Speaker 1: Welcome to a deep dive that might just change how
Speaker 1: you look at the digital world around you.
Speaker 2: Yeah, today we're really pulling back the curtain on hacking.
Speaker 1: But and this is key, not from the criminal side.
Speaker 1: We're looking at the people who learn these techniques to
Speaker 1: well defend.
Speaker 2: Us all exactly. Our main source today is this book
Speaker 2: Ethical Hacking, A hands on Introduction to Breaking In. And
Speaker 2: it's really practical, not just theory then, no, not at all.
Speaker 2: It shows you how systems get compromised, you know, from
Speaker 2: the basics of networks right up to complex exploitation. It's
Speaker 2: solid stuff, technically reviewed by people like doctor ed Novak,
Speaker 2: who really knows his security and privacy.
Speaker 1: Okay, so what's our mission here? What do we want you,
Speaker 1: the listener to get out of this?
Speaker 2: Well, the goal is to help you start thinking like
Speaker 2: an ethical hacker, someone who can, you know, carefully look
Speaker 2: at a system, figure out its weaknesses and find ways.
Speaker 1: In, but purely for defensive reasons.
Speaker 2: Right, It's kind of a shortcut to understanding these hidden
Speaker 2: cyber threats and honestly how much they impact our every
Speaker 2: day lives.
Speaker 1: All right, let's dive in.
Speaker 2: So the influence of hacking today it's huge. It touches everything,
Speaker 2: doesn't it, elections, power grids, big infrastructure, even just our
Speaker 2: personal safety.
Speaker 1: Absolutely, it's not abstract. Remember the Colonial pipeline attack in
Speaker 1: twenty twenty one that caused real panic, flight cancelations, actual
Speaker 1: fuel shortages. Millions of people felt that directly.
Speaker 2: And that's just one example. We've seen attacks on companies,
Speaker 2: even countries just accelerate like crazy over the past decade.
Speaker 1: Yeah, twenty twenty one alone was wild hackers stealing over
Speaker 1: one hundred million in crypto, trying to poison a water
Speaker 1: supply in.
Speaker 2: Florida, attacking Pfizer, hitting government agencies all over the place.
Speaker 1: So why is this happening? Why?
Speaker 2: Now? Well, fundamentally, it's because we depend so much on
Speaker 2: technology right. Our entire society, our economy, it all runs
Speaker 2: on it. So attacks on that tech infrastructure have massive
Speaker 2: knock on effects socially and economically.
Speaker 1: So understanding hacking isn't really optional anymore, pretty much essential. Yeah,
Speaker 1: and to really get it, you need to get your
Speaker 1: hands dirty safely though exactly.
Speaker 2: That's where setting up your own virtual lab comes in
Speaker 2: is crucial. You need this isolated space to learn and
Speaker 2: practice without accidentally messing up your real computer or network.
Speaker 1: Keeps everything secure. So what does this lab look like? Typically?
Speaker 2: Usually you'd set up a few virtual machines or vms.
Speaker 2: You'd have something like a Kithens router firewall that's like
Speaker 2: your virtual networks bodyguard. Then a Kali Linux machine. Think
Speaker 2: of that as your ethical hacking toolkit. It's packed with
Speaker 2: specialized software, got it. You probably want a couple of
Speaker 2: say Ubuntu Linux desktops as targets just to practice attacking
Speaker 2: common systems. And definitely a metasploitable VM.
Speaker 1: Metasploitable yeah, like, that's the one designed to be vulnerable exactly.
Speaker 2: It's deliberately full of holes, so it's perfect for profiting
Speaker 2: attacks without doing any real harm. It's a safe target.
Speaker 1: And you run all this using virtual box.
Speaker 2: Yeah. Virtual box is a great option. It's free and
Speaker 2: lets you create these virtual computers inside your actual computer.
Speaker 2: You just need a reasonably decent machine yourself. You know
Speaker 2: of hard drive space, maybe thirty gigs free and enough
Speaker 2: RAM say four gigs minimum, ideally more to run several
Speaker 2: vms at.
Speaker 1: Once, right, like building a whole mini network inside your laptop,
Speaker 1: a safe little sandbox precisely.
Speaker 2: So let's talk about the digital battlefield itself. The network fundamentals. Okay,
Speaker 2: at the most basic level, everything on the Internet travels
Speaker 2: in packets. You have to think of them like a
Speaker 2: digital envelopes sense, Yeah, and each envelope has a from
Speaker 2: address and a two address. Those are the source and
Speaker 2: destination MSE addresses for local stuff, and IP addresses for
Speaker 2: getting across the wider Internet.
