
incoming into a routing server to the relevant devices or servers that it knows about in the
LAN. This is usually implemented in physical LANs as a way to route requests through one
IP address to the necessary backend servers.

● Gateway: A gateway, as the name suggests, is a passage to connect two networks

together that may work upon different networking models. They basically work as the
messenger agents that take data from one system, interpret it, and transfer it to another
system. Gateways are also called protocol converters and can operate at any network layer.

7
REDTEAM HACKER ACADEMY

Gateways are generally more complex than switch or router.

● VPN: VPN stands for virtual private network. It is a means of connecting separate LANs
through the internet, while maintaining privacy. This is used as a means of connecting
remote systems as if they were on a local network, often for security reasons. There are
many other terms that you may come across, and this list cannot afford to be exhaustive. We
will explain other terms as we need them. At this point, you should understand some basic,
high-level concepts that will enable us to better discuss the topics to come.

1.6 OSI MODEL

OSI stands for Open Systems Interconnect. The OSI model is introduced for communicating
between machines using different operating systems and hardware vendors. This model
defines seven separate layers. This image shows what are the seven layers and possible
attacks in each layer

8
REDTEAM HACKER ACADEMY

7. THE APPLICATION LAYER

The application layer is the layer that the users and user-applications most often interact with.
Network communication is discussed in terms of availability of resources, partners to
communicate with, and data synchronization.

This layer uses following protocols:

● HTTP (hypertext transfer protocol)

● HTTPS (hypertext transfer protocol secure)
● SMTP (simple mail transfer protocol)
● DHCP (dynamic host control protocol
● FTP (file transfer protocol)
● Telnet
● SNMP (simple network management protocol)
● SMPP (Short Message Peer-to-Peer)
● DNS (Domain Name System)
● SOAP (Simple Object Access Protocol)

Security in Application Layer

The final host layer is the one closest to the end user – and the one which presents potential
intruders with the biggest attack surface. The application layer includes the user interface
and various other critical functions, and if successfully exploited entire networks may be shut
down in a Denial of Service attack, user data may be stolen, and individual applications may

9
REDTEAM HACKER ACADEMY

fall under an intruder’s control. Secure application development practices are the safest way
to guarantee that applications are able to sanitize user input, detect malicious activity, and
securely handle and transfer sensitive information.

These are the attacks that are occurred in application layer:

● XSS
● SQL injection
● Data leaks
● Spam
● Etc.

6. THE PRESENTATION LAYER

The presentation layer is responsible for mapping resources and creating context. It is used
to translate lower level networking data into data that applications expect to see.

• It encodes the messages from the user-dependent format to the common format and vice
versa, for communication among dissimilar systems.
• It is responsible for data encryption and decryption of sensitive data before they are
transmitted over common channels.
• It is also responsible for data compression. Data compression is done at the source to
reduce the number of bits to be transmitted. It reduces the storage space and increases the
file transfer rate. It is particularly useful for the transmission of large multimedia files.

This layer uses following protocols:

● XDR (External data representation is a standard for the description and encoding of
data)
● TLS (transport layer security is a cryptographic protocol that provides end-to-end
communications security over networks)
● SSL (Secure Sockets Layer is a standard security protocol for establishing encrypted
links between a web server and a browser)
● MIME (Multi-Purpose Internet Mail Extensions is an extension to the Internet email
protocol that allows users to exchange different kinds of data files).

10
REDTEAM HACKER ACADEMY

Security in presentation layer

● SSL attacks
● XML encryption flaws

This logical or host layer uses a number of conversion methods to standardize data to and
from various local formats, as information is transferred from the application layer to the
network. Input from users should be isolated from program control functions, to avoid
malicious inputs that might lead to system crashes or exploits.

5. THE SESSION LAYER

The session layer is a connection handler. It creates, maintains, and destroys connections
between nodes in a persistent way. This layer is also responsible for authentication
authorization and session management.

This layer uses following protocols

● PPTP (Point-to-Point Tunneling Protocol is an obsolete method for implementing

virtual private networks)
● SAP (Session Announcement Protocol is an experimental protocol for broadcasting
multicast session information)
● L2TP (Layer 2 Tunneling Protocol is a tunneling protocol used to support virtual
private networks (VPNs) or as part of the delivery of services by ISPs)
● NetBIOS (Network Basic Input/output System is a program that allows applications on
different computers to communicate within a local area network (LAN)
● SMB (Server Message Block).

Security in session layer

● RPC (Remote Procedure Call) attacks

● NetBIOS auth attacks

11
REDTEAM HACKER ACADEMY

● SNMP attacks
● SMB attacks

The second of the host layers governs the interaction between local and remote applications.
It creates, manages, and terminates connections between machines on demand.

The session layer is susceptible to brute force attacks and may be breached if authentication
protocols are weak. To ensure security, authentication should take place through the
exchange of encrypted passwords (which must be safely stored), and timers should be put in
place to limit the number of attempts that may be made to establish a session.

4. THE TRANSPORT LAYER

The transport layer is responsible for handing the layers above it a reliable connection. In this
context, reliable refers to the ability to verify that a piece of data was received intact at the
other end of the connection.

This layer can resend information that has been dropped or corrupted and can acknowledge
the receipt of data to remote computers.

12
REDTEAM HACKER ACADEMY

This layer uses following protocols

● TCP (Transmission Control Protocol)

● UDP (user datagram protocol)
● SPX (sequenced packet [Link] handles the connections between systems)
● DCCP (Datagram Congestion Control Protocol is implements reliable connection
setup, teardown, Explicit Congestion Notification (ECN), congestion control)
● SCTP (Stream Control Transmission Protocol is a protocol for transmitting multiple
streams of data at the same time between two endpoints)

Security in transport layer

● SYN/ACK attacks
● Port scans
● MITM

13
REDTEAM HACKER ACADEMY

This first host layer is a logical zone in which the transfer of data sequences of various
lengths occurs. Smooth data flows with error control and measures ensuring segmentation
and de segmentation are the mark of a strong transport layer protocol such as TCP or
Transmission Control Protocol. Security here is dependent on limiting access to the
transmission protocols and their underlying information, together with strong firewall
protection.

3. THE NETWORK LAYER

The network layer is used to route data between different nodes on the network. It uses
addresses to be able to tell which computer to send information to. This layer can also break
apart larger messages into smaller chunks to be reassembled on the opposite end.

● Path Determination
● Logical Addressing

This layer uses following protocols

● Internet Protocol (IPv4)
● Internet Protocol (IPv6)
● IPX (Inter-network Packet Exchange)

14
REDTEAM HACKER ACADEMY

● ICMP (Internet Control Message Protocol)

● IPsec (internet protocol security defines the architecture for security services for IP
network traffic)
● IGMP (Internet Group Management Protocol is a group management protocol that
mainly manages the group membership in a multicast network)
● NAT (Network Address Translator)

Security in network layer

● Port filters
● IP fragmentation
● Spoofing
● Smurfs

This final media layer governs the routing, control, and addressing of data and traffic on the
network. A major threat to application security in this layer is IP address or packet spoofing,
where data packets originating from malicious sources are disguised so that they appear to
come from legitimate addresses within the network. Route and anti-spoofing filters in
conjunction with strongly configured firewalls can best provide security in this layer.

2. THE DATA LINK LAYER

This layer is implemented as a method of establishing and maintaining reliable links between
different nodes or devices on a network using existing physical connections.

● Physical Addressing

15
REDTEAM HACKER ACADEMY

This layer uses following protocols

● ARP (address resolution protocol)

● CSLIP (Compressed serial line internet protocol is reducing the size of the headers in
IP packets by eliminating a certain amount of redundancy.)
● PPP (Point-to-Point Protocol)
● ATM (Asynchronous Transfer Mode)
● VTP (VLAN Trunking Protocol)
● STP (Spanning Tree Protocol)

Security in data link layer

● VLANs
● ARP Poisoning

This media layer involves all the data packets which are moved by the physical layer. Efforts
to bypass virtual Local Area Network or VLAN security protocols and the spoofing of network
interface identifying media access control or MAC addresses are typical vulnerabilities of this
layer, and successful exploits can go on to compromise the security of the network layer.
Filtering MAC addresses and ensuring that all wireless applications have authentication and
encryption built in are common security strategies for this layer.

1. THE PHYSICAL LAYER

The physical layer is responsible for handling the actual physical devices that are used to
make a connection. This layer involves the bare software that manages physical connections
as well as the hardware itself (like Ethernet).

As you can see, there are many different layers that can be discussed based on their
proximity to bare hardware and the functionality that they provide.

16
REDTEAM HACKER ACADEMY

Security in physical layer

● Management interface segmentation

Security in the physical layer is easily threatened by accidental or malicious intent (e.g.
unplugging of power or network cables) or environmental factors like power surges. Denial of
Service (DoS) for crucial applications and networks can result. Biometric authentication,
electromagnetic shielding, and advanced locking mechanisms are typically used to secure it.

Here is a mnemonic to remember osi layers

17
REDTEAM HACKER ACADEMY

1.7 TCP/IP Model

The TCP/IP model, more commonly known as the Internet protocol suite, is another layering
model that is simpler and has been widely adopted. It defines the four separate layers, some
of which overlap with the OSI model:

[Link]

In this model, the application layer is responsible for creating and transmitting user data
between applications. The applications can be on remote systems, and should appear to
operate as if locally to the end user. The communication is said to take place between peers.

18
REDTEAM HACKER ACADEMY

[Link]

The transport layer is responsible for communication between processes. This level of
networking utilizes ports to address different services. It can build up unreliable or reliable
connections depending on the type of protocol used.

[Link]

The network layer is used to transport data from node to node in a network. This layer is
aware of the endpoints of the connections, but does not worry about the actual connection
needed to get from one place to another. IP addresses are defined in this layer as a way of
reaching remote systems in an addressable manner.

[Link] Interface

The network interface layer implements the actual topology of the local network that allows
the internet layer to present an addressable interface. It establishes connections between
neighboring nodes to send data. As you can see, the TCP/IP model, is a bit more abstract
and fluid. This made it easier to implement and allowed it to become the dominant way that
networking layers are categorized.

1.8 Protocols

DNS (Domain Name System)

The Internet system for converting alphabetic names into numeric IP addresses. For
example, when a Web address (URL) is typed into a browser, DNS servers return the IP
address of the Web server associated with that name. In this made-up example, the DNS
converts the URL [Link] into the IP address [Link]. The root servers
point to the "authoritative" servers located in ISPs, as well as in large companies, that turn
the names into IP addresses the process known as "name resolution." Using our
[Link] example, [Link] is the domain name, and WWW is the
hostname. The domain name is the organization's identity on the Web, and the hostname is
the name of the Web server within that domain.

FTP (File Transfer Protocol)

FTP is a protocol designed for transferring files over the internet. Files stored on an FTP
server can be accessed using an FTP client, such as a web browser, FTP software program
or a command line interface. The standard FTP protocol is not encrypted, meaning it is
vulnerable to packet sniffers and other types of snooping attacks. To connect to an FTP
server, you first need to enter the server name and port number. The server name often
starts with "ftp," such as "[Link]." The standard port number for FTP is 21, while
SFTP uses port 22 (SSH). If you connect via FTPS, you might be required to enter a custom
port number, but the most common one is 990. In order to access FTPS server, you will also
need to enter a username and password.

19
REDTEAM HACKER ACADEMY

HTTP (Hypertext Transfer Protocol)

The communications protocol used to connect to Web servers on the Internet or on a local
network (intranet). Its primary function is to establish a connection with the server and send
HTML pages back to the user's browser. It is also used to download files from the server
either to the browser or to any other requesting application that uses HTTP.

HTTP is a "stateless" request/response system. The connection is maintained between client

and server only for the immediate request, and the connection is closed. After the HTTP
client establishes a TCP connection with the server and sends it a request command, the
server sends back its response and closes the connection.

SSL (Secure Sockets Layer)

SSL is the standard security technology for establishing an encrypted link between a web
server and a browser. This link ensures that all data passed between the web server and
browsers remain private and integral.

SSH (Secure Shell)

SSH is a remote administration protocol that allows users to control and modify their remote
servers over the Internet. The service was created as a secure replacement for the
unencrypted Telnet and uses cryptographic techniques to ensure that all communication to
and from the remote server happens in an encrypted manner. It provides a mechanism for
authenticating a remote user, transferring inputs from the client to the host, and relaying the
output back to the client.

SNMP (Simple Network Management Protocol)

Simple Network Management Protocol is an Internet standard protocol implemented on the

application layer. The protocol was created in 1898 as a way of monitoring network
performance, error rates and so on. The main purpose of SNMP is to define a unified
interface and protocol for devices of different categories, versions and manufactures. Thus,
assisted by SNMP, system administrators can remotely monitor and manage the numbers of
systems and devices on a network, which can greatly simplify their work and improve
efficiency of network administration.

DHCP (Dynamic Host Configuration Protocol)

Dynamic Host Configuration Protocol is a network protocol that enables a server to

automatically assign an IP address to a computer from a defined range of numbers
configured for a given network.

ICMP (Internet Control Message Protocol)

Internet Control Message Protocol is an error-reporting protocol network device like routers

20
REDTEAM HACKER ACADEMY

use to generate error messages to the source IP address when network problems prevent
delivery of IP packets. ICMP creates and sends messages to the source IP address
indicating that a gateway to the Internet that a router, service or host cannot be reached for
packet delivery. Any IP network device has the capability to send, receive or process ICMP
messages. ICMP is used by network administrators to troubleshoot Internet connections in
diagnostic utilities including ping and traceroute.

ARP (Address Resolution Protocol)

Address Resolution Protocol is a network protocol used to find out the hardware (MAC)
address of a device from an IP address. It is used when a device wants to communicate with
some other device on a local network. The sending device uses ARP to translate IP
addresses to MAC addresses. The device sends an ARP request message containing the IP
address of the receiving device. All devices on a local network segment see the message,
but only the device that has that IP address responds with the ARP reply message
containing its MAC address. The sending device now has enough information to send the
packet to the receiving device.

IPsec (Internet Protocol Security)

IPsec is a framework of related protocols that secure communications at the network or

packet processing layer. It can be used to protect one or more data flows between peers.
IPsec enables data confidentiality, integrity, origin authentication and anti-replay.

SYSLOG

Syslog is a way for network devices to send event messages to a logging server – usually
known as a Syslog server. The Syslog protocol is supported by a wide range of devices and
can be used to log different types of events. For example, a router might send messages
about users logging on to console sessions, while a web-server might log access-denied
events.

SMTP (Simple Mail Transfer Protocol)

Simple Mail Transfer Protocol is the standard protocol for email services on a TCP/IP
network. SMTP provides the ability to send and receive email messages. SMTP is an
application-layer protocol that enables the transmission and delivery of email over the
Internet.

POP (Post Office Protocol)

Post Office Protocol is a type of computer networking and Internet standard protocol that
extracts and retrieves email from a remote mail server for access by the host machine. POP
is an application layer protocol in the OSI model that provides end users the ability to fetch
and receive email.

21
REDTEAM HACKER ACADEMY

Media Access Control

Media access control is a communications protocol that is used to distinguish specific

devices. Each device is supposed to get a unique MAC address during the manufacturing
process that differentiates it from every other device on the internet.

Addressing hardware by the MAC address allows you to reference a device by a unique
value even when the software on top may change the name for that specific device during
operation. Media access control is one of the only protocols from the link layer that you are
likely to interact with on a regular basis.

