# Who is Space C4det

### **Hey there,** I'm Julian, my buddies started calling me space cadet so I thought I'd assign myself the identity of Space C4det for my online presence. I've been into computers since ever since I got my hands on my first one, this was when I was 7 years old, my parents purchased an HP Desktop computer with an Intel Pentium processor if I'm remembering correctly. My siblings and I shared this computer between the four of us, it wasn't the greatest experience since we all had different interests and would annoy each other when we wanted some time on the internet. I remember playing games and loosing connection whenever the phone rang, this was because we had AOL Dial-Up. I still remember the day we moved to a different house and with a different house came a whole different Internet Provider and from there AOL Dial-Up was history! I started my first security-related job in April of 2022 as a SOC Analyst. This was shortly after graduating from Western Governors University with my Bachelors of Science in Cybersecurity and Information Assurance! ### Julian's Resume

# eJPT Notes ### [Course Link](https://ine.com/learning/certifications/internal/elearnsecurity-junior-penetration-tester-v2) The eJPTv2 is a thoughtfully crafted certification designed to test you on every phase of the penetration life cycle from assessment methodologies, to host and network auditing, host and network penetration testing, and web application penetration testing. This browser-based, hands-on, exam mirrors real world junior penetration tasks using a methodological approach. Not only does our exam environment feature modern infrastructure, operating systems, and current versions of software, but it also uses innovative technology to make each user’s testing experience unique. # Assessment Methodologies # Information Gathering Information gathering is the first step of any penetration test and is arguably the most important as all other phases rely on the information obtained about the target during the information gathering phase. This course will introduce you to information gathering and will cover the process of performing both passive and active information gathering by leveraging various tools and techniques in order to obtain as much information as possible from a target. ### [Course Link](https://my.ine.com/CyberSecurity/courses/454b33b7/assessment-methodologies-information-gathering) ### Course Instructor: [Alexis Ahmed](https://alexisahmed.com/) #### [LinkedIn](https://linkedin.com/in/alexisahmed) #### [YouTube](https://youtube.com/hackersploit) #### [Twitter](https://twitter.com/hackersploit) #### [GitHub](https://github.com/alexisahmed)


	Introduction To Information Gathering		Introduction To Information Gathering
	Passive and Active Information Gathering		Passive and Active Information Gathering

# Introduction To Information Gathering ## Information Gathering Information gathering is the first step of any penetration test and involves gathering or collecting information about an individual, company, website or system that you are targeting. ### What is the first step in any penetration test that involves gathering or collecting information? * Information Gathering * The more information on your target, the more successful you will be during the latter stages of a penetration test. ### What type of information gathering involves gathering as much information as posible without actively engaging with the target? * Passive Information Gathering ### What type of information gathering involves gathering as much information as possible by actively engaging with the target system? * Active Information Gathering ### What involves utilizing publicly available information or resources to learn more about a website and more? * Passive information gathering ## Passive Information Gathering * Identifying IP Addresses and DNS information * Identifying domain names and domain ownership information * Identifying email addresses and social media profiles * Identifying web technologies being used on target sites * Identifying subdomains ## Active Information Gathering * Discovering open ports or target systems * Learning about the internal infrastructure of a target network/organization * Enumerating information from target systems # Passive and Active Information Gathering ## Passive Information Gathering ### Footprinting **Target: Hackersploit.org** What we are looking for\ IP Addresses:\ IPv4: 172.67.202.99 and 104.21.44.180\ IPv6: 2606:4700:3036::ac43:ca63 and 2606:4700:3031::6815:2cb4\ Directories hidden from search engines: /wp-admin/, /wp-content/uploads/wpo-plugins-tables-list.json\ Names\ Email Addresses\ Phone Number\ Physical Addresses\ Web technologies being used: Use add-on "BuiltWith" to detect what technologies are being used. Obtain IP Address by:\ use host command, use