Speaker 1: And the routers they're like the post offices.
Speaker 2: Exactly like sorting offices. They look at the destination IP
Speaker 2: address and forward the packet along the way. It's all hierarchical.
Speaker 2: The lowest level is your local network, your land like
Speaker 2: your home Wi Fi, all connected through one main router.
Speaker 1: Which brings us to something like ARP spoofing. You mentioned
Speaker 1: that as an example.
Speaker 2: Yes, NRP spoofing. It's a classic example of exploiting a
Speaker 2: fund metal maybe slightly flawed protocol. Basically, if you're on
Speaker 2: say public Wi Fi at a coffee shop, yeah, an
Speaker 2: attacker on that same network could potentially use airpacepoofing to
Speaker 2: intercept your unencrypted web traffic. See what sites you're visiting,
Speaker 2: that kind of thing.
Speaker 1: How does that work? Sound sneaky?
Speaker 2: It is. The attacker basically tricks both your computer and
Speaker 2: the router. They convince your machine that the attacker's machine
Speaker 2: is the router. They convince the router that the attacker's
Speaker 2: machine is your computer.
Speaker 1: So all the traffic goes through though.
Speaker 2: Exactly they become a man in the middle. And this
Speaker 2: just highlights how risky unencrypted communication on public Wi Fi
Speaker 2: can be. Even simple tools like earl snarf can then
Speaker 2: pull out things like the website addresses you visit from
Speaker 2: that intercepted traffic.
Speaker 1: Wow. Okay, so how do ethical hackers actually see and
Speaker 1: analyze this traffic?
Speaker 2: Good question. That's where you need to understand the Internet
Speaker 2: protocol stack. Think of protocols as just rules for talking,
Speaker 2: like how human and say hello to start a conversation
Speaker 2: and goodbye to end it. Computers need similar rules and
Speaker 2: it's layered right. Yeah. It typically shown as a five
Speaker 2: layer stack. Yeah. Information gets wrapped up kind of like
Speaker 2: nesting dolls as it moves down the layers.
Speaker 1: So like the application layers where your browser works with HTTP.
Speaker 2: Right, then it goes down to transport maybe using TCP,
Speaker 2: then network with IP addresses, data link with AMC addresses
Speaker 2: for the local network, and finally physical turning it into
Speaker 2: electrical signals or light pulses.
Speaker 1: And each layer does its job independently.
Speaker 2: Pretty much, which is efficient, but it also means a
Speaker 2: weakness of one layer, like ARP at the data link
Speaker 2: layer can be exploited.
Speaker 1: And what about ports. You hear about open ports being bad.
Speaker 2: Ah, ports they're essential. They let multiple programs on your
Speaker 2: computer use the network at the same time, like your
Speaker 2: browser uses port four four three for HTTPS, your email
Speaker 2: client uses others.
Speaker 1: But they're also a risk.
Speaker 2: They can be open ports are like open doors into
Speaker 2: your system. Attackers scan for open ports because they represent
Speaker 2: potential ways to interact with services running on your machine.
Speaker 2: They're often the first thing an attacker looks for.
Speaker 1: So how do you actually see all this packet stuff?
Speaker 2: The key tool here is wire Shark. Think of it
Speaker 2: as your network microscope. It captures every single packet going
Speaker 2: in and out of your computer's network.
Speaker 1: Interface, every single one. That must be a lot of data.
Speaker 2: It can be thousands. Yeah, but wire shark has power fulfillters.
Speaker 2: You can tell it show me only traffic to this
Speaker 2: specific IP address, or show me packets containing the word password.
Speaker 2: It lets you cut through the noise and find what
Speaker 2: you're looking for. It's how you really visualize what's happening.
Speaker 1: You can even monitor firewall traffic.
Speaker 2: Absolutely on something like a pfens firewall VM. You could
Speaker 2: use a tool called TCP dump to capture traffic passing
Speaker 2: through it, save it and analyze it later, maybe even
Speaker 2: using online tools.
Speaker 1: Okay, that covers the fundamentals. Let's move into Part three,
Speaker 1: exploitation techniques actually breaking in right.
Speaker 2: A really fundamental concept here is getting remote control. Key
Speaker 2: technique is the reverse shell.