PORT NUMBER DESCRIPTION

1 TCP Port Service Multiplexer (TCPMUX)

18 Message Send Protocol (MSP)

20 FTP -- Data

21 FTP -- Control

22 SSH Remote Login Protocol

23 Telnet

25 Simple Mail Transfer Protocol (SMTP)

42 Host Name Server (Nameserver)

43 Who Is

53 Domain Name System (DNS)

22
REDTEAM HACKER ACADEMY

69 Trivial File Transfer Protocol (TFTP)

80 HTTP

109 POP2

110 POP3

115 Simple File Transfer Protocol (SFTP)

118 SQL Services

137 NetBIOS Name Service

143 Internet Mail Access Protocol (IMAP)

156 SQL Server

161 SNMP

179 Border Gateway Protocol (BGP)

190 Gateway Access Control Protocol (GACP)

194 Internet Relay Chat (IRC)

197 Directory Location Service (DLS)

220 Interactive mail access protocol v3 (IMAP3)

23
REDTEAM HACKER ACADEMY

389 Lightweight Directory Access Protocol (LDAP)

443 HTTPS

444 Simple Network Paging Protocol (SNPP)

445 Microsoft-DS

546 DHCP Client

547 DHCP Server

1.9 IP and Subnetting

The internet protocol is one of the fundamental protocols that allow the internet to work. IP
addresses are unique on each network and they allow machines to communicate with each
other across a network. It is implemented on the internet layer in the IP/TCP model.

The most common implementation today is IPv4, although IPv6 is growing in popularity as an
alternative due to the scarcity of IPv4 addresses available and improvements in the
protocol’s capabilities.

1.9.1 Internet Protocol Version 4 (IPv4)

Internet Protocol Version 4 (IPv4) is the fourth revision of the Internet Protocol and a widely
used protocol in data communication over different kinds of networks.

IPv4 is a connectionless protocol used in packet-switched layer networks, such as Ethernet.

It provides the logical connection between network devices by providing identification for
each device. There are many ways to configure IPv4 with all kinds of devices – including
manual and automatic configurations – depending on the network type.

IPv4 is based on the best-effort model. This model guarantees neither delivery nor avoidance
of duplicate delivery; these aspects are handled by the upper layer [Link] is used in the
packet-switched link layer in the OSI model.

24
REDTEAM HACKER ACADEMY

IP Classes and Ranges

CLASS RANGE ADDRESS SUPPORTS

Class A 1-126 [Link] to Supports 16 million

[Link] hosts on each of 127 networks

Class B 128-191 [Link] to Supports 65000 hosts on each of

[Link] 16000 networks

Class C 192-223 [Link] to Supports 254 hosts on each 2

[Link] million networks

Class D 224-239 [Link] to Reversed for multicast groups

[Link]

Class E 240-254 [Link] to Reserved for future use or

[Link] research and development
purpose

IPv4 uses 32-bit addresses for Ethernet communication in five classes: A, B, C, D and E.
Classes A, B and C have a different bit length for addressing the network host. Class D
addresses are reserved for multicasting, while class E addresses are reserved for future use.
Class A has subnet mask [Link] or /8, B has subnet mask [Link] or /16 and class C
has subnet mask [Link] or /24. For example, with a /16 subnet mask, the network
[Link] may use the address range of [Link] to [Link]. Network hosts
can take any address from this range; however, address 192.168.255.255is reserved for
broadcast within the network. The maximum number of host addresses IPv4 can assign to
end users is 232.

Class A Address

The first bit of the first octet is always set to 0 (zero). Thus, the first octet ranges from 1 – 127,
i.e.
00000001 - 01111111
1 - 127

Class A addresses only include IP starting from 1.x.x.x to 126.x.x.x only. The IP range
127.x.x.x is reserved for loopback IP addresses.
The default subnet mask for Class A IP address is [Link] which implies that Class A
addressing can have 126 networks (27-2) and 16777214 hosts (224-2). Class A IP address
format is thus: [Link]

25
REDTEAM HACKER ACADEMY

Class B Address

An IP address which belongs to class B has the first two bits in the first octet set to 10, i.e.

10000000 - 10111111
128 - 191

Class B IP Addresses range from 128.0.x.x to 191.255.x.x. The default subnet mask for
Class B is 255.255.x.x. Class B has 16384 (214) Network addresses and 65534 (216-2) Host
addresses. Class B IP address format is:
[Link]

Class C Address

The first octet of Class C IP address has its first 3 bits set to 110, that is:

11000000 - 11011111
192 - 223

Class C IP addresses range from 192.0.0.x to 223.255.255.x. The default subnet mask for
Class C is 255.255.255.x. Class C gives 2097152 (221) Network addresses and 254 (28-2)
Host addresses. Class C IP address format is:
[Link]

Class D Address

Very first four bits of the first octet in Class D IP addresses are set to 1110, giving a range of:

11100000 - 11101111
224 - 239

Class D has IP address rage from [Link] to [Link]. Class D is reserved for
Multicasting. In multicasting data is not destined for a particular host, that is why there is no
need to extract host address from the IP address, and Class D does not have any subnet
mask.

Class E Address

This IP Class is reserved for experimental purposes only for R&D or Study. IP addresses in
this class ranges from [Link] to [Link]. Like Class D, this class too is not
equipped with any subnet mask.

26
REDTEAM HACKER ACADEMY

1.9.2 Subnetting and Subnet Masks

Subnetting is the process of dividing a network into small networks and is a common task on
IPV4 networks. Before we discuss how to implement it is useful to understand why and

when we need to do it and to do that, we are first going to work through a simple analogy to
illustrate the problem subnetting solves

Subnetting Analogy

● As an analogy imagine a school and we need to split it into classrooms.

● But why split it into classrooms? The answer is to stop classes interfering with one
another.
● Now each classroom has a desk with a computer and we have been tasked with
creating a labeling system for the computers.
● Now say we have 30 classrooms each with a maximum of 30 students and
computers.
● If we assign numbers to our classrooms and computers then we could have for
example: computer 11, classroom 24
● We need two digits for the classroom which would allow for a maximum of 100
classrooms (0-99).
● We need two digits for the computer which would allow for a maximum of 100
computers (0-99).
● If we also say that classroom numbers 0 and 99 and computer numbers 0 and 99
were reserved and not allowed to be assigned then we now have a maximum of 98
classrooms and 98 computers which is enough for our own requirements.
● So, let's create our label we could use the following scheme:
○ computer 11, classroom 24 o 24-11 o 11-24 o 2411 o etc.
● There are many possible permutations we just need to pick one and tell everyone
about the labeling scheme.
● Let's assume we go for 2411 where 24 is the classroom and 11 is the computer.
● So now when we see the following 0223, we now know that this refers to classroom
2 and computer 23.
● This we do easily in our heads once we know the labelling scheme.
● We could even make it easier for ourselves by creating a paper mask that we put
over the label that would reveal the classroom.
IP Addresses and Subnetting

● Just like in our classroom example an IP address is split into two components: a
network component and a node component.
● So, the address [Link] is split into Network plus Node.
● So, is the network number 10, or 10.2 or 10.0.2?
● In early IPv4 networks address classes were used to identify the number of bytes
allocated to the network component.
● The main classes were class A, B, C. With the allocation as follows: o Class A
network,node,node,node o Class B network,network,node,node o Class C
network,network,network,node

27
REDTEAM HACKER ACADEMY

To determine the class, you needed to examine the most significant byte (far left).

● 0-127 Class A
● 128-191 Class B
● 192-ccc Class C

1.9.3 Internet Protocol Version 6 (IPv6)

Internet Protocol Version 6 (IPv6) is an Internet Protocol (IP) used for carrying data in
packets from a source to a destination over various networks. IPv6 is the enhanced version
of IPv4 and can support very large numbers of nodes as compared to IPv4. It allows for 2128
possible node, or address, combinations.

● IPv6 is also known as Internet Protocol Next Generation (IPng).

● It uses 128 bits of data to store an address, permitting 2128 unique addresses, or
340,282,366,920,938,463,463,374,607,431,768,211,456.
● Released June 6, 2012,
● IPv6 was developed in hexadecimal format containing 8 octets to provide large
scalability.
● Like IPv4, IPv6 deals with address broadcasting without containing broadcast
addresses in any class.

28
REDTEAM HACKER ACADEMY

1.9.4 Dynamic and Static IP Address

IP addresses can be either static or dynamic. Static IP addresses never change. They serve
as a permanent Internet address and provide a simple and reliable way for remote
computers to contact you. Static IP addresses reveal such information as the continent,
country, region, and city in which a computer is located; the ISP (Internet Service Provider)
that services that particular computer; and such technical information as the precise latitude
and longitude of the country, as well as the locale, of the computer. Many websites provide
IP address lookup services to their visitors, free of charge. If you're curious about your own
IP address, you can locate these websites by performing a Google search.

Dynamic IP addresses

Dynamic IP addresses are temporary and are assigned (via DHCP) each time a computer
joins a network. They are, in effect, borrowed from a pool of IP addresses that are shared
among various computers. Since a limited number of static IP addresses are available, many
ISPs reserve a portion of their assigned addresses for sharing among their subscribers in

29
REDTEAM HACKER ACADEMY

this way. This lowers costs and allows them to service far more subscribers than they
otherwise could.

Static IP addresses

Static IP addresses are generally preferable for such uses as VOIP (Voice over Internet
Protocol), online gaming, or any other purpose where users need to make it easy for other
computers to locate and connect to them. Easy access can also be facilitated when using a
dynamic IP address through the use of a dynamic DNS service, which enables other
computers to find you even though you may be using a temporary, one-time IP address. This
often entails an extra charge, however, so check with your ISP.

Static IP addresses are considered somewhat less secure than dynamic IP addresses, since
they are easier to track for data mining purposes. However, following safe Internet practices
can help mitigate this potential problem and keep your computer secure no matter what type
of IP address you use.

1.9.5 PRIVATE IP ADDRESS

In short, private IP addresses are used "inside" a network, like the one you probably run at
home. These types of IP addresses are used to provide a way for your devices to
communicate with your router and all the other devices in your private network. Private IP
addresses can be set manually or assigned automatically by your router.

1.9.6 PUBLIC IP ADDRESS

Public IP addresses are used on the "outside" of your network and are assigned by your ISP
(Internet Service Provider). It's the main address that your home or business network uses to
communicate with the rest of the networked devices around the world (i.e. the internet). It
provides a way for the devices in your home, for example, to reach your ISP, and therefore
the outside world, allowing them to do things like access websites and communicate directly
with other people's computers. Both private IP addresses and public IP addresses are either
dynamic or static, which means that, respectively, they either change or they don't.

30
REDTEAM HACKER ACADEMY

1.10 TCP

TCP stands for transmission control protocol. It is implemented in the transport layer of the
IP/TCP model and is used to establish reliable connections. TCP is one of the protocols that
encapsulates data into packets. It then transfers these to the remote end of the connection
using the methods available on the lower layers. On the other end, it can check for errors,
request certain pieces to be resent, and reassemble the information into one logical piece to
send to the application layer.

The protocol builds up a connection prior to data transfer using a system called a three- way
handshake. This is a way for the two ends of the communication to acknowledge the request
and agree upon a method of ensuring data reliability. After the data has been sent, the
connection is turned down using a similar four-way handshake. TCP is the protocol of choice
for many of the most popular uses for the internet, including WWW, FTP, SSH, and email. It
is safe to say that the internet we know today would not be here without TCP.

TCP PACKET STRUCTURE

THREE-WAY HANDSHAKE

A three-way handshake is a method used in a TCP/IP network to create a connection

between a local host/client and server. It is a three-step method that requires both the client
and server to exchange SYN and ACK (acknowledgment) packets before actual data
communication begins.

31
REDTEAM HACKER ACADEMY

1.11 UDP

UDP stands for user datagram protocol. It is a popular companion protocol to TCP and is
also implemented in the transport layer. The fundamental difference between UDP and TCP
is that UDP offers unreliable data transfer. It does not verify that data has been received on
the other end of the connection. This might sound like a bad thing, and for many purposes, it
is. However, it is also extremely important for some functions. Because it is not required to
wait for confirmation that the data was received and forced to resend data, UDP is much
faster than TCP. It does not establish a connection with the remote host, it simply fires off the
data to that host and doesn't care if it is accepted or not. Because it is a simple transaction, it
is useful for simple communications like querying for network resources. It also doesn't
maintain a state, which makes it great for transmitting data from one machine to many real-
time clients. This makes it ideal for VOIP, games, and other applications that cannot afford
delays.

1.12 TCP VS UDP

TCP UDP

Connection oriented protocol Connection less

https, http, telnet, ftp VOIP, video streaming, dhcp, SNMP

High reliability Low reliability

Speed is lower than udp Faster

There is absolute guarantee in data There is no guarantee

transfer

Header size 20 bytes Header size is 8 bites

Heavy size Lightweight protocol

Tcp does flow control, error checking Does have an option for flow control

32
REDTEAM HACKER ACADEMY

LINUX FOR HACKERS

33
REDTEAM HACKER ACADEMY

2.1 OBJECTIVE

Kali Linux is used for penetration testing. Or you can say ethical hacking, can also be used
for unethical hacking too. In simple words its customized Ubuntu with testing software. Also,
it has very less network interaction to keep the system hidden on the network. To familiarize
how to install kali Linux and Linux basic commands. Some tips and tricks for using Linux
commands are included in this module. Virtual environment is the best way to practice ethical
hacking. The concept of virtualization is included to understand VMware and VirtualBox
working.

2.2 INTRODUCTION TO LINUX

Linux is an operating system or a kernel. It is distributed under an open source license. Its
functionality list is quite like UNIX.

● Linux Kernel Plus Additional Software - It is the Linux Kernel and a collection of
software that together create an operating system.
● Each distribution can have a different focus - Your choice of distribution will depend
on what you are trying to accomplish.

There are literally hundreds of Linux distributions. Here are some popular Linux distributions:

● Red Hat Enterprise Linux

● Fedora
● Ubuntu
● CentOS
● OpenSUSE

Best Linux hacking distributions

These Linux distros provide various tools that are needed for assessing networking security
and other similar tasks.

1. Kali Linux

Kali Linux is the most widely known Linux distro for ethical hacking and penetration testing.
Kali Linux was developed by Offensive Security taking on the mantle of Backtrack. The only
reason for most pentesters using Kali Linux is the feature of network activity managed by its
developers. Kali Linux is based on Debian. It comes with a large amount of penetration
testing tools from various fields of security and forensics. It is the most advanced penetration
testing platform out there. It supports a wide range of devices and hardware platforms.
Moreover, Kali Linux provides decent documentation and a large & active community. You
can easily install Kali Linux in VirtualBox inside Windows and start your hacking practice right
away.

34
REDTEAM HACKER ACADEMY

2. BackBox

BackBox is a Ubuntu-based distro developed for penetration testing and security assessment
purpose. It is one of the best distros in its field. BackBox has its own software repository
providing the latest stable versions of various system & network analysis toolkits and the
best-known ethical hacking tools. It is designed with minimalism in mind and uses the XFCE
desktop environment. It delivers a fast, effective, customizable and complete experience. It
also has a very helpful community behind it.

3. Parrot Security OS

Parrot Security OS is relatively new in the game. Frozen box Network is behind the
development of this distro. The target users of Parrot Security OS are penetration testers
who need a cloud-friendly environment with online anonymity and encrypted system. Parrot
Security OS is also based on Debian and uses MATE as its desktop environment. Almost
every recognized tool for penetration testing is available here, along with some exclusive
custom tools from Frozen box Network. And yes, it is available as Rolling Release.

