WEBVTT

1
00:00:00.000 --> 00:00:02.160
<v Speaker 1>All right, let's dive in. Today. We're cracking open The

2
00:00:02.160 --> 00:00:06.200
<v Speaker 1>Hacker Playbook two, a guide for aspiring penetration testers. It's

3
00:00:06.200 --> 00:00:08.800
<v Speaker 1>like a VIP pass to the world of ethical hacking

4
00:00:09.119 --> 00:00:12.480
<v Speaker 1>without all the code crunching marathons. You know. This deep

5
00:00:12.519 --> 00:00:15.759
<v Speaker 1>dive is your shortcut to understanding the tactics and tools,

6
00:00:16.079 --> 00:00:19.559
<v Speaker 1>the real deal, what pros use, what's super cool? This

7
00:00:19.600 --> 00:00:23.120
<v Speaker 1>book throws you right into a scenario. Imagine you're hired

8
00:00:23.120 --> 00:00:27.839
<v Speaker 1>to test the security of Secure Universal cyber Kittens, Inc.

9
00:00:28.320 --> 00:00:29.960
<v Speaker 1>Yeah you got that right, SCCK.

10
00:00:30.199 --> 00:00:30.559
<v Speaker 2>For sure.

11
00:00:30.800 --> 00:00:34.000
<v Speaker 1>It's pretty memorable. Makes the learning way more hands on,

12
00:00:34.039 --> 00:00:34.479
<v Speaker 1>don't you think?

13
00:00:34.600 --> 00:00:35.119
<v Speaker 2>Absolutely?

14
00:00:35.200 --> 00:00:35.479
<v Speaker 1>Yeah.

15
00:00:35.520 --> 00:00:39.159
<v Speaker 2>The author years of experience under their belt penetration testing

16
00:00:39.280 --> 00:00:42.960
<v Speaker 2>across the board, financial utilities, even government. They've seen it all,

17
00:00:43.000 --> 00:00:45.600
<v Speaker 2>so they really know how to break it down. You know,

18
00:00:46.000 --> 00:00:50.119
<v Speaker 2>complex stuff made simple and using this fictional company seck

19
00:00:50.359 --> 00:00:52.679
<v Speaker 2>is the target. Well, it keeps things interesting for sure.

20
00:00:52.799 --> 00:00:55.280
<v Speaker 1>Now I got admit I'm really hooked on this football analogy.

21
00:00:55.280 --> 00:00:58.560
<v Speaker 1>The book uses different stages of a penetration test. Explain

22
00:00:58.719 --> 00:01:01.719
<v Speaker 1>like a game plan, Go learn some digital blitzing, right, Uh.

23
00:01:01.759 --> 00:01:04.439
<v Speaker 2>Huh, Yeah, you could say that the book compares each

24
00:01:04.480 --> 00:01:06.879
<v Speaker 2>stage you see two phases of a football game. You

25
00:01:06.959 --> 00:01:10.000
<v Speaker 2>got the setup phase that's recon gathering intel like a

26
00:01:10.040 --> 00:01:13.359
<v Speaker 2>team scouting their opponent. Then there's the drive where you

27
00:01:13.400 --> 00:01:16.760
<v Speaker 2>exploit those vulnerabilities, get a foothold, moving the ball down

28
00:01:16.760 --> 00:01:18.879
<v Speaker 2>the field, and it keeps going like that.

29
00:01:19.120 --> 00:01:21.719
<v Speaker 1>Okay, so let's huddle up here, break down this setup phase.

30
00:01:22.239 --> 00:01:23.920
<v Speaker 1>What's the game plan for reconnaissance?

31
00:01:23.959 --> 00:01:28.239
<v Speaker 2>Then reconnaissance, it all starts with OSENT open source intelligence,

32
00:01:28.680 --> 00:01:32.359
<v Speaker 2>gathering info, publicly available stuff. You'd be amazed the amount

33
00:01:32.400 --> 00:01:35.239
<v Speaker 2>of information just out there waiting to be discovered.

34
00:01:35.439 --> 00:01:39.200
<v Speaker 1>So like a digital detective game, piecing together clues, but

35
00:01:39.359 --> 00:01:40.840
<v Speaker 1>from public info exactly.

36
00:01:40.840 --> 00:01:44.120
<v Speaker 2>And there are tools for that streamline the whole process. Discover,

37
00:01:44.400 --> 00:01:48.920
<v Speaker 2>for one, automate searches, DNS records, Google, even social media

38
00:01:49.280 --> 00:01:50.439
<v Speaker 2>gives you a complete picture.

39
00:01:50.879 --> 00:01:54.680
<v Speaker 1>So with Discover, you're basically casting a wide net, right, Yeah,

40
00:01:54.680 --> 00:01:56.079
<v Speaker 1>what other tools are in the playbook.