Speaker 1: Reverse shell sounds backwards.
Speaker 2: It kind of is. Imagine an attacker manages to run
Speaker 2: some malicious code on your machine. Now, instead of the
Speaker 2: attacker trying to connect in through your firewall, which is
Speaker 2: usually blocked, this malicious code connects out from inside your
Speaker 2: network to the attacker's waiting machine.
Speaker 1: Uh so it bypasses the firewalls incoming rules.
Speaker 2: Clever, very clever, and it gives the attacker persistent access
Speaker 2: a way back in whenever they want.
Speaker 1: And if they do that to lots of machines.
Speaker 2: Then you have a botnet, a whole network of compromised
Speaker 2: computers or bots, all under the attacker's control, and they can.
Speaker 1: Use these bots for what DEDAS attacks.
Speaker 2: DDAs is a big one. Yeah, overwhelming a website or
Speaker 2: server with so much traffic from the botnet that it
Speaker 2: just falls over, it goes offline.
Speaker 1: Wasn't there a famous botnet, Mira.
Speaker 2: Miri exactly back in twenty sixteen was huge, infected something
Speaker 2: like three hundred thousand devices.
Speaker 1: Mostly those Internet of Things devices, right, cameras, routers.
Speaker 2: Yeah, basic stuff. And the crazy part is how it
Speaker 2: infected them, mostly just by logging in with the default
Speaker 2: usernames and passwords that people never changed.
Speaker 1: Wow, just default credentials yep.
Speaker 2: And what made me write tricky to stop was how
Speaker 2: the bots found their master, their commanding control server or
Speaker 2: C two. They didn't use a fixed IP address, They
Speaker 2: looked up a domain name a URL, which the attackers
Speaker 2: could easily change. Made it much harder to take down
Speaker 2: the whole network.
Speaker 1: Okay, so controlling machines is one thing. What about data
Speaker 1: that leads to cryptography? Right?
Speaker 2: Yeah? And ransomware absolutely. Crytography is fundamental to digital security
Speaker 2: and ransomware. Oh that's the nightmare scenario where malware encrypts
Speaker 2: all your important.
Speaker 1: Files, it demands money to get them back.
Speaker 2: Right, malicious encryption to understand the risks, it helps to
Speaker 2: know a bit about how encryption works, even simple concepts
Speaker 2: like the one time pad.
Speaker 1: That's the theoretically unbreakable one.
Speaker 2: Theoretically yes, if the key is truly random and you
Speaker 2: only use it once. The critical part is only once.
Speaker 1: What happens if you reuse the key big problems.
Speaker 2: If you encrypt two different messages with the same one
Speaker 2: time pad key, you actually leak information that lets someone
Speaker 2: potentially figure out both original messages. It shows how even
Speaker 2: a perfect system can fail catastrophically if used incorrectly.
Speaker 1: So for real world security, we use things like RSA
Speaker 1: public key cryptography exactly.
Speaker 2: RSA is a cornerstone, uses a pair of keys, a
Speaker 2: public key you can share with anyone, and a private
Speaker 2: key you guard.
Speaker 1: Fiercely, and if someone encrypts a message with my public.
Speaker 2: Key, only you with your corresponding private key, can decrypt it.
Speaker 2: It guarantees confidentiality.
Speaker 1: And the other way around. Encrypting with a private key
Speaker 1: that acts like.
Speaker 2: A digital signature. If you encrypt something or usually a
Speaker 2: hash of something, with your private key, anyone can use
Speaker 2: your public key to verify that you must have been
Speaker 2: the one who signed it.
Speaker 1: Proves authenticity, which is crucial for things like secure websites
Speaker 1: HDTPS that uses TLS right Transport layer security.
Speaker 2: Right TLS uses all these public private keys for authentication,
Speaker 2: and keys change symmetric encryption for the actual data transfer
Speaker 2: message authentication codes. For integrity, it relies on certificate authorities
Speaker 2: CAAs to vouch for the public keys and build that
Speaker 2: chain of trust.
Speaker 1: But attackers still try to break it, like trying to
Speaker 1: force a connection down from HTTPS to unencrypted HTTP.
Speaker 2: They definitely try. It's called SSL stripping, but modern browsers
Speaker 2: fight back with something called HTCs HTT Strict Transport Security.