35
REDTEAM HACKER ACADEMY

4. BlackArch

BlackArch is a penetration testing and security researching distro built on top of Arch Linux.
Black Arch has its own repository containing thousands of tools organized in various groups.
And the list is growing over time. If you are already an Arch Linux user, you can setup Black
Arch tools collection on top of it.

5. Bugtraq

Bugtraq is a Linux distro with a huge range of penetration, forensic and laboratory tools.
Bugtraq is available with XFCE, GNOME and KDE desktop environments based on Ubuntu,
Debian, and OpenSUSE. It is also available in 11 different languages. Bugtraq packs a huge
arsenal of penetration testing tools – mobile forensics, malware testing laboratories along
with tools specifically designed by the Bugtraq-Community.

36
REDTEAM HACKER ACADEMY

2.3 File System

In computing, a file system controls how data is stored and retrieved. Without a file system,
information placed in a storage medium would be one large body of data with no way to tell
where one piece of information stops and the next begins. By separating the data into pieces
and giving each piece a name, the information is easily isolated and identified. The structure
and logic rules used to manage the groups of information and their names are called a "file
system".

Unix and Unix-like operating systems

Unix-like operating systems create a virtual file system, which makes all the files on all the
devices appear to exist in a single hierarchy. This means, in those systems, there is one root
directory, and every file existing on the system is located under it somewhere. Unix-like
systems can use a RAM disk or network shared resource as its root directory.

Linux

Linux supports numerous file systems, but common choices for the system disk on a block
device include the ext* family (ext2, ext3, and ext4), XFS, JFS, and btrfs. For raw flash
without a flash translation layer (FTL) or Memory Technology Device (MTD), there are UBIFS,
JFFS2 and YAFFS, among others. SquashFS is a common compressed read-only file
system.

37
REDTEAM HACKER ACADEMY

Linux File Hierarchy Structure

2.4 Install Kali Linux

Installation Requirements

● Minimum 20 GB of free space in your hard drive is recommended.

● Minimum 1 GB of ram, recommended: 2 GB or more in Hard Disk install or dual boot
installation but if you are opting for installing it with virtualization in your current OS
(VirtualBox) then at least 4 GB of ram is recommended.
● CD-DVD Drive / USB Support

Getting Started with Installation

● Download Kali Linux [Link]

● Burn the kali ISO to DVD or make a bootable pen drive with Rufus or you can opt for
virtualization in your current OS with virtual-box (select Linux Type Debian -> VDI
hard disk type dynamically allocated & load the Kali ISO that you have downloaded.

38
REDTEAM HACKER ACADEMY

Installation Procedure

STEP 1: Boot with your chosen medium or load the Kali ISO. Below shown screen must
appear, choose the graphical install (recommended for new users)

STEP 2: Select your preferred language.

STEP 3: Select your geographical location.

STEP 4: Select the preferred keyboard, then the loader will automatically install the
additional components from CD, then it will configure your network related settings.

39
REDTEAM HACKER ACADEMY

STEP 5: Let kali be your hostname & hit continue.

STEP 6: You may optionally provide a default domain name for this system to use or you can
keep it blank and can continue.

STEP 7: Set a password for your Kali Machine & hit continue.

Step 8: The installer will now offer you four choices about the partitions of the disk. In our
case, we are using the entire disk on our computer and not configuring LVM (logical volume
manager). Experienced users can use the “Manual” partitioning method for more granular
configuration options.

40
REDTEAM HACKER ACADEMY

Step 9: Select the partitioning disk, recommended option is all files in one partition for new
users & then hit on continue.

Step 10: Select finish partitioning and write changes to disk then hit continue
-> Select Yes to write changes to the disk and click on continue

41
REDTEAM HACKER ACADEMY

Let it install the system automatically, this may take a while

Step 11: Configure network mirrors. Kali uses a central repository to distribute applications,
select Yes on mirror network & hit on continue.
--> keep HTTP proxy information blank on the next screen and hit continue.

NOTE: If you select “No” on this screen then you will not be able to install packages from kali
repositories. Click here to manually install Kali repositories if you have selected “No” by
mistake or if there is any error while installation. Let the installation get completed and then
you can manually install kali repositories by the instructions given on this link :
[Link]

Let it configure the package manager related files then...

Step 12: Install the grub boot loader manually so select Yes & hit on continue

42
REDTEAM HACKER ACADEMY

Step 13: Finally, click on continue to finish the installation, it will install some final stage files
and after it is completely done, your security related weapons loaded Kali is ready to roll!

Update and Upgrade Sources list and Kali Linux

The Kali Linux source list is found on the directory ‘/etc/apt/’ and this list is name as sources
List.

1. Copy the repositories from the website -

[Link]

43
REDTEAM HACKER ACADEMY

2. Open terminal and type this command to open the [Link]

leafpad /etc/apt/[Link]

3. Clear everything from the file and paste the copied repository then save and close the file.

4. Come back to the terminal and execute this command to update your kali Linux.

apt-get update

5. Execute any of this command to upgrade your kali Linux.

apt-get upgrade or apt dist-upgrade

Setting up a Pentest Lab in Kali Linux

Building a virtual lab inside the kali Linux machine is more important because you can pen
test everything on there so there is no need for other real systems. Here you can up any
operating system on the VirtualBox in kali Linux. It’s not very difficult. Just execute the
following command to install the VirtualBox on your kali Linux. Then you can put any OS on
there and go on with happy hacking!

apt-get install virtualbox*

install metasploitable2 machine

([Link]

2.5 Virtualization

Virtualization is the process of creating a software-based, or virtual, representation of

something, such as virtual applications, servers, storage and networks. It is the single most
effective way to reduce IT expenses while boosting efficiency and agility for all size
businesses.

Benefits of Virtualization

Virtualization can increase IT agility, flexibility and scalability while creating significant cost
savings. Greater workload mobility, increased performance and availability of resources,
automated operations – they’re all benefits of virtualization that make IT simpler to manage
and less costly to own and operate.

44
REDTEAM HACKER ACADEMY

Additional benefits include:

● Reduced capital and operating costs.

● Minimized or eliminated downtime.
● Increased IT productivity, efficiency, agility and responsiveness.
● Faster provisioning of applications and resources.
● Greater business continuity and disaster recovery.
● Simplified data center management.
● Availability of a true Software-Defined Data Center.

HOW VIRTUALIZATION WORKS

Due to the limitations of x86 servers, many IT organizations must deploy multiple servers,
each operating at a fraction of their capacity, to keep pace with today’s high storage and
processing demands. The result: huge inefficiencies and excessive operating costs.
Virtualization relies on software to simulate hardware functionality and create a virtual
computer system. This enables IT organizations to run more than one virtual system – and
multiple operating systems and applications – on a single server. The resulting benefits
include economies of scale and greater efficiency.

Virtual Machines Explained

A virtual computer system is known as a “virtual machine” (VM): a tightly isolated software
container with an operating system and application inside. Each self-contained VM is
completely independent. Putting multiple VMs on a single computer enables several
operating systems and applications to run on just one physical server, or “host.” A thin layer
of software called a “hypervisor” decouples the virtual machines from the host and
dynamically allocates computing resources to each virtual machine as needed. Key
Properties of Virtual Machines VMs have the following characteristics, which offer several
benefits.

Partitioning

● Run multiple operating systems on one physical machine.

● Divide system resources between virtual machines.

Isolation

● Provide fault and security isolation at the hardware level.

● Preserve performance with advanced resource controls.

Encapsulation

● Save the entire state of a virtual machine to files.

● Move and copy virtual machines as easily as moving and copying files.

45
REDTEAM HACKER ACADEMY

Hardware Independence

● Provision or migrate any virtual machine to any physical server.

2.5.1 Types of Virtualization

Server Virtualization

Server virtualization enables multiple operating systems to run on a single physical server as
highly efficient virtual machines. Key benefits include:

● Greater IT efficiencies
● Reduced operating costs
● Faster workload deployment
● Increased application performance
● Higher server availability
● Eliminated server sprawl and complexity

Network Virtualization

By completely reproducing a physical network, network virtualization allows applications to

run on a virtual network as if they were running on a physical network — but with greater
operational benefits and all the hardware independencies of virtualization. (Network
virtualization presents logical networking devices and services — logical ports, switches,
routers, firewalls, load balancers, VPNs and more — to connected workloads.).

Desktop Virtualization

Deploying desktops as a managed service enables IT organizations to respond faster to

changing workplace needs and emerging opportunities. Virtualized desktops and
applications can also be quickly and easily delivered to branch offices, outsourced and
offshore employees, and mobile workers using iPad and Android tablets.

Virtualization vs. Cloud Computing

Although equally buzz-worthy technologies, virtualization and cloud computing are not
interchangeable. Virtualization is software that makes computing environments independent
of physical infrastructure, while cloud computing is a service that delivers shared computing
resources (software and/or data) on demand via the Internet. As complementary solutions,
organizations can begin by virtualizing their servers and then moving to cloud computing for
even greater agility and self-service.

46
REDTEAM HACKER ACADEMY

2.6 Linux Shell or “Terminal”

So, basically, a shell is a program that receives commands from the user and gives it to the
OS to process, and it shows the output. Linux shell is its main part. Its distros come in GUI
(graphical user interface), but basically, Linux has a CLI (command line interface). In this
tutorial, we are going to cover the basic commands that we use in the shell of Linux. To open
the terminal, press Ctrl+Alt+T in Ubuntu, or press Alt+F2, type in gnome-terminal, and press
enter. In Raspberry Pi, type in lxterminal. There is also a GUI way of taking it, but this is
better!

2.6.1 Different Types of Shell

Bash Shell

Bash stands for Bourne Again Shell and it is the default shell on many Linux distributions
today. It is also a sh-compatible shell and offers practical improvements over sh for
programming and interactive use which includes:

● Command line editing

● Job Control
● Unlimited size command history
● Shell Functions and Aliases
● Unlimited size Indexed arrays
● Integer arithmetic in any base from two to sixty-four

Tcsh/Csh Shell

Tcsh is an enhanced C shell, it can be used as an interactive login shell and shell script
command processor. Tcsh has the following features:

● C like syntax
● Command-line editor
● Programmable word and filename completion
● Spelling correction
● Job control

Ksh Shell

Ksh stands for Korn shell and was designed and developed by David G. Korn. It is a
complete, powerful, high-level programming language and also an interactive command
language just like many other Unix/GNU Linux shells.

47
REDTEAM HACKER ACADEMY

2.7 Linux Basic Commands

1. pwd - When you first open the terminal, you are in the home directory of your user. To
know which directory you are in, you can use the “pwd” command. It gives us the absolute
path, which means the path that starts from the root. The root is the base of the Linux file
system. It is denoted by a forward slash( / ). The user directory is usually something like
"/home/username".

2. ls - Use the "Is" command to know what files are in the directory you are in. You can see
all the hidden files by using the command “ls -a”.

3. cd - Use the "cd" command to go to a directory. For example, if you are in the home folder,
and you want to go to the downloads folder, then you can type in “cd Downloads”.
Remember, this command is case sensitive, and you have to type in the name of the folder
exactly as it is. To go back from a folder to the folder before that, you can type “cd ..” . The
two dots represent back.

4. mkdir & rmdir — Use the mkdir command when you need to create a folder or a directory.
For example, if you want to make a directory called “DIY”, then you can type “mkdir
REDTEAM”. Remember, as mentioned before, if you want to create a directory named
“REDTEAM Hacking”, then you can type “mkdir REDTEAM\ Hacking”. Use rmdir to delete a
directory. But rmdir can only be used to delete an empty directory. To delete a directory
containing files, use rm.

48
REDTEAM HACKER ACADEMY

5. rm - Use the rm command to delete files and directories. But rm cannot simply delete a
directory. Use “rm -r” to delete a directory recursively. In this case, it deletes both the folder
and the files in it. Use “rm -rf” to delete a directory recursively and forcefully.

6. touch - The touch command is used to create a file. It can be anything, from an empty txt
file to an empty zip file. For example, “touch [Link]”.

7. man & --help - To know more about a command and how to use it, use the man
command. It shows the manual pages of the command. For example, “man cd” shows the
manual pages of the cd command. Typing in the command name and the argument helps it
show which ways the command can be used (e.g., cd –help).

49
REDTEAM HACKER ACADEMY

8. cp - Use the cp command to copy files through the command line. It takes two arguments:
The first is the location of the file to be copied, the second is where to copy. You can also
use cp -r for copy the file recursively. That means copying the file also including the folder.

9. mv — Use the mv command to move files through the command line. We can also use the
mv command to rename a file. For example, if we want to rename the file “[Link]” to
“[Link]”, we can use “mv filename”. It takes the two arguments, just like the cp command.

50
REDTEAM HACKER ACADEMY

2.8 Intermediate Commands

10. echo - The "echo" command helps us move some data, usually text into a file. For
example, if you want to create a new text file or add to an already made text file, you just
need to type in, “echo hello, my name is alok >> [Link]”. You do not need to separate the
spaces by using the backward slash here, because we put in two triangular brackets when
we finish what we need to write.

11. cat - Use the cat command to display the contents of a file. It is usually used to easily
view programs.

12. nano, vi, jed - nano and vi are already installed text editors in the Linux command line.
The nano command is a good text editor that denotes keywords with color and can recognize
most languages

13. hostname — Use hostname to know your name in your host or network. Basically, it
displays your hostname and IP address. Just typing “hostname” gives the output. Typing in
“hostname -I” gives you your IP address in your network.

51
REDTEAM HACKER ACADEMY

2.9 Tips and Tricks for Using Linux Command Line

● You can use the clear command to clear the terminal if it gets filled up with too many
commands.
● TAB can be used to fill up the terminal. For example, you just need to type “cd Doc”
and then TAB and the terminal fills the rest up and makes it “cd Documents”.
● Ctrl+C can be used to stop any command in the terminal safely. If it doesn't stop with
that, then Ctrl+Z can be used to force stop it.
● You can exit from the terminal by using the exit command.
● You can power off or reboot the computer by using the command sudo halt and sudo
reboot.

52
REDTEAM HACKER ACADEMY

CYBER SECURITY 101

53
REDTEAM HACKER ACADEMY

3.1 Objective

Information is a critical part of any organization and investing on the right service provider
keeps your business in safe hands in the ever-expanding IoT (Internet of Things) world. A
scalable and customized cyber security-driven business model includes disaster-recovery
capabilities and secures data and the underlying infrastructure of the organization, thus
building a safe barrier for the information even before it is attacked and saving the
organization from a loss of billions of dollars that could result from the security threat. We
need to think the same way Before hackers come and exploit. In this module we are going to
study about offensive approach in cyber security that include

● Information Security Threat

● Hacking Phases
● TOR
● VPN
● OSINT
● Scanning methodologies, tools
● Enumeration
● Exploitation
● Privilege Escalation
● Malware
● Wireless Attack

3.2 Basic Terminology

White Hat Hacker: A white hat hacker is a computer security specialist ( ethical hacker )
who breaks into secured systems and networks to test and assess their level of security.
These are the good guys in the hacking community and use their skills and knowledge to
improve security by exposing vulnerabilities before a malicious hacker (also known as black
hat hackers) detects and exploits them.

Black Hat Hacker: A black hat hacker is an individual with very good computer knowledge
and with a sole purpose to bypass or breach internet security for malicious reasons. Black
hat hackers are also known as dark-side hackers or crackers. These are the guys with whom
White hat hackers have to fight all the time.

