Speaker 1: Welcome to the Deep Dive. We're the show where we
Speaker 1: take a whole stack of sources, you know, articles, books, research,
Speaker 1: our own notes, and we really try to pull out
Speaker 1: those key bits of knowledge, those insights.
Speaker 2: That's right, And today we're diving into a world that
Speaker 2: I think fascinates a lot of people how things work,
Speaker 2: especially digital things.
Speaker 1: And it's a space where curiosity well can sometimes rope
Speaker 1: right up against security boundaries.
Speaker 2: Yeah, that line is thin, isn't it. The interplay between
Speaker 2: wanting to know and the risks involved. That's really our
Speaker 2: focus today. We're exploring the world.
Speaker 1: Of hacking, but specifically ethical hacking right its role which
Speaker 1: maybe isn't always understood in finding vulnerabilities and actually making
Speaker 1: our digital world safer.
Speaker 2: Exactly making it stronger. So for this deep dive, our
Speaker 2: main guide is a book called Hacking the Unlocking of Transparency.
Speaker 2: Security is a myth, it's a title, it is. It's
Speaker 2: by our Shutosh pertop Singh, who's also known as Joker
Speaker 2: of Technical Sepien.
Speaker 1: Okay, so our mission here is to really unpack the
Speaker 1: key insights from his work, give you a kind of
Speaker 1: shortcut to getting up to speed on ethical hacking. We're
Speaker 1: hoping for some surprising facts, maybe some explanations that really
Speaker 1: click absolutely.
Speaker 2: And to really get it, you kind of have to
Speaker 2: start with the author himself, a shutash pratopsing his journey
Speaker 2: into this whole thing. It started with, believe it or not,
Speaker 2: a YouTube video, oh yeah, yeah, one that claimed to
Speaker 2: show how you could remotely shut down someone else's computer.
Speaker 2: Turned out the video was fake, okay, but the curiosity
Speaker 2: it ignited in him that was one hundred percent real.
Speaker 1: That's fascinating. So from that that kind of false start.
Speaker 2: He just dove in totally headfirst into hacking during a
Speaker 2: summer break, and the book is pretty open about it.
Speaker 2: He initially went down the black hat path.
Speaker 1: Right the illegal side, things like cracking software.
Speaker 2: Card carding, spamming, that kind of thing, but he says
Speaker 2: he pretty quickly realized, you know, how risky that was unsustainable,
Speaker 2: and it really opened his eyes to just how bad
Speaker 2: cybersecurity often is out there.
Speaker 1: So that was the turning point, seeing the risks and
Speaker 1: the well the need for better security.
Speaker 2: It seems so that realization was pivotal. By late twenty seventeen,
Speaker 2: he made a conscious shift. He decided to focus on
Speaker 2: ethical hacking wanting to use those skills. He was developing
Speaker 2: for something constructive, something useful.
Speaker 1: And that led to technical sapien, that's right.
Speaker 2: In January twenty eighteen, he started an Instagram page. The
Speaker 2: initial goal was simple, find other people who were interested
Speaker 2: in the same things.
Speaker 1: A community, building, exercise base.
Speaker 2: Exactly, And like any big project, it wasn't smooth sailing
Speaker 2: at first. He tried what zapp groups had about five
Speaker 2: active ones. Oh wow, yeah, but apparently getting smart people
Speaker 2: to cooperate smoothly in that format it was tough. Then
Speaker 2: he moved to Telegram, built up this huge community over
Speaker 2: eleven thousand members, but faced issues there too, scams, people
Speaker 2: you couldn't trust. So ultimately he decided, okay, let's just
Speaker 2: focus everything on Instagram, build a more dedicated, reliable community.
Speaker 1: There, and that focused approach worked.
Speaker 2: It seems to have thought the Instagram community now they
Speaker 2: share info daily, help each other with technical problems, even
Speaker 2: self development stuff. They make informative posts, stories, guide people
Speaker 2: on careers.
Speaker 1: Sounds pretty comprehensive. And they actively ask for feedback too, you.
Speaker 2: Said, very interactive. They've even run five ethical hacking classes,
Speaker 2: trained over five hundred people. Wow, And apparently the demand
Speaker 2: for those classes was huge, way more than they had
Speaker 2: seats for it. That was actually a big reason he
Speaker 2: wrote the book. To get this knowledge out.
Speaker 1: To more people makes sense. And the name technical Sapien
Speaker 1: it's not just random, is it.
Speaker 2: No, there's a philosophy behind it. It plays on a
Speaker 2: homo sapien right. The mission, as he puts it, is
Speaker 2: to make people really aware of technology, to sort of
Speaker 2: convert them into technical humans.
Speaker 1: Technical humans. I like that.
Speaker 2: Yeah, the idea is helping people learn tech in easier,
Speaker 2: faster ways, keeping them current for this digital age. We're
Speaker 2: all in. And interestingly, their focus isn't just ethical hacking anymore.
Speaker 2: It's broadened out to other tech felss.
Speaker 1: Too, so a wider mission for digital literacy overall. Okay,
Speaker 1: as a great background, Now let's peel back the layers,
Speaker 1: the foundations. What actually is hacking because often we think
Speaker 1: of it as purely modern right digital, But the book
Speaker 1: says its roots go way back.
Speaker 2: They really do. The core idea manipulating systems has been
Speaker 2: around for over fifty years. You can even argue the
Speaker 2: spirit goes back to like eighteen seventy eight Bell telephone
Speaker 2: teenage switchboard operators messing with calls, disconnecting them, misdirecting them,
Speaker 2: kind of mischievous hacks.
Speaker 1: Huh, never thought of it like that.