whatis host to learn more about this command ``` host hackersploit.org ``` ``` ┌──(kali㉿kali)-[~] └─$ host hackersploit.org hackersploit.org has address 104.21.44.180 hackersploit.org has address 172.67.202.99 hackersploit.org has IPv6 address 2606:4700:3031::6815:2cb4 hackersploit.org has IPv6 address 2606:4700:3036::ac43:ca63 hackersploit.org mail is handled by 0 _dc-mx.2c2a3526b376.hackersploit.org. ``` Why does this website have two IPv4 Addresses? * The website is behind CloudFlare, which is a Firewall/Proxy * If you ever come across a website using two IPv4 addresses * You're dealing with some sort of proxy **Robots.txt**\ It essentially allows you to specify what folders or what files you don't want search engines to index **sitemap.xml**\ A file that provides search engines an organized way of indexing a website. ``` XML Sitemap Generated by Yoast SEO, this is an XML Sitemap, meant for consumption by search engines. You can find more information about XML sitemaps on sitemaps.org. This XML Sitemap Index file contains 4 sitemaps. Sitemap Last Modified https://hackersploit.org/post-sitemap.xml 2022-12-28 12:26 +00:00 https://hackersploit.org/page-sitemap.xml 2023-02-09 09:12 +00:00 https://hackersploit.org/category-sitemap.xml 2022-12-28 12:26 +00:00 https://hackersploit.org/author-sitemap.xml 2021-01-27 19:55 +00:00 ``` ### **Helpful Addons** **Builtwith** - Web technology profiler tool that allows users to identify what technologies a website is using **Wappalyzer** - A web browser extension and open-source software that uncovers the technologies used on websites. It can detect content management systems, web frameworks, e-commerce platforms, JavaScript libraries, analytics tools, and many other technologies. **Whatweb** - A command-line tool used for website reconnaissance and information gathering. It can be used to detect what technologies a website is using, such as web servers, programming languages, and content management systems. **HTTRack**- This can be used to download a mirror of a website so you can analyze the source code to learn more about the site, ex: find vulnerabilities, get an understanding of the website structure etc ### Whois Enumeration **whois** A query and response protocol that is widely used for querying databases that store the registered users or assignees of an internet resource, such as: * Domain Name * IP Address Block * Autonomous System ``` ┌──(kali㉿kali)-[~] └─$ whois hackersploit.org Domain Name: hackersploit.org Registry Domain ID: 77f8fe62a425487cbefef4bf7e27d2ec-LROR Registrar WHOIS Server: whois.namecheap.com Registrar URL: http://www.namecheap.com Updated Date: 2022-12-22T11:20:08Z Creation Date: 2018-04-05T11:27:07Z Registry Expiry Date: 2024-04-05T11:27:07Z Registrar: NameCheap, Inc. Registrar IANA ID: 1068 Registrar Abuse Contact Email: abuse@namecheap.com Registrar Abuse Contact Phone: +1.6613102107 Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited Registry Registrant ID: REDACTED FOR PRIVACY Registrant Name: REDACTED FOR PRIVACY Registrant Organization: Privacy service provided by Withheld for Privacy ehf Registrant Street: REDACTED FOR PRIVACY Registrant City: REDACTED FOR PRIVACY Registrant State/Province: Capital Region Registrant Postal Code: REDACTED FOR PRIVACY Registrant Country: IS Registrant Phone: REDACTED FOR PRIVACY Registrant Phone Ext: REDACTED FOR PRIVACY Registrant Fax: REDACTED FOR PRIVACY Registrant Fax Ext: REDACTED FOR PRIVACY Registrant Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name. Registry Admin ID: REDACTED FOR PRIVACY Admin Name: REDACTED FOR PRIVACY Admin Organization: REDACTED FOR PRIVACY Admin Street: REDACTED FOR PRIVACY Admin City: REDACTED FOR PRIVACY Admin State/Province: REDACTED FOR PRIVACY Admin Postal Code: REDACTED FOR PRIVACY Admin Country: REDACTED FOR PRIVACY Admin Phone: REDACTED FOR PRIVACY Admin Phone Ext: REDACTED FOR PRIVACY Admin Fax: REDACTED FOR PRIVACY Admin Fax Ext: REDACTED FOR PRIVACY Admin Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name. Registry Tech ID: REDACTED FOR PRIVACY Tech Name: REDACTED FOR PRIVACY Tech Organization: REDACTED FOR PRIVACY Tech Street: REDACTED FOR PRIVACY Tech City: REDACTED FOR PRIVACY Tech State/Province: REDACTED FOR PRIVACY Tech Postal Code: REDACTED FOR PRIVACY Tech Country: REDACTED FOR PRIVACY Tech Phone: REDACTED FOR PRIVACY Tech Phone Ext: REDACTED FOR PRIVACY Tech Fax: REDACTED FOR PRIVACY Tech Fax Ext: REDACTED FOR PRIVACY Tech Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name. Name Server: dee.ns.cloudflare.com Name Server: jim.ns.cloudflare.com DNSSEC: unsigned URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/ >>> Last update of WHOIS database: 2023-02-14T01:42:33Z <<< ``` ### Website Footprinting With Netcraft Netcraft can be used to enumerate information **passively** from a