Grey Hat Hacker: The term Grey Hat hacker refers to a computer hacker or computer
security expert who sometimes violate laws or typical ethical standards, for personal
purposes but don’t have malicious intentions like a typical black hat hacker. Script Kiddie: A
Skiddie or Script Kiddie is an unskilled individual who uses programs or scripts developed by
other hackers to attack networks and computer systems even to deface websites.

Breach: The moment a hacker successfully exploits a vulnerability in a computer or device,

and gains access to its files and network.

Back door: A back door, or trap door, is a hidden entry to a computing device or software

54
REDTEAM HACKER ACADEMY

that bypasses security measures, such as logins and password protections.

SE: Social engineering is an attack vector that relies heavily on human interaction and often
involves tricking people into breaking normal security procedures.

Root: Root is the Highest permission level on a computer that allows the user to modify
anything on the system without a single restriction.

SQL: Structured Query Language or SQL is a special-purpose programming language

designed for managing data contained in a relational database management system
(RDBMS), or even for stream processing in a relational data stream management system or
RDSMS.

SQL Injection: SQL injection is a famous code injection technique, commonly to attack data-
driven applications. In this attack, malicious SQL statements are inserted into an entry field
for execution.

FUD: Fully undetectable or FUD in short, can stand for data that had been encrypted,
making it appear to be random noise. This term is used in hacker circles to refer to
something as a clean software to many anti-viruses but still contain some kind of hacking tool
inside it.

Trojan: A Trojan or Trojan horse is a type of malware that disguises itself as a legitimate
software. These Trojans can be employed by hackers and cyber-thieves trying to gain
access to users’ systems. Users are typically tricked into loading and executing Trojans on
their systems.

Macro Virus: (i.e. malicious software) that uses the macro capabilities of common
applications such as spreadsheets and word processors to infect data.

Malware: Software intended to infiltrate and damage or disable computers. Shortened form
of malicious software.

Worm: A computer worm is a standalone malware computer program that replicates itself in
order to spread to other computers. Often, it uses a computer network to spread itself, relying
on security failures on the target computer to access it. Unlike a computer virus, it does not
need to attach itself to an existing program.

RAT: A remote administration tool (RAT) is a piece of software that allows a remote
“operator” to control a system as if he has physical access to that system. While desktop
sharing and remote administration have many legal uses, “RAT” software is usually
associated with criminal or malicious activity.

Botnet: A botnet (also known as a zombie army) is a number of Internet computers that,
although their owners are unaware of it, have been set up to forward transmissions (including
spam or viruses) to other computers on the Internet.

55
REDTEAM HACKER ACADEMY

Keylogger: Keylogger is a computer program that records every keystroke made by a

computer user, especially in order to gain fraudulent access to passwords and other
confidential information.

IP Grabber: IP Grabber is a link that grabs a victim's IP when they visit it.

DDoS: DDoS means Distributed Denial of Service. This is a type of DOS attack in which
multiple compromised systems are used and these systems are often infected with a Trojan.
All these infected systems select a target and cause a Denial of Service (DoS) attack.

Phishing: Method used by criminals to try to obtain financial or other confidential information
(including usernames and passwords) from internet users, usually by sending an email that
looks as though it has been sent by a legitimate organization (often a bank). The email
usually contains a link to a fake website that looks authentic.

Brute force attack: A brute force attack is an automated and the simplest kind of method to
gain access to a system or website. It tries different combination of usernames and
passwords, over and over again, until it gets in.

Spam: A Spam is simply an unsolicited email, also known as junk email, sent to a large
number of recipients without their consent.

Spoofing: Spoofing is a technique used to gain unauthorized access to computers, whereby

the intruder sends messages to a computer with an IP address indicating that the message is
coming from a trusted host.

3.3 Information Security Threat Categories

Network Threats

● Information gathering
● Sniffing and eavesdropping
● Spoofing
● Session hijacking and Man-In-The-Middle attack
● DNS and ARP Poisoning
● Password-based attack
● Denial-of-Service attack
● Compromised-key attack
● Firewall and IDS attack

Host Threats

● Malware attacks
● Foot printing
● Password attacks
● Denial-of-Service attacks

56
REDTEAM HACKER ACADEMY

● Arbitrary code execution

● Privilege escalation
● Backdoor attacks
● Physical security threats

Application Threats

● Improper data/input validation

● Authentication and Authorization attacks
● Security misconfiguration
● Information disclosure
● Broken session management
● Buffer overflow issues
● Cryptography attacks
● SQL injection
● Improper error handling and exception management

3.4 CIA Triad of Information Security

The CIA (Confidentiality, Integrity, and Availability) triad of information security is an

information security benchmark model used to evaluate the information security of an
organization. The CIA triad of information security implements security using three key areas
related to information systems including confidentiality, integrity and availability.

The CIA triad of information security was created to provide a baseline standard for
evaluating and implementing information security regardless of the underlying system and/or
organization. The three core goals have distinct requirements and processes within each
other.

Confidentiality: Confidentiality is roughly equivalent to privacy. Measures undertaken to

ensure confidentiality are designed to prevent sensitive information from reaching the wrong
people. User Id and passwords, access control lists (ACL) and policy-based security are

57
REDTEAM HACKER ACADEMY

some of the methods through which confidentiality is achieved.

Integrity: integrity involves maintaining the consistency, accuracy, and trustworthiness of

data over its entire life cycle. Data must not be changed in transit, and steps must be taken
to ensure that data cannot be altered by unauthorized people. Data encryption and hashing
algorithms are key processes in providing integrity.

Availability: Data and information systems are available when required. Hardware
maintenance, software patching/upgrading and network optimization ensures availability.

3.5 Hacking Phases

Intelligence Gathering

Reconnaissance

● refers to the preparation phase where an attacker seeks to gather information about a
target prior to launching an attack
● Could be the future point of return, noted for ease of entry for an attack when more
about the target is known on a broad scale
● Reconnaissance target range may include target organization’s clients, employees,
operations, network, and systems
● Passive reconnaissance means acquiring information without direct interacting with
the target
● Active reconnaissance means acquiring information directly interacting with the target

Scanning

● Pre-Attack Phase: Scanning refers to the pre-attack phase when the attacker scan
the network for specific information on the basis of information gathered during
reconnaissance
● Port Scanner: Scanning can include use of dialers, port scanners, network mappers,
ping tools, vulnerability scanners, etc.
● Extract Information: Attackers extract information such as live machines, port, port
status, OS details, device type, system uptime, etc. to launch attack

Gaining Access

● Gaining access refers to the point where the attacker obtains access to the operating
system or applications on the computer or network
● The attacker can gain access at the operating system level, application level, or
network level
● The attacker can escalate privileges to obtain complete control of the system. In the
process, intermediate systems that are connected to it are also compromised

58
REDTEAM HACKER ACADEMY

Maintaining Access

● Maintaining access refers to the phase when the attacker tries to retain his or her
ownership of the system
● Attacker may prevent the system from being owned by other attackers by securing
their exclusive access with Backdoors, Rootkits, or Trojans
● Attackers can upload, download, or manipulate data application, and configurations
on the owned system
● Attackers use the compromised system to launch further attacks

Clearing Tracks

● Covering tracks refers to the activities carried out by an attacker to hide malicious
acts The attacker’s intentions include: continuing access to the victim’s system,
remaining unnoticed and uncaught, deleting evidence that might lead to his
prosecution
● The attacker overwrites the server, system, and application logs to avoid suspicious

3.6 Penetration Testing Methodologies and Standards

PTES (Penetration Testing Methodologies and Standards)

Penetration testing involves everything from initial communication to information gathering

and covers the threat modelling phase, which involves testers to understand the organization.
A basic penetration testing model consists of seven phases.

● Pre-engagement Interactions
● Intelligence Gathering
● Threat Modeling
● Vulnerability Analysis
● Exploitation
● Post Exploitation
● Reporting

59
REDTEAM HACKER ACADEMY

ANONYMITY AND VPN

60
REDTEAM HACKER ACADEMY

4.1 OBJECTIVE

Privacy is “workings of your mind”. We share our personal moments captured in images,
credit card details, thoughts that are personal or professional with a person or a certain group
at different instances of time and want it to be safe and secure. We use an electronic gadget
to share something trusting blindly the service provider company which may have to obey
some unveiled laws of that country to which it belongs and our data might be at risk. In this
we will cover the importance of Anonymity and the usage of Virtual Private Networks

4.2 TOR the Anonymity Network

Tor is an Internet networking protocol designed to anonymize the data relayed across it.
Using Tor's software will make it difficult, if not impossible, for any snoops to see your
webmail, search history, social media posts or other online activity. They also won't be able
to tell which country you're in by analyzing your IP address

4.2.1 Why we need TOR

Using Tor protects you against a common form of Internet surveillance known as "traffic
analysis." Traffic analysis can be used to infer who is talking to whom over a public network.
Knowing the source and destination of your Internet traffic allows others to track your
behavior and interests. This can impact your checkbook if, for example, an e-commerce site
uses price discrimination based on your country or institution of origin. It can even threaten
your job and physical safety by revealing who and where you are. For example, if you're
travelling abroad and you connect to your employer's computers to check or send mail, you
can inadvertently reveal your national origin and professional affiliation to anyone observing
the network, even if the connection is encrypted.

How does traffic analysis work? Internet data packets have two parts: a data payload and a
header used for routing. The data payload is whatever is being sent, whether that's an email
message, a web page, or an audio file. Even if you encrypt the data payload of your
communications, traffic analysis still reveals a great deal about what you're doing and,
possibly, what you're saying. That's because it focuses on the header, which discloses
source, destination, size, timing, and so on.

A basic problem for the privacy minded is that the recipient of your communications can see
that you sent it by looking at headers. So, can authorized intermediaries like Internet service
providers, and sometimes unauthorized intermediaries as well. A very simple form of traffic
analysis might involve sitting somewhere between sender and recipient on the network,
looking at headers. But there are also more powerful kinds of traffic analysis. Some attackers
spy on multiple parts of the Internet and use sophisticated statistical techniques to track the
communications patterns of many different organizations and individuals. Encryption does
not help against these attackers, since it only hides the content of Internet traffic, not the
headers.

61
REDTEAM HACKER ACADEMY

Tor helps to reduce the risks of both simple and sophisticated traffic analysis by distributing
your transactions over several places on the Internet, so no single point can link you to your
destination. The idea is similar to using a twisty, hard-to-follow route in order to throw off
somebody who is tailing you — and then periodically erasing your footprints. Instead of
taking a direct route from source to destination, data packets on the Tor network take a
random pathway through several relays that cover your tracks so no observer at any single
point can tell where the data came from or where it's going.

To create a private network pathway with Tor, the user's software or client incrementally
builds a circuit of encrypted connections through relays on the network. The circuit is
extended one hop at a time, and each relay along the way knows only which relay gave it
data and which relay it is giving data to. No individual relay ever knows the complete path
that a data packet has taken. The client negotiates a separate set of encryption keys for
each hop along the circuit to ensure that each hop can't trace these connections as they
pass through.

Once a circuit has been established, many kinds of data can be exchanged and several
different sorts of software applications can be deployed over the Tor network. Because each
relay sees no more than one hop in the circuit, neither an eavesdropper nor a compromised
relay can use traffic analysis to link the connection's source and destination. Tor only works

62
REDTEAM HACKER ACADEMY

for TCP streams and can be used by any application with SOCKS support.

For efficiency, the Tor software uses the same circuit for connections that happen within the
same ten minutes or so. Later requests are given a new circuit, to keep people from linking
your earlier actions to the new ones.

4.2.2 Installing TOR Browser

Install From apt-get

The first step is to install the Tor services from the Kali repositories by using apt-get.
apt-get install tor

By Downloading Tor Bundle

1. Download tor browser from the official Tor website

[Link]

You can see that there are two download buttons that says 64 bit or 32 bit. You can choose
32 bit if your computer is only compatible to 32 bit but I personally think that most computers
can handle 64 bit.

2. Extract the downloaded file

3. Go to your extracted folder and open a terminal from there. To open a terminal, simply
right click once and select "open in terminal". Once you've open a terminal from the folder,
run this command

./start-tor-browser

63
REDTEAM HACKER ACADEMY

Optional: If You Run As Root

If you’re running Kali Linux as root, you’ll get an error saying you can’t run Tor as root. You
can run the following commands to comment out this check and run Tor as root:

1. Go to the tor folder and open terminal there and type this and hit enter leafpad start-tor-
browser

2. Comment these lines

if [ “`id -u`” -eq 0 ]; then

complain “The Tor Browser Bundle should not be run as root. Exiting.”
exit 1
Fi

Like this.

#if [ “`id -u`” -eq 0 ]; then

#complain “The Tor Browser Bundle should not be run as root. Exiting.”
#exit 1
#fi

3. Save the file.

4.3 VPN or Virtual Private Network

A Virtual Private Network is a connection method used to add security and privacy to private
and public networks. Privacy is increased with a VPN because the user's initial IP address is
replaced with one from the Virtual Private Network provider. Subscribers can obtain an IP
address from any gateway city the VPN service provides.

How Does a VPN Work?

Here’s how a VPN works for you, the user. You start the VPN client (software) from your
VPN service. This software encrypts your data, even before your Internet Service Provider or
the coffee shop Wi-Fi provider sees it. The data then goes to the VPN, and from the VPN
server to your online destination.

When you connect to the web without a VPN, here’s how your connection looks:

64
REDTEAM HACKER ACADEMY

Though it’s the standard, this sort of connection has some flaws. All of your data is out there
in the open, and any interested party can peek at what you’re sending. The internet is a
collection of servers responsible for storing websites and serving them to anyone who wants
to view them. Those servers talk with each other all the time, including sharing your data with
each other to ultimately let you browse a page. Great for you to be able to surf, but not great
for privacy.

Now, here’s how the same connection looks with a VPN enabled:

When you use a VPN service, your data is encrypted (because you’re using their app), goes
in encrypted form to your ISP then to the VPN server. The VPN server is the third party that
connects to the web on your behalf. This solves the privacy and security problem for us in a
couple of ways:

● The destination site sees the VPN server as the traffic origin, not you.
● No one can (easily) identify you or your computer as the source of the data, nor what
you’re doing (what websites you’re visiting, what data you’re transferring, etc.).
● Your data is encrypted, so even if someone does look at what you’re sending, they
only see encrypted information and not raw data.

65
REDTEAM HACKER ACADEMY

4.3.1 Why Do We Need a VPN?

● Hide your IP address

● Connecting to a Virtual Private Network often conceals your real IP address.
● Change your IP address
● Using a VPN will almost certainly result in getting a different IP address.
● Encrypt data transfers
● A Virtual Private Network will protect the data you transfer over public Wi-Fi.
● Mask your location
● With a Virtual Private Network, users can choose the country of origin for their
Internet connection.
● Access blocked websites
● Get around website blocked by governments with a VPN.

How Secure is a VPN?

Security is the main reason why corporations have used VPNs for years. There are
increasingly simple methods to intercept data traveling to a network. Wi-Fi spoofing and Fire
sheep are two easy ways to hack information. A useful analogy is that a firewall protects your
data while on the computer and a VPN protects your data on the web. VPNs use advanced
encryption protocols and secure tunneling techniques to encapsulate all online data transfers.
Most savvy computer users wouldn't dream of connecting to the Internet without a firewall
and up-to-date antivirus. Evolving security threats and ever-increasing reliance on the
Internet make a Virtual Private Network an essential part of well-rounded security. Integrity
checks ensure that no data is lost and that the connection has not been hijacked. Since all
traffic is protected, VPNs are preferred over proxies.