Speaker 2: It basically tells the browser only ever talk to this
Speaker 2: site over HTDPS, which prevents most downgrade attacks.
Speaker 1: Although misconfigurations can still happen.
Speaker 2: I guess oh absolutely, especially with subdomains or complex setups.
Speaker 2: Security is never perfectly simple.
Speaker 1: Okay, let's shift focus a bit Part four, the human side,
Speaker 1: social engineering and ocent.
Speaker 2: Yeah, the human element is often the weakest link. Phishing
Speaker 2: emails are a classic example. It's surprisingly easy to fake
Speaker 2: the from address in an email because of how the
Speaker 2: underlying protocol SMTP works, so you.
Speaker 1: Can make can email look like it came from a
Speaker 1: trusted source easily.
Speaker 2: And now we're seeing the rise of deep fakes, which
Speaker 2: is frankly terrifying.
Speaker 1: AI generated fake videos exactly.
Speaker 2: Using machine learning, attackers can create incredibly convincing videos. Imagine
Speaker 2: getting a video call that looks and sounds exactly like
Speaker 2: your CEO telling you to approve a wire transfer or
Speaker 2: expect a certain.
Speaker 1: Email which is actually malicious. Wow. The potential for deception
Speaker 1: there is huge, It really is.
Speaker 2: Which highlights why information gathering OCENT open source intelligence is
Speaker 2: so critical for attackers.
Speaker 1: Just collecting publicly available info yep.
Speaker 2: The more an attacker knows about you or your organization,
Speaker 2: the more tailored and convincing their attack can be. OCENT
Speaker 2: is the process of finding and connecting those public data.
Speaker 1: Points like what kind of data points?
Speaker 2: Oh anything? Contact details from website registration records, ye, email
Speaker 2: addresses are user names exposed in data breaches. You can
Speaker 2: check sites like have in pobayan dot com, social media profiles,
Speaker 2: company directories, news articles.
Speaker 1: And tools help connect these dots. You mentioned.
Speaker 2: Maltago, Yeah, Maultago is great for visualizing these connections. You
Speaker 2: feed it bits of information and it spiders out, finding
Speaker 2: links you might never see otherwise. It can map relationships
Speaker 2: between people, companies, email addresses infrastructure, and.
Speaker 1: This OCENT enables really nasty attacks like simjacking.
Speaker 2: Simjacking is a prime example of weaponized OCENT. It's highly sophisticated.
Speaker 2: Attackers gather enough personal information about you to convincingly impersonate
Speaker 2: you when talking to your mobile phone provider.
Speaker 1: And they trick the provider into.
Speaker 2: Transferring your phone number to a simcard they control.
Speaker 1: Oh wow, so they get all your calls and texts,
Speaker 1: including two factor authentication codes exactly.
Speaker 2: It completely bypasses SMS based two FA It requires a
Speaker 2: lot of prep work, but it's devastating when it works.
Speaker 1: Scary stuff. What about finding vulnerable systems directly?
Speaker 2: Google dorking Google dorking. It's basically using advanced search operators
Speaker 2: in Google to find things that shouldn't be public, like
Speaker 2: what misconfigured web servers, login pages, sensitive documents or configuration
Speaker 2: files accidentally indexed by Google, even live unsecured webcams. Sometimes
Speaker 2: you'd be amazed what's just out there?
Speaker 1: And beyond Google there are specialized tools.
Speaker 2: Oh yeah, Tools like mass scan can scan huge ranges
Speaker 2: of the Internet incredibly quickly, looking for specific open ports.
Speaker 2: Showdan is like a search engine specifically for Internet connected devices.
Speaker 2: Finding everything from industrial control systems to refrigerators online though
Speaker 2: SHOWDAN logs your IP so ethical use is key.
Speaker 1: And once you find a potential target system and you
Speaker 1: start looking.
Speaker 2: For known weaknesses, use the osent you gathered. What software
Speaker 2: is it running? What version? Then you check vulnerability databases
Speaker 2: like the CVE list using tools like search sploit to
Speaker 2: see if there are known published exploits for that specific.
Speaker 1: Software, and automated scanners like ENMAP or nessis can help
Speaker 1: find these vulnerabilities too.
Speaker 2: Absolutely. NMAP is fantastic for port scanning and service identification.
Speaker 2: NESSUS is a more common, comprehensive vulnerability scanner. The checks
Speaker 2: for thousands of known issues, including things like back doors
Speaker 2: like the one deliberately built into that metasploitable practice machine.