website. Netcraft correlates information such as: * WHOIS * SSL or TLS certs * Web Technologies being used * Name servers This saves you time from doing manual work, as Netcraft provides a lot of information that would otherwise take more time to gather if done manually. Using results from our internet data mining, find out the technologies and infrastructure of any site. Explore hostnames visited by users of the Netcraft extensions. Search by domain or keyword. **Important results given by Netcraft** Validity Period (Certificate) Certificate Issuer/Country Certificate Transparency Country: US Organizational unit: Not Present Subject Alternative Name: sni.cloudflaressl.com, hackersploit.org, \*.hackersploit.org Validity period: From May 11 2022 to May 10 2023 (11 months, 4 weeks, 2 days) SSLv3/POODLE or Heartbleed Vulnerable? No, not according to Netcraft **Web trackers** This tells you what web analytics/trackers are enabled on the site **Site technologies Profiler** Issuing organisation Cloudflare, Inc. Issuer common name Cloudflare Inc ECC CA-3 **Certificate Transparency**

**Sender Policy Framework** A host's Sender Policy Framework (SPF) describes who can send mail on its behalf. This is done by publishing an SPF record containing a series of rules. Each rule consists of a qualifier followed by a specification of which domains to apply this qualifier to. DNSSEC: This ensures personal data such as the owners name, address etc, is all redacted from the WHOIS query. Domain registered through namecheap Confirmed with registrar URL Creation date: 2018-04-05T11:27:07Z Renewed: 2022-12-22 Domain Expiration: 2024-04-05T11:27:07Z ``` `┌──(kali㉿kali)-[~] └─$ whois zonetransfer.me Domain Name: ZONETRANSFER.ME Registry Domain ID: D108500000003513097-AGRS Registrar WHOIS Server: Registrar URL: http://www.meshdigital.com Updated Date: 2022-01-05T10:14:50Z Creation Date: 2011-12-27T15:34:08Z Registry Expiry Date: 2023-12-27T15:34:08Z Registrar Registration Expiration Date: Registrar: Mesh Digital Limited Registrar IANA ID: 1390 Registrar Abuse Contact Email: Registrar Abuse Contact Phone: Reseller: Domain Status: ok https://icann.org/epp#ok Registrant Organization: DigiNinja Registrant State/Province: Routerville Registrant Country: GB Name Server: NSZTM1.DIGI.NINJA Name Server: NSZTM2.DIGI.NINJA DNSSEC: unsigned URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/ >>> Last update of WHOIS database: 2023-02-14T01:45:18Z <<< ` ``` As you can see in this WHOIS query, since DNSSEC is not being used in this webserver, information such as the Registration Organization, State/Province, Country, is not redacted. ### DNS Recon DNS Recon falls under passive information gathering, this is because we are not actively engaging any targets (DNS Servers), we are just gathering information from public sources. We will be looking for information that will provide us with a better understanding as to how the target website or system is configured to run **DNSRecon** DNSRecon is a Python script that provides the ability to perform: Check all NS Records for Zone Transfers. Enumerate General DNS Records for a given Domain (MX, SOA, NS, A, AAAA, SPF and TXT). Perform common SRV Record Enumeration. Top Level Domain (TLD) Expansion. MX: Mail server address NS: Nameserver A: IPv4 Addresses AAAA: IPv6 Addresses TXT: A DNS Record in text format which contains information about a given domain * TXT Records also have information that helps external network servers and services handle outgoing email from your domain. SPF (Server Policy Framework): A type of DNS TXT record commonly used for email authentication. This lists all the servers authorized to send emails from a particular domain * Without SPF records, or other authentication records, an attacker can easily impersonate a sender and trick the recipient into taking action or sharing information they otherwise would not. * SPF records were created because the standard protocol for email (SMTP) does not inherently authenticate the "from" address in an email **DNSRECON command** ``` dnsrecon -d hackersploit.org ``` `-d` indicates we're providing a domain, in this case "hackersploit.org"

In the screenshot above we can see that the Mail server is displayed, this indicates CloudFlare doesn't hide proxy mail server addresses very well. MX: MX \_dc-mx.2c2a3526b376.hackersploit.org 198.54.120.212 ```┌──(kali㉿kali)-[~] └─$ dnsrecon -d zonetransfer.me ``` **DNSDumpster** A FREE domain research tool that can discover hosts related to a domain. Finding visible hosts from the attackers perspective is an important part of the security assessment process. Very similar to DNSRecon, but it has the advantage that the information displayed is organized fantasticly. **What is DNSDumpster**\ A web-based tool used for gathering information about a target domain, including * Its subdomains * IP Addresses * Mail Servers * DNS Records What is DNS Dumpster Commonly used for? * Reconnaissance * Security Auditing * Troubleshooting DNS Configurations In addition, DNSDumpster provides a graphical user interface, and allows users to export data in various formats * It is important to use DNSDumpster ethically and responsibly ### **WAF with wafw00f** *WAF stands for Web Application Firewall* **wafw00f**\ WafW00f is an open source tool used for detecting and fingerprinting web application firewalls (WAFs). **How does WafW00f work?