Speaker 2: But the first sort of authentic computer hackers they showed
Speaker 2: up in the nineteen sixties at MIT, students finding clever
Speaker 2: programming shortcuts, hacks to make computers do tasks faster, sometimes
Speaker 2: even better than the original design.
Speaker 1: And that creative shortcut approach led to big things.
Speaker 2: Like Unix exactly. The book credits Dennis Ritchie and Ken
Speaker 2: Thompson at Bell Labs in nineteen sixty nine they created
Speaker 2: you Andix as this open set of rules for running machines,
Speaker 2: essentially a really sophisticated creative hack at the time.
Speaker 1: Okay, so how do we get from creative shortcuts to
Speaker 1: the definition we mostly use today?
Speaker 2: Well, that's the crucial evolution. Today. Hacking in the common
Speaker 2: sense is mostly about finding those entry points, those vulnerabilities
Speaker 2: in a system or network, usually to gain unauthorized access,
Speaker 2: maybe steal info, cause harm.
Speaker 1: Right, But ethical hacking flips that completely.
Speaker 2: Ethical hacking is deliberately doing the same things, but with permission.
Speaker 2: You're exploring the weaknesses, testing the defenses, specifically to improve security.
Speaker 2: It's also called penetration testing, intrusion testing, red teaming, different
Speaker 2: names for the same goal.
Speaker 1: Got it. So what motivates people to hack in the
Speaker 1: first place? The book covers a pretty wide range, doesn't it.
Speaker 2: It really does. It goes from just you know, for
Speaker 2: fun or showing off skills all the way to malicious
Speaker 2: stuff like stealing information, damaging systems, invading privacy, even extortion.
Speaker 1: But it also includes the positive side, like testing security.
Speaker 2: Absolutely system security testing, maybe even breaking policy compliance in
Speaker 2: a way that highlights a flaw constructively. It's a mixed
Speaker 2: bag of motivations, which.
Speaker 1: Leads us nicely into different types of hackers. The book
Speaker 1: breaks them down by intent.
Speaker 2: Yeah, pretty clearly, you've got your white hat hackers. Those
Speaker 2: are the ethical security experts, the good guys doing the
Speaker 2: penetration testing to protect us.
Speaker 1: Then the black hat hackers sometimes called crackers. They're the
Speaker 1: ones operating illegally with malicious intent, stealing data, wrecking systems.
Speaker 2: And then there's that interesting gray area, the gray hat hackers.
Speaker 1: Right, they might bend or break rules, maybe even laws,
Speaker 1: but not necessarily with bad intentions.
Speaker 2: Often, yeah, their goal might be just to find a
Speaker 2: weakness and tell the owner. Maybe hoping for some recognition
Speaker 2: or even a bug bounty payment. They operate in that
Speaker 2: ambiguous zone.
Speaker 1: The book also mentions red hat hackers that's distinct from
Speaker 1: the software company right.
Speaker 2: Very distinct.
Speaker 1: Yeah.
Speaker 2: In this context, red hat hackers are described as focusing
Speaker 2: specifically on targeting government agencies, top secret data hubs, high
Speaker 2: level target Okay.
Speaker 1: And then you have the less sophisticated.
Speaker 2: Actors right script kitties, people who use hacking tools made
Speaker 2: by others without really understanding the underlying principles. And activists
Speaker 2: who use hacking techniques like defacing websites or launching denial
Speaker 2: of service attacks to promote a social, political, or religious message.
Speaker 1: It's a whole ecosystem. Now. Trying to understand all this
Speaker 1: requires learning a new language. Almost The book includes a
Speaker 1: glossary which seems super.
Speaker 2: Helpful, absolutely essential. Understanding these terms is key to unlocking
Speaker 2: what the book and the field is all about. And
Speaker 2: you'll notice as we go through some how many revolve
Speaker 2: around deception. Unauthorized access tells you a lot.
Speaker 1: Good point, it's as much about psychology as technology sometimes,
Speaker 1: So let's run through a few key ones. Adwere software
Speaker 1: that just forces ads on you annoying, sometimes malicious.
Speaker 2: An attack is pretty straightforward. The action to get in
Speaker 2: or get data a backdoor.
Speaker 1: Secret entrance, a hidden way in that bypasses the normal
Speaker 1: security checks.
Speaker 2: Okay, Bots and botnets. A bot is just an automated program.
Speaker 2: A botnet is when an attacker controls a whole network
Speaker 2: of infected computers. Those zombie drones we mentioned to do
Speaker 2: their bidding, like sending spam or launching massive attacks.
Speaker 1: Brute force attack that's.
Speaker 2: Just trying every single password combination possible, usually automated until
Speaker 2: one works simple, but can be effective against weak passwords.
Speaker 1: But for overflow, you described it like pouring too much
Speaker 1: water into a glass earlier.
Speaker 2: Exactly, you overwhelm a specific memory area, causing data to
Speaker 2: spill over, potentially crashing the system or worse, allowing the
Speaker 2: attacker to inject their own code.
Speaker 1: Clone fishing sounds sneaky.
Speaker 2: It is taking a legitimate email, copying it, but changing
Speaker 2: the links to point somewhere malicious to trick you.
Speaker 1: A cracker versus a hacker.
Speaker 2: Often use for someone who modifies software, especially to break
Speaker 2: copy protection. Sometimes overlaps with black.
Speaker 1: Hat denial of service sandidas.
Speaker 2: Making a website or service unusable by flooding it with traffic.
Speaker 2: Didas is the distributed version using a botnet to amplify
Speaker 2: the attack massively.
Speaker 1: Exploit and exploit kit.
Speaker 2: An exploit is the specific piece of code or technique
Speaker 2: that takes advantage of a vulnerability. An exploit kit is
Speaker 2: like a prepackaged toolkit that helps automate finding and using
Speaker 2: those exploits.
