Speaker 1: Hey there, and welcome back to the deep dive. Hey,
Speaker 1: get ready, because today we're tackling something well maybe a
Speaker 1: bit cloak and dagger sidding.
Speaker 2: Uh huh.
Speaker 1: We're diving into the actual how behind ethical hacking techniques. Right,
Speaker 1: this comes straight from the source material you shared with us. Yeah,
Speaker 1: you're asking about the practical side, you know, the tools,
Speaker 1: the steps. Yeah, and that's exactly what we're here to unpack.
Speaker 2: That's right. We've got this guide here and it lays
Speaker 2: out various practical methods and tools. Okay, what's really interesting
Speaker 2: about it is the focus. It's very hands on. It's
Speaker 2: really designed to show how things are done, rather than
Speaker 2: getting you know, bogged down in abstract theory.
Speaker 1: So our mission for this deep dive then is to
Speaker 1: pull out those key techniques, the tools, the concepts from
Speaker 1: this guide. I want to understand the steps involved, see
Speaker 1: what insights they offer about how these methods actually work
Speaker 1: in practice.
Speaker 2: And look, it's absolutely essential we highlight something the source
Speaker 2: makes really clear right at the start. Okay, what's that
Speaker 2: It states very iplicitly that whenever it uses the word hacking,
Speaker 2: it's referring to ethical hacking.
Speaker 1: Right, important distinction.
Speaker 2: Absolutely, it gives a strong warning against using any of
Speaker 2: this for illegal stuff and clearly says it's not responsible
Speaker 2: for any illegal actions.
Speaker 1: So, just to be crystal clear, we're exploring the information
Speaker 1: in the source purely for education to understand the techniques
Speaker 1: described precisely.
Speaker 2: That's the goal here, understanding, not instruction for misuse.
Speaker 1: Got it, and the material itself, you said, it's quite direct.
Speaker 2: Yeah, it gets straight to the point, almost like field notes,
Speaker 2: you know, focuses on the practical steps. It acknowledges there
Speaker 2: might be like language imperfections, but the focus is action, okay,
Speaker 2: And it sets the stage early on saying, look, this
Speaker 2: isn't movie.
Speaker 1: Magic, right, no glowing green text rolling super fast.
Speaker 2: Uh huh, probably not. It emphasizes groundwork, especially information gathering
Speaker 2: and a solid grasp of both theory and practice. And
Speaker 2: it really highlights knowing Linux specifically calls out Kala Linux
Speaker 2: as like found.
Speaker 1: Okay, calie linox good to know. All right, right, let's
Speaker 1: unpack this. Then the guide seemed to jump right into
Speaker 1: gaining initial access first method up SSH brute force.
Speaker 2: Yeah. It points out that getting SSH access is like
Speaker 2: a top priority because if you get.
Speaker 1: That, basically in control of the whole system pretty much.
Speaker 2: So it shows how to use tools like n maps,
Speaker 2: specifically an n MAP script called swish brute and another
Speaker 2: tool MEDUSA right to just hammer away trying tons of
Speaker 2: username and password combinations.
Speaker 1: Until one works. And it mentioned something kind of surprising
Speaker 1: trying a blank password for SSH.
Speaker 2: It does a small detail, but yeah, it's just giving
Speaker 2: that a try. Sometimes NMP even does it automatically as
Speaker 2: a first check.
Speaker 1: Huh, a simple potential weak point.
Speaker 2: Maybe less common now, but yeah, it's mentioned so before.
Speaker 1: The main brute force. It's about recon finding weak spots. Yeah,
Speaker 1: what other reconnaissance tools does it mention?
Speaker 2: Early on it lists a few others to sort of
Speaker 2: give try once as it puts it, okay, like dirbuster
Speaker 2: or dirb They search for hidden web pages or directories.
Speaker 1: Ah, finding stuff that's not obviously linked exactly.
Speaker 2: Then there's an n MAP script FTP dash and non
Speaker 2: dot NSS just to quickly check if a site allows
Speaker 2: anonymous FTP logins.