**\ It works by analyzing HTTP responses from a web application and searching for patterns and anomalies that are indicative of the presence of a WAF. WafW00f is often used to test the effectiveness of WAFs and identify potential vulnerabilities in web applications.

### **Subdomain Enumeration With Sublist3r** **What is Sublist3r?**\ Sublist3r is a python-based open source tool used for subdomain enumeration. It works by querying multiple search engines, including Google, Yahoo, and Bing, as well as other sources such as certificate transparency logs, to generate a list of subdomains associated with a target domain Sublist3r is commonly used to identify potential attack vectors, such as unsecured subdomains, misconfigured DNS records, and other security vulnerabilities. This tool should be used ethically and responsibly, as subdomain enumeration can be used for malicious purposes.

### **Google Dorking** Google Dorking, also known as Google hacking or Google-fu, is the practice of using advanced Google search techniques to locate sensitive or confidential information that is not easily accessible through simple searches. **Examples**\ Limit search results to a domain, * site:ine.com Limit results to URL: inurl:\[word] * inurl:admin (ine.com/admin.php) Limit results to subdomains: site:\*.\[domain] * site:\*.ine.com Limit results to site title: intitle:\[word] * intitle:admin Limit results to file type: filetype:\[file type] * filetype:pdf Limit results to indexes: intitle: index of * This results with indexes of a website Find older cached versions of a website: cache:\[domain] * cache:ine Waybackmachine or Archive.org, has snapshots of older versions of websites ExploitDB Google Hacking Database * A database of google dorks that have found useful info such as users, passwords, etc. ### Email Harvesting with theHarvester TheHarvester, a tool similar to Sublist3r, uses OSINT tools to find emails that belong to a domain that may be publicly available or found by crawling a leaked database. ``` ┌──(spacec4det㉿Space)-[~] └─$ theHarvester -d proton.me -b all ******************************************************************* * _ _ _ * * | |_| |__ ___ /\ /\__ _ _ ____ _____ ___| |_ ___ _ __ * * | __| _ \ / _ \ / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__| * * | |_| | | | __/ / __ / (_| | | \ V / __/\__ \ || __/ | * * \__|_| |_|\___| \/ /_/ \__,_|_| \_/ \___||___/\__\___|_| * * * * theHarvester 4.2.0 * * Coded by Christian Martorella * * Edge-Security Research * * cmartorella@edge-security.com * * * ******************************************************************* [*] Target: proton.me ``` ## **Leaked Password Databases** ### [HaveIBeenPwned](https://haveibeenpwned.com) ## Active Information Gathering ### **DNS Zone Transfers** DNS or Domain Name System, is used to translate human-readable domain names into IP Addresses that are used by computers to identify and communicate with each other over the internet. **How does DNS work?**\ DNS works by maintaing a distributed database of domai names and their corresponding IP Addresses. When a user types in a domain name in their web browser, the browser sends a DNS query to a DNS server, which then looks up the corresponding IP Address and returns it to the browser. **How do DNS Zone Transfers work?**\ DNS Zone Transfers are a mechanism used to replicate DNS databases between primary and secondary DNS servers. When a primary DNS server is updated with new DNS resource records, it notifies secondary DNS servers that are configured to replicate the zone. The secondary DNS servers then request a copy of the updated DNS database from the primary DNS server using a zone transfer. ### **DNS Records**

### **DNS Interrogation** DNS Interrogation is the process of enumerating DNS Records for a specific domain. It can be used to diagnose and troubleshoot DNS-related issues, such as identifying the cause of DNS resolution failures or misconfigured DNS records. It can also be used to perform reconnaissance and obtain information about a target network or domain. Therefore, it is important to ensure that proper security measures are in place to protect against unauthorized DNS interrogation or exploitation. DNSDumpster Result: zonetransfer.me

**DNSDumpster** Result: zonetransfer.me

**DNSEnum**