41
00:01:56.239 --> 00:02:00.760
<v Speaker 2>There's spiderfoot incredibly fast, pulls in tons of ocent data, websites,

42
00:02:00.799 --> 00:02:03.760
<v Speaker 2>employee profiles, anything out there, a great way to get

43
00:02:03.799 --> 00:02:05.640
<v Speaker 2>to get a feel for the landscape quickly.

44
00:02:05.879 --> 00:02:07.799
<v Speaker 1>Sounds like both Discover and spiderfot they give you a

45
00:02:07.799 --> 00:02:11.639
<v Speaker 1>broad view. But what about say, more targeted Intel something

46
00:02:11.639 --> 00:02:13.840
<v Speaker 1>to help like crack passwords.

47
00:02:14.159 --> 00:02:17.520
<v Speaker 2>That's where brute scrape and wordhound come in. Analyze websites,

48
00:02:17.560 --> 00:02:23.159
<v Speaker 2>social media, all that to extract keywords, products, services, employee names.

49
00:02:23.199 --> 00:02:26.319
<v Speaker 2>All of it helps create a custom password list, way

50
00:02:26.319 --> 00:02:28.319
<v Speaker 2>more effective than just using generic ones.

51
00:02:28.400 --> 00:02:32.039
<v Speaker 1>Oh clever, wouldn't have thought about that. Keywords. Seemingly random

52
00:02:32.039 --> 00:02:34.879
<v Speaker 1>stuff can actually be valuable. Speaking of code, you mentioned

53
00:02:34.919 --> 00:02:37.960
<v Speaker 1>GitHub earlier. I thought that was just for developers.

54
00:02:38.039 --> 00:02:40.120
<v Speaker 2>It is, but can also be a gold mine for

55
00:02:40.400 --> 00:02:43.759
<v Speaker 2>well for us. That's where git trop comes in. Analyzes

56
00:02:43.800 --> 00:02:47.639
<v Speaker 2>public repositories those on GitHub looking for sensitive info, stuff

57
00:02:47.639 --> 00:02:51.479
<v Speaker 2>that might have been leaked accidentally, passwords, apikeys, internal docs.

58
00:02:51.919 --> 00:02:54.520
<v Speaker 2>Developers sometimes commit sensitive stuff without realizing.

59
00:02:54.719 --> 00:02:56.879
<v Speaker 1>Good reminder for everyone out there, double check your own

60
00:02:56.919 --> 00:03:00.560
<v Speaker 1>repos Yeah, so you got discover spiderfoot, Brud's great wordhound

61
00:03:00.560 --> 00:03:03.520
<v Speaker 1>git trop. This is all passive recon right. Does the

62
00:03:03.639 --> 00:03:06.960
<v Speaker 1>setup also involve more active scanning, getting a bit more

63
00:03:06.960 --> 00:03:07.400
<v Speaker 1>hands on?

64
00:03:07.840 --> 00:03:11.039
<v Speaker 2>Absolutely, Once you've got your initial Intel time to get

65
00:03:11.080 --> 00:03:15.240
<v Speaker 2>more well proactive. Mascan is great for that. Blazing fast

66
00:03:15.360 --> 00:03:19.800
<v Speaker 2>scans tons of IP addresses, checks for open ports, running services.

67
00:03:19.560 --> 00:03:22.080
<v Speaker 1>Why is speed so important here? What makes mass can

68
00:03:22.240 --> 00:03:24.840
<v Speaker 1>stand out from say map Speed is.

69
00:03:24.840 --> 00:03:28.639
<v Speaker 2>Key when you're dealing with potentially millions of IP addresses.

70
00:03:28.840 --> 00:03:31.199
<v Speaker 2>That's what masscan is built for. It's got this this

71
00:03:31.319 --> 00:03:35.800
<v Speaker 2>custom TCPI kistack optimized for sending and receiving packet's super

72
00:03:35.919 --> 00:03:39.840
<v Speaker 2>quick and maps like a detective meticulous right. Mass can

73
00:03:40.000 --> 00:03:43.000
<v Speaker 2>is a swarm of drones covering vast areas quickly.

74
00:03:43.240 --> 00:03:45.319
<v Speaker 1>So masscan is the go to when you need to

75
00:03:45.360 --> 00:03:48.280
<v Speaker 1>cover a lot of ground. Once you've identified potential entry points,

76
00:03:48.560 --> 00:03:49.439
<v Speaker 1>what happens next?

77
00:03:49.639 --> 00:03:52.080
<v Speaker 2>Then we bring in tools like Sparta. It's like a

78
00:03:52.159 --> 00:03:55.840
<v Speaker 2>multi tool combines vulnerability scanning with other tools. For example,

79
00:03:55.840 --> 00:03:59.199
<v Speaker 2>it integrates nikto finds vulnerabilities on web servers, even takes

80
00:03:59.199 --> 00:04:00.719
<v Speaker 2>screenshots of webs applications.