Speaker 1: Firewall the digital bouncer.
Speaker 2: YEP filtering traffic trying to keep intruders out.
Speaker 1: Dampto quogging malicious.
Speaker 2: Software that secretly records everything you type, very dangerous for
Speaker 2: capturing passwords, credit card numbers. A logic bomb a piece
Speaker 2: of malicious code designed to trigger only under certain conditions,
Speaker 2: like on a specific date or if an employee gets fired.
Speaker 1: That kind of thing. Malware is the big umbrella.
Speaker 2: Term right covers, viruses, worms, trojans, ransomware, any software designed
Speaker 2: to be hostile.
Speaker 1: Phishing. We all know that one sadly, the fake emails
Speaker 1: trying to get personal info.
Speaker 2: Freaker is an older term, most for breaking into phone networks.
Speaker 2: Rootkit super stealthy malware. It hides itself and other malicious processes,
Speaker 2: often giving the attacker the highest level root privileges. On
Speaker 2: a system very hard to detect.
Speaker 1: Shrink wrap code exploit.
Speaker 2: Taking advantage of vulnerabilities in software that hasn't been patched
Speaker 2: or is using default insecure configurations, basically exploiting the out
Speaker 2: of the box weaknesses.
Speaker 1: Social engineering. This one feels different, less technical.
Speaker 2: Absolutely, it's the art of manipulation. Tricking people into giving
Speaker 2: up information or performing actions they shouldn't. Often involves impersonation.
Speaker 2: Pre Texting relies on human psychology.
Speaker 1: Spam unwanted email spoofing.
Speaker 2: Faking your identity could be your IP address, email address,
Speaker 2: caller ID to gain unauthorized access or trick someone.
Speaker 1: Spyware gathers info without you knowing.
Speaker 2: SQL injection a huge one for web security. Injecting malicious
Speaker 2: database commands or into input fields on a website can
Speaker 2: let attackers read, chained or delete database comes.
Speaker 1: Threat versus vulnerability.
Speaker 2: A vulnerability is the weakness itself, the unlocked window. A
Speaker 2: threat is the potential danger that could exploit that weakness,
Speaker 2: the burglar who might climb through the window.
Speaker 1: Trojan horse malware disguises something legitimate.
Speaker 2: Yep, you willingly let it in because you think it's
Speaker 2: harmless or useful.
Speaker 1: Virus versus worm a.
Speaker 2: Virus needs to attach itself to another program to spread,
Speaker 2: often requiring human action like opening a file. A worm
Speaker 2: is self replicating, it can spread across networks on its
Speaker 2: own without needing to attach to anything.
Speaker 1: Cross sight scripting EXSS.
Speaker 2: Injecting malicious scripts usually JavaScript, into a legitimate website so
Speaker 2: it runs in the browsers of other visitors. Can steal cookies,
Speaker 2: redirect users, deface sites.
Speaker 1: And zombie drawn that hijacked computer and a bot.
Speaker 2: At exactly doing the attackers dirty work.
Speaker 1: Okay, that's a ton of terminology, but really crucial for
Speaker 1: understanding the landscape. So once you grasp the language, what
Speaker 1: tools does an ethical hacker actually use? The book talks
Speaker 1: about starting with physical tools. What does that really mean? Here?
Speaker 2: It's more about starting with tools where you can kind
Speaker 2: of see the cause and effect more directly. The idea
Speaker 2: is to understand the underlying protocols and concepts without getting
Speaker 2: lost in complex code right away see the results of
Speaker 2: your actions.
Speaker 1: Clearly makes sense, and the book highlights some big ones
Speaker 1: Metasploid framework. Yeah.
Speaker 2: Cornerstone open source penetration testing tool makes exploiting known vulnerabilities
Speaker 2: much easier with its library of pre built modules and payloads.
Speaker 2: It's incredibly powerful end map network mapper, fantastic tool for
Speaker 2: network discovery and security auditing. It finds hosts, scans for
Speaker 2: open ports, identifies services running, can even help fingerprint operating
Speaker 2: systems and bypass firewalls really versatile.
Speaker 1: Wireshark is another famous one packet sniffing.
Speaker 2: The go to packet analyzer. It captures network traffic in
Speaker 2: real time and lets you inspect individual packets. Essential for
Speaker 2: troubleshooting network problems, analyzing protocols, and yes, finding things like
Speaker 2: unencrypted passwords if they're flying across the network. Nesis a
Speaker 2: popular vulnerability scanner. It checks systems against a huge database
Speaker 2: of known vulnerabilities cvees and reports potential weaknesses. Uses its
Speaker 2: own scripting language NASL for tests, air.
Speaker 1: Cracking sounds Wi Fi specific it is.
Speaker 2: It's a whole suite of tools for auditing wireless network security,
Speaker 2: monitoring traffic, attacking networks like trying to crack WP and
Speaker 2: wpopat two keys, testing Wi Fi cards, the standard for
Speaker 2: Wi Fi pen testing.
Speaker 1: John the Ripper for passwords.
Speaker 2: YEP a fast password cracker primarily known for cracking various
Speaker 2: password hash formats, especially good at finding weak Unix passwords,
Speaker 2: but supports many others too.
Speaker 1: And surprisingly, Google itself is listed as a tool.
Speaker 2: Oh yeah, definitely. The book calls it a near real
Speaker 2: time vulnerability database. Using specific search queries what's often called
Speaker 2: Google dorking, you can find an astonishing amount of sensitive
Speaker 2: information that's been accidentally exposed online, misconfigured servers, internal documents,
Speaker 2: open network share. It's all about knowing how to search.