Speaker 2: There are even tools like discovered that try to automate
Speaker 2: a whole range of ocent gathering.
Speaker 1: Okay, so that's finding non issues. What about the unknown?
Speaker 1: Part five? Advanced exploitation? Finding zero days?
Speaker 2: Right? Zero days? These are the vulnerabilities nobody knows about
Speaker 2: yet except maybe the person who found them. They can
Speaker 2: be incredibly valuable, sometimes selling for huge sums on the
Speaker 2: black market or to.
Speaker 1: Governments because there's no patch, no defense yet exactly.
Speaker 2: The famous heart bleed bug in open ssl was effectively
Speaker 2: a zero day for a while before it was discovered
Speaker 2: and publicized.
Speaker 1: And how do people find these? Fuzzing?
Speaker 2: Fuzzing is a major technique. It's basically automated bug hunting.
Speaker 2: You throw tons and tons of malformed, unexpected random data
Speaker 2: at a program, hoping to make it crash or behave.
Speaker 1: Strangely just random jump.
Speaker 2: Well, simple fuzzers do that, but smarter fuzzers like American
Speaker 2: Fuzzy lop AFL are more clever. They watch how the
Speaker 2: program reacts to input and intelligently mutate the inputs that
Speaker 2: seem to explore new paths within the code, making the
Speaker 2: process much more efficient at finding hidden bugs.
Speaker 1: So once an attacker gets in, maybe using a zero
Speaker 1: day or maybe something simpler, they want to stay hidden, right.
Speaker 1: Trojans and rootkits exactly.
Speaker 2: Persistence and stealth are key. A trojan horse program is
Speaker 2: malware disguised is something harmless, like the Greek myth, just
Speaker 2: like it. You might hide your malicious implant inside a
Speaker 2: legitimate looking installer file for Linux dot deb, or maybe
Speaker 2: inside a simple Windows game like Mind Sweeper, or even
Speaker 2: a word document, macro or an Android app DOTK file.
Speaker 1: How do they get past antivirus? Then?
Speaker 2: Good question. Antivirus often looks for known signatures of malware,
Speaker 2: so attackers use techniques to change the signature. Simple encoding
Speaker 2: like BA sixty four can sometimes help disguise the code,
Speaker 2: but more advanced methods polymorphic encoders are the next level.
Speaker 2: Something like the chicatagun I encoder used by the Metasbolate
Speaker 2: framework actually generates a slightly different version of the malware
Speaker 2: code each time it's used. It does the same bad stuff,
Speaker 2: but its signature looks different every time, making it much
Speaker 2: harder for signature based antivirus to catch.
Speaker 1: And then rootkits those sound serious they are.
Speaker 2: If a trojan gets the malware installed, a root kit
Speaker 2: helps it hide and maintain control at a very deep level,
Speaker 2: often by modifying the operating system itself.
Speaker 1: How does that work? In Linux? For example, so.
Speaker 2: Normal programs run in user space, but they need to
Speaker 2: ask the core of the OS, the kernel, to do
Speaker 2: privileged things like accessing hardware or managing files. They do
Speaker 2: this using system calls for ciscolls. A rootkit might hook
Speaker 2: these cis calls it replaces the kernel's normal function for say,
Speaker 2: listing files in a directory, with its own function. This
Speaker 2: malicious function does the normal job, but also hides the
Speaker 2: rootkit's own files from the listing.
Speaker 1: So the malware becomes invisible to standard tools.
Speaker 2: Exactly could to hide processes. Network connections prevent reboots. Very
Speaker 2: sneaky and hard to detect or remove.
Speaker 1: Let's switch to web applications. SEQL injection that seems to
Speaker 1: come up a lot.
Speaker 2: It does because it's still surprisingly common. It happens when
Speaker 2: a website developer doesn't properly clean up the input they
Speaker 2: get from a user, maybe from a search.
Speaker 1: Box or a log in form, and the attacker puts
Speaker 1: database commands in there.
Speaker 2: Precisely, they inject malicious sequel commands into the input field.
Speaker 2: If the website just blindly pastes that input into its
Speaker 2: database query, the attacker's commands get executed by the database.
Speaker 1: Letting them do what dump data.
Speaker 2: Yeah, potentially steal entire tables of data, user names, passwords,
Speaker 2: customer info, whatever's in the database. It relies on trusting
Speaker 2: user input, which you should.