81
00:04:00.879 --> 00:04:03.360
<v Speaker 1>Screenshots. I'm curious about those. It sounds a bit a

82
00:04:03.360 --> 00:04:05.120
<v Speaker 1>bit like something out of a spy movie. Haha.

83
00:04:05.479 --> 00:04:09.360
<v Speaker 2>It might sound surprising, but visual recon can be super valuable.

84
00:04:10.000 --> 00:04:14.719
<v Speaker 2>Tools like eyewitness and wmap, even HTTP screenshot reveal a

85
00:04:14.759 --> 00:04:17.360
<v Speaker 2>lot about the target's environment. Think of it as a

86
00:04:17.399 --> 00:04:21.199
<v Speaker 2>gathering clues visually their systems, the tech they use, even

87
00:04:21.240 --> 00:04:26.279
<v Speaker 2>software versions, the specifics these details can be crucial later on.

88
00:04:26.680 --> 00:04:29.720
<v Speaker 1>So you're building a digital blueprint their whole network. We've

89
00:04:29.759 --> 00:04:31.959
<v Speaker 1>covered a lot in this setup phase. It's this careful

90
00:04:32.000 --> 00:04:35.920
<v Speaker 1>balance passive and active recon using all these different tools,

91
00:04:36.120 --> 00:04:38.800
<v Speaker 1>gathering all the info you can before making your move.

92
00:04:39.199 --> 00:04:40.680
<v Speaker 1>But I got a feeling things are about to get

93
00:04:40.680 --> 00:04:44.519
<v Speaker 1>a lot more intense as we move to the next phase,

94
00:04:44.839 --> 00:04:48.279
<v Speaker 1>the drive. Ready to start exploiting those vulnerabilities we are.

95
00:04:48.240 --> 00:04:51.120
<v Speaker 2>We've scouted the field, identified our targets. Now it's time

96
00:04:51.160 --> 00:04:53.360
<v Speaker 2>to execute that play. Get a foothold in their network.

97
00:04:53.399 --> 00:04:55.160
<v Speaker 1>Okay, so we spent some time in the huddle, Yeah,

98
00:04:55.600 --> 00:04:58.120
<v Speaker 1>mapping out their network, figuring out the players. Now it's

99
00:04:58.160 --> 00:05:00.160
<v Speaker 1>time for the drive. This is where we see if

100
00:05:00.199 --> 00:05:02.240
<v Speaker 1>those plays, you know, actually get us past the defense

101
00:05:02.279 --> 00:05:05.680
<v Speaker 1>onto the field. Tell me more about this exploitation phase.

102
00:05:05.720 --> 00:05:07.160
<v Speaker 1>How does it all? How does it all work?

103
00:05:07.360 --> 00:05:10.439
<v Speaker 2>The drive? It's all about taking what we've learned in

104
00:05:10.480 --> 00:05:13.480
<v Speaker 2>recon using it to find to find those weak spots.

105
00:05:13.519 --> 00:05:17.600
<v Speaker 2>Like a football team analyzing the opponent's weaknesses, finding the

106
00:05:17.639 --> 00:05:20.360
<v Speaker 2>perfect play. We're looking for vulnerabilities, those chinks in the

107
00:05:20.439 --> 00:05:23.480
<v Speaker 2>armor that we can we can leverage to get in.

108
00:05:23.519 --> 00:05:26.639
<v Speaker 1>It sounds like this phase it needs a deep understanding

109
00:05:27.079 --> 00:05:31.000
<v Speaker 1>how systems work where those vulnerabilities might be hiding. Are

110
00:05:31.000 --> 00:05:35.079
<v Speaker 1>there are there specific types that are commonly exploited in

111
00:05:35.160 --> 00:05:36.720
<v Speaker 1>this phase? Like what are we looking for?

112
00:05:36.839 --> 00:05:40.000
<v Speaker 2>There are, yeah, and sometimes they're in places you wouldn't expect.

113
00:05:40.079 --> 00:05:43.160
<v Speaker 2>Like let's talk warf FTP. It's an FTP server and

114
00:05:43.279 --> 00:05:46.519
<v Speaker 2>like any software, it can have, you know, vulnerabilities. Imagine

115
00:05:46.560 --> 00:05:49.680
<v Speaker 2>an attacker they find a weakness in a specific version

116
00:05:49.759 --> 00:05:52.839
<v Speaker 2>of WARFTP. Right, they could search online find code, a

117
00:05:52.879 --> 00:05:56.399
<v Speaker 2>publicly available code that exploits that vulnerability. With a few

118
00:05:56.399 --> 00:05:58.480
<v Speaker 2>tweaks they could they could potentially gain control of the

119
00:05:58.519 --> 00:05:59.000
<v Speaker 2>whole server.