Speaker 1: That's wild. So you have the tools, but you need
Speaker 1: a place to use them safely and effectively. That brings
Speaker 1: us to the workplace. Setup Kali Linux Why is Collie?
Speaker 1: The standard?
Speaker 2: KLLI is basically Debian Linux, specifically rebuilt and pre configured
Speaker 2: for penetration testing and digital forensics. It's maintained by Offensive Security,
Speaker 2: the folks behind the OSCP certification. It comes bundled with
Speaker 2: hundreds of specialized tools metasploid, end map, wire Shark, aircrack,
Speaker 2: John the Ripper. They're all usually there. It saves a
Speaker 2: ton of setup time and provides a standardized, reliable environment.
Speaker 1: And the book recommends setting it up in a virtual
Speaker 1: machine like virtual box.
Speaker 2: Exactly. Running Collie in a VM creates an isolated sandbox
Speaker 2: you can experiment even break things without affecting your main
Speaker 2: operating system. It's much safer, especially when you're learning or
Speaker 2: dealing with potentially risky tools or exploits. The book gives
Speaker 2: step by step instructions for that virtual.
Speaker 1: Box setup, covering things like memory allocation, virtual hard disk,
Speaker 1: set up, all.
Speaker 2: The details right, getting the foundation right, and beyond just
Speaker 2: installing Collie. The book covers configuring essential network services within it,
Speaker 2: making sure you can connect properly, maybe setting up network
Speaker 2: proxies if needed, and.
Speaker 1: Enabling SSH secure shell for remote access but.
Speaker 2: Securely, crucially securely, Collie disables the default SSH service for safety.
Speaker 2: The book explains how to generate unique keys and start
Speaker 2: the service properly if you need it.
Speaker 1: And keeping Collie updated is paramount, just like ANYOS.
Speaker 2: Absolutely critical. The threat landscape changes constantly. The book explains
Speaker 2: debian's package management system APT and the commands like appt
Speaker 2: get update and app get upgrade or disted upgrade. To
Speaker 2: keep Collie and all its tools patched and current. An
Speaker 2: outdated hacking toolkit is not very effective or safe.
Speaker 1: Okay, environment set tools ready. Now the actual process begins.
Speaker 1: The book Hammer's home that reconnaissance or information gathering is
Speaker 1: the first and maybe most critical step. It says it
Speaker 1: can take up to seventy five percent of the effort.
Speaker 2: Why so much because you can't effectively attack what you
Speaker 2: don't understand. Recon is about meticulously mapping out your target's
Speaker 2: digital footprint. What systems do they have, what software are
Speaker 2: they running, who works there, what's their network structure like.
Speaker 2: The more info you gather up front, the higher your
Speaker 2: chances of finding a viable enter point. Rushing this phase
Speaker 2: is a recipe for failure or getting caught, and.
Speaker 1: There are two main types of recon, active and passive.
Speaker 2: That's right. Passive recon is gathering information without directly interacting
Speaker 2: with the target systems. Think public records, social media, news articles, DNS,
Speaker 2: lookups from public servers, Google dorking. It's stealthier, lower risk
Speaker 2: of detection.
Speaker 1: Active recon, then, is when you start probing the target directly.
Speaker 2: Exactly things like ports, standing their servers, trying to identify
Speaker 2: web server versions, interacting with their systems in ways that
Speaker 2: could be logged or detected by intrusion detection systems IDs
Speaker 2: or intrusion prevention systems IPS. It yields more detailed info
Speaker 2: but carries more risk.
Speaker 1: You mentioned DNS lookups. DNS reconnaissance seems like a key
Speaker 1: part of this.
Speaker 2: It's incredibly valuable DNS. The Internet's phone book holds info
Speaker 2: about domain names, mail servers, IP addresses. Analyzing and organization's
Speaker 2: DNS records can reveal a surprising amount about their internal
Speaker 2: network structure, often without setting off alarms. Because while DNAs
Speaker 2: traffic is usually considered normal.
Speaker 1: So what are some specific methods the book mentions for
Speaker 1: gathering target info footprinting?
Speaker 2: Footprinting is that broad initial information gathering, collecting domain names,
Speaker 2: IP ranges, network blocks, employee names, and contact details, maybe
Speaker 2: even physical locations using tools like who is and slick
Speaker 2: up trace route, even just searching online databases.
Speaker 1: Fingerprinting sounds more specific.
Speaker 2: It is fingerprinting aims to identify the exact operating system, services,
Speaker 2: and software versions running on a target system. Active fingerprinting
Speaker 2: involves sending specific, sometimes malformed packets and analyze the response
Speaker 2: different ozs response slightly differently. Passive fingerprinting involves analyzing network
Speaker 2: traffic characteristics without sending.
Speaker 1: Anything directly DNS enumeration.
Speaker 2: This is actively querying DNS servers to try and discover
Speaker 2: all DNS records associated with a domain, host names, subdomains,
Speaker 2: server roles. It's like trying to get a complete map
Speaker 2: of their digital territory, and.
Speaker 1: Tools like the Harvester can automate finding user names and emails.
Speaker 2: Yeah, the Harvester is great for passive recon. It's screen
Speaker 2: search engines, pgpkey servers, social networks like LinkedIn to gather
Speaker 2: email addresses, employee names, subdomains associated with the target domain
Speaker 2: very useful for building a picture of the organization.
Speaker 1: And finding domain registration details via whis is standard.
Speaker 2: Practice absolutely whoiz, dot com or command line whose tools
Speaker 2: give you the owner registrar, registration expiry dates, name servers,
Speaker 2: contact info sometimes reveals more than.
Speaker 1: Intended pingsweep sounds simple.