4.3.3 Installing VPN

Setting up a Virtual Private Network is a straightforward process. It's often as simple as

entering a username and server address. The dominant smartphones can configure Virtual
Private Networks using PPTP and L2TP/IPsec protocols. All major operating systems can
configure PPTP VPN connections. OpenVPN and L2TP/IPsec protocols require a small open
source application (OpenVPN) and certificate download respectively.

Setup Free VPN from VPNBOOK

● Goto the website vpnbook and download the free vpn

[Link] (Note the username and password given at the
bottom of the free vpn section on the website)
● Extract the downloaded file and open the terminal on the extracted folder. Now you
see a number of files on the folder.

66
REDTEAM HACKER ACADEMY

● You can execute this files by using this command openvpn filename

● Now it asks for the username and password. Enter the username and password we
got from the website

● Now our vpn is okay and you can check your IP address.

67
REDTEAM HACKER ACADEMY

OPEN SOURCE INTELLIGENCE TOOLS

68
REDTEAM HACKER ACADEMY

5.1 OBJECTIVE

Open-source Intelligence or OSINT is a part of the reconnaissance process that consists of

using any online public intelligence that can provide information about a company,
organization, or individuals. It’s a collection of data from public sources to be used in an
intelligence context, and this type of information is often missed by link crawling search
engines such as Google. Also, as per DoD, OSINT is “produced from publicly available
information that is collected, exploited, and disseminated in a timely manner to an
appropriate audience for addressing a specific intelligence requirement. As an ethical hacker,
you can use the data when performing target reconnaissance.

5.2 What kind of information can you get from the OSINT sources?

OSINT can be very informative if you use it properly, it gives you a general idea of what you
are trying to get through. The following list contains some helpful interests you can obtain
with OSINT:

● An overview of the Headquarter of the target company and its branches and their
specializations (some branches might have sensitive information than others).
● Associated companies and partners whom might have some kind of partnership with
the target.
● What type of technology the target utilizes to provide its services? For example, the
vendor that provides the company with network devices and operating systems.
● The target’s official website and its sub-domains.
● Social media accounts (Facebook, Twitter, LinkedIn...) of the company and its
employees or for other individuals too, you can use those data in social engineering
attacks.
● Posts and questions the company employees post in different forums
● newsgroups, to see if there was an issue in the company infrastructure.
● Unsecured devices used by the company
● Domain name server (DNS), IP addresses, metadata, and Statistics.

By the same token, it is awesome how all those significant information you can find just by
using search engines (like Google, Bing, DuckDuckGo, and Yahoo) are available to public,
you can use those search engines in a specific way (Google Dorks for example), this will
guarantee you fetching more efficacious results (a list of other search engines will be
available for you later in this article). the expected effect of this is to make it easy for you to
find your way into the target’s privacy.

Keep in mind that the number of results you can collect depends on the aim of the search.
For example, some sensitive information like a military database or government
documents...etc. cannot be found easily (unless this information was leaked to the public).

5.3 OSINT Tools

There are various tools you can use when trying to access to public information. This list

69
REDTEAM HACKER ACADEMY

contains some of the major tools and websites used to collect different information:

Shodan

Shodan is the search engine for everything on the internet. While Google and other search
engines index only the web, Shodan indexes pretty much everything else — web cams,
water treatment facilities, yachts, medical devices, traffic lights, ports, wind turbines, license
plate readers, smart TVs, refrigerators, anything and everything you could possibly imagine
that's plugged into the internet (and often shouldn't be).

Using Shodan Example

By searching Port

Not only the devices but it can help to find which port is open in which device. For example, I
have here searched port: 1723. Now we all know this port is used for VPN so through this we
can know which device is using VPN as shown in the image below:

Webcam

When you search for a webcam, it will show you all the webcam present in the world. It will
show the results as shown in the image below:

70
REDTEAM HACKER ACADEMY

Google Dorks

Search engines do provide us much information, and they index much information, too,
which can be used to gather information about a target. Google dorks provide such
information through the usage of some operators which are otherwise difficult to extract using
simple searches. Below are some of the operators used in Google Dorking:

● Intitle: Looks out for mentioned words in the Page title

● Inurl: Looks out for mentioned words in the URL.
● Filetype: This is used to find file-types.
● Ext: This is used to identify files with specific extensions. Think of using it for finding
such files like .log which are not supposed to be indexed.
● Intext: This helps to search for specific text on the page.

Real examples

"intitle:[Link]:" mp3 jackson – download your favorite music for free

intitle:[Link] +?last modified? +?parent directory? +pdf "lord of the rings" -htm -html -php -
asp – download book for free

300 -inurl:(htm|html|php|pls|txt) intitle:[Link] “last modified” (mp4|wma|aac|avi) – download

your favorite movie directly from the Internet or you can watch it even online (in our example
movie 300)

movie Name -inurl:(htm|html|php|pls|txt) intitle:[Link] “last modified” (mp4|wma|aac|avi) –

as a result, you will see a movie name there you can add any movie name for example 300,

deadpool, etc.

71
REDTEAM HACKER ACADEMY

ART OF SCANNING

72
REDTEAM HACKER ACADEMY

6.1 OBJECTIVE

After foot printing and reconnaissance, scanning is the second phase of information
gathering that hackers use to size up a network. Scanning is where they dive deeper into the
system to look for valuable data and services in a specific IP address range. It is a set of
procedures for identifying live hosts, ports, and services, discovering Operating system and
architecture of target system, Identifying vulnerabilities and threats in the network. Port
scanners can be used to detect listening ports to find information about the nature of
services running on the target machine. The primary defense technique against port
scanners is to shut down unnecessary services. Appropriate filtering may also be adopted as
a defense mechanism, but attackers can still use tools to determine filtering rules.

6.2 Scanning Methodology

In this phase the target system is scanned to look for open ports and vulnerabilities. One can
find reach ability of devices using the ping command and then run port scans on the active
IPs. This phase is still a part of the information gathering but is more interesting than the foot
printing phase and this begins to give you the feel of hacking. It is in this phase that we get to
know:

● Live systems on the network by pinging

● Find out services that are run on target
● Find the TCP and UDP ports and services
● Find the Operating System running on the target

6.3 Types of Scanning

● Connect scan
● Half-Open-Scan / Stealth scan
● XMAS scan
● FIN scan
● ACK scan
● Null scan
● Idle scan
● Port Scanning
● Network Scanning
● Vulnerability Scanning

73
REDTEAM HACKER ACADEMY

Connect scan: Identifies open ports by establishing a TCP handshake with the target.

Nmap command: nmap -sT -v -p- <TargetIP>

Half-open scan: otherwise known as Stealth scan used to scan the target in a stealthy way
by not completing the TCP handshake by abruptly resetting the communication.

Nmap command: nmap -sS -v <TargetIp>

XMAS scan: This is also called inverse TCP scanning. This works by sending packets set
with PSH, URG, FIN flags. The targets do not respond if the ports are open and send a reset
response if ports are closed.

FIN scan: Fin flag is set in the TCP packets sent to the target. open ports does not respond
while closed ports send a reset response.

Nmap command: nmap -SF <target IP>

ACK scan: Here the attacker sets the ACK flag in the TCP header and the target's port status
is gathered based on window size and TTL value of RESET packets received from the target.

74
REDTEAM HACKER ACADEMY

Nmap command: nmap -SA -v <target IP>

Null Scan: Works by sending TCP packets with no flags set to the target. Open ports do not
respond while closed ports respond with a RESET packet.

Nmap Command: nmap -sN -p- <target IP>

Idle Scan: Here the attacker tries to mask his identity uses an idle machine on the network to
probe the status details of target ports.

Port Scanning: In this process the hacker identifies available and open ports and
understands what services are running. You must understand the ports and port numbers.
The ports numbers can be in these three ranges:

1. Well known Ports from 0 to 1023

2. Registered ports from 1024 to 49151
3. Dynamic Ports from 49152 to 65535

In you are using a Windows system, you can see the common or well-known ports in the
below

path: C:\Windows\System32\Drivers\etc\services

Banner Grabbing: Is a process of collecting information like operating system details, the

75
REDTEAM HACKER ACADEMY

name of the service running with its version number etc.

Network Scanning: This means to look for active machines or targets on the network. This
can be done using tools or scripts that ping to all IP addresses on the networks and get a list
of the alive nodes and their IP addresses.

Vulnerability Scanning: This is the mechanism where the target is scanned or looked for any
vulnerability. In this scan the Operating system is found out with installed patches etc. and
then based on the information vulnerabilities are found in that particular version of Operating
System.

6.4 Scanning Tools

6.4.1 Nmap

Network Mapped (Nmap) is a network scanning and host detection tool that is very useful
during several steps of penetration testing. Nmap is not limited to merely gathering
information and enumeration, but it is also powerful utility that can be used as a vulnerability
detector or a security scanner. So Nmap is a multipurpose tool, and it can be run on many
different operating systems including Windows, Linux, BSD, and Mac. Nmap is a very
powerful utility that can be used to:

● Detect the live host on the network (host discovery)

● Detect the open ports on the host (port discovery or enumeration)
● Detect the software and the version to the respective port (service discovery)
● Detect the operating system, hardware address, and the software version
● Detect the vulnerability and security holes (Nmap scripts)

Nmap is a very common tool, and it is available for both the command line interface and the
graphical user interface. It contains all of the necessary information about Nmap and its
usage.

Nmap uses different techniques to perform scanning including: TCP connect ()

scanning,TCP reverse ident scanning, FTP bounce scanning and so on. All these types of
scanning have their own advantages and disadvantages, and we will discuss them as we go
on.

The usage of Nmap depends on the target machine because there is a difference between
simple (basic) scanning and advance scanning. We need to use some advanced techniques
to bypass the firewall and intrusion detection/prevention software to get the right result.
Below are the examples of some basic commands and their usage:

If you want to scan a single system, then you can use a simple command

nmap target

76
REDTEAM HACKER ACADEMY

# nmap [Link]
# nmap [Link]

If you want to scan the entire subnet, then the command is

nmap target/cdir

# nmap [Link]/24

It is very easy to scan a multiple target; all you need to do is to separate each target via
space:

nmap target target1 target2

# nmap [Link] [Link]

Let’s suppose you want to scan a range of IP addresses, but not the entire subnet. In this
scenario, use this command:

nmap target-100

# nmap [Link]-100

Let's suppose you have a list of target machines. You can make Nmap scan for the entire list:

# nmap -iL [Link]

Make sure to put the file on the same directory

If you want to see the list of all the hosts that you are scanning, then use the command with
an - sL parameter:

nmap -sL target/cdir

# nmap -sL [Link]/24

In some cases, we need to scan the entire subnet but not a specific IP addresses because it
might be dangerous for us. In this scenario, use the Nmap command with the excluding
parameter:

# nmap [Link]/24 – -exclude [Link]

If you have a file that contains the list of IP addresses that you want to exclude, then you can
call the file in the exclude parameter:

77
REDTEAM HACKER ACADEMY

# nmap [Link]/24 –exclude file [Link]

If you want to scan a specific port on the target machines (for example, if you want to scan
the HTTP, FTP, and Telnet port only on the target computer), then you can use the Nmap
command with the relevant parameter:

# nmap -p80,21,23 [Link] It scan the target for port number 80,21 and 23.

You now have a basic understanding of Nmap scanning techniques.

Nmap Scanning Techniques

There are so many scanning techniques available on Nmap, including the TCP connect
scanning method discussed earlier, so in this section, I will discuss the most popular
scanning technique in detail.

TCP SYN Scan (-sS)

It is a basic scan, and it is also called half-open scanning because this technique allows
Nmap to get information from the remote host without the complete TCP handshake process,
Nmap sends SYN packets to the destination, but it does not create any sessions, As a result,
the target computer can’t create any log of the interaction because no session was initiated,
making this feature an advantage of the TCP SYN scan. If there is no scan type mentioned
on the command, then TCP SYN scan is used by default, but it requires the
root/administrator privilege.

# nmap -sS [Link]

78
REDTEAM HACKER ACADEMY

TCP connect () scan (-sT)

This the default scanning technique used, if and only if the SYN scan is not an option,
because the SYN scan requires root privilege. Unlike the TCP SYN scan, it completes the
normal TCP three-way handshake process and requires the system to call connect (), which
is a part of the operating system. Keep in mind that this technique is only applicable to find
out the TCP ports, not the UDP ports.

# nmap -sT [Link]

UDP Scan (-sU)

As the name suggests, this technique is used to find an open UDP port of the target machine.
It does not require any SYN packet to be sent because it is targeting the UDP ports. But we
can make the scanning more effective by using -sS along with –sU. UDP scans send the
UDP packets to the target machine, and waits for a response—if an error message arrives
saying the ICMP is unreachable, then it means that the port is closed; but if it gets an
appropriate response, then it means that the port is open.

# nmap -sU [Link]

FIN Scan (-sF)

Sometimes a normal TCP SYN scan is not the best solution because of the firewall. IDS and
IPS scans might be deployed on the target machine, but a firewall will usually block the SYN
packets. A FIN scan sends the packet only set with a FIN flag, so it is not required to
complete the TCP handshaking.

root@bt:~# nmap -sF [Link]

Starting Nmap 5.51 ( [Link] ) at 2012-07-08 19:21 PKT

79
REDTEAM HACKER ACADEMY

Nmap scan report for [Link]

Host is up (0.000026s latency).
Not shown: 999 closed ports
PORT STATE SERVICE
111/tcp open|filtered rpcbind

The target computer is not able to create a log of this scan (again, an advantage of FIN). Just
like a FIN scan, we can perform an xmas scan (-sX) and Null scan (-sN). The idea is the
same but there is a difference between each type of scan. For example, the FIN scan sends
the packets containing only the FIN flag, whereas the Null scan does not send any bit on the
packet, and the xmas sends FIN, PSH, and URG flags.

Ping Scan (-sP)

Ping scanning is unlike the other scan techniques because it is only used to find out whether
the host is alive or not, it is not used to discover open ports. Ping scans require root access
so ICMP packets can be sent, but if the user does not have administrator privilege, then the
ping scan uses connect() call.

# nmap -sP [Link]

Version Detection (-sV)

Version detection is the right technique that is used to find out what software version is
running on the target computer and on the respective ports. It is unlike the other scanning
techniques because it is not used to detect the open ports, but it requires the information
from open ports to detect the software version. In the first step of this scan technique, version
detection uses the TCP SYN scan to find out which ports are open.

# nmap -sV [Link]

80
REDTEAM HACKER ACADEMY

Idle Scan (-sI)

Idle scan is one of my favorite techniques, and it is an advance scan that provides complete
anonymity while scanning. In idle scan, Nmap doesn’t send the packets from your real IP
address—instead of generating the packets from the attacker machine, Nmap uses another
host from the target network to send the packets. Let’s consider an example to understand
the concept of idle scan:

nmap -sI zombie_host target_host

# nmap -sI [Link] [Link]

The idle scan technique (as mentioned above) is used to discover the open ports on
[Link] while it uses the zombie_host ([Link]) to communicate with the target host.
So, this is an ideal technique to scan a target computer anonymously.

There are many other scanning techniques are available like FTP bounce, fragmentation
scan, IP protocol scan. and so on; but we have discussed the most important scanning
techniques (although all of the scanning techniques can important depending on the situation
you are dealing with).

OS Detection Nmap

One of the most important features that Nmap has is the ability to detect remote operating
systems and software. It is very helpful during a penetration test to know about the operating
system and the software used by the remote computer because you can easily predict the
known vulnerabilities from this information.