## Nmap Demo ### **Host Discovery with NMap** Finding your Home network IP and subnet.

```` ┌──(spacec4det㉿Space)-[~] └─$ sudo nmap -sn 10.0.0.0/24 [sudo] password for spacec4det: Starting Nmap 7.93 ( https://nmap.org ) at 2023-02-18 21:00 EST Nmap scan report for 10.0.0.17 Host is up (0.077s latency). Nmap scan report for 10.0.0.41 Host is up (0.12s latency). Nmap scan report for 10.0.0.48 Host is up (0.051s latency). Nmap scan report for 10.0.0.59 Host is up (0.11s latency). Nmap scan report for 10.0.0.62 Host is up (0.12s latency). Nmap scan report for 10.0.0.72 Host is up (0.075s latency). Nmap scan report for 10.0.0.97 Host is up (0.096s latency). Nmap scan report for 10.0.0.126 Host is up (0.11s latency). Nmap scan report for 10.0.0.165 Host is up (0.0084s latency). Nmap scan report for 10.0.0.175 Host is up (0.038s latency). Nmap scan report for 10.0.0.195 Host is up (0.12s latency). Nmap scan report for 10.0.0.209 Host is up (0.12s latency). Nmap scan report for 10.0.0.222 Host is up (0.077s latency). Nmap scan report for 10.0.0.236 Host is up (0.098s latency). Nmap scan report for 10.0.0.251 Host is up (0.00049s latency). Nmap scan report for 10.0.0.159 Host is up. Nmap done: 256 IP addresses (17 hosts up) scanned in 2.77 seconds.``` ```` Using the `-sn` argument, `nmap -sn 10.0.0.0/24`\ Using nmap with the -sn switch tells Nmap to perform a "ping scan" of the IP addresses in the range `10.0.0.0` to `10.0.0.255` and report which hosts are up and running, **without performing a port scan**. Nmap Results

**Netdiscover**\ An open-source network address discovery tool that is used to discover hosts and devices on a local area network (LAN). It actively sends ARP requests and listens to ARP replies to identify devices and their associated MAC addresses, IP addresses, and vendor information Netdiscover can be useful for network administrators who want to identify all the devices on a network or identify unauthorized devices. It can also be used to scan for vulnerable devices on a network. **How do Netdiscover and Nmap differ?** **Nmap:** * A network exploration tool that scans a network for hosts, services, and vulnerabilities. * Conducts a comprehensive port scan and identifies the services running on those ports. * Can perform a variety of advanced techniques such as OS detection, version detection, and service enumeration. **Netdiscover:** * A network exploration tool that scans a network for live hosts and provides basic information such as MAC address and manufacturer. * Uses ARP (Address Resolution Protocol) to discover live hosts on a network. * Does not provide detailed information about the services running on hosts. **Nmap Lab**\ \ Here we ran `ip a` to find the IP Address of the Kali Machine we are using to perform Nmap scans.

We then used the ping command to determine if our target host is up or not.