Speaker 2: It is, but effective for basic network mapping sending ICMP
Speaker 2: echo requests things to a range of IP addresses to
Speaker 2: see which ones respond, indicating live hosts. Tools like flepping
Speaker 2: or nmap do this efficiently.
Speaker 1: Import scanning checking for open doors.
Speaker 2: Precisely systematically probing the ports on a target host to
Speaker 2: see which ones are open and listening for connections. Open
Speaker 2: ports indicate running services which might be vulnerable. N map
Speaker 2: is the king of port Standing all this together builds
Speaker 2: that crucial foundation before you even think about.
Speaker 1: Exploits, which brings us to actually executing exploits. The book
Speaker 1: dives deep into metasploid. Here we doudged on it, but
Speaker 1: let's revisit its core components. Right.
Speaker 2: Metasploid is modular. You have exploits, which are the code
Speaker 2: that takes advantage of a specific vulnerability. You have payloads,
Speaker 2: which is the code that runs on the victim machine
Speaker 2: after the exploit succeeds, giving you control like a reverse shell.
Speaker 1: A shell code.
Speaker 2: Often the payload itself is referred to as shell code,
Speaker 2: especially if its goal is to give you a command
Speaker 2: shell like a command prompt terminal on the victim system.
Speaker 1: And modules are the interchangeable parts yep.
Speaker 2: Metascloid organizes everything into modules. Exploit modules, payload modules, auxiliary
Speaker 2: modules for scanning, fuzzing, et cetera. Post exploitation modules. You
Speaker 2: mix and match them. A listener is needed on the
Speaker 2: attackers machine to handle the incoming connection from the payload
Speaker 2: running on the victim.
Speaker 1: The show command helps navigate all this invaluable.
Speaker 2: Show exploits, show payloads, show options. It tells you what's
Speaker 2: available and what parameters you need. To set for a
Speaker 2: chosen module.
Speaker 1: You mentioned. Payloads could be staged or single. Can you
Speaker 1: unpack that a bit?
Speaker 2: Sure? A single payload contains the exploit and the entire
Speaker 2: shell code all in one to go fire and forget.
Speaker 2: Useful sometimes, but can be large, okay. Staged payloads are
Speaker 2: more common, especially for network exploits. They split the payload
Speaker 2: into a small stager and a larger stage. The exploit
Speaker 2: delivers just the tiny stage or first. The stager's only
Speaker 2: job is to connect back to the attackers machine the
Speaker 2: listener and download the main stage the rest of the payload.
Speaker 1: Ah. So it gets around size limits and makes the
Speaker 1: initial exploit smaller and stealthier exactly.
Speaker 2: The stager has the attackers IP and port embedded in
Speaker 2: it metasploits listener handles serving up the main stage when
Speaker 2: the stager connects back. It's quite clever.
Speaker 1: The book gives a practical example hacking Windows XP using
Speaker 1: an older exploit MS zero three zero two six RPCD
Speaker 1: Soka walk us through the metasploid steps conceptually.
Speaker 2: Okay, So first you'd launch the metasploit console MSF console.
Speaker 2: Then you'd search for the exploit, maybe search d dot com.
Speaker 2: You'd find the MS zero three zero two six dy
Speaker 2: dot com exploit module and select it using use exploit
Speaker 2: Windows d sarch CMS zero three zero two six.
Speaker 1: D dot Com, then configure.
Speaker 2: It right use show options to see what needs setting.
Speaker 2: The main one is RHOS the remote host or target
Speaker 2: IP address, so set rhos ten dot on zero, pote
Speaker 2: aer point three or whatever the target's IP is. Choose
Speaker 2: a payload, yeah, show payloads lists compatible ones. A common
Speaker 2: choice is a reverse TCP shell like genericshell reverse at show.
Speaker 2: You select it with set payload genericshell.
Speaker 1: Reverse dose and tell it where to connect back to exactly.
Speaker 2: Set elos the local host, your attacker machines IP, setlos
Speaker 2: ten dot a zero tot at six, then just type
Speaker 2: exploit and if it works, metasploit will attempt the exploit.
Speaker 2: If successful, the payload runs on the target, connects back
Speaker 2: to your listener, and you'll likely get a command shell session.
Speaker 2: You can interact with it using sessions mine one if
Speaker 2: it's session one, and run commands like dirt or ip
Speaker 2: canfig on the remote machine.
Speaker 1: It really demystifies the process, showing it step by step.
Speaker 1: The book also covers hacking Android using metasploit. This involves
Speaker 1: a trojan APK.
Speaker 2: Yeah, this is more reliant on social engineering. First, you
Speaker 2: use a tool like Msvenom or the older MS payload
Speaker 2: to create a malicious Android application package dot APK file.
Speaker 2: You embed a payload like Android metroprodervers and sippy and
Speaker 2: configure it with your lhost IP address. You might disguise
Speaker 2: the APK as something harmless like upgrader, dot ap or
Speaker 2: a game.
Speaker 1: Then you need the victim to actually install it.
Speaker 2: That's the tricky part. You need to get that APK
Speaker 2: onto their device and convince them to install it bypassing
Speaker 2: Android security warnings about unknown sources.
Speaker 1: If they do install it.
Speaker 2: While they install it, you'd have metasploit running on your machine.
Speaker 2: Using the Exploit Multi handler module. This is a generic listener.
Speaker 2: You can figure it with the same payload and LHA
Speaker 2: you use to create the APK. Start the listener with exploit.
Speaker 2: When the victim runs the malicious app, the payloa executes,
Speaker 2: connects it back to your listener and boom you get
Speaker 2: a interpreter session.
Speaker 1: And interpreter gives you a lot of control.
Speaker 2: Oh yeah. The book lists commands like fix us, view processes,
Speaker 2: webcamsnap take a picture, dump contacts, dump bos geolocate pretty
Speaker 2: expensive access to the device's functions and data.