Speaker 1: Ever do, and web interactions rely heavily on HTTP requests right,
Speaker 1: especially cookies.
Speaker 2: Absolutely you need to understand how browsers talk to servers
Speaker 2: using get and post requests, the headers involved like host
Speaker 2: and user agent, and crucially the cookie header.
Speaker 1: That's what keeps you logged in.
Speaker 2: Yeah, cookie store your session state. If an attacker can
Speaker 2: steal your session cookie, maybe through intercepting traffic or another
Speaker 2: attack like XSS, they can often put that cookie in
Speaker 2: their own browser and impersonate you, taking over your logged
Speaker 2: in session without needing your password at all.
Speaker 1: Speaking of passwords, systems don't store them in plain text,
Speaker 1: hopefully they use hashes, right.
Speaker 2: They store hashes. A hash function like SAHA two fifty
Speaker 2: six takes an input your password and produces a fixed
Speaker 2: size output the hash. It's designed to be one way
Speaker 2: easy to compute the hash from the password, but incredibly
Speaker 2: hard to get the password back from the hash.
Speaker 1: But attackers can still crack hashes dictionary attacks they.
Speaker 2: Can try if the system just stores the raw hash
Speaker 2: of the password. Attackers can pre calculate hashes for millions
Speaker 2: of common passwords a rainbow table, or just try hashing
Speaker 2: words from a dictionary until they find a match.
Speaker 1: So how do systems defend against that? Salting?
Speaker 2: Exactly? Salting is crucial. Before hashing the password, the system
Speaker 2: adds a unique random value, the salt, to it, so
Speaker 2: even if two users have this password, their salted hashes
Speaker 2: will be.
Speaker 1: Different, which makes rainbow tables useless completely useless.
Speaker 2: Attackers then have to crack each salted hash individually, usually
Speaker 2: using brute force methods with tools like John the Ripper,
Speaker 2: or for more speed, using graphics cards hashcat. It makes
Speaker 2: cracking much much slower.
Speaker 1: Okay, another big web attack cross site scripting XSS. What's
Speaker 1: that about?
Speaker 2: XSS is about injecting malicious JavaScript code into a web
Speaker 2: page so that it runs in the victims browser.
Speaker 1: How does the script get there?
Speaker 2: Two main ways. Stored XSS is where the malicious script
Speaker 2: gets saved permanently on the website's server, maybe in a
Speaker 2: comment section or a user profile. Anyone who've used that
Speaker 2: page later executes the script, and the other way reflected XSS.
Speaker 1: Here the script is usually part of a link the
Speaker 1: victim clicks, The script gets sent to the server, maybe
Speaker 1: as a URL parameter, and the server then includes it
Speaker 1: or reflects it back in the response page it sends
Speaker 1: to the victim's browser, which then runs it.
Speaker 2: And the impact of running this malicious script. A major
Speaker 2: one is stealing those session cookies we talked about. The
Speaker 2: script runs with the permissions of the website and the
Speaker 2: victim's browser, so it can often access the cookies associated
Speaker 2: with that site and send them off to the.
Speaker 1: Attacker, allowing session hijacking again exactly.
Speaker 2: Ye AXSS is a powerful way to compromise user accounts, and.
Speaker 1: There are frameworks to make this easier for attackers.
Speaker 2: BEEF Yeah, Beef the Browser Exploitation Framework. It's a tool
Speaker 2: specifically designed for EXSS. An attacker gets a user to
Speaker 2: run a small BEEF JavaScript hook. Once hooked, the attacker
Speaker 2: gets a control panel showing the hook browser and they
Speaker 2: can easily launch further attacks. Pop up fake login prompts,
Speaker 2: redirect the browser, try to exploit browser plug ins, all
Speaker 2: sorts of nasty stuff. It makes sophisticated browser based attacks
Speaker 2: much more accessible.
Speaker 1: Okay, let's zoom out to corporate networks, specifically Windows environments.
Speaker 1: Getting that first foothold is one thing, but attackers want
Speaker 1: to move deeper, right lateral movement.
Speaker 2: Absolutely, landing on one workstation is usually just the start.
Speaker 2: The goal is often to get to more sensitive systems
Speaker 2: like servers or domain controllers, so they use the first
Speaker 2: compromised machine as a stepping stone a pivot to reach
Speaker 2: other parts of the network they couldn't access directly.
