Hey, guys, welcome back to another episode on How to Hack.
So today we will be going through the Culley Lennix.
Explain.
All right.
So before I do that, I have a wonderful news.
OK, so the first thing is we actually have the following new changes.
All right.
Can actually help us do more to target for you so I can go ahead and go into command problem and I can
actually show you the new upgrade that we got so that we can actually put in more systems, more service,
more applications, so that we can demonstrate how an enterprise network is actually looking like and
how we can do ethical hacking and penetration testing on those tests.
Lapse environment in which you have like your proxy servers, your directory service, your application
systems and so on and so forth.
So we can actually build up a very, very nice LEPP environment in which we can test all this different
kind of exploits vulnerabilities and how enterprises could be trying to protect US systems.
So we got the AMD nine hundred sixty.
All right.
So this is a 12 core.
All right.
You have 12 core running to actually help us and do all this processing as we begin to virtualize even
more systems.
All right.
So that's the good news to start off today's tutorial.
OK, so going back to colonics, right?
So the first question is what is called Linux?
All right.
So colonics is an operating system.
All right.
Very similar to how, for example, you would use your Macintosh, your Windows 10 computer Ubuntu.
All right.
And the list goes on.
So this is a Linux distribution and it is, of course, created and maintained by offensive security.
And it was previously known as backtrack.
So I was using backtrack more than a decade ago, more 10 years ago, and already had all these wonderful
tools, software for us to actually do radical hacking and penetration testing on whether you are doing
it as a penetration tester or whether you're doing it and learning about how sort of software it could
be run, how we could test it on networks and systems and applications.
So this is colonics and ethical hacking, penetration testing platform.
OK, so of course you can go into the official site, which is colleague.
OK, so over here we have the advanced penetration testing distribution, OK?
And of course it has all the details, the new updates of all the software and so on.
So one of those wonderful places that you go to is to go to the top Tepp, click on the download and
click under download call of Linux.
OK, so over here, the wonderful thing is that we have a lot of different images that you can use to
run Linux and you have a 64 bit.
You can torrent them all.
You can also download them if you're, for example, of running different kind of virtualization technology
like VMware Virtual Box, you can just download it straight and all you got to do is double click on
it.
And once you have, for example, Oracle Virtual Box of VMware running, you can immediately get colonics
up and running in just a few minutes.
OK, so this is a wonderful way for us to actually start using a learning colonics to get more understanding
about radical hacking.
OK, so moving back into Colonie, so let me login.
OK, so this is the login page.
Let me login into colonics and of course in colonics.
I am actually using it as a platform where I can go, where I'm also teaching a lot of IT professionals
in the area of cyber security.
All right.
I've trained hundreds of I.T. professionals across the world in terms of using colonics.
And of course, you can see all of the different kind of information, a different kind of payloads
that have created as part of all this training.
And one of the important places that we look at is actually on the top left corner.
So this is the manual of colonics and they have actually broken down all this different software for
us.
So you have your favorites recently used and so on and so forth.
But the more important one here is zero one zero two zero three zero four all the way to number one
tree.
OK, so this are how they have actually categorized some of this software.
And before I actually dive deeper into what each of this category does, I also want to share with you
a little more about, for example, some of you may be familiar with the cyber attack framework, which
was developed by Lockheed Martin.
And of course, there's also the missile attack framework.
So this is a knowledge base of the foundation of the development of models, methodologies in the private
sector, in government and cybersecurity, product and service community, or as you can see over here.
So we have to attack Mr Orji so we can see all of this information as you scroll down.
OK, you have the different kind of tactics, techniques that the hackers are using.
So you have the initial access, execution, persistence and so on and so forth all the way to the end.
All right.
So you can.
You see all of those different kind of tactics and techniques.
All right, the techniques are listed over here.
OK, so, for example, if you want to look at abuse elevation control mechanism, you can just go ahead
and click on it and it'll give you more information about some techniques.
So, for example, the techniques here said UUID Saajid Bypass USSI.
So we have done a couple of those privilege escalation tutorial and part of this channel.