120
00:05:59.199 --> 00:06:02.000
<v Speaker 1>So it's like finding that skeleton key that fits a

121
00:06:02.000 --> 00:06:05.560
<v Speaker 1>specific lock. But aren't FTP servers a bit I don't know,

122
00:06:05.839 --> 00:06:07.879
<v Speaker 1>old school do people even use those anymore?

123
00:06:08.040 --> 00:06:11.040
<v Speaker 2>You'd be surprised older tech. It tends to linger on

124
00:06:11.120 --> 00:06:14.879
<v Speaker 2>networks forgotten but still vulnerable. And you know what they say,

125
00:06:14.959 --> 00:06:18.199
<v Speaker 2>the most overlooked areas those are the most vulnerable. Take

126
00:06:18.240 --> 00:06:18.839
<v Speaker 2>printers for.

127
00:06:18.839 --> 00:06:22.120
<v Speaker 1>Example, printers. I wouldn't think of a printer as a

128
00:06:22.439 --> 00:06:24.439
<v Speaker 1>security risk, Like what could they do?

129
00:06:24.759 --> 00:06:28.680
<v Speaker 2>Think again, a lot of modern printers, their network devices,

130
00:06:28.839 --> 00:06:33.519
<v Speaker 2>especially those MFPs multifunction printers everyone seems to have one.

131
00:06:33.720 --> 00:06:36.240
<v Speaker 2>If they're not secured properly, they can be a back

132
00:06:36.279 --> 00:06:40.040
<v Speaker 2>door into the whole network. Imagine an attacker gets into

133
00:06:40.040 --> 00:06:45.560
<v Speaker 2>the printer's management console. They could capture LDP credentials potentially LDP.

134
00:06:46.279 --> 00:06:48.399
<v Speaker 1>Can you remind me what that is? Again? Just to

135
00:06:48.439 --> 00:06:49.360
<v Speaker 1>refresh my memory.

136
00:06:49.639 --> 00:06:53.959
<v Speaker 2>LDP stands for Lightweight Directory Access Protocol. Basically, it's a

137
00:06:53.959 --> 00:06:56.759
<v Speaker 2>directory service for user accounts, used a lot in corporate

138
00:06:56.800 --> 00:07:00.439
<v Speaker 2>environments managing access to resources. All that, if a printer

139
00:07:00.519 --> 00:07:04.399
<v Speaker 2>is configured to use LDPP for authentication, well, an attacker

140
00:07:04.399 --> 00:07:07.319
<v Speaker 2>with those credentials they might get access to other systems

141
00:07:07.360 --> 00:07:07.839
<v Speaker 2>on the network.

142
00:07:07.879 --> 00:07:10.480
<v Speaker 1>You see, So even a harmless device like a printer

143
00:07:10.639 --> 00:07:14.319
<v Speaker 1>can't become a risk. Good reminder security needs to be

144
00:07:14.360 --> 00:07:17.519
<v Speaker 1>considered for everything on the network, not just the obvious stuff.

145
00:07:18.279 --> 00:07:22.000
<v Speaker 1>Any other examples of I don't know, surprising vulnerabilities that

146
00:07:22.079 --> 00:07:22.600
<v Speaker 1>come to mind.

147
00:07:22.920 --> 00:07:25.519
<v Speaker 2>You mentioned big name vulnerabilities earlier. One that definitely made

148
00:07:25.560 --> 00:07:29.399
<v Speaker 2>headlines a few years back. Heart bleed exploited a flaw

149
00:07:29.480 --> 00:07:32.040
<v Speaker 2>in open SSL, pretty widely used software.

150
00:07:31.800 --> 00:07:35.399
<v Speaker 1>Library parply Yeah, I vaguely remember that. Why was it

151
00:07:34.920 --> 00:07:35.800
<v Speaker 1>such a.

152
00:07:35.720 --> 00:07:39.480
<v Speaker 2>Big deal again open SSL, it's used for encryption all

153
00:07:39.519 --> 00:07:42.279
<v Speaker 2>over the internet. Heart bleed it basically allowed attackers to

154
00:07:42.839 --> 00:07:46.240
<v Speaker 2>read parts of a server's memory, like peeking into the

155
00:07:46.279 --> 00:07:51.160
<v Speaker 2>server's brain, seeing sensitive info, passwords, private keys, even confidential documents,

156
00:07:51.199 --> 00:07:52.120
<v Speaker 2>all kinds of stuff.

157
00:07:52.160 --> 00:07:54.759
<v Speaker 1>So not only could they steal information, but also eavesdrop

158
00:07:54.920 --> 00:07:57.680
<v Speaker 1>on communications right right which we're supposed to be secure.

159
00:07:57.759 --> 00:08:00.600
<v Speaker 1>That's a pretty pretty serious flaw is and.