Speaker 1: How might they do that?
Speaker 2: Well, Sometimes a compromised machine might be dual homed, connected
Speaker 2: to two different networks, maybe the main corporate land and
Speaker 2: a smaller private one. The attacker can use that machine
Speaker 2: as a proxy to route their traffic between those networks.
Speaker 2: Bridging segments that were supposed to be separate.
Speaker 1: And getting credentials is key and Windows too like password hashes.
Speaker 2: Definitely similar to Linux, Windows stores password hashes. Attackers often
Speaker 2: try to extract these hashes, frequently from the memory of
Speaker 2: a critical system process called l sas. Local security authority
Speaker 2: subsystem service tools like mimicats are famous for doing this.
Speaker 1: Does that require special permissions?
Speaker 2: Usually Yes, You typically need administrative rights on the machine
Speaker 2: to dumb hashes from l SAS memory. That's often a
Speaker 2: key goal after initial access, escalating privileges to become an admin.
Speaker 1: And Windows networks use protocols like NTLM for authentication that
Speaker 1: can be attacked too.
Speaker 2: Yes. NTLM is an older but still common protocol. Attackers
Speaker 2: can often perform past the hash attacks. Once they have
Speaker 2: your NTLM password hash, which they might get from mimic
Speaker 2: ads or by tricking your machine and descending it, they
Speaker 2: can sometimes use that hash directly to authenticate to other
Speaker 2: machines on the network that accept NTLM.
Speaker 1: So they don't even need the actual password, just the
Speaker 1: hash exactly.
Speaker 2: It's a powerful lateral movement.
Speaker 1: Technique and navigating these large corporate networks. It's complex, right.
Speaker 2: Domains forests, Yeah, large organizations use active directory, which has
Speaker 2: a hierarchical structure. Organizational units OUs within domains, domains grouped
Speaker 2: into trees and trees into forests. Understanding the structure, how
Speaker 2: security policies are applied and where valuable assets like domain
Speaker 2: controllers reside, is crucial for an attacker planning their movement.
Speaker 1: The domain controller or DC is the main target then
Speaker 1: often yes.
Speaker 2: The DC manages all the users, computers and security for
Speaker 2: the domain runs critical services like DNA Domain Name System
Speaker 2: for resolving names. Attackers might try DNS poisoning or exploiting
Speaker 2: related protocols like lmn R, which is a fallback name
Speaker 2: resolution protocol. If they can intercept an LLM in our request,
Speaker 2: they might trick a client into sending its credentials to
Speaker 2: the attackers machine.
Speaker 1: And LDAP lightweight.
Speaker 2: Directory access protocol that's how you query active directory for
Speaker 2: information about users, groups, computers, permissions. Attackers use LDPP extensively
Speaker 2: for reconnaissance inside the network. Tools like Bloodhound visualize ad
Speaker 2: data gathered via LDP to find attack paths, ways to
Speaker 2: hop from a low privileged user to eventually becoming a
Speaker 2: domain admin.
Speaker 1: And Carberos authentication.
Speaker 2: Carberos is the primary authentication protocol and modern active directory.
Speaker 2: It's more secure than NTLM, but still has potential weaknesses
Speaker 2: attackers try to exploit, often related to stealing Carbero's tickets,
Speaker 2: specifically ticket granting tickets tgts.
Speaker 1: Ultimate goal being the Golden ticket ah.
Speaker 2: The Golden Ticket attack. That's kind of the holy grail
Speaker 2: for an active directory attacker. It involves compromising the domain
Speaker 2: controller itself, stealing the password hash of a very special
Speaker 2: account called karbpga. With that hash, the attacker can forge
Speaker 2: any Carbero's ticket they want, granting themselves access to anything
Speaker 2: in the domain, often for years, and it's very hard
Speaker 2: to detect. It provides ultimate persistence and access.
Speaker 1: Ooh, that's comprehensive control.
Speaker 2: Okay, we've covered a massive amount of ground. After learning
Speaker 2: all this, what are the practical next steps beyond the
Speaker 2: virtual lab?
Speaker 1: Right? The virtual lab is for safe learning, but if
Speaker 1: you were doing say, external penetration testing for real, you'd
Speaker 1: likely use a hardened server online, a virtual private server
Speaker 1: or VPS with a public EYP address.
Speaker 2: Hardened meaning what meaning locking it down tight applying rigorous
Speaker 2: security configurations. You might use tools like Lennis to audit
Speaker 2: the server's security settings to get a score, identify weaknesses.