All right.
And we have super user do the right caching and so on.
So all this gives us a wonderful way of first understanding about how Disabler Tech is doing and to
in terms of the mitigation strategy and activities that we can put in place to protect ourselves in
our enterprises against all these cyber threats.
OK, so moving back into colonics so you can see some sort of similarity, of course, in this case,
more from the attackers point of view.
So we have, for example, like information gathering.
OK, so we have information gathering is about gathering information of a network, a device, a suite
of devices within a network or even about an entity which is coming from open source intelligence platforms
to help us find out more details before we launch attack.
So you have, for example, here, DNS analysis.
You have SSL analysis, SMTP, simple mail transfer protocol, and the list goes on and you have all
this common software and we have quite a number of them in terms of helping us list down the number
of devices in a network.
All right.
So this helps us understand, for example, how many mobile devices is in the wireless network, how
many devices are there in the network remedy or Macintosh network attached storage Windows, computers,
mobile devices.
We can find all of that from here.
OK, and moving on to zero two, we have vulnerability analysis.
OK, so this is the part where we are scanning the devices, looking out for certain information where
we can try to break open certain openings in which we can gain access into the device.
So I always go back to the very straightforward use case that we do as part of a cyber attack.
So think of it again, like how a robber would go breaking into a house.
OK, so what the robbers will do is that they will first gather information about a particular location,
about a particular building or a house or a residential area.
So they will look at the house, look at the vicinity.
Is there any nearby police station?
Is there any high walls that we need to climb?
What kind of fancy to using?
And how many doors does this house have?
How many windows do we have on the first floor?
So all these are the different information that they are gathering about that particular house.
Right.
Just like how we get our information of a particular network.
All right.
And then we have to begin scanning for vulnerabilities.
So what do I mean by vulnerabilities?
We're looking for places that can give us access into the house.
OK, so maybe this house does not have a high wall so we can easily jump through the walls and gain
access into the house.
And maybe in the house there are 10 windows on the first floor and one of the windows is always open
in which the robbers can easily just jump through the window and gain access to the house, after which
they will begin finding out where our cash, the valuables inside the house.
So, of course, in the cyber world, we are looking for critical data.
All right.
So once we gain access to critical data like financial information, credit card details, personal
data, once we gain access to them.
Right.
So that means the hackers have access to those systems applications and those key data.
All right.
And on 023, we have Web application analysis.
So we have been doing a lot of Web application penetration testing series as well, where we demonstrate
how many different of this sites could be vulnerable to different kind of hacks.
So we went through and using, of course, open Web application security project and looking at some
of this electronic commerce site as an example of how hackers could do cross site scripting, quasi
request forgery, trying to do SQL injection to gain access into other parts of the sites.
All right.
So we have actually went through a lot of them.
And as you can see over here, we have CMS, right, content management system.
So we are trying to identify what kind of platform technology that is running so that we can conduct
specific and create specific payloads to go and target against that particular site.
We have proxy web crawlers, directory systems.
So we even had one tutorial where we could find out where is the login page for.
So those were the kind of different tutorials that we were doing previously.
And Bourbon Street, I know I got a lot of requests, but Bourbon Street, so I would do a tutorial.
Stories on this coming soon.
All right, so do do watch out for those tutorials.
And we've gone through all this different kind of technology and platforms for us to do analysis of
those sites, especially in an automated way.
But give us the option to be more manl to actually customize your payload and inject them specifically
into different input forms.
04 is database assessment.
So this is the part where the hackers go directly into the database system to try to extract data.
All right.
So we have done no tutorial on this.
And of course, SQL Map is one of the most used tool to actually conduct SQL injection to try to gain
access into the database system.
And he could help us quickly map out the structure of the database and be able to have five thousand
tables with sensitive data, with passwords and try to even crack them open.
And we've SQLite database browser.
Right.
So a lot of new modern and mobile applications actually need somewhere to store some of the data.
So a lot of this different data could be stored in a sequel light fall so we can actually browse them
using the school like database browser.
