Original subtitles

1

Hey, guys, welcome back to another episode on How to Hack.

2

So today we will be going through the Culley Lennix.

3

Explain.

4

All right.

5

So before I do that, I have a wonderful news.

6

OK, so the first thing is we actually have the following new changes.

7

All right.

8

Can actually help us do more to target for you so I can go ahead and go into command problem and I can

9

actually show you the new upgrade that we got so that we can actually put in more systems, more service,

10

more applications, so that we can demonstrate how an enterprise network is actually looking like and

11

how we can do ethical hacking and penetration testing on those tests.

12

Lapse environment in which you have like your proxy servers, your directory service, your application

13

systems and so on and so forth.

14

So we can actually build up a very, very nice LEPP environment in which we can test all this different

15

kind of exploits vulnerabilities and how enterprises could be trying to protect US systems.

16

So we got the AMD nine hundred sixty.

17

All right.

18

So this is a 12 core.

19

All right.

20

You have 12 core running to actually help us and do all this processing as we begin to virtualize even

21

more systems.

22

All right.

23

So that's the good news to start off today's tutorial.

24

OK, so going back to colonics, right?

25

So the first question is what is called Linux?

26

All right.

27

So colonics is an operating system.

28

All right.

29

Very similar to how, for example, you would use your Macintosh, your Windows 10 computer Ubuntu.

30

All right.

31

And the list goes on.

32

So this is a Linux distribution and it is, of course, created and maintained by offensive security.

33

And it was previously known as backtrack.

34

So I was using backtrack more than a decade ago, more 10 years ago, and already had all these wonderful

35

tools, software for us to actually do radical hacking and penetration testing on whether you are doing

36

it as a penetration tester or whether you're doing it and learning about how sort of software it could

37

be run, how we could test it on networks and systems and applications.

38

So this is colonics and ethical hacking, penetration testing platform.

39

OK, so of course you can go into the official site, which is colleague.

40

OK, so over here we have the advanced penetration testing distribution, OK?

41

And of course it has all the details, the new updates of all the software and so on.

42

So one of those wonderful places that you go to is to go to the top Tepp, click on the download and

43

click under download call of Linux.

44

OK, so over here, the wonderful thing is that we have a lot of different images that you can use to

45

run Linux and you have a 64 bit.

46

You can torrent them all.

47

You can also download them if you're, for example, of running different kind of virtualization technology

48

like VMware Virtual Box, you can just download it straight and all you got to do is double click on

49

it.

50

And once you have, for example, Oracle Virtual Box of VMware running, you can immediately get colonics

51

up and running in just a few minutes.

52

OK, so this is a wonderful way for us to actually start using a learning colonics to get more understanding

53

about radical hacking.

54

OK, so moving back into Colonie, so let me login.

55

OK, so this is the login page.

56

Let me login into colonics and of course in colonics.

57

I am actually using it as a platform where I can go, where I'm also teaching a lot of IT professionals

58

in the area of cyber security.

59

All right.

60

I've trained hundreds of I.T. professionals across the world in terms of using colonics.

61

And of course, you can see all of the different kind of information, a different kind of payloads

62

that have created as part of all this training.

63

And one of the important places that we look at is actually on the top left corner.

64

So this is the manual of colonics and they have actually broken down all this different software for

65

us.

66

So you have your favorites recently used and so on and so forth.

67

But the more important one here is zero one zero two zero three zero four all the way to number one

68

tree.

69

OK, so this are how they have actually categorized some of this software.

70

And before I actually dive deeper into what each of this category does, I also want to share with you

71

a little more about, for example, some of you may be familiar with the cyber attack framework, which

72

was developed by Lockheed Martin.

73

And of course, there's also the missile attack framework.

74

So this is a knowledge base of the foundation of the development of models, methodologies in the private

75

sector, in government and cybersecurity, product and service community, or as you can see over here.

76

So we have to attack Mr Orji so we can see all of this information as you scroll down.

77

OK, you have the different kind of tactics, techniques that the hackers are using.

78

So you have the initial access, execution, persistence and so on and so forth all the way to the end.

79

All right.

80

So you can.

81

You see all of those different kind of tactics and techniques.

82

All right, the techniques are listed over here.

83

OK, so, for example, if you want to look at abuse elevation control mechanism, you can just go ahead

84

and click on it and it'll give you more information about some techniques.

85

So, for example, the techniques here said UUID Saajid Bypass USSI.