160
00:08:00.519 --> 00:08:03.120
<v Speaker 2>What made heart bleeds so impactful It affected a huge

161
00:08:03.199 --> 00:08:07.639
<v Speaker 2>range of systems web servers, email servers, VPNs, you name it,

162
00:08:07.720 --> 00:08:11.240
<v Speaker 2>and the irony many it admins. They were connecting to

163
00:08:11.319 --> 00:08:14.160
<v Speaker 2>VPNs to patch their systems, making them easy targets.

164
00:08:14.439 --> 00:08:17.079
<v Speaker 1>Wow, so they were basically walking right into the trap.

165
00:08:17.680 --> 00:08:21.000
<v Speaker 1>Talk about adding insult to injury. Heartbreed really showed us

166
00:08:21.000 --> 00:08:24.639
<v Speaker 1>how a single vulnerability in widely used software can have

167
00:08:24.720 --> 00:08:27.160
<v Speaker 1>such a massive impact exactly.

168
00:08:27.279 --> 00:08:31.040
<v Speaker 2>And another example another vulnerability that exploited weaknesses in common

169
00:08:31.079 --> 00:08:34.960
<v Speaker 2>software was shell shock. This one targeted Bash, a Unix

170
00:08:34.960 --> 00:08:36.840
<v Speaker 2>shell used on lots of web servers.

171
00:08:37.080 --> 00:08:37.799
<v Speaker 1>How they won't work?

172
00:08:38.120 --> 00:08:41.279
<v Speaker 2>Shell shock it allowed attackers to inject commands into web

173
00:08:41.320 --> 00:08:44.480
<v Speaker 2>server requests, potentially giving them control of the server. What

174
00:08:44.600 --> 00:08:48.159
<v Speaker 2>made it so dangerous It was relatively easy to exploit

175
00:08:48.240 --> 00:08:50.039
<v Speaker 2>and many systems were vulnerable.

176
00:08:50.480 --> 00:08:53.440
<v Speaker 1>So again, a vulnerability and a common component can ripple

177
00:08:53.480 --> 00:08:54.879
<v Speaker 1>out affects so many systems.

178
00:08:55.559 --> 00:08:58.799
<v Speaker 2>Let's shift gears a bit. You mentioned GET repository hacking earlier.

179
00:08:58.919 --> 00:09:01.879
<v Speaker 2>What exactly is that? Right? So GET it's a version

180
00:09:01.879 --> 00:09:06.080
<v Speaker 2>control system. Developers use it to track changes in their code.

181
00:09:06.120 --> 00:09:10.080
<v Speaker 2>Incredibly useful tool. But if a GIT repository is misconfigured,

182
00:09:10.440 --> 00:09:13.039
<v Speaker 2>oh boy, it can be a gold mine for attackers.

183
00:09:13.159 --> 00:09:16.639
<v Speaker 2>If it's accidentally made public or doesn't have proper access controls,

184
00:09:16.799 --> 00:09:20.600
<v Speaker 2>attackers can just just download the entire code, based passwords,

185
00:09:20.639 --> 00:09:23.600
<v Speaker 2>API keys, even deleted files everything.

186
00:09:23.679 --> 00:09:25.879
<v Speaker 1>It's like a digital time machine for hackers. They can

187
00:09:25.879 --> 00:09:27.080
<v Speaker 1>see the whole history of the code.

188
00:09:27.159 --> 00:09:27.360
<v Speaker 2>Yeah.

189
00:09:27.440 --> 00:09:29.399
<v Speaker 1>What about databases? I know there are different types like

190
00:09:29.440 --> 00:09:31.799
<v Speaker 1>SQL and noseql. Are those susceptible to.

191
00:09:31.759 --> 00:09:35.480
<v Speaker 2>Attacks to Absolutely? We often hear about SQL injection, but

192
00:09:35.639 --> 00:09:39.480
<v Speaker 2>no SQL databases like Mango dB they're vulnerable too. These

193
00:09:39.519 --> 00:09:43.200
<v Speaker 2>types of attacks can allow attackers to bypass security, steal data,

194
00:09:43.519 --> 00:09:45.320
<v Speaker 2>even take control of the database server.

195
00:09:45.519 --> 00:09:49.080
<v Speaker 1>So basically every component from servers to databases, even seemingly

196
00:09:49.120 --> 00:09:51.840
<v Speaker 1>harmless things like printers can be a weak point, and

197
00:09:51.879 --> 00:09:54.840
<v Speaker 1>once an attacker gains that initial foothold, I imagine the

198
00:09:54.879 --> 00:09:55.639
<v Speaker 1>real game begins.

199
00:09:55.720 --> 00:09:58.759
<v Speaker 2>Right, you're right, gaining access, It's just the first step.

200
00:09:58.919 --> 00:10:01.440
<v Speaker 2>Attackers want to to make sure they can stay in

201
00:10:02.039 --> 00:10:05.200
<v Speaker 2>maintain their access even if that initial entry point is

202
00:10:05.720 --> 00:10:08.799
<v Speaker 2>discovered and closed. This is where the persistence phase comes

203
00:10:08.840 --> 00:10:10.879
<v Speaker 2>in the next stage at the penetration test.

204
00:10:11.039 --> 00:10:13.039
<v Speaker 1>So the attackers made it onto the field, scored their

205
00:10:13.039 --> 00:10:14.799
<v Speaker 1>first touchdown, but the game's not over yet.

206
00:10:14.919 --> 00:10:17.360
<v Speaker 2>Is it not even close? Think of it this way.

207
00:10:17.480 --> 00:10:21.480
<v Speaker 2>In football, after a touchdown, the team doesn't just leave, right,

208
00:10:21.960 --> 00:10:25.879
<v Speaker 2>They have to keep playing. Same goes for penetration testing attackers.

209
00:10:25.919 --> 00:10:29.039
<v Speaker 2>They want to establish a persistent presence, make sure they

210
00:10:29.039 --> 00:10:32.279
<v Speaker 2>can come back even if that initial access is revoked.

211
00:10:32.519 --> 00:10:34.440
<v Speaker 1>Okay, so they're in, right, they gether foot in the door,

212
00:10:34.480 --> 00:10:37.600
<v Speaker 1>scored that first touchdown, but the game's not over. They

213
00:10:37.679 --> 00:10:40.440
<v Speaker 1>got to stay on the field, keep that access. How

214
00:10:40.440 --> 00:10:43.039
<v Speaker 1>do they do that? What are the tactics for persistence?

215
00:10:43.360 --> 00:10:47.039
<v Speaker 2>Well, one common tactic is creating backdoor accounts, Essentially hidden

216
00:10:47.120 --> 00:10:51.159
<v Speaker 2>user accounts give the attacker ongoing access even if their

217
00:10:51.200 --> 00:10:54.320
<v Speaker 2>initial entry point gets shut down. They can use tools

218
00:10:54.399 --> 00:10:58.720
<v Speaker 2>like powersploit create these accounts, often with elevated privileges, you know,

219
00:10:58.919 --> 00:11:02.639
<v Speaker 2>lets them operate with more freedom inside the network.

220
00:11:02.279 --> 00:11:05.320
<v Speaker 1>Because it's like planting a secret agent inside the organization,

221
00:11:05.440 --> 00:11:07.519
<v Speaker 1>ready to open the back door whenever exactly.

222
00:11:07.559 --> 00:11:11.200
<v Speaker 2>Another method exploiting vulnerable services. They might change the configuration

223
00:11:11.320 --> 00:11:15.200
<v Speaker 2>so their malicious code automatically runs every time the system reboots,

224
00:11:15.600 --> 00:11:16.639
<v Speaker 2>like setting a trap.

225
00:11:17.000 --> 00:11:20.720
<v Speaker 1>Wow, these are These are pretty clever and kind of unsettling.

226
00:11:20.919 --> 00:11:23.759
<v Speaker 1>Makes you realize how persistent they can be once they're

227
00:11:23.799 --> 00:11:27.559
<v Speaker 1>in any other any other persistence methods that did stand

228
00:11:27.559 --> 00:11:28.840
<v Speaker 1>out Carbero's attacks.

229
00:11:29.200 --> 00:11:33.080
<v Speaker 2>Carberos is an authentication protocol used a lot in corporate environments.

230
00:11:33.440 --> 00:11:36.600
<v Speaker 2>Attackers can exploit weaknesses in Carberos to get what are

231
00:11:36.600 --> 00:11:38.879
<v Speaker 2>called golden tickets or skeleton keys.

232
00:11:38.960 --> 00:11:41.440
<v Speaker 1>So sound those sounds straight out of a spy movie.

233
00:11:41.519 --> 00:11:43.720
<v Speaker 1>What are those exactly and why are these so valuable

234
00:11:43.720 --> 00:11:44.320
<v Speaker 1>to attackers?

235
00:11:44.519 --> 00:11:47.039
<v Speaker 2>Think of them as master keys long term access to

236
00:11:47.080 --> 00:11:50.320
<v Speaker 2>the network. Even if passwords get changed, an attacker with

237
00:11:50.360 --> 00:11:53.240
<v Speaker 2>a golden ticket or a skeleton key, they might still

238
00:11:53.360 --> 00:11:55.159
<v Speaker 2>bypass security keep their access.

239
00:11:55.159 --> 00:11:58.879
<v Speaker 1>Still that's that's a nightmare scenario for any security admin

240
00:11:59.360 --> 00:12:03.799
<v Speaker 1>shows you patching vulnerabilities is key, but also strong security

241
00:12:03.840 --> 00:12:10.039
<v Speaker 1>measures like multi factor authentication to minimize the impact if

242
00:12:10.080 --> 00:12:11.200
<v Speaker 1>something like this happens.

243
00:12:11.519 --> 00:12:14.960
<v Speaker 2>Okay, so let's say and attackers managed to get that persistence,

244
00:12:15.000 --> 00:12:17.679
<v Speaker 2>what's next? Do they just start I don't know, wreaking havoc?

245
00:12:18.480 --> 00:12:21.320
<v Speaker 1>Not necessarily a skilled attacker. They often try to stay

246
00:12:21.360 --> 00:12:23.320
<v Speaker 1>under the radar for as long as possible. They don't

247
00:12:23.320 --> 00:12:26.440
<v Speaker 1>want to trigger any alarms while they're gathering more info,

248
00:12:26.639 --> 00:12:29.919
<v Speaker 1>expanding their access, maybe even preparing for bigger attack. This

249
00:12:29.960 --> 00:12:32.240
<v Speaker 1>is where the evasion phase comes in. It's all about stealth,

250
00:12:32.840 --> 00:12:35.519
<v Speaker 1>covering your tracks, making it seem like you were never

251
00:12:35.600 --> 00:12:36.080
<v Speaker 1>even there.

252
00:12:36.519 --> 00:12:38.559
<v Speaker 2>So if the drive is about getting onto the field,

253
00:12:38.600 --> 00:12:41.480
<v Speaker 2>evasion is about moving silently, staying out of the spotlight.

254
00:12:41.960 --> 00:12:46.000
<v Speaker 2>What are some techniques for evading detection? Anti virus? Evasion

255
00:12:46.120 --> 00:12:50.120
<v Speaker 2>attackers use different tools, different techniques to create malware that

256
00:12:50.679 --> 00:12:54.600
<v Speaker 2>can slip past antivirus software. They might obfuscate the code,

257
00:12:54.720 --> 00:12:56.960
<v Speaker 2>disguise it so it's not detected.

258
00:12:56.840 --> 00:13:00.360
<v Speaker 1>Like creating a digital smoke screen to hide their moods.

259
00:13:00.600 --> 00:13:04.759
<v Speaker 1>But what about network traffic? Surely security tools can can

260
00:13:04.799 --> 00:13:06.679
<v Speaker 1>pick up suspicious activity, right.

261
00:13:06.639 --> 00:13:09.279
<v Speaker 2>They can, but attackers have ways to hide there too.

262
00:13:09.720 --> 00:13:12.720
<v Speaker 2>They might blend their traffic in with legitimate communication, make

263
00:13:12.759 --> 00:13:16.000
<v Speaker 2>it harder to spot or use encryption, so their traffic

264
00:13:16.080 --> 00:13:17.200
<v Speaker 2>just looks like gibberish.

265
00:13:17.279 --> 00:13:20.600
<v Speaker 1>Yeah, basically speaking in code then asking their intentions. What

266
00:13:20.639 --> 00:13:23.960
<v Speaker 1>about logs? Don't systems keep track of everything? Can't those

267
00:13:23.960 --> 00:13:26.440
<v Speaker 1>be used to trace the attackers' activity?

268
00:13:26.639 --> 00:13:29.360
<v Speaker 2>Logs are valuable for sure, but attackers know that they

269
00:13:29.399 --> 00:13:31.879
<v Speaker 2>often try to cover their tracks by deleting or changing

270
00:13:31.919 --> 00:13:35.360
<v Speaker 2>log entries. It's like erasing their footprints in the digital sand.

271
00:13:35.519 --> 00:13:38.960
<v Speaker 1>So even with all these security measures, anti virus, network monitoring,

272
00:13:39.039 --> 00:13:42.720
<v Speaker 1>log analysis, a determined attacker can still still find ways

273
00:13:42.759 --> 00:13:45.399
<v Speaker 1>to avoid detection. That's a bit unnerving.

274
00:13:45.639 --> 00:13:48.600
<v Speaker 2>It is a constant cat and mouse game. Yeah, Attackers

275
00:13:48.639 --> 00:13:51.679
<v Speaker 2>develop new techniques, defenders have to keep up stay ahead.

276
00:13:52.000 --> 00:13:54.759
<v Speaker 1>So what's the key takeaway here? What can we learn

277
00:13:54.840 --> 00:13:59.000
<v Speaker 1>from from all this exploration of penetration testing.

278
00:13:59.159 --> 00:14:02.440
<v Speaker 2>I'd say the big takeaway is that cybersecurity it's an

279
00:14:02.519 --> 00:14:05.360
<v Speaker 2>ongoing process. It's not set it and forget it. It's

280
00:14:05.480 --> 00:14:11.840
<v Speaker 2>continuous improvement, patching vulnerabilities, strong security measures, active monitoring, and

281
00:14:11.919 --> 00:14:14.639
<v Speaker 2>being prepared to respond if an attack does happen.

282
00:14:14.759 --> 00:14:17.279
<v Speaker 1>It's dynamic. You got to be vigilant, adapt to the

283
00:14:17.919 --> 00:14:20.600
<v Speaker 1>changing threats like a game of chess, always thinking a

284
00:14:20.639 --> 00:14:24.320
<v Speaker 1>few moves ahead. This deep dive has been wow, really insightful,

285
00:14:24.559 --> 00:14:27.679
<v Speaker 1>a glintse into this world of penetration testing, seeing the

286
00:14:27.720 --> 00:14:31.080
<v Speaker 1>tactics both sides use, and it reminds us to truly

287
00:14:31.120 --> 00:14:34.000
<v Speaker 1>defend against attacks. You got to understand how the attackers think.

288
00:14:33.879 --> 00:14:36.960
<v Speaker 2>Exactly, and that's where resources like the Hacker Playbook too,

289
00:14:37.159 --> 00:14:40.039
<v Speaker 2>they're so valuable. They give you that insight practical into

290
00:14:40.080 --> 00:14:44.080
<v Speaker 2>the tools, the techniques, essential reading for anyone in cybersecurity really,

291
00:14:44.360 --> 00:14:47.039
<v Speaker 2>whether you're aspiring to be a penetration tester or a

292
00:14:47.080 --> 00:14:50.120
<v Speaker 2>season pro, or just someone who wants to understand the threats.

293
00:14:50.519 --> 00:14:53.440
<v Speaker 1>Well said, As we wrap up this deep dive, I'm

294
00:14:53.480 --> 00:14:56.639
<v Speaker 1>left with one one final question. If you were a

295
00:14:56.679 --> 00:15:00.200
<v Speaker 1>penetration tester, what kind of attack would you launch? Oh?

296
00:15:00.200 --> 00:15:03.480
<v Speaker 2>That's a tough one, so many possibilities. The best approach

297
00:15:04.039 --> 00:15:06.879
<v Speaker 2>it always depends right on the target, the goals of

298
00:15:06.879 --> 00:15:10.559
<v Speaker 2>the test. But I think often the most effective attacks

299
00:15:10.559 --> 00:15:15.000
<v Speaker 2>are the simplest ones, the ones that exploit not technical vulnerabilities,

300
00:15:15.039 --> 00:15:16.759
<v Speaker 2>but human weaknesses.

301
00:15:16.960 --> 00:15:19.240
<v Speaker 1>You mean like social engineering exactly.

302
00:15:19.320 --> 00:15:23.159
<v Speaker 2>Social engineering praise on trust, curiosity, fear, all of that.

303
00:15:23.200 --> 00:15:25.879
<v Speaker 2>It can be incredibly effective because it bypasses all those

304
00:15:25.919 --> 00:15:28.919
<v Speaker 2>technical defenses. A good phishing email, for example, it can

305
00:15:28.919 --> 00:15:31.399
<v Speaker 2>trick even the most security conscious person.

306
00:15:31.320 --> 00:15:33.799
<v Speaker 1>So the human element that's often the weakest link. It's

307
00:15:34.200 --> 00:15:37.039
<v Speaker 1>a sobering thought, but important to remember. We've got to

308
00:15:37.039 --> 00:15:39.000
<v Speaker 1>be just as vigilant about our own habits as we

309
00:15:39.039 --> 00:15:40.320
<v Speaker 1>are about the technical defenses.

310
00:15:40.440 --> 00:15:44.639
<v Speaker 2>Couldn't agree more security it's everyone's responsibility. Starts with awareness,

311
00:15:44.840 --> 00:15:48.519
<v Speaker 2>with education. The more we understand the threats, the tactics,

312
00:15:48.600 --> 00:15:51.960
<v Speaker 2>the better prepared will be to defend ourselves our organizations.

313
00:15:52.159 --> 00:15:54.600
<v Speaker 1>Great note to end On, Thanks for joining us for

314
00:15:54.679 --> 00:15:57.480
<v Speaker 1>this deep dive into the world of penetration testing. We

315
00:15:57.559 --> 00:16:00.200
<v Speaker 1>hope you found it informative and, as you said, little

316
00:16:00.200 --> 00:16:04.600
<v Speaker 1>bit eye opening. Until next time, stay curious, stay vigilant,

317
00:16:04.960 --> 00:16:07.559
<v Speaker 1>and most importantly, stay safe out there.

318
00:16:07.360 --> 00:16:10.039
<v Speaker 2>And keep learning. Always something new to discover in this

319
00:16:10.159 --> 00:16:12.159
<v Speaker 2>ever evolving world of cybersecurity.