Nmap has a database called nmap-os-db, the database contains information of more than
2,600 operating systems. Nmap sends TCP and UDP packets to the target machine and
then it examines the response by comparing the result with the database. The Nmap
operating system discovery technique is slightly slower than the scanning techniques
because OS detection involves the process of finding open ports.

Initiating SYN Stealth Scan at 10:21

Scanning localhost ([Link]) [1000 ports]
Discovered open port 111/tcp on [Link]
Completed SYN Stealth Scan at 10:21, 0.08s elapsed (1000 total ports)
Initiating OS detection (try #1) against localhost ([Link])

81
REDTEAM HACKER ACADEMY

Retrying OS detection (try #2) against localhost ([Link])

The example above clearly demonstrates that the Nmap first discovers the open ports, then it
sends the packets to discover the remote operating system. The OS detection parameter is -
O (capital O).

6.4.2 METASPLOIT SCANNING

We will use two tools of Metasploit

1. Msfcrawler
2. wmap

Firstly, we need to have Metasploit on your machine, to do that follow below commands for
ubuntu

> sudo apt-get install build-essential libreadline-dev libssl-dev libpq5 libpq-dev libreadline5
libsqlite3-dev libpcap-dev openjdk-7-jre git-core autoconf postgresql pgadmin3 curl zlib1g-
dev
libxml2-dev libxslt1-dev vncviewer libyaml-dev curl zlib1g-dev

Metasploit comes pre-loaded with kali Linux and Backtrack OS.

So now we all are set to test our application, just follow these commands

1. Start Metasploit
> msfconsole

2. Load the msfcrawler

> use auxiliary/scanner/http/crawler

82
REDTEAM HACKER ACADEMY

3. So now you have to set RHOST (url/IP address eg. localhost) and RPORT (port in which
you want to connect eg. 9000)
> set RHOST localhost
> set RPORT 9000

4. Run the crawler

> run

5. After finishing crawling, we have to load the “wmap”

> load wmap

6. Now we have to create site in wmap

> wmap_sites -a localhost:9000

7. Now you can see your added sites by

> wmap_sites -l

83
REDTEAM HACKER ACADEMY

8. Now we have to add this site in to our targets

> wmap_target -d 0

Note: - 0 is this id of the site and we can see our selected targets by

> wmap_target -l

9. Run the vulnerability scanner

> wmap_run -e
This can take a while depending on the size of the site

6.5 Enumeration

Enumeration is defined as the process of extracting user names, machine names, network
resources, shares and services from a system. In this phase, the attacker creates an active
connection to the system and performs directed queries to gain more information about the
target. The gathered information is used to identify the vulnerabilities or weak points in
system security and tries to exploit in the System gaining phase.

84
REDTEAM HACKER ACADEMY

6.6 EXPLOITATION

An exploit is an attack on a computer system, especially one that takes advantage of a

particular vulnerability the system offers to intruders. Used as a verb, exploit refers to the act
of successfully making such an attack. An exploit takes advantage of a weakness in an
operating system, application or any other software code, including application plug-ins or
software libraries. The owners of the code typically issue a fix, or patch, in response. Users
of the system or application are responsible for obtaining the patch, which can usually be
downloaded from the software developer on the web, or it may be downloaded automatically
by the operating system or application that needs it. Failure to install a patch for a given
problem exposes the user to a computer exploit and the possibility of a security breach.

Types of exploits

Security exploits come in all shapes and sizes, but some techniques are used more often
than others. Some of the most common web-based security vulnerabilities include SQL
injection attacks, cross-site scripting and cross-site request forgery, as well as abuse of
broken authentication code or security misconfigurations. Computer exploits can be
categorized in several different ways, depending on how the exploits work and what type of
attacks they are able to accomplish. The most familiar type of exploit is the zero-day exploit,
which takes advantage of a zero-day vulnerability. A zero-day vulnerability occurs when a
piece of software usually an application or an operating system, contains a critical security
vulnerability of which the vendor is unaware. The vulnerability only becomes known when a
hacker is detected exploiting the vulnerability, hence the term zero-day exploit. Once such an
exploit occurs, systems running the software are left vulnerable to an attack until the vendor
releases a patch to correct the vulnerability and the patch is applied to the software.
Computer exploits can be characterized by the expected result of the attack, such as denial
of service, remote code execution, privilege escalation, malware delivery or other malicious
goals. Computer exploits may also be characterized by the type of vulnerability being
exploited, including buffer overflow exploits, code injection or other types of input validation
vulnerabilities and side-channel attacks.

Metasploit

First of all, open the Metasploit console in Kali. You can do so by following the path: Applications →
Exploitation Tools → Metasploit.

Or by typing msfconsole in your terminal.

85
REDTEAM HACKER ACADEMY

Let’s discuss some basic commands that are frequently used in Metasploit.

help - it will show you a list of core commands in Metasploit along with their description.
msfupdate is an important administration command. It is used to update Metasploit with the
latest vulnerability exploits.

Search is a powerful command in Metasploit that you can use to find what you want to locate. For
example, if you want to find exploits related to Microsoft, then the command will be
−msf>search name:Microsoft type:exploit

info command provides information regarding a module or platform, such as where it is used,
who is the author, vulnerability reference, and its payload restriction.

Terms to understand with metasploit

Module

Most of the tasks that you perform in Metasploit require the use of a module, which is a
standalone piece of code that extends the functionality of the Metasploit Framework. A
module can be an exploit, auxiliary or post-exploitation module. The module type determines
its purpose. For example, any module that can open a shell on a target is considered an
exploit module. A popular exploit module is MS08-067.

86
REDTEAM HACKER ACADEMY

Exploit Module

An exploit module executes a sequence of commands to target a specific vulnerability found

in a system or application. An exploit module takes advantage of a vulnerability to provide
access to the target system. Exploit modules include buffer overflow, code injection, and web
application exploits.

Auxiliary Module

An auxiliary module does not execute a payload and perform arbitrary actions that may not
be related to exploitation. Examples of auxiliary modules include scanners, fuzzers, and
denial of service attacks.

Post-Exploitation Module

A post-exploitation module enables you to gather more information or to gain further access
to an exploited target system. Examples of post-exploitation modules include hash dumps
and application and service enumerators.

Bind Shell Payload

A bind shell attaches a listener on the exploited system and waits for the attacking machine
to connect to the listener.

Database

The database stores host data, system logs, collected evidence, and report data.

Discovery Scan

A discovery scan is a Metasploit scan that combines Nmap and several Metasploit modules
to enumerate and fingerprint targets.

Exploit

An exploit is a program that takes advantage of a specific vulnerability and provides an

attacker with access to the target system. An exploit typically carries a payload and delivers it
to a target. For example, one of the most common exploits is windows/smb/s08-067_netapi,
which targets a Windows Server Service vulnerability that could allow remote code execution.

Listener

A listener waits for an incoming connection from either the exploited target or the attacking
machine and manages the connection when it receives it.

87
REDTEAM HACKER ACADEMY

Meterpreter

Meterpreter is an advanced multi-function payload that provides you an interactive shell.

From the Meterpreter shell, you can do things like download a file, obtain the password
hashes for useraccounts, and pivot into other networks. Meterpreter runs on memory, so it is
undetectable by most intrusion detection systems.

Modules

A prepackaged collection of code from the Metasploit Framework that performs a specific
task, such as run a scan or launch an exploit.

Payload

A payload is the actual code that executes on the target system after an exploit successfully
executes. A payload can be a reverse shell payload or a bind shell payload. The major
difference between these payloads is the direction of the connection after the exploit occurs.
Payload, in simple terms, are simple scripts that the hackers utilize to interact with a hacked
system. Using payloads, they can transfer data to a victim system.

Metasploit payloads can be of three types –

Singles − Singles are very small and designed to create some kind of communication, then move to
the next stage. For example, just creating a user.

Staged − It is a payload that an attacker can use to upload a bigger file onto a victim system.

Stages − Stages are payload components that are downloaded by Stagers modules. The various
payload stages provide advanced features with no size limits such as Meterpreter and VNC Injection.

Project

A project is a container for the targets, tasks, reports, and data that are part of a penetration
test. A project contains the workspace that you use to create a penetration test and configure
tasks. Every penetration test runs from within a project.

Reverse Shell Payload

A reverse shell connects back to the attacking machine as a command prompt.

Shellcode

Shellcode is the set of instructions that an exploit uses as the payload.

Shell

88
REDTEAM HACKER ACADEMY

A shell is a console-like interface that provides you with access to a remote target.

Task

A task is an action that Metasploit Pro can perform. Examples of tasks include performing a
scan, running a brute force attack, exploiting a vulnerable target, or generating a report.

Vulnerability

A vulnerability is a security flaw or weakness that enables an attacker to compromise a target.

A compromised system can result in privilege escalation, denial-of-service, unauthorized
data access, stolen passwords, and buffer overflows.

Exploit using Command Prompt

msf > use “exploit path”

Next, use the following command in order to see what parameters you have to set to make it
functional.

msf > show options

This exploit shows that we have to set RHOST “target IP”Next, use the commands –

Use Commands

msf > set RHOST [Link]

msf > set RPORT 21

89
REDTEAM HACKER ACADEMY

Next, use the command −

msf > run

If the exploit is successful, then you will see one session opened, as shown in the following

Screenshot.

Exploit Successful

Now, you can interact with this system.

6.7 PRIVILEGE ESCALATION

WHAT IS PRIVILEGE ESCALATION?

Privilege escalation is the act of exploiting a bug, design flaw or configuration oversight in an
operating system or software application to gain elevated access to resources that are
normally protected from an application or user. The result is that an application with more
privileges than intended by the application developer or system administrator can perform
unauthorized actions.

6.7.1 LINUX

We will talk in detail as to what security issues could lead to a successful privilege escalation
attack on any Linux based systems. We would also discuss how an attacker can use the
possible known techniques to successfully elevate his privileges on a remote host and how
we can protect our systems from any such attack. At the end, examples would be
demonstrated as how we achieved privilege escalation on different Linux systems under
different conditions.

90
REDTEAM HACKER ACADEMY

PERMISSION MODEL IN LINUX

Linux has inherited from UNIX the concept of ownerships and permissions for files. File
permissions are one way the system protects against malicious tampering. On a UNIX web
server, every single file and folder stored on the hard drive has a set of permissions
associated with it, which says who is allowed to do what with the file. In the above two
screenshots we can see that the file ‘[Link]’ only has read access by the
owner which is ‘root’. If any other user tries to read this file, he cannot read it. We can see
the permission denied error, when I tried reading the file when I am not a superuser.

We will not go into permission model details here as it is another big topic. It is just to
understand the basic fact that a user can not access (read/write/execute) files which are
permitted to access. However, the superuser(root) can access all the files which are present
on the system. In order to change any important configuration or perform any further attack,
first we need to get root access on any Linux based system.

WHY DO WE NEED TO PERFORM PRIVILEGE ESCALATION?

● Read/Write any sensitive file

● Persist easily between reboots
● Insert a permanent backdoor

TECHNIQUES USED FOR PRIVILEGE ESCALATION

We assume that now we have a shell on the remote system. Depending upon how we got
there, we probably might not have ‘root’ privilege. The below mentioned techniques can be
used to get ‘root’ access on the system.

1. KERNEL EXPLOITS

Kernel exploits are programs that leverage kernel vulnerabilities in order to execute arbitrary
code with elevated permissions. Successful kernel exploits typically give attackers super
user access to target systems in the form of a root command prompt. In many cases,
escalating to root on a Linux system is as simple as downloading a kernel exploit to the
target file system, compiling the exploit, and then executing it.

91
REDTEAM HACKER ACADEMY

Assuming that we can run code as an unprivileged user, this is the generic workflow of a
kernel exploit.

1. Trick the kernel into running our payload in kernel mode

2. Manipulate kernel data, e.g. process privileges
3. Launch a shell with new privileges Get root!

Consider that for a kernel exploit attack to succeed, an adversary requires four conditions:

1. A vulnerable kernel
2. A matching exploit
3. The ability to transfer the exploit onto the target
4. The ability to execute the exploit on the target

The easiest way to defend against kernel exploits is to keep the kernel patched and updated.
In the absence of patches, administrators can strongly influence the ability to transfer and
execute the exploit on the target. Given these considerations, kernel exploit attacks are no
longer viable if an administrator can prevent the introduction and/or execution of the exploit
onto the Linux file system. Therefore, administrators should focus on restricting or removing
programs that enable file transfers, such as FTP, TFTP, SCP, wget, and curl. When these
programs are required, their use should be limited to specific users, directories, applications
(such as SCP), and specific IP addresses or domains.

The infamous DirtyCow exploit – Linux Kernel <= 3.19.0-73.8

A race condition was found in the way the Linux kernel’s memory subsystem handled the
copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged local
user could use this flaw to gain write access to otherwise read-only memory mappings and
thus increase their privileges on the system. It was one of the most serious privilege
escalation vulnerabilities ever discovered and it affected almost all the major Linux distros.

92
REDTEAM HACKER ACADEMY

WIRELESS SECURITY

93
REDTEAM HACKER ACADEMY

7.1 WIRELESS NETWORK

Wireless networks are computer networks that are not connected by cables of any kind. The
use of a wireless network enables enterprises to avoid the costly process of introducing
cables into buildings or as a connection between different equipment locations. The basis of
wireless systems are radio waves, an implementation that takes place at the physical level of
network structure.

Ad-hoc Network / Device Network

On some devices (e.g. laptops) some available network connections are shown as computer
to computer networks. These are networks that may be ad-hoc mesh networks or point to
point links between computers for small file sharing. The term “ad-hoc” can also refer to
unplanned, decentralized network connections.

Antenna

Converts electrical signals to radio waves. It is normally connected to a radio transmitter or

radio receiver, and is the interface between the electrical signals in the radio, and the
movement of the signals through the air.

AP (Access Point)

A device that allows wireless devices to connect to a wired network using Wi-Fi or related
standards Client Device:The device with a Wi-Firadio that you use to connect to a wireless
access point, e.g. a computer, cell phone or tablet device.

Ethernet

A type of networking protocol -it defines the types of cables andconnections that are used to
wire computers, switches, and routers together. Most often Ethernet cabling is Category 5 or
6, made up of twisted pair wiring similar to phone cables.