### Nmap Port Scan We then ran our first nmap scan against our target `10.4.16.154` which determined that the target was blocking ping probes, which indicated we needed to use `-Pn` , this switch tells Nmap to do no ping, which skips the host discovery stage altogether. ![](https://i.imgur.com/s81RE5L.png) In the screenshot above, we can see that now nmap was able to discover the target host's open ports to identify the running services and applications. Then we performed the same scan but added the `-sV` switch (Version detection), which tells Nmap to send a series of probes to determine the versions of the services and applications running. ![](https://i.imgur.com/ih7Bir3.png) # Footprinting & Scanning # Enumeration # Vulnerability Assessment # Blue Team Labs Online Lab Write-up by Julian Cadavid A gamified platform for defenders to practice their skills in security investigations and challenges covering; Incident Response, Digital Forensics, Security Operations, Reverse Engineering, and Threat Hunting. # Remote Desktop Protocol (RDP) ## **Scenario** > An interplanetary illegal dealer was using a remote machine to store all his Trade secrets. Intelligence team of the solar system identified that the dealer was from Earth. When investigated, it was found that the dealer was maintaining a clean machine in his home and storing all his trade secrets in a remote machine via RDP. Unfortunately, the remote machine was destroyed. The only source of evidence we have is the forensic disk image of the clean machine. Show your forensic skills. Help the investigators in cracking the trade secrets like the dealer’s crypto wallet address, his customer details etc. Note: This is a work of fiction. Names, characters, places and incidents either are products of the author's imagination or are used fictitiously. ### Questions > Question 1) Submit the USERNAME of the dealer's machine from which the forensic disk image was created (Format: username)*(2 points)* > > *💡* **Answer:** `spiderman` To begin this question, I initiated the machine. Upon logging in, I glanced around the desktop icons looking for what I was going to look at first, since i'm not well versed in digital forensics i'm trying to improvise. I first opened up the Evidence folder and saw there was a text file named `RDPCache.ad1` since this lab is about an actor storing all his trade secrets in a remote machine via RDP, this appeared interesting to me. The text file was created by AccessData FTK imager, AccessData FTK is a computer forensics software, it scans a hard drive looking for various information. An example of what it can locate is deleted emails, it can also scan a disk for text strings to sue them as a password dictionary to crack encryption. From looking at the text file, it seems the source disk for the information captured by the FTK comes from `C:\Users\`**`spiderman`**`\Desktop` This tells me this is the username of the dealer's machine. ![](https://1432198867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fsngedy7Q6PXyOr2kzcDl%2Fuploads%2FNwvJ1BDNPQFu7gbpGuID%2FUntitled%202.png?alt=media\&token=752b4d07-ab29-4898-8724-da2713c8f0b1) # Phishy V1 BTLO ### **Scenario** > You have been sent a phishing link - It is your task to investigate this website and find out everything you can about the site, the actor responsible, and perform threat intelligence work on the operator(s) of the phishing site. 💡Warning: The website and kit you see in the lab are REAL. Exercise caution when interacting with the malicious website and do not enter any sensitive information ### Questions > 1\. The HTML page used on securedocument.net is a decoy. Where was this webpage mirrored from, and what tool was used? (Use the first part of the tool name only)*(4 points)* 💡**Answer**: `61.221.12.26/cgi-sys/defaultwebpage.cgi, HTTrack` To figure this part out, we navigated to securedocument.net/secure. This part was a little confusing for me and I had to use a write-up because I wasn’t sure how to get here, if I had access to DirBuster, it would’ve been the first tool I would’ve used in order to bruteforce and find directories. ![](https://1432198867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fsngedy7Q6PXyOr2kzcDl%2Fuploads%2F716n7mUDd0R3HCtHd86j%2FScreen_Shot_2022%2003%2007_at_4.55.57_PM?alt=media) We can see that from here, the Parent Directory is available, the Phishing kit is also here, `0ff1cePh1sh.zip`, we will be using this later. Clicking on Parent Directory redirected us to `http://securedocument.net/cgi-sys/` We viewed the page source and found where this webpage was mirrored from as well as what tool was used. ![](https://1432198867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fsngedy7Q6PXyOr2kzcDl%2Fuploads%2FcyKAmBXB1KokzJ5uErQV%2FScreen_Shot_2022%2003%2007_at_5.01.45_PM?alt=media) Here we can see it is mirrored from `61.221.12.26/cgi-sys/defaultwebpage.cgi` The tool used is `HTTrack Website Copier` > 2\. What is the full URL of the background image which is on the phishing landing page?