Speaker 1: Another potential way in YEP.
Speaker 2: And nikto for vulnerability standing though it notes nikto can
Speaker 2: be slow but often.
Speaker 1: Accurate slow bit steady, and.
Speaker 2: Search sploit, which lets you search databases of known exploits.
Speaker 1: Offline, right, So you don't need to be connected while
Speaker 1: searching for attack methods.
Speaker 2: Correct, So it's all about building that initial picture.
Speaker 1: Reconnaissance sounds like a whole toolkit, not just one thing.
Speaker 2: Oh. Absolutely, the guide really hammers home that information gathering
Speaker 2: is maybe the most critical.
Speaker 1: Phase, more important than the attack itself arguably.
Speaker 2: Yeah. It lists tools like Maltago, the Osen framework, reconninging
Speaker 2: and map again dymmetry, a lot of tools, and the
Speaker 2: stresses that any info can be useful user names, emails,
Speaker 2: even things like hobbies or company structure, anything. The more
Speaker 2: you know, the better your chance is.
Speaker 1: Basically, Okay, here's something that caught my eye in the notes.
Speaker 1: Banner grabbing Chapter eight sounds a bit retro.
Speaker 2: It does sound a bit old school, right, But what's
Speaker 2: fascinating is how simple the source makes it seem.
Speaker 1: How simple.
Speaker 2: Banner grabbing is just described as, you know, connecting to
Speaker 2: an open port on a system to see what service responds.
Speaker 1: And how do you do that, according to the guide.
Speaker 2: Using really basic often built in tools like netcat and
Speaker 2: c or tilnet. So nothing fancy needed, Nope, just connect
Speaker 2: to the port like port eighty for web or twenty
Speaker 2: two for SSH. Maybe send some garbage input and the
Speaker 2: server often sends back a banner basically a greeting.
Speaker 1: Message, and that banner tells you.
Speaker 2: Often the service name and crucially it's version number.
Speaker 1: Ah. And knowing the version is key because.
Speaker 2: Because you can immediately look up if that specific version
Speaker 2: has known vulnerabilities. You know, cvees common vulnerabilities and exposures.
Speaker 1: So it's a low tech way to find a known
Speaker 1: weakness before you even try anything complicated.
Speaker 2: Exactly straight from the sources description.
Speaker 1: Okay, Moving on from reconnaissance, the guide gets into common
Speaker 1: attack types. Wi Fi hacking comes up, apparently a popular
Speaker 1: search query.
Speaker 2: Yeah, it mentions that, and it contrasts the older method
Speaker 2: capturing that Wi Fi handshake and trying to crack the
Speaker 2: password hash offline.
Speaker 1: Which takes a lot of computing power.
Speaker 2: Now right right, the guide calls it a headache. Now instead,
Speaker 2: it focuses on what it presents as a more modern approach,
Speaker 2: the evil twin attack.
Speaker 1: Evil twin sounds ominous. How does that work? According to
Speaker 1: this guide?
Speaker 2: Okay, so it involves setting up a fake Wi Fi
Speaker 2: access point, one that looks exactly like a legitimate one
Speaker 2: nearby same name the SSID.
Speaker 1: Like mimiking the coffee shop's s WiFi precisely.
Speaker 2: The material shows using a tool called.
Speaker 1: Flection for this election. Got it.
Speaker 2: Then the attack actively kicks legitimate users off the real network,
Speaker 2: forces them off, yeah, deauthenticates them. So their devices automatically
Speaker 2: look for the work again and find your fake one.
Speaker 1: Ah, and connect to the fake one because it looks
Speaker 1: right and might even be open often.
Speaker 2: Yeah. And once they're connected to your fake network, then
Speaker 2: what then comes the trap? They get presented with a
Speaker 2: fake login page looks like one of those captive portals,
Speaker 2: you know, enter the password to access the Internet.
Speaker 1: So it is like phishing, but for the Wi Fi
Speaker 1: password itself exactly.