Speaker 2: You can figure firewalls carefully, maybe using UfW uncomplicated firewall
Speaker 2: or even more advanced systems like Cylinux for fine grained
Speaker 2: access control, basically making your attack platform as secure as possible.
Speaker 1: And what about anonymity? Ethical hackers need that sometimes.
Speaker 2: Depending on the engagement rules. Yes, anonymity tools like Tour
Speaker 2: are important. Tour routes your Internet traffic through a volunteer
Speaker 2: network of relays, bouncing it around the globe to obscure
Speaker 2: your original IP.
Speaker 1: Address makes it hard to trace back.
Speaker 2: Very hard. There are even specialized operating systems like Tails,
Speaker 2: a Linux distribution designed for privacy. It forces all network
Speaker 2: traffic through Tour and includes tools like HTTPS everywhere and
Speaker 2: no script to block potential de anonymizing elements.
Speaker 1: But Tour isn't perfect, right, No, it's not foolproof.
Speaker 2: Your Internet service provider can still see that you're connecting
Speaker 2: to the Tour network even if they don't know what
Speaker 2: you're doing inside it, and sophisticated adversaries might try correlation
Speaker 2: attacks trying to match timing patterns of traffic entering and
Speaker 2: exiting the Tour network to try and link them. Anonymity
Speaker 2: is a complex, ongoing challenge.
Speaker 1: It really feels like we've only scratched the surface today,
Speaker 1: even with all this detail.
Speaker 2: Oh, absolutely, the field is vast. We haven't even touched
Speaker 2: on things like software defined radio SDRs SDR. Yeah, using
Speaker 2: relatively cheap hardware and software to receive and analyze radio signals.
Speaker 2: People use it to grab whether satellite images, listen to
Speaker 2: unencrypted police or emergency services, chatter, track aircraft. The NSA
Speaker 2: even released their own SDR tool, red Hawk, to the public.
Speaker 1: Or attacking cellular networks.
Speaker 2: That's another area understanding how cell networks work and how
Speaker 2: tools sometimes called stingrays or IMSI catchers, can mimic cell
Speaker 2: towers to track phones or intercept communications. Obviously, you need
Speaker 2: extreme caution and ethical boundaries, like using a Faraday cage.
Speaker 2: If you were ever experimenting with radio.
Speaker 1: Signals and getting data off completely isolated systems air gaps. Yeah,
Speaker 1: escaping the air gap. There are techniques, often theoretical or
Speaker 1: lab based, using things like ultrasonics, sound light pulses, even
Speaker 1: heat variations to transmit tiny amounts of data from a
Speaker 1: machine with absolutely no network connection. It's fascinating stuff.
Speaker 2: Reverts to engineering software.
Speaker 1: Crucial skill, especially for malware analysis, taking compiled code and
Speaker 1: figuring out what it does.
Speaker 2: Physical hacking tools like those hack five gadgets.
Speaker 1: Right, things like the USB rubber ducky that pretends to
Speaker 1: be a keyboard and types of commands super fast, or
Speaker 1: the Wi Fi Pineapple that acts as a rogue access
Speaker 1: point for man in the middle attacks. Physical access often
Speaker 1: bypasses a lot of digital security.
Speaker 2: Hacking industrial control systems. Stucksnet showed the potential damage there a.
Speaker 1: Stark warning about critical infrastructure security.
Speaker 2: Yeah, and the future quantum computing breaking current encryption. That's
Speaker 2: the long term worry. Petershore's quantum algorithm can in theory
Speaker 2: break RSA encryption relatively easily by factoring large numbers. We
Speaker 2: don't have quantum computers powerful enough yet, but it's driving
Speaker 2: research into new quantum resistant cryptographic methods.
Speaker 1: It really hammers home how and maybe fragile our digital
Speaker 1: world is it?
Speaker 2: Certainly does. You have now seen a glimpse into how
Speaker 2: systems can be analyzed, probed and potentially compromised.
Speaker 1: So the final thought for you, the listener, given this understanding,
Speaker 1: this peak behind the curtain, what new, maybe unseen vulnerabilities
Speaker 1: might exist in the systems you rely on every single
Speaker 2: Day, And perhaps more importantly, how can the knowledge you've
Speaker 2: gained today help you and others start thinking about how
Speaker 2: to better protect them