*(3 points)* 💡Answer: [`http://Securedocument.net/secure/L0GIN/protected/login/portal/axCBhIt.png`](http://securedocument.net/secure/L0GIN/protected/login/portal/axCBhIt.png) To find the URL of the background image, all we have to do is right click the image itself, behind the login form and inspect element, from there navigate to “Style Editor”, I first thought we could find the URL by just using inspect element on the image itself, but that didn’t work, I looked around the page source and the image couldn’t be found anywhere. My next step was to check CSS. From there, we found the styling sheet `style.css` , the first rule we can see is the body rule. ![](https://1432198867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fsngedy7Q6PXyOr2kzcDl%2Fuploads%2FTdbV5jBG86c9s7bWNptv%2FScreen_Shot_2022%2003%2007_at_5.12.02_PM?alt=media) From this rule, we can see what url is used for the background, `axCBhIt.png` If we add this to the URL, `http://securedocument.net/secure/L0GIN/protected/login/portal/axCBhIt.png` We are redirected to the image itself, I first got the answer wrong because I didn’t realize the 0 in `L0GIN`, so don’t make the same mistake I did! > 3\. What is the name of the php page which will process the stolen credentials?*(3 points)* 💡**Answer: `jeff.php`** The way we figure this out is by looking at the page source again, we can see that the login form has a form action, ![](https://1432198867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fsngedy7Q6PXyOr2kzcDl%2Fuploads%2Fy2hpb9aUWqkbKPwaS57n%2FScreen_Shot_2022%2003%2007_at_5.19.25_PM?alt=media) We can see it here, `

` This uses a HTTP POST request method. > The HTTP POST method requests the web server accept the data enclosed in the body of the POST message. HTTP POST method is often used when submitting login or contact forms or uploading files and images to the server. When the victim clicks the download button, the POST method will be used, this also executes the form action, jeff.php, which will process the credentials entered in the login form. ![](https://1432198867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fsngedy7Q6PXyOr2kzcDl%2Fuploads%2FM3sXBAQcbVniqQuQ9dLl%2FScreen_Shot_2022%2003%2007_at_5.25.44_PM?alt=media) This is the PHP script, Jeff.php > 4\. What is the SHA256 of the phishing kit in ZIP format? (Provide the last 6 characters)*(3 points)* 💡**Answer:** `fa5b48F` For this question we will be using the file we found earlier, `0ff1cePh1sh.zip` To get the SHA256 hash of the phishing kit we will be using the sha256sum linux command, sha256sum: > Print or check SHA256 (256-bit) checksums. With no FILE, or when FILE is -, read standard input. 💡[`https://linux.die.net/man/1/sha256sum`](https://linux.die.net/man/1/sha256sum) To use this command, launch the terminal, and cd (Change Directory) to the directory where you downloaded the Phishing kit. In my case, the default downloads folder is `/home/ubuntu/Downloads` Enter these two commands in to the terminal, one by one. > cd /home/ubuntu/Downloads > sha256sum 0ff1cePh1sh.zip The terminal responds with the SHA256 hash of the zip file. ![](https://1432198867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fsngedy7Q6PXyOr2kzcDl%2Fuploads%2FrxdbRQLTNdiXWN8TBsUr%2FScreen_Shot_2022%2003%2007_at_5.39.41_PM?alt=media) An alternative to using cd to navigate directories is going to the directory yourself using the file manager and right clicking the directory and clicking `“Open Terminal Here”` ![](https://1432198867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fsngedy7Q6PXyOr2kzcDl%2Fuploads%2Ffq2cJTSn67PC7q4OC62t%2FScreen_Shot_2022%2003%2007_at_5.36.11_PM?alt=media) > 5\. What email address is setup to receive the phishing credential logs?