Speaker 2: But and this is a crucial difference, the source highlights
Speaker 2: m M unlike a lot of web fishing where you
Speaker 2: might enter fake details and it still looks like it
Speaker 2: works right here, for the evil twin portal to seem
Speaker 2: to grant Internet access, the user actually has to enter
Speaker 2: the correct real password for the network they thought they
Speaker 2: were joining.
Speaker 1: WHOA, So the attack relies on them needing to input
Speaker 1: the actual password to proceed. That's how it captures it.
Speaker 2: That's the mechanism described Yeah, the requirement for the real
Speaker 2: password is the core of it. The guide walks through
Speaker 2: the flection steps pretty thoroughly.
Speaker 1: That's clever deceptive. Oh okay, speaking of fishing, the guide
Speaker 1: cover standard webfishing too fake login pages, but it notes
Speaker 1: people are getting better at spotting fake URLs, so it
Speaker 1: suggests twists.
Speaker 2: Yeah, a couple of interesting vectors described. First, instead of
Speaker 2: just sending a link, generate the fishing link using a
Speaker 2: tool like next fisher, but then embed that link inside
Speaker 2: a mobile app file. It shows using an online tool
Speaker 2: like appskyzer dot com for.
Speaker 1: This, Wait, turn the fishing page into an app.
Speaker 2: Basically, yeah, so you're tricking someone into installing a seemingly
Speaker 2: harmless app, which then presents the login page.
Speaker 1: That's wow, that's a different level. What was the other method?
Speaker 1: Masking the link?
Speaker 2: Right? Using a tool shown called mask phish, it takes
Speaker 2: your nasty fishing url uh huh and creates a new
Speaker 2: link that looks incredibly real. It can make it look
Speaker 2: like www dot Facebook dot com, but maybe with extra
Speaker 2: words tacked on that seem legit while completely hiding the
Speaker 2: actual malicious destination.
Speaker 1: The sources. These look so real sounds really effective, especially
Speaker 1: on mobile, it does.
Speaker 2: The guide notes desktop browsers might sometimes throw a warning,
Speaker 2: but on mobile often works smoothly.
Speaker 1: Scary. It even gives a tip about making a fake
Speaker 1: Facebook app and asking a friend to log in.
Speaker 2: Yeah, highlighting that social engineering element again is often not
Speaker 2: just about the tech, right, Okay.
Speaker 1: So, let's say an attacker gets some kind of foothold
Speaker 1: or they're probing deeper. The guide talks about defenses they
Speaker 1: might hit, like cloud Flare.
Speaker 2: Cloud Flair's common the source explains its main job is
Speaker 2: protecting sites from things like denial of service.
Speaker 1: Attacks and hiding the site's real IP address right acting
Speaker 1: as a proxy exactly.
Speaker 2: So. The guide shows how to try and bypass that
Speaker 2: protection using a tool called cloud.
Speaker 1: Fail cloud fail, and its goal.
Speaker 2: Is to find the actual original IP address of the
Speaker 2: web server behind cloud Flair's network.
Speaker 1: Ah okay, yeah, And why is finding that real IP
Speaker 1: so important for an attacker?
Speaker 2: Because, as the guide shows, if you know the real IP,
Speaker 2: you might be able to attack the server directly, maybe
Speaker 2: launch that DOS attack cloud Flair was supposed to stop.
Speaker 1: Or access things cloud flaw might be hiding, like an
Speaker 1: admin login.
Speaker 2: Page, precisely like the cPanel login. The source demonstrates it's
Speaker 2: about peeling back that protective layer.
Speaker 1: Got it, so stripping away defenses. Now what happens after
Speaker 1: getting basic access to the SSH access we talked about earlier?
Speaker 1: The guide implies that's just step one.
Speaker 2: Oh definitely, it moves onto something critical, privilege.
Speaker 1: Escalation, raising your permission level.
Speaker 2: Exactly, especially on Linux systems, which the source notes are
Speaker 2: common for websites. You might get in as a regular
Speaker 2: user with limited powers.