7.2 TYPES OF WIRELESS ATTACKS

Wireless Attacks can come at you through different methods. For the most part you need to
worry about Wi-Fi. Some methods rely on tricking users, others use brute force, and some
look for people who don’t bother to secure their network. Many of these attacks are
intertwined with each other in real world use. Here are some of the kinds of attacks you could
encounter:

● Packet Sniffing: When information is sent back and forth over a network, it is sent in
what we call packets. Since wireless traffic is sent over the air, it’s very easy to
capture. Quite A lot of traffic (FTP, HTTP, SNMP, ect.) is sent in the clear, meaning
that there is no encryption and files are in plain text for anyone to read. So using a

94
REDTEAM HACKER ACADEMY

tool like Wireshark allows you to read data transfers in plain text! This can lead to
stolen passwords or leaks of sensitive information quite easily. Encrypted data can be
captured as well, but it’s obviously much harder for an attacker to decipher the
encrypted data packets.
● Rogue Access Point: When an unauthorized access point (AP) appears on a
network, it is referred to as a rogue access point. These can pop up from an
employee who doesn’t know better, or a person with ill intent. These APs represent a
vulnerability to the network because they leave it open to a variety of attacks. These
include vulnerability scans for attack preparation, ARP poisoning, packet captures,
and Denial of Service attacks.
● Password Theft: When communicating over wireless networks, think of how often
you log into a website. You send passwords out over the network, and if the site
doesn’t use SSL or TLS, that password is sitting in plain text for an attacker to read.
There are even ways to get around those encryption methods to steal the password.
I’ll talk about this with the man in the middle attacks.
● Man in the Middle Attack: It’s possible for hackers to trick communicating devices
into sending their transmissions to the attacker’s system. Here they can record the
traffic to view later (like in packet sniffing) and even change the contents of files.
Various types of malware can be inserted into these packets, email content could be
changed, or the traffic could be dropped so that communication is blocked.
● Jamming: There are a number of ways to jam a wireless network. One method is
flooding an AP with deauthentication frames. This effectively overwhelms the network
and prevents legitimate transmissions from getting through. This attack is a little
unusual because there probably isn’t anything in it for the hacker. One of the few
examples of how this could benefit someone is through a business jamming their
competitors Wi-Fisignal. This is highly illegal (as are all these attacks), so businesses
would tend to shy away from it. If they got caught,they would be facing serious
charges.
● War Driving: Wardriving comes from an old term called war dialing, where people
would dial random phone numbers in search of modems. War driving is basically
people driving around looking for vulnerable APs to attack. People will even use
drones to try and hack APs on higher floors of a building. A company that owns
multiple floors around ten stories up might assume nobody is even in range to hack
their wireless, but there is no end to the creativity of hackers!
● Bluetooth Attacks: There are a variety of Bluetooth Exploits out there. These range
from annoying pop up messages, to full control over victims Bluetooth enabled
devices. Check out this blog post on hacking Bluetooth For an in-depth look.
● WEP/WPA Attacks: Attacks on wireless routers can be a huge problem. Older
encryption standards are extremely vulnerable, and it’s pretty easy to gain the access
code in this case. Once someone's on your network, you’ve lost a significant layer of
security. APs and routers are hiding your IP address from the broader Internet using
Network Address Translation (unless you use IPv6 but that’s a topic for another day).
This effectively hides your private IP address from those outside your subnet, and
helps prevent outsiders from being able to directly attack you. The keyword there is
that it helps prevent the attacks, but doesn’t stop it completely.

Another thing to take note of, is that our mobile devices are at risk whenever they connect to
public Wi-Fi. Whether you use a phone, tablet, or laptop; accessing an insecure network is
putting a target on your data. Understand the risks or consider using a VPN.

95
REDTEAM HACKER ACADEMY

7.3 Wireless Signal Dumping Tools

Air crack-ng

Aircrack-ng is one of the most popular tools for WEP/WPA/WPA2 cracking. The Air crack-ng
suite contains tools to capture packets and handshakes, de-authenticate connected clients
and generate traffic and tools to perform brute force and dictionary attacks. Air crack-ng is an
all-in-one suite containing the following tools (among others):–Air crack-ng for wireless
password cracking–Aireplay-ng to generate traffic and client deauthentication–Airodump-
ngfor packet capturing–Airbase-ng to configure fake access pointsThe Aircrack-ng suite is
available for Linux and comes standard with Kali Linux. If you plan to use this tool you have
to make sure your Wi-Ficard is capable of packet injection

Reaver

Number 2 in the Top 10 Wi-FiHacking Tools is Reaver. Reaver is another popular tool for
hacking wireless networks and targets specifically WPS vulnerabilities. Reaver performs
brute force attacks againstWi-FiProtected Setup (WPS) registrar PINs to recover the
WPA/WPA2 passphrase. Since many router manufacturers and ISPs turn on WPS by default
a lot of routers are vulnerable to this attack out of the [Link] order to use Reaver you need a
good signal strength to the wireless router together with the right configuration. On average
Reaver can recover the passphrase from vulnerable routers in 4-10 hours, depending on the
access point, signal strength and the PIN itself off course. Statistically you have a 50%
chance of cracking the WPS PIN in half of the time.

Wifite

Wifite is an automated tool to attack multiple wireless networks encrypted with

WEP/WPA/WPA2 and WPS. On start-up Wifite requires a few parameters to work with and
Wifite will do all the hard work. It will capture WPA handshakes, automatically de-
authenticate connected clients, spoof your MACaddress and save the cracked passwords.

96
REDTEAM HACKER ACADEMY

Wireshark

Wireshark is one of the best network protocol analyzer tools available, if not the best. With
Wireshark you can analyze a network to the greatest detail to see what’s happening.
Wireshark can be used for live packet capturing, deep inspection of hundreds of protocols,
browse and filter packets and is multiplatform. Wireshark is included with Kali Linux but also
available for Windows and Mac. For certain features you do need a Wi-Fiadapter which
supports promiscuous and monitoring mode.

7.4 WIRELESS ATTACK SIMULATIONS

Step 1:Disconnect From all wireless networks, open a Terminal, and type airmon-ng

This will list all of the wireless cards that support monitor mode. If no cards are listed, try
disconnecting and reconnecting the adapter (if you’re using one) and check that it supports
monitor mode. If you’re not using an external adapter, and you still don’t see anything listed,
then your card doesn’t support monitor mode, and you’ll have to purchase an external one .
You can see here that my card supports monitor mode and that it’s listed as wlan0.

Step 2:Type airmon-ng start followed by the interface name of your wireless card. mine is
wlan0, so my command would be: airmon-ng start wlan0

The “(monitor mode enabled)” message means that the card has successfully been put into
monitor mode. Note the name of the new monitor interface, mon0.

Step 3: Type airodump-ng followed by the name of the new monitor interface, which is
probably mon0.

97
REDTEAM HACKER ACADEMY

If you receive a “fixed channel –1” error, see the Edit above.

Step 4: Airodump will now list all of the wireless networks in your area, and a lot of useful
information about them. Locate your network or the network that you have permission to
penetration test. Once you’ve spotted your network on the ever-populating list, hit Ctrl + C on
your keyboard to stop the process. Note the channel of your target network.

Step 5: Copy the BSSID of the target network

Now type this command:

airodump-ng -c [channel] --bssid [bssid] -w /root/Desktop/ [monitor interface]

Replace [channel] with the channel of your target network. Paste the network BSSID where
[bssid] is, and replace [monitor interface] with the name of your monitor-enabled interface,
(mon0). The “–w” and file path command specifies a place where airodump will save any
intercepted 4-way handshakes (necessary to crack the password). Here we saved it to the
Desktop, but you can save it anywhere. A complete command should look similar this:

airodump-ng -c 10 --bssid 00:14:BF:E0:E8:D5 -w /root/Desktop/ mon0

You can see in this picture, that a client has appeared on our network, allowing us to start
the next step.

98
REDTEAM HACKER ACADEMY

Step 6: Leave airodump-ng running and open a second terminal. In this terminal, type this
command:
aireplay-ng –0 2 –a [router bssid] –c [client bssid] mon0

The –0 is a short cut for the deauth mode and the 2 is the number of deauth packets to send.
-a indicates the access point/router’s BSSID, replace [router bssid] with the BSSID of the
target network, which in my case, is 00:14:BF:E0:E8:D5.

-c indicates the client’s BSSID, the device we’re trying to deauth, noted in the previous
picture. Replace the [client bssid] with the BSSID of the connected client, this will be listed
under “STATION.”

And of course, mon0 merely means the monitor interface, change it if yours is different. My
complete command looks like this:
aireplay-ng –0 2 –a 00:14:BF:E0:E8:D5 –c 4C:EB:42:59:DE:31 mon0

Step 7: Upon hitting Enter, you’ll see aireplay-ng send the packets. If you were close enough
to the target client, and the deauthentication process works, this message will appear on the
airodump screen (which you left open):

This means that the handshake has been captured, the password is in the hacker’s hands, in
some form or another. You can close the aireplay-ng terminal and hit Ctrl + C on the
airodump- ng terminal to stop monitoring the network, but don’t close it yet just in case you

99
REDTEAM HACKER ACADEMY

need some of the information later.

Step 8: From now on, the process is entirely between your computer, and those four files on
your Desktop. Actually, it’s the .cap one, that is important. Open a new Terminal, and type in
this command:
aircrack-ng -a2 -b [router bssid] -w [path to wordlist] /root/Desktop/*.cap

-a is the method aircrack will use to crack the handshake, 2=WPA method.

-b stands for bssid, replace [router bssid] with the BSSID of the target router, mine is
00:14:BF:E0:E8:D5.

-w stands for wordlist, replace [path to wordlist] with the path to a wordlist that you have
downloaded. I have a wordlist called “[Link]” in the root folder. /root/Desktop/*.cap is the
path to the .cap file containing the password. The * means wild card in Linux, and since I’m
assuming that there are no other .cap files on your Desktop, this should work fine the way it
is. My complete command looks like this:

aircrack-ng –a2 –b 00:14:BF:E0:E8:D5 –w /root/[Link] /root/Desktop/*.cap

Step 9: Aircrack-ng will now launch into the process of cracking the password. However, it
will only crack it if the password happens to be in the wordlist that you’ve selected.
Sometimes, it’s not. If this is the case, you can try other wordlists. If you simply cannot find
the password no matter how many wordlists you try, then it appears your penetration test has
failed, and the network is at least safe from basic brute-force attacks. Cracking the password
might take a long time depending on the size of the wordlist. Mine went very quickly. If the
phrase is in the wordlist, then aircrack-ng will show it too you like this:

The passphrase to our test-network was “not secure,” and you can see here that it was in the
wordlist, and aircrack found it. If you find the password without a decent struggle, then
change your password, if it’s your network. If you’re penetration testing for someone, then tell
them to change their password as soon as possible.

100
REDTEAM HACKER ACADEMY

WEB APPLICATION SECURITY

101
REDTEAM HACKER ACADEMY

8.1 Objective

In this module we are going to study web application security. It involves the evolution of web
application, Basics of web app, Burp suit tool, OWASP top 10 attacks and common web
attacks. Before starting with web application security it’s going to be important for you to
understand how the internet works. What I mean is how the URL you type in the address bar
is mapped to a domain, which is resolved to an IP address. We start from basics and end
with some case studies.

8.2 Introduction

This book is a practical guide to discovering and exploiting the flaws in the web applications.
The term “Web Application” means that those are accessed using a web browser to
communicate with a web server. If you want to know how to hack web applications, stealing
sensitive data and performing unauthorized access, this is the right book for you.

8.3 Web Application Security

There is no doubt that web application security is a current and newsworthy subject. For all
concerned, the stakes are high: for businesses that derive increasing revenue from Internet
commerce, for users who trust web applications with sensitive information, and for criminals
who can make big money by stealing payment details or compromising bank accounts.
Reputation plays a critical role. Few people want to do business with an insecure website, so
few organizations want to disclose details about their own security vulnerabilities or breaches.
Hence, it is not a trivial task to obtain reliable information about the state of web application
security today.

8.4 Evolution of web applications

In the early days world wide web only consisted in web sites. These were static web pages
like documents (fig 1.1). Web browsers were invented for retrieving and displaying those
sites. And that time most sites did not authenticate users, because there was no need for it.
Each user was presented with the same documents. And if an attacker compromised a web
server, he usually wouldn’t gain access to any sensitive information, because the information
held on the server is already available to the public.

102
REDTEAM HACKER ACADEMY

Today the World wide web is almost changed from its earlier forms. Now majority of the sites
on the web are applications.

Common Functions of Web Applications

● Shopping (Amazon, Flipkart)

● Social Networks (WhatsApp, Facebook)
● Banking
● Web Search
● Auctions
● Gambling
● Web Mail
● Web Logs
● Interactive Information

8.5 Basics of a Web Application

What is a web application consisting of?

We know that a web application consists of different technologies such as html, JavaScript,
cascade style sheet, etc.

HTTP Protocol

The HyperText Transfer Protocol is the core communication protocol used to access the web.
HTTP uses a message-based model in which a client sends a request message and a server
returns a response message. This protocol is connectionless. But it uses stateful TCP
protocol as it’s transport mechanism, each exchange of request and response is an
autonomous transaction and may use a different TCP connection.

103
REDTEAM HACKER ACADEMY

HTTP Requests

All HTTP messages (requests and responses) consist of one or more headers, each on a
separate line followed by a mandatory blank line followed by an optional message body. A
typical HTTP request is as follows:

HTTP Responses

A typical HTTP response is as follows

8.6 HTTP Methods

When you are attacking web applications, you will be dealing almost exclusively with the
most commonly used methods: GET and POST. You need to be aware of some important
differences between these methods, as they can affect an application’s security if overlooked.
There is an agreement on how these messages will be sent, including the specific methods

104
REDTEAM HACKER ACADEMY

used and the requirement for a Host request-header for all HTTP/1.1 requests. The methods
defined include:

● GET
● HEAD
● POST
● PUT
● DELETE
● TRACE
● CONNECT
● OPTIONS

• The GET method means to retrieve whatever information is identified by the request
Uniform Request Identifier (URI). The term URI may be confusing, especially given the
reference to a URL above, but essentially, for the purposes of this book, just know that a
URL is like a person’s address and is a type of URI which is like a person’s name. Typically
GET requests should not be associated with any data altering functions, they should just
retrieve and provide data.

• The HEAD method is identical to the GET message except the server must not return a
message body in the response. Typically, you won’t often see this used but apparently it is
often employed for testing hypertext links for validity, accessibility and recent changes.

• The POST method is used to invoke some function to be performed by the server, as
determined by the server. In other words, typically there will be some type of back end action
performed like creating a comment, registering a user, deleting an account, etc. The action
performed by the server in response to the POST can vary and doesn’t have to result in
action being taken. For example, if an error occurs processing the request.

• The PUT methods used when invoking some function but referring to an already existing
entity. For example, when updating your account, updating a blog post, etc. Again, the action
performed can vary and may result in the server taking no action at all.

• The DELETE method is just as it sounds, it is used to invoke a request for the remote
server to delete a resource identified by the URI.

• The TRACE method is another uncommon method, this time used to reflect back the
request message to the requester. This allows the requester to see what is being received by
the server and to use that information for testing and diagnostic information.

• The CONNECT method is actually reserved for use with a proxy (a proxy is a basically a
server which forwards requests to other servers)

• The OPTIONS method is used to request information from a server about the
communication options available. For example, calling for OPTIONS may indicate that the
server accepts GET, POST, PUT, DELETE and OPTIONS calls but not HEAD or TRACE.

105
REDTEAM HACKER ACADEMY

8.7 Status Codes

Every HTTP response message must contain a status code in its first line, indicating the
results of the request. The status codes are grouped into five, according to the code’s first
digit:

● 1xx – Informational
● 2xx – Successful Responses
● 3xx – Redirection Messages
● 4xx – Client Error
● 5xx – Server Error

8.9 HTTPS

The HTTP protocol uses plain TCP as its transport mechanism, which is unencrypted and
therefore can be intercepted by an attacker who is suitably positioned on the network.
HTTPS is essentially the same application-layer protocol as HTTP but is tunneled over the
secure transport mechanism, Secure Sockets Layer (SSL). This protects the privacy and
integrity of data passing over the network, reducing the possibilities for noninvasive
interception attacks. HTTP requests and responses function in exactly the same way
regardless of whether SSL is used for transport.

8.10 Burp Suite

Burp Suite is a web application testing tool designed by Portswigger. Currently it is the
industry standard for web application penetration testing. It is also widely used by many
individuals who partake in bug bounty hunting. This post discusses a few key features of the
suite and some interesting tips along the way. To use burp suite, you need to configure your
browser to work with Burp, and install Burp's CA certificate in your browser.