Speaker 1: Scary stuff, definitely okay. Shifting gears from OS hacking to
Speaker 1: web applications. These are everywhere accessed via browsers. The booknotes
Speaker 1: data breaches are constant, often involving web at vulnerabilities.
Speaker 2: It's a huge attack surface. Web apps handle sensitive data,
Speaker 2: interact with databases, and unfortunately they're often complex, can contain
Speaker 2: subtle flaws in how they handle user input or managed sessions.
Speaker 2: Even simple coding mistakes can lead to major breaches, and.
Speaker 1: SQL injection is one of the biggest culprits mentioned. Remindus
Speaker 1: how it works.
Speaker 2: Web apps talk to databases using SQL structured query language.
Speaker 2: SQL injection happens when the application takes data provided by
Speaker 2: a user, like in a search box or log in form,
Speaker 2: and includes directly in a SQL query without properly sanitizing
Speaker 2: or validating it first.
Speaker 1: So the user input becomes part of the database command exactly.
Speaker 2: If an attacker crafts their input carefully, they can inject
Speaker 2: their own SQL commands. This can trick the database into
Speaker 2: doing things it shouldn't like bypassing logins the book's user
Speaker 2: name admin example, dumping entire tables of user data, modifying records,
Speaker 2: or sometimes even executing commands on the underlying server operating system.
Speaker 1: The impact sounds massive, and it's not just SQL.
Speaker 2: Other injection types exist too, right LDAP injection, command injection,
Speaker 2: X path injection similar principle, different underlying technology being manipulated
Speaker 2: through unsaid anetized input.
Speaker 1: So prevention is key. What does the book recommend?
Speaker 2: Several crucial things. First, always validate untrusted input, preferably using
Speaker 2: a strict allow list, only permit expected characters formats. Second,
Speaker 2: use parameterized queries also called prepared statements or stored procedures.
Speaker 2: These separate the SQL code from the user data, preventing injection. Third,
Speaker 2: use well vetted ORM libraries that handle this securely. And fourth,
Speaker 2: follow the principle of least privilege. Make sure the web
Speaker 2: application's database account only has the minimum permissions it absolutely needs.
Speaker 1: The book then shows a practical SEQL injection using tools
Speaker 1: like secultiv and sql map. What's the process there?
Speaker 2: Siglo can be used with Google dorking to find potentially
Speaker 2: vulnerable URLs like pages with item dot PHP, dot ID
Speaker 2: in the URL. Once you have a suspect URL, you
Speaker 2: hand it over to sqlmap.
Speaker 1: And sql map automates the attack pretty much.
Speaker 2: You tell sql map the target url, squamap iu targeturle.
Speaker 2: Then you can ask it to find database dbs, list
Speaker 2: tables within a database, dab to dB name tables, list
Speaker 2: columns in a table, dire t table name columns, and
Speaker 2: finally dump the data WC column one. Call them to
Speaker 2: dump or just dump for the whole table.
Speaker 1: And the book shows an example pulling usernames and passwords
Speaker 1: from an e commerce site settings table.
Speaker 2: Yeah, it illustrates how an attacker could potentially extract sensitive
Speaker 2: customer data like loging, credentials or even in some cases,
Speaker 2: payment details. It highlights why this technique is so dangerous,
Speaker 2: especially for online stores.
Speaker 1: Beyond screen, the book mentions cross site scripting EXSS. Again,
Speaker 1: how does that work? On a website?
Speaker 2: AXSS happens when a web application takes untrusted data, often
Speaker 2: from a user, and includes it in a web page
Speaker 2: without properly encoding it. This allows an attacker to inject
Speaker 2: malicious client side scripts, usually JavaScript, into the page. When
Speaker 2: another user visits that page, the malicious script runs in
Speaker 2: their browser within the context of the trusted website, so.
Speaker 1: The website itself delivers the attack.
Speaker 2: Essentially, yes, the attacker leverages the trusted site to attack
Speaker 2: its users. This can be used to steal session cookies,
Speaker 2: hijacking user accounts, redirect users to phishing sites, deface pages,
Speaker 2: or install malware. It's very common in damaging.
Speaker 1: Then there's DNS poisoning. We touched on this the Internet's
Speaker 1: phone book Analogy. How is it exploited?
Speaker 2: Practically, the idea is to corrupt the DNS cache on
Speaker 2: a DNS server or even on a user's local machine.
Speaker 2: You trick it into storing the wrong IP address for
Speaker 2: a legitimate domain name. So when a user tries to
Speaker 2: go to say, mybank dot com, the poison DNS cash
Speaker 2: tells your browser to go to the attacker's fraudulent IP
Speaker 2: address instead.
Speaker 1: And they end up on a fake lookalike site.
Speaker 2: Often yes, a phishing site designed to steal their credentials.
Speaker 2: The book shows a practical example using Ettercap, a tool
Speaker 2: for network sniffing and MITM attacks. You can figure edttercaps
Speaker 2: edited dot DNS file with fake mappings, gmap Facebook dot
Speaker 2: Com to a different IP. Then you run an AARP
Speaker 2: poisoning attack to intercept the victims traffic and activate Ttercap's
Speaker 2: DN spoof plug in.
Speaker 1: So Entercap intercepts the DNS request for fur Facebook and
Speaker 1: sends back the fake IP address precisely.
Speaker 2: The victim's browser then connects to the wrong server, completely unaware.
Speaker 2: It undermines trust in basic internet infrastructure.
Speaker 1: Okay, let's move into the wireless realm attacking Wi Fi networks.
Speaker 1: The book defines them using the IEA eight H two
Speaker 1: point one point one standards, routers, access points.