So we have done a couple of tutorial on mobile application penetration testing to password attacks.
So password attacks are mainly segregated into two forms.
So one is the offline tech and the other one is online.
So online attack means that we do a direct attack against a server to try to gain entry into those credentials
and for offline attacks.
Offline attacks we are actually targeting.
All right.
Based on the data that we have extracted.
So once we have extracted those data, what we will do is we will try to crack those passwords that
we found.
All right.
So that's the whole idea of password attacks.
And we can also look at some of the usage of the software here.
It has been created like John Medusa, where it lists that we have used very, very frequently together
with all the platforms whilst attacks.
All right.
So you can get yourself a couple of wireless adapters and we can put them into the promiscuous mode
and we can start sniffing for data in the network, looking at how data are being transacted in the
vicinity in the area.
So that's part of Wallace attacks.
And more than 10 years ago, I was already using crack and.
All right.
So this is actually very, very useful in helping us crack certain wireless networks and we have reverse
engineering.
All right.
So this is the part where we can look into these software and look at the assembly language of how they
actually call certain functions and be able to map out how they're how old your application could be
running logically and in looking at places where we possibly inject into the into the software to gain
access to the system, we have exploitation tools like metastable framework that we have done a lot
of tutorials on in which we learn about how we can target a specific system and rondos pilots with a
shell.
All right.
So that we have access into the system and looking at the different modules as part of our supply framework
to run our attack.
And we have also look into social engineering toolkit as a way for us to also target users on the psychological
end of the attack.
So this is how the fraudsters, all these scammers, as to try to trick users into giving up their usernames,
passwords, personal data and so on.
All right.
Then we have sniffing and spoofing.
All right.
So this is the part where you could possibly set up a fake wireless access point.
And as people gain access to your fake wireless access point, you could see all those data that going
in and out of system.
Or if you managed to join a network, you could actually run a sniffing right to look at certain data
that's been transacted in the environment and be able to view into those payload.
We have post exploitation.
So this is the part where you gain access to the system and you may want to correct password, you may
want to gain elevator privileges.
So those are the different kind of modules available as part of post exploitation.
So we went through maybe Cats' Palace, Bloy.
All right.
And we'll try to go through the rest of the other software or even writing those software ourselves.
We have forensics.
OK, so this is the part where we have not gone through at all yet as part of the channel, but definitely
really exciting topic and domain that we will look deeply into in future.
To Tara.
So do stay tuned for debt.
Reporting tools.
So if you're a penetration tester at the end of day, whether you are doing your internal or external
penetration testing, you definitely need to be able to generate reports to provide them back to the
stakeholders and let them be informed of where you detected vulnerabilities.
So, again, going back to the earlier analogy about how robbers go after houses.
So what we're trying to do here is to be the good guys.
All right.
So you're scanning the house ahead and you're scanning the doors, the windows, assessing the security
posture of the House and of course, in a cyber world, security posture of the enterprise.
And once you look into all this, different systems, applications, devices, now equipments and so
on, and you find out and figure out where are the vulnerabilities and how you prioritize them, because
depending on the criticality of those vulnerabilities and how easy and dangerous they are, if they
are exploited and then giving a recommendation back to the stakeholders about what they should do in
order to contain.
All right.
And, of course, in order to remediate against those vulnerabilities before to hackers do it OK.
And again, social engineering tools.
We have tago.
We have social engine toolkit, MSF, Paillot, creator, NBC.
So, again, very, very good ways for us to launch attacks where we could get usernames and passwords.
So rather than doing all the technical stuff, why not couple it together with how the hackers could
be doing up a fake login page to get the names of passwords to phishing attacks?
OK, so this are the different components or categories inside colonics as part of how we can perform
ethical hacking and penetration testing.
So once again, I hope you've learned something valuable in today's tutorial.
And if I have any questions, feel free to leave a comment below and I'll try my best to answer any
of your questions and maybe like share and subscribe to channel so that you can be kept abreast of the
latest cyber security tutorial.
Thank you so much once again for watching.