Proxy – Where It Starts

● A proxy is a piece of software (it could be hardware)

● This is an intercepting web proxy that operates as a man-in-the-middle between the
end browser and the target web application. It lets you intercept, inspect and modify
the raw traffic passing in both directions.

Example

● You are at your browser communicating with a web app

● You decide you want a proxy sitting between your browser and the app
● So, you start a proxy server running and then you tell your browser to send requests
to the proxy
● The proxy receives requests from the browser and forwards them to the web app
● When responses come back, the proxy routes them to you Proxy

106
REDTEAM HACKER ACADEMY

How does Burp Suite work

In its simplest form, Burp Suite can be classified as an Interception Proxy. Burp Suite then
acts as a (sort of) Man In The Middle by capturing and analyzing each request to and from
the target web application so that they can be analyzed.

Project Files

Only available in the pro version Project files very useful as I mentioned earlier, they store all
of the traffic sent in a session including both in scope and out of scope hosts which can be
useful to view later. Essentially think of a project file like a temporary save location for
information stored in your burp session that can be loaded at a later date. They work
alongside being able to save your session to a disk which is accessible from the burp menu
in top left-hand corner of the screen burp > save state.

Target Tab

The target tab is one of the most useful tools within burp as it holds the site map for target
sites that you are testing. Within the target tab there are two sub tabs, the Scope tab and
Site map. Specifically, the main information for an application that you are testing is held
within the site-map tab.

107
REDTEAM HACKER ACADEMY

Scope

It can be configured so that only targets that are within scope are displayed. To do this first
you’ll need to configure the sites within scope. Navigate to Target > Scope then Include in
scope. This option will allow you to either paste a URL from the address bar or add manually
using the add button. Additionally, you can load a list of targets from a text file using the Load
button, this can be very useful for adding in several hosts at a time. Top tip for open scoped
engagements, if a scope states that *.[Link] is within scope you can add this to burp’s
scope using: ^*\.domain\.com$. This will add all potential sub-domains into scope, what this
also means is should you identify other hosts while browsing the main target they will
automatically be added to scope and displayed in the site-map.

Tuning Site-map

Besides displaying all of the hosts browsed to in a burp session the site map tab can be
tuned to only view the hosts you have set that are within scope. This can be achieved by
clicking on the bar just below the Site map and selecting Show only in-scope items. This will
allow you to only view targets you’ve set as in scope.

This menu area also allows you to tweak what is displayed, it can be useful to view only
requests that have generated types of errors.

Spider

The spider tab can be used for discovering content on a site however I don’t use it very often
as it does generate masses of traffic. Additionally, it can cause issues with the target
applications if not tuned correctly. To use it correctly, I suggest you disable the auto-form
submission and auto login ‘features’ to ensure minimal traffic generation. Doing so will
prevent burp from attempting to flood the target site with form submissions of Peter
Weiner/Winter.

Scanner

Only available in the pro version The scanner tab is very useful as it picks up on ‘low hanging
fruit’ vulnerabilities within an application. However, like all of the other tools within the suite it
can be tuned to work better. By default, the options for it are pretty good but with tuning it
can be great! Burp Scanner is a tool for performing automated scans of web sites, to
discover content and audit for vulnerabilities. The work involved in performing a scan
comprises two key phases:

Crawling for content - This involves navigating around the application, following links,
submitting forms, and logging in where necessary, to catalog the content of the application
and the navigational paths within it.

Auditing for vulnerabilities - This involves analyzing the application's traffic and behavior to
identify security vulnerabilities and other issues. Depending on the scan configuration, it may
involve sending a large number of requests to the application.

108
REDTEAM HACKER ACADEMY

Pairing Intruder with Scanner

Only available in the pro version. To tune the scanner there is a little-known trick that will
allow you to pinpoint scanning. This can be achieved by trapping a request that has
parameters you want to scan then, right clicking on it and sending it to the intruder. Once the
request is in intruder manually select the areas in which you want to scan then select Actively
scan insertion points. This will send the scanner off against only the points in which you’ve
selected instead of randomly scanning points in the app/target. This can be very useful for
pinpointing vulnerabilities in applications that would otherwise be missed potentially.

Repeater

Burp Repeater is a simple tool for manually manipulating and reissuing individual HTTP and
WebSocket messages, and analyzing the application's responses. You can use Repeater for
all kinds of purposes, such as changing parameter values to test for input-based
vulnerabilities, issuing requests in a specific sequence to test for logic flaws, and reissuing
requests from Burp Scanner issues to manually verify reported issues.

The main Repeater UI lets you work on multiple different messages simultaneously, each in
its own tab. When you send messages to Repeater, each one is opened in its own numbered
tab. You can rename tabs by double-clicking the tab [Link] repeater tool is arguably
the most useful and powerful section within the burp suite tool set. It allows requests to be
passed to it and modified then resent to the server. During a test I will spend a lot of time in
here playing with requests and modifying different parameters to see their responses.
Specifically, it has two main uses, the first of which allows free manipulation of requests.
Allowing you to target specific parameters and functions within an application. The second
while not a feature or possibly not the intended use, it can be used as a clipboard/archive or
interesting requests for you to go back to look at. Imagine you’re looking at an application
which shows signs of processing certain characters differently, you can right click and send
this to repeater to look at later. Having the request in repeater will allow you to manipulate it
at a later time.

Intruder

The intruder tool has many functions, however in this post I am only going to discuss a few of
these. Mainly it can be used for fuzzing, error checking & brute-forcing. In order to utilize
intruder, select an interesting request either from the proxy intercept or another you’ve
previously saved in repeater. Right click and select send to intruder. When the request is
within intruder select the positions tab to select your inputs. The payload positions are up to
you to set, however burp will auto-select what it thinks are parameters, you can clear this
using the clear button, then select your own ones by selecting the parameter then choosing
add §. There are four attack types available to use in intruder, the subsections below explain
what each does.

Sniper

The sniper attack takes one wordlist as an input and iterates over each parameter, one at a
time. If you have multiple insertion points, it will enumerate the first parameter with all the

109
REDTEAM HACKER ACADEMY

payloads from the wordlist supplied and move on to the next and so on. It is best used when
you’re wanting to fuzz either single or multiple parameters with the same wordlist.

Battering Ram

Like the sniper attack, the battering ram uses a single word list however it will iterate over
multiple parameters with the same payload for all the parameters. This can be useful when
you’re looking at how different parameters react to certain payloads.

Pitchfork

The pitchfork attack type runs through multiple parameters at the same time using different
payloads for each parameter. This takes a single or multiple wordlist but will iterate through
the words in the list split across selected parameters. An example of this is shown:

● 1st request - id=wordlist1[1]&param2=wordlist2[1]

● 2nd request - id=wordlist1[2]&param2=wordlist2[2]

Cluster Bomb

The cluster bomb attack type will take multiple wordlists and is useful when you have multiple
parameters. It will run through over multiple parameters by using all the possible
combinations of payloads from the multiple wordlists. So, if you have multiple parameters, it
will enumerate over one of the parameters with all the payloads from its respective wordlist,
while the other parameters have the first payload from their respective wordlists loaded.

Decoder

As with all of the tools within burp suite, each has a useful function. The decoder tool is all in
the name, it decodes a select type of character sets and encoding types:

● Plain Text
● URL Encoding
● HTML
● Base64
● ASCII Hex
● Hex
● Octal
● Binary
● Gzip

Each of which can also be encoded into using the decoder tool. This is particularly useful for
when you encounter parameters and data within requests which is encoded. By default, burp
will attempt to auto detect the encoding however you can manually select which type of
encoding to decode as too. Decoder can also be used to take checksums of strings, using a
variety of hashing functions, these are located in the hash drop-down menu.

Sequencer

110
REDTEAM HACKER ACADEMY

The sequencer tool has many functions but its main use is for checking the entropy of tokens
and cookies. It is accessible by sending requests to it that can then be replayed in the 100s
or 1000s to check the randomness of created values. This can be very useful for testing the
randomness of cookie or CSRF token generation, mainly a use when testing authentication
and authorization but can also be used for testing UUID and GUID values too.

Comparer

Comparer is essentially a difftool to allow you to check the differences between two or more
requests either based upon the words or bytes. This is useful when an application reacts
differently to certain characters or words being used, it can be useful to identify more
information about injection type vulnerabilities. To use it simple right, click on a request and
select send to comparer, then select a second request and do the same. Then navigate to
the comparer tab and your requests should be there now. Simply select bytes or words, this
will show a comparison of the requests you’ve sent and highlight the differences.

Extender

Finally, the extender tab is where add-ons/plugins for burp are located. Housed within this
tab is where extensions can be installed and added. Additionally, all information surrounding
various environment files such as Jython and Jruby can be set within this tab. This allows for
usage of other 3rd party extensions build by developers that have been approved by
Portswigger. Also located within this tab is information surrounding all of the APIs that Burp
suite uses, allowing you to write your own extension. For more information on creating an
extension check out Portswigger site

Configuring Firefox with Burp Suite

1. In Firefox, go to the Firefox Menu. Click on "Preferences" / "Options".

2. Select the "General" tab and scroll to the "Network Proxy" settings. Click on the
"Settings" button.

111
REDTEAM HACKER ACADEMY

3. Select the "Manual proxy configuration" option.

4. Enter your Burp Proxy listener address in the "HTTP Proxy" field (by default this is set
to [Link]).
5. Next enter your Burp Proxy listener port in the "Port" field (by default, 8080).
6. Make sure the "Use this proxy server for all protocols" box is checked.

7. Delete anything that appears in the "No proxy for" field.

8. Now click "OK" to close all of the options dialogs.

112
REDTEAM HACKER ACADEMY

Getting Started with Burp Suite

● Start Burp Suite. Select Temporary project/ New Project and click “Next”

● Click on “Start Burp”.

Installing Burp's CA Certificate in Firefox

By default, when you browse an HTTPS website via Burp, the Proxy generates a TLS
certificate for each host, signed by its own Certificate Authority (CA) certificate. This CA
certificate is generated the first time Burp is run, and stored locally. To use Burp Proxy most
effectively with HTTPS websites, you will need to install Burp's CA certificate as a trusted
root in your browser

With Burp running, visit [Link] in your browser and click the "CA Certificate" link to
download and save your Burp CA certificate. Take note of where you save the Burp CA
certificate.

113
REDTEAM HACKER ACADEMY

In Firefox open the Firefox Menu. Click on "Preferences / "Options"".

Go to the "Privacy and Security" settings. Click "View Certificates" .

Select the "Authorities" tab, Click "Import", select the Burp CA certificate file that you
previously saved and click “Open”.

114
REDTEAM HACKER ACADEMY

In the dialog box that pops up, check the box "Trust this CA to identify web sites", and click
"OK".

Close all dialogs and restart Firefox. If everything has worked, you should now be able to
visitany HTTPS URL via Burp without any security warnings.

Ensure that the certificate is trusted to identify web sites.

8.11 Web Application Security Testing Methodology

In addition to WAFs, there are a number of methods for securing web applications. The
following processes should be part of any web application security testing methodology

● Configuration and Deployment Management Testing

● Identity Management Testing
● Authentication Testing
● Authorization Testing
● Session Management Testing
● Input Validation Testing
● Testing for Error Handling
● Testing for weak Cryptography
● Business Logic Testing

115
REDTEAM HACKER ACADEMY

● Client-Side Testing

SQL Injection

A SQL injection attack consists of insertion or "injection" of a SQL query via the input data
from the client to the application. A successful SQL injection exploit can read sensitive data
from the database, modify database data (Insert/Update/Delete), execute administration
operations on the database (such as shutdown the DBMS), recover the content of a given
file present on the DBMS file system and in some cases issue commands to the operating
system. SQLi attacks are usually a result of unescaped input being passed into a site and
used as part of a database query. An example of this might look like:

$name = $_GET['name']; $query = "SELECT * FROM users WHERE name = $name";

Here, the value being passed in from user input is being inserted straight into the database
query. If a user entered test’ OR 1=1, the query would return the first record where the name
= test OR 1=1, so the first row. Now other times, you may have something like:

$query = "SELECT * FROM users WHERE (name = $name AND password = 12345");

In this case, if you used the same payload, test’ OR 1=1, your statement would end up as:

$query = "SELECT * FROM users WHERE (name = 'test' OR 1=1 AND password = 12345");

So, here, the query would behave a little different (at least with MySQL). We would get all
records where the name is test and all records where the password is 12345. This obviously
wouldn’t achieve our goal of finding the first record in the database. As a result, we need to
eliminate the password parameter and can do that with a comment, test’ OR 1=1;–. Here,
what we’ve done is add a semicolon to properly end the SQL statement and immediately
added two dashes to signify anything which comes after should be treated as a comment
and therefore, not evaluated. This will end up having the same result as our initial example.

116
REDTEAM HACKER ACADEMY

VULNERABILITY ASSESSMENT AND

PENETRATION TESTING

117
REDTEAM HACKER ACADEMY

9.1 Objective

Vulnerability Assessment and Penetration Testing (VAPT) are two types of vulnerability
testing. The tests have different strengths and are often combined to achieve a more
complete vulnerability analysis. In short, Penetration Testing and Vulnerability Assessments
perform two different tasks, usually with different results, within the same area of focus.

9.2 Features and Benefits of VAPT

Vulnerability Assessment and Penetration Testing (VAPT) provides enterprises with a more
comprehensive application evaluation than any single test alone. Using the Vulnerability
Assessment and Penetration Testing (VAPT) approach gives an organization a more
detailed view of the threats facing its applications, enabling the business to better protect its
systems and data from malicious attacks. Vulnerabilities can be found in applications from
third-party vendors and internally made software, but most of these flaws are easily fixed
once found. Using a VAPT provider enables IT security teams to focus on mitigating critical
vulnerabilities while the VAPT provider continues to discover and classify vulnerabilities.

Benefits of VAPT

When it comes to security, VAPT offers excessive benefits to an organization, let’s look at a
few of its benefits.

● Providing the organization, a detailed view of potential threats faced by an application.

● Help the organization in identifying programming errors that leads to cyber-attacks.
● Provide risk management
● Safeguards the business from loss of reputation and money
● Secures applications from internal and external attacks
● Protects the organization's data from malicious attacks

9.3 What is vulnerability assessment?

Vulnerability assessment (VA) is a systematic technical approach to find the security

loopholes in a network or software system. VA is entirely a process of searching and finding,
with the objective that none of the loopholes are missed. It primarily adopts a scanning
approach which is done both manually and performed by certain tools. The outcome of a VA
process is a report showing all vulnerabilities, which are categorized based on their severity.
This report is further used for the next step, which is penetration testing (PT). VA is usually a
non-intrusive process and can be carried out without jeopardizing the IT infrastructure or
application’s operations.

118
REDTEAM HACKER ACADEMY

9.4 What is penetration testing?

A penetration test (PT) is a proof-of-concept approach to actually explore and exploit

vulnerabilities. This process confirms whether the vulnerability really exists and further
proves that exploiting it can result in damage to the application or network. The PT process is
mostly intrusive and can actually cause damage to the systems; hence, a lot of precautions
need to be taken before planning such a test. The outcome of a PT is, typically, evidence in
the form of a screenshot or log, which substantiates the finding and can be a useful aid
towards remediation. As a summary, shown below are the steps involved in the VAPT
process.

● Scanning the network or application

● Searching for security flaws
● Exploiting the security flaws
● Preparing the final report of the test

119