86

So we have done a couple of those privilege escalation tutorial and part of this channel.

87

All right.

88

And we have super user do the right caching and so on.

89

So all this gives us a wonderful way of first understanding about how Disabler Tech is doing and to

90

in terms of the mitigation strategy and activities that we can put in place to protect ourselves in

91

our enterprises against all these cyber threats.

92

OK, so moving back into colonics so you can see some sort of similarity, of course, in this case,

93

more from the attackers point of view.

94

So we have, for example, like information gathering.

95

OK, so we have information gathering is about gathering information of a network, a device, a suite

96

of devices within a network or even about an entity which is coming from open source intelligence platforms

97

to help us find out more details before we launch attack.

98

So you have, for example, here, DNS analysis.

99

You have SSL analysis, SMTP, simple mail transfer protocol, and the list goes on and you have all

100

this common software and we have quite a number of them in terms of helping us list down the number

101

of devices in a network.

102

All right.

103

So this helps us understand, for example, how many mobile devices is in the wireless network, how

104

many devices are there in the network remedy or Macintosh network attached storage Windows, computers,

105

mobile devices.

106

We can find all of that from here.

107

OK, and moving on to zero two, we have vulnerability analysis.

108

OK, so this is the part where we are scanning the devices, looking out for certain information where

109

we can try to break open certain openings in which we can gain access into the device.

110

So I always go back to the very straightforward use case that we do as part of a cyber attack.

111

So think of it again, like how a robber would go breaking into a house.

112

OK, so what the robbers will do is that they will first gather information about a particular location,

113

about a particular building or a house or a residential area.

114

So they will look at the house, look at the vicinity.

115

Is there any nearby police station?

116

Is there any high walls that we need to climb?

117

What kind of fancy to using?

118

And how many doors does this house have?

119

How many windows do we have on the first floor?

120

So all these are the different information that they are gathering about that particular house.

121

Right.

122

Just like how we get our information of a particular network.

123

All right.

124

And then we have to begin scanning for vulnerabilities.

125

So what do I mean by vulnerabilities?

126

We're looking for places that can give us access into the house.

127

OK, so maybe this house does not have a high wall so we can easily jump through the walls and gain

128

access into the house.

129

And maybe in the house there are 10 windows on the first floor and one of the windows is always open

130

in which the robbers can easily just jump through the window and gain access to the house, after which

131

they will begin finding out where our cash, the valuables inside the house.

132

So, of course, in the cyber world, we are looking for critical data.

133

All right.

134

So once we gain access to critical data like financial information, credit card details, personal

135

data, once we gain access to them.

136

Right.

137

So that means the hackers have access to those systems applications and those key data.

138

All right.

139

And on 023, we have Web application analysis.

140

So we have been doing a lot of Web application penetration testing series as well, where we demonstrate

141

how many different of this sites could be vulnerable to different kind of hacks.

142

So we went through and using, of course, open Web application security project and looking at some

143

of this electronic commerce site as an example of how hackers could do cross site scripting, quasi

144

request forgery, trying to do SQL injection to gain access into other parts of the sites.

145

All right.

146

So we have actually went through a lot of them.

147

And as you can see over here, we have CMS, right, content management system.

148

So we are trying to identify what kind of platform technology that is running so that we can conduct

149

specific and create specific payloads to go and target against that particular site.

150

We have proxy web crawlers, directory systems.

151

So we even had one tutorial where we could find out where is the login page for.

152

So those were the kind of different tutorials that we were doing previously.

153

And Bourbon Street, I know I got a lot of requests, but Bourbon Street, so I would do a tutorial.

154

Stories on this coming soon.

155

All right, so do do watch out for those tutorials.

156

And we've gone through all this different kind of technology and platforms for us to do analysis of

157

those sites, especially in an automated way.

158

But give us the option to be more manl to actually customize your payload and inject them specifically

159

into different input forms.

160

04 is database assessment.

161

So this is the part where the hackers go directly into the database system to try to extract data.

162

All right.

163

So we have done no tutorial on this.

164

And of course, SQL Map is one of the most used tool to actually conduct SQL injection to try to gain

165

access into the database system.

166

And he could help us quickly map out the structure of the database and be able to have five thousand

167

tables with sensitive data, with passwords and try to even crack them open.

168

And we've SQLite database browser.

169

Right.

170

So a lot of new modern and mobile applications actually need somewhere to store some of the data.

171

So a lot of this different data could be stored in a sequel light fall so we can actually browse them

172

using the school like database browser.