Speaker 2: The key takeaway is flexibility comes at a cost. Wireless
Speaker 2: signals radiate outwards, making them inherently easier to intercept than
Speaker 2: data flowing through a physical cable. An attacker nearby can
Speaker 2: potentially capture packets, especially if the network isn't properly secured, and.
Speaker 1: Putting a wireless card into monitor mode is key for this.
Speaker 2: Yes, normal Wi Fi cards ignore packets not addressed to them.
Speaker 2: Monitor mode tells the card to capture all packets flying
Speaker 2: through the air on a specific channel, regardless of destination.
Speaker 2: This is essential for sniffing and many Wi Fi attacks.
Speaker 1: Sniffing men is just capturing and analyzing those packets right.
Speaker 2: Using tools like wire shark or TCP. If the traffic
Speaker 2: isn't encrypted like old HTTP, you can potentially see sensitive
Speaker 2: data like usernames and passwords and plaintext. The book gives
Speaker 2: a clear example of logging into a hypothetical HTTP site
Speaker 2: techpana dot org while wire shark is running.
Speaker 1: And wireshark just displays the captured post request containing the
Speaker 1: log in credentials.
Speaker 2: Exactly you filter for HTTP traffic, find the post request
Speaker 2: associated with the log in and look at the packet details.
Speaker 2: Under line based text data or HTML form URL encoded,
Speaker 2: you'll see the submitted variables, often including username and password
Speaker 2: in cleartext, a stark reminder of why HTTPS is non
Speaker 2: negotiable now.
Speaker 1: Definitely, so encryption is crucial. The book discusses WP and
Speaker 1: WPP two. WP was the first attempt.
Speaker 2: Wired equivalent privacy. The goal was to provide confidentiality similar
Speaker 2: to a wired network, but it had fundamental cryptographic flaws
Speaker 2: and is considered completely broken now easily crackable in minutes.
Speaker 1: So WPAI FI pertated Access replaced it.
Speaker 2: Yes, WPA was developed as an interim solution to fix
Speaker 2: WP's weaknesses. It introduced TKEAP temporal key integrity protocol which
Speaker 2: was better but still had some vulnerabilities.
Speaker 1: And WPA two is the current standard.
Speaker 2: WP two using AES encryption is the standard for strong security.
Speaker 2: The booknotes that if you use a strong unique password passphrase,
Speaker 2: WPA two is very difficult bordering on practically impossible for
Speaker 2: most attackers to crack via brute force. However, if the
Speaker 2: password is weak or common found in dictionary lists, it
Speaker 2: can still be cracked using tools that capture the authentication
Speaker 2: handshake and try passwords.
Speaker 1: Offline patients and computing power needed them and a good
Speaker 1: word list.
Speaker 2: Yeah, but WPA two with a strong key is generally solid.
Speaker 1: The book demonstrates a different kind of Wi Fi attack
Speaker 1: using weaf of Fisher. This one sounds more like social
Speaker 1: engineering mixed with tech.
Speaker 2: It's clever with Fisher automated setting up a rogue access
Speaker 2: point AP and performing a phishing attack. First, it creates
Speaker 2: a fake AP that mimics the target network's name ss
Speaker 2: twin exactly. Then it launches a diauthentication attack against the
Speaker 2: real AP, kicking all connected clients off the legitimate network.
Speaker 1: So everyone gets disconnected.
Speaker 2: Yep, And what do devices usually do when disconnected? They
Speaker 2: automatically try to reconnect. Wife of Fisher's fake AP is
Speaker 2: sitting there looking identical to the real one, ready to
Speaker 2: accept their connections.
Speaker 1: Ah okay, so they connect to the fake one.
Speaker 2: Then what Once a client connects to the fake AP,
Speaker 2: Wife of Fisher redirects their web traffic to a phishing page.
Speaker 2: This page usually looks like a legitimate router configuration page
Speaker 2: or a network log in portal, often saying something like
Speaker 2: firmware update required, Please re enter your Wi Fi password
Speaker 2: to continue, And.
Speaker 1: If the user falls forward and types in.
Speaker 2: Their password, Wife of Fisher captures it and displays it
Speaker 2: right there in the attacker's terminal. It bypasses cracking the
Speaker 2: encryption entirely by tricking the user into giving up the key.
Speaker 2: Requires specific hardware, two Wi Fi cards, one supporting monitor
Speaker 2: mode and Callie Linux.
Speaker 1: Very sneaky okay. Wrapping up with some miscellaneous attacks. Man
Speaker 1: in the Middle MITM explain the concept again.
Speaker 2: Three players, victim, the server person they think they're talking to,
Speaker 2: and the attacker secretly positioned in between, intercepting and potentially
Speaker 2: altering the communication. The victim and the legitimate entity are
Speaker 2: usually unaware the attacker is there.
Speaker 1: Like an invisible eavesdrop or relaying messages.
Speaker 2: And possibly changing them. The book gives a phishing example
Speaker 2: fake bank email, e fake website. Attacker intercepts credentials, but
Speaker 2: it can happen in.
Speaker 1: Other ways too, Like on unsecured Wi Fi.
Speaker 2: Yes, that's a common one. Attacker connects to the same
Speaker 2: public hotspot, uses techniques like ARP spoofing to redirect the
Speaker 2: victim's traffic through their machine, allowing them to intercept data,
Speaker 2: or man in the browser attacks where malware on the
Speaker 2: victim's computer intercepts data before it even gets encrypted by HTTPS.
Speaker 1: The book lists seven types of MITM. Let's recap them quickly.