*(3 points)* > > *💡***Answer:** `boris.smets@tfl-uk.co` > > This can be found by looking at the PHP script from earlier (jeff.php). ![](https://1432198867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fsngedy7Q6PXyOr2kzcDl%2Fuploads%2FLxpe1cwwOZeNdfFwKWW9%2FScreen_Shot_2022%2003%2007_at_5.25.44_PM?alt=media) Here we can see the recipient, this script has this email setup to receive the phishing credential logs. You can find it under "recipient". > 6\. What is the function called to produce the PHP variable which appears in the index1.html URL? > > **💡Answer:** `getTime()` Open the `index.html` file, you will notice a javascript function `(getTime)` is ran which produces the timestamph in PHP. ![](https://1432198867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fsngedy7Q6PXyOr2kzcDl%2Fuploads%2FupwVRCF7Z6W0GvTgIgSE%2FScreen%20Shot%202022-03-07%20at%207.04.25%20PM.png?alt=media\&token=4765ddb7-3883-4a9d-8557-56251a718f31) > What is the domain of the website which should appear once credentials are entered?*(3 points)* > > 💡**Answer:** `Office.com` ![](https://1432198867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fsngedy7Q6PXyOr2kzcDl%2Fuploads%2FLxpe1cwwOZeNdfFwKWW9%2FScreen_Shot_2022%2003%2007_at_5.25.44_PM?alt=media) Here we can see that the script that runs after the login form is submitted is at the end of the script, `https://www.office.com` will be the result. > 7\. There is an error in this phishing kit. What variable name is wrong causing the phishing site to break? (Enter any of 4 potential answers)*(3 points)* > > *💡***Answer:** `userrr` ![](https://1432198867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fsngedy7Q6PXyOr2kzcDl%2Fuploads%2FWu7rCM6qVG0g7ZqxukAV%2FScreen%20Shot%202022-03-07%20at%207.12.53%20PM.png?alt=media\&token=ec886a31-a71a-400e-b216-24145e0e293a) This can be found by looking at the page source, this causes the phishing site to break. There are apparently 3 other potential answers but this was the first one i spotted, as well as `passss` being used instead of `pass` # BITS (IN PROGRESS) https\://blueteamlabs.online/home/investigation/33 ## Scenario > Using BitsParser from FireEye to retrieve BITS jobs, can you help the SOC identify persistence actions conducted on a compromised host? **Read the "READ ME!.txt" file in the Investigation folder on the Desktop.** \ > \ > **Reading Material:**\ > [FireEye Blog Post](https://www.mandiant.com/resources/attacker-use-of-windows-background-intelligent-transfer-service)\ > [BitsParser GitHub Page](https://github.com/fireeye/BitsParser) BITS is a living off-the-land binary that is used by software such as web browsers to periodically download updates. It can however be abused for lateral movement, tool deployment, and persistence. To start this lab we will refer to the BitsParser GitHub Page for documentation on how to use it. {% hint style="info" %} BitsParser is a Python 3 script that can parse Windows Background Intelligent Transfer Service database files and extract job and file information. It supports both the original custom database format as well as the ESE database format used on Windows 10 systems. {% endhint %} I also opened up the Investigation folder on the desktop and found a `READ ME!` file. This file contains information relevant to the lab, including what BITS as well as some key points relating to BITS. We will be using an administrator-level Command Prompt since to execute BitsParser.py, you need administrator privileges. To do this we right click the cmd file and select Run as Administrator Before the BitsParser is able to retrieve the BITS jobs, the BITS service that is currently running needs to be stopped. To do this we can launch the Task Manager by simply right clicking the taskbar and selecting Task Manager. Open the Services tab and located the BITS service, which we can see is running under the netscvs group. Right click it and click Stop. ![](https://1432198867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fsngedy7Q6PXyOr2kzcDl%2Fuploads%2Fug429cQViocTO6Gqgzy2%2FScreen%20Shot%202022-03-08%20at%2010.12.50%20PM.png?alt=media\&token=c1fdedd0-e327-4c38-82ff-ba1634fd67c1) We will now be using the cmd (Remember to run as an administrator). Use the command cd to change the directory to the directory containing the BitsParser python script. Run the following command: `cd C:\Users\BTLOTest\Desktop\Investigation\BitsParser-master` Entering the `dir` command shows the contents of the BitsParser-master folder. Here we can see the `BitsParser.py` python script. To run this script, enter this command in to the cmd: `python BitsParser.py --carveall > output.txt` The `--carveall` flag will provide more information. The script is also known to not properly output the results when using their `-o