173

So we have done a couple of tutorial on mobile application penetration testing to password attacks.

174

So password attacks are mainly segregated into two forms.

175

So one is the offline tech and the other one is online.

176

So online attack means that we do a direct attack against a server to try to gain entry into those credentials

177

and for offline attacks.

178

Offline attacks we are actually targeting.

179

All right.

180

Based on the data that we have extracted.

181

So once we have extracted those data, what we will do is we will try to crack those passwords that

182

we found.

183

All right.

184

So that's the whole idea of password attacks.

185

And we can also look at some of the usage of the software here.

186

It has been created like John Medusa, where it lists that we have used very, very frequently together

187

with all the platforms whilst attacks.

188

All right.

189

So you can get yourself a couple of wireless adapters and we can put them into the promiscuous mode

190

and we can start sniffing for data in the network, looking at how data are being transacted in the

191

vicinity in the area.

192

So that's part of Wallace attacks.

193

And more than 10 years ago, I was already using crack and.

194

All right.

195

So this is actually very, very useful in helping us crack certain wireless networks and we have reverse

196

engineering.

197

All right.

198

So this is the part where we can look into these software and look at the assembly language of how they

199

actually call certain functions and be able to map out how they're how old your application could be

200

running logically and in looking at places where we possibly inject into the into the software to gain

201

access to the system, we have exploitation tools like metastable framework that we have done a lot

202

of tutorials on in which we learn about how we can target a specific system and rondos pilots with a

203

shell.

204

All right.

205

So that we have access into the system and looking at the different modules as part of our supply framework

206

to run our attack.

207

And we have also look into social engineering toolkit as a way for us to also target users on the psychological

208

end of the attack.

209

So this is how the fraudsters, all these scammers, as to try to trick users into giving up their usernames,

210

passwords, personal data and so on.

211

All right.

212

Then we have sniffing and spoofing.

213

All right.

214

So this is the part where you could possibly set up a fake wireless access point.

215

And as people gain access to your fake wireless access point, you could see all those data that going

216

in and out of system.

217

Or if you managed to join a network, you could actually run a sniffing right to look at certain data

218

that's been transacted in the environment and be able to view into those payload.

219

We have post exploitation.

220

So this is the part where you gain access to the system and you may want to correct password, you may

221

want to gain elevator privileges.

222

So those are the different kind of modules available as part of post exploitation.

223

So we went through maybe Cats' Palace, Bloy.

224

All right.

225

And we'll try to go through the rest of the other software or even writing those software ourselves.

226

We have forensics.

227

OK, so this is the part where we have not gone through at all yet as part of the channel, but definitely

228

really exciting topic and domain that we will look deeply into in future.

229

To Tara.

230

So do stay tuned for debt.

231

Reporting tools.

232

So if you're a penetration tester at the end of day, whether you are doing your internal or external

233

penetration testing, you definitely need to be able to generate reports to provide them back to the

234

stakeholders and let them be informed of where you detected vulnerabilities.

235

So, again, going back to the earlier analogy about how robbers go after houses.

236

So what we're trying to do here is to be the good guys.

237

All right.

238

So you're scanning the house ahead and you're scanning the doors, the windows, assessing the security

239

posture of the House and of course, in a cyber world, security posture of the enterprise.

240

And once you look into all this, different systems, applications, devices, now equipments and so

241

on, and you find out and figure out where are the vulnerabilities and how you prioritize them, because

242

depending on the criticality of those vulnerabilities and how easy and dangerous they are, if they

243

are exploited and then giving a recommendation back to the stakeholders about what they should do in

244

order to contain.

245

All right.

246

And, of course, in order to remediate against those vulnerabilities before to hackers do it OK.

247

And again, social engineering tools.

248

We have tago.

249

We have social engine toolkit, MSF, Paillot, creator, NBC.

250

So, again, very, very good ways for us to launch attacks where we could get usernames and passwords.

251

So rather than doing all the technical stuff, why not couple it together with how the hackers could

252

be doing up a fake login page to get the names of passwords to phishing attacks?

253

OK, so this are the different components or categories inside colonics as part of how we can perform

254

ethical hacking and penetration testing.

255

So once again, I hope you've learned something valuable in today's tutorial.

256

And if I have any questions, feel free to leave a comment below and I'll try my best to answer any

257

of your questions and maybe like share and subscribe to channel so that you can be kept abreast of the

258

latest cyber security tutorial.

259

Thank you so much once again for watching.