Speaker 2: IP spoofing fake in your source IP address, DNS spoofing,
Speaker 2: corrupting DNA to redirect traffic httpspoofing, making a fake site
Speaker 2: look secures using similar characters in the domain name. SSL
Speaker 2: hijacking intercepting supposedly secure SSLTLS traffic, often by stripping encryption
Speaker 2: or presenting fake certificates. Email hijacking gaining access to email
Speaker 2: accounts to monitor or send fraudulent messages. Wi Fi eavesdropping,
Speaker 2: setting up fake hotspots like with a fisher, but maybe
Speaker 2: just for listening stealing browser cookies, capturing session cookies to
Speaker 2: hijack logged in sessions. It covers a lot of ground
Speaker 2: for interception.
Speaker 1: It does next. The Zanta Android app, a mobile pen
Speaker 1: testing toolkit.
Speaker 2: Yeah for rooted Android devices developed by Zimperium. It lets
Speaker 2: you perform network scans, vulnerability checks, and various MITM attacks
Speaker 2: right from your phone. Things like MC address spoofing, creating
Speaker 2: malicious hotspot, session hijacking, capturing downloads, modifying HTTP traffic on
Speaker 2: the fly, checking for shell shock, SSL, poodle vulms.
Speaker 1: So you get audit network security or simulated time from
Speaker 1: a mobile device exactly.
Speaker 2: It has modules for changing back addresses, creating tethered hotspots
Speaker 2: where you can monitor traffic, steather, edit packets, Z packet editor,
Speaker 2: strip SSL, redirect HTTP, replace images and victims browsers, intercept downloads,
Speaker 2: insert HTML. Pretty powerful if used ethically for testing.
Speaker 1: It also includes password auditing and tools to launch MITM
Speaker 1: attacks like ARP or ICNP spoofing directly from the app.
Speaker 2: Right It's a serious toolkit in your pocket, emphasizing the
Speaker 2: need for mobile security awareness too.
Speaker 1: The book includes a funny hack disrupting Internet connections using
Speaker 1: ARP spoofing tools like netcut or tuxcut. Yeah.
Speaker 2: These tools flood the local network with fake AARP messages,
Speaker 2: basically telling devices that the attacker's machine is the router gateway.
Speaker 2: Traffic gets sent to the attacker, who just drops it,
Speaker 2: effectively cutting off the target's Internet access. The book stresses
Speaker 2: ethical use cases like maybe stopping bandwidth hogs on your
Speaker 2: own network, and warns against abuse.
Speaker 1: And provides setup guides even for running tuxcats safely in
Speaker 1: a Linux.
Speaker 2: VM, emphasizing safe experimentation.
Speaker 1: Finally, DOS attack's denial of service making things unavailable by
Speaker 1: overwhelming them.
Speaker 2: Flooding a server or network with so much traffic or
Speaker 2: so many requests that it can't respond to legitimate users.
Speaker 2: DS is the distributed version using a botnet for massive scale.
Speaker 1: The book lists several types ping.
Speaker 2: Of death sending oversized ICMP packets to crash older systems,
Speaker 2: mostly historical now due to patches murpherttech amplification attack using
Speaker 2: ICMP echo requests sent to a network's broadcast address, spoofing
Speaker 2: the victim's IP as the source. All replies flood the
Speaker 2: victim also largely mitigated.
Speaker 1: Now buffer overflow. We covered that teardrop.
Speaker 2: Attack exploiting TCPIP fragmentation reassembly sending deliberately overlapping packet fragments
Speaker 2: to crash the target OS when it tries to put
Speaker 2: them back together. SYN attack flooding the target with SYN
Speaker 2: packets the first step in a TCP connection, but never
Speaker 2: completing the handshake. This ties up the servers resources waiting
Speaker 2: for replies that never come, exhausting its connection table.
Speaker 1: Still relevant, the book mentions tools like nemesy Land Latierra botnets,
Speaker 1: but also emphasizes doss protection.
Speaker 2: Crucial protection involves keeping systems patched, using firewalls to block
Speaker 2: malicious ips or protocols, configuring routers with access control lists
Speaker 2: acls to filter traffic, and employing intrusion detection prevention systems.
Speaker 2: For large scale ditaos, specialized mitigation services are often.
Speaker 1: Needed, and it provides a practical example of a simple
Speaker 1: pin of death using the Windows pin command with large
Speaker 1: packet sizes and the infinite flag dense t t DO
Speaker 1: six five five hundred and using nemesy.
Speaker 2: Just to illustrate the concept. Yeah, showing how flooding can
Speaker 2: impact network usage even if it doesn't crash modern systems.
Speaker 1: Okay, that brings us to the end of this really
Speaker 1: comprehensive deep dive. We've covered a lot, the author's journey,
Speaker 1: the core concepts of hacking, the tools, the setup, the
Speaker 1: critical importance of recon, and then practical examples across operatings
Speaker 1: as web apps, wireless networks, and other attack vectors.
Speaker 2: The goal really was to distill the essence of the
Speaker 2: book to make you feel well informed about this often
Speaker 2: opaque world of cybersecurity. It's a shortcut, hopefully to understanding
Speaker 2: the landscape better, and.
Speaker 1: It definitely highlights that idea from the book's title. Maybe
Speaker 1: security is a myth, or at least a constant process,
Speaker 1: not a final state. Understanding how a tax work seems
Speaker 1: absolutely fundamental to building any kind of defense.
Speaker 2: Couldn't agree more. Knowing the offense informs the defense.
Speaker 1: So here's a thought to leave you with in this
Speaker 1: world of constant vulnerabilities, where transparency about flaws is maybe
Speaker 1: the only way forward. What aspect of your own digital life,
Speaker 1: your own security posture, will you look at differently now?
Speaker 1: How does knowing about these mechanisms change your perspective? Something
Speaker 1: to think about until next time on the deep dive.