Speaker 1: Right, can't do much damage, not really.
Speaker 2: To make significant changes, install things, read sensitive files.
Speaker 3: You need root access the super rouser the administrator keys
Speaker 3: basically yep, and the guide calls this the point where
Speaker 3: real skills come to play, not just running simple scripts.
Speaker 1: So how does it suggest getting root without having the
Speaker 1: root password? This seems like the hard part.
Speaker 2: It demonstrates a technique focused on exploiting the pseudo command.
Speaker 1: To pseudo that lets users run some commands. Is root
Speaker 1: right correct?
Speaker 2: The method shown is first check exactly which commands your
Speaker 2: specific user account is allowed to run using Pseudo without
Speaker 2: needing the root password. You use pseudo dsh L for that.
Speaker 1: Okay, so you see your allowed list?
Speaker 2: Then what then you cross reference that list with external resources?
Speaker 2: The guide specifically mentions gtfobins gtf obins. Yeah, it's a
Speaker 2: curated list of Unix Linux binaries that can be abused
Speaker 2: to bypass local security restrictions, including getting a rootshell if
Speaker 2: they're configured incorrectly with pseudo.
Speaker 1: Huh. So you find a command you are allowed to
Speaker 1: run with pseudo, check gtf obins and see there's a
Speaker 1: known exploit for it.
Speaker 2: Exactly. The guide shows an example using the tar command.
Speaker 2: Running tar in a very specific way with pseudo based
Speaker 2: on the gtf opins entry directly gives you a root command.
Speaker 1: Prompt Wow, turning a file archiving tool into a root exploit.
Speaker 1: That's subtle.
Speaker 2: It's presented as a classic example of, as the source
Speaker 2: puts it, the game of Linux privileged esigalation. This configurations
Speaker 2: are key.
Speaker 1: Okay, so that's getting deeper access. What about communication? If
Speaker 1: you're doing this, you probably want to share files or
Speaker 1: info securely, right, good point.
Speaker 2: The guide addresses that too. It points out that normal
Speaker 2: methods email cloud storage aren't secure for sensitive stuff mentions.
Speaker 2: Even big platforms.
Speaker 1: Get breached, like Twitter, it said, right.
Speaker 2: So it introduces a tool called Onion Share.
Speaker 1: Onion Share uses tour I assume from.
Speaker 2: The name YEP designed for secure and anonymous file sharing
Speaker 2: over the Tour network.
Speaker 1: How does it work? Does it use servers?
Speaker 2: No, that's the clever part. According to the guide, it
Speaker 2: starts a temporary web server directly on your own computer
Speaker 2: and makes whatever you're sharing accessible only via a unique,
Speaker 2: unguessable Tour Onion address.
Speaker 1: So the recipient needs the Tour browser.
Speaker 2: To get it exactly, and the connection is described as
Speaker 2: end to end encrypted using tours strong v three Onion services,
Speaker 2: no third parties, no accounts needed.
Speaker 1: Meat What can you do with it? Just send files?
Speaker 2: The source shows options for send files securely, receiving files
Speaker 2: from someone, and even publishing a simple static website anonymously.
Speaker 1: Pretty versatile for a secure peer to peer sharing.
Speaker 2: Seems like it okay, But the guide doesn't just focus
Speaker 2: on attacking. It flips the script a bit, so it
Speaker 2: talks about catching attackers. Chapter seven introduces honeypots.
Speaker 1: Honey pots like setting a trap? What does the guide
Speaker 1: say they are?
Speaker 2: Describes them as a way to catch the hacker, or
Speaker 2: even quote hack the hacker.
Speaker 1: Okay, sounds interesting? Are they hard to set up?
Speaker 2: Present? It is pretty easy. Actually. The demo uses a
Speaker 2: tool called pent box vent box.
Speaker 3: Yeah.
Speaker 2: It shows configuring it to listen on a specific port.
Speaker 2: Maybe make it look like an interesting service, and you
Speaker 2: can even set a custom fake message if someone connects.
Speaker 1: So you set up this fake service, how does it
Speaker 1: catch anyone?
Speaker 2: The practical example shows running an NMP scan against the
Speaker 2: machine with the honeypot running.
Speaker 1: Just a standard port scan.
Speaker 2: Yep, and the pent Box honeypot immediately detects the connection
Speaker 2: attempt from the scanner and lugs. It logs the attackers
Speaker 2: IP address and the port they tried to connect to.
Speaker 2: So even this simple setup acts as an early warning system.
Speaker 1: Ah, so you see someone poking around your network where
Speaker 1: they shouldn't be.
Speaker 2: Exactly turns the tables a bit using their scanning against them.
Speaker 1: Clever. Okay, so we've gone through access attacks, escalations, secure comms,
Speaker 1: even detection. What's the final stage?
Speaker 2: According to this guide Cleaning Tracks chapter thirteen, absolutely vital.
Speaker 1: It stresses to avoid getting caught obviously and maybe maintain
Speaker 1: access both.
Speaker 2: Avoid detection maintain persistence. The guide shows a few methods
Speaker 2: creating hidden directories to store tools or data.
Speaker 1: Like putting a dot before the directory name and Linux Yeah.
Speaker 2: Like secret inside devshim was the example. Clearing your command
Speaker 2: history history dash you see so no one sees what
Speaker 2: you type.
Speaker 1: Makes sense?
Speaker 2: And critically clearing system log.
Speaker 1: Files that seems like the big one which logs does
Speaker 1: it mention key.
Speaker 2: Ones like varlogoth dot log that tracks logins, authentication attempts right,
Speaker 2: also varlocron dot log for scheduled tasks, barlog, mail log,
Speaker 2: web server logs like varla tpd basically anywhere your activity
Speaker 2: might be recorded.
Speaker 1: And how does this show clearing them just delete the file?
Speaker 2: It shows two ways, either armin to remove the file completely, which.
Speaker 1: Might be suspicious if the file is suddenly missing.
Speaker 2: Right, or perhaps more subtly, using echo varlogoth dot log
Speaker 2: to just erase the contents of the file, leaving an
Speaker 2: empty log file behind. Ah less obvious maybe possibly. And
Speaker 2: it also points out an automated tool called cover my ass.
Speaker 1: Seriously, cover my ass that's.
Speaker 2: The name shown for those who are as the source
Speaker 2: puts it lazy to clear your own tracks. It apparently
Speaker 2: clears logs and bash history automatically.
Speaker 1: Okay, automation for the file steps seems so now to
Speaker 1: put some of this together, the guide includes a CTF
Speaker 1: walkthrough capture the flag.
Speaker 2: Yeah, a simple one from tri Hackney chapter twelve. It's
Speaker 2: a nice way to show how these techniques link up
Speaker 2: in a practical scenario.
Speaker 1: Okay, walk us through how the guy presents it. How
Speaker 1: does it connect the dots?
Speaker 2: It starts naturally with reconnaissance an n.
Speaker 1: MAP scan finding open ports.
Speaker 2: Right, it finds FTP, SSH and HTTP open on the.
Speaker 1: Target machine standard services.
Speaker 2: Then it runs a specific n map script that ftpdashanon
Speaker 2: dot essa we mentioned earlier to check for vulnerabilities. Finds
Speaker 2: an anonymous FTP log in vulnerability. Anyone can log in.
Speaker 1: Okay, so that's the first way in well.
Speaker 2: A way to get information logging into FTP as anonymous.
Speaker 2: The walkthrough finds a couple of files. One has a
Speaker 2: username and another file contains a list of passwords.
Speaker 1: So the recon led to a vulnerability, which led to
Speaker 1: finding potential credentials. Clever exactly. So now they have a
Speaker 1: username l I N and the example and a password
Speaker 1: list locks dot txt.
Speaker 2: What next try those passwords?
Speaker 1: Yep. The guide shows using a brute force tool MEDUSA
Speaker 1: again targeting the SSA service, this time.
Speaker 2: Using the username l I N and the password list
Speaker 2: found via FTP correct and MEDUSA successfully the SSH.
Speaker 1: Password, giving them command line access as the user.
Speaker 2: Lai in precisely. Once logged in via SSH, they find
Speaker 2: the first flag user dot txt. Goal one achieved.
Speaker 1: But there's usually a root flag too, right, the ultimate goal.
Speaker 2: There is and to get the second flag root dot txt.
Speaker 2: The guide explicitly states you need to perform privileged escalation.
Speaker 1: Referencing the techniques from chapter six we discussed pseudo SLGTF
Speaker 1: opens exactly.
Speaker 2: It doesn't show the full steps again in the CTF walkthrough,
Speaker 2: but it points back to that chapter saying that's what's
Speaker 2: needed to get root access and the final flag.
Speaker 1: So the CTF example really ties it together. Reconvulnerability and
Speaker 1: on FTP info gathering, user name, password list, brute force,
Speaker 1: initial access, SSH post exploitation, privileged escalation, final goal root flag.
Speaker 2: Yeah, it's in a neat little package showing several of
Speaker 2: the key steps described individually in the source, all used
Speaker 2: in sequence.
Speaker 1: Wow. Okay, that was quite a journey through the practical
Speaker 1: techniques this guide laid out. We went from scanning and
Speaker 1: initial access as the states brute force banner grabbing, to
Speaker 1: common attacks like the evil twin WiFi hack that appmbitted
Speaker 1: fishing yep, the creative ones bypassing defenses like cloud flare,
Speaker 1: getting deeper with privileged escalation.
Speaker 2: Using tools like onion share for secure.
Speaker 1: Comms, setting traps with honeypots, and then that final crucial
Speaker 1: step cleaning tracks.
Speaker 2: We really unpack the how to details, the specific tools
Speaker 2: mentioned in the source material, seeing the steps according to
Speaker 2: the author, and how they might chain together. In that
Speaker 2: CTF example.
Speaker 1: It definitely gives you a different picture than the movies,
Speaker 1: doesn't it.
Speaker 2: Oh?
Speaker 1: Completely, It's much more about like systematic information gathering, understanding
Speaker 1: the target system, finding those specific weak points.
Speaker 2: And knowing the right tools and techniques for the job.
Speaker 2: Like the source kept emphasizing that practical knowledge, and you know,
Speaker 2: going back to the start, that strong disclaimer the source
Speaker 2: included about ethical use, only it really underscores the power
Speaker 2: I mean understanding stuff. It's potent knowledge.
Speaker 1: It really is.
Speaker 3: Yeah.
Speaker 1: So thinking about everything we've just gone through, all these
Speaker 1: detailed steps, the tools many readily available, Yeah, it does
Speaker 1: make you think, doesn't it.
Speaker 2: It absolutely raises a pre significant question, I think, which
Speaker 2: is well in a world where this kind of technical knowledge,
Speaker 2: these methods, even if learned for defense, are becoming more
Speaker 2: widely documented and accessible.
Speaker 1: Right like in guys like this one.
Speaker 2: Exactly, how do we as individuals, as organizations, as a society,
Speaker 2: how do we ensure that this powerful information is pursued,
Speaker 2: used and applied responsibly ethically.
Speaker 1: That's a heavy question, definitely something that you want. Thank
Speaker 1: you for taking as though as deep dive into these
Speaker 1: techniques as presented in the source.
Speaker 2: You're welcome, Thank you and honestly just understanding these methods
Speaker 2: even at a high level like this, Yeah, it really
Speaker 2: can highlight why basic security hygiene, strong passwords, updates, being cautious,
Speaker 2: and having multiple layers of defense are just so important.
Speaker 1: Absolutely a good reminder. Yeah, Well, until next time, keep learning,
Speaker 1: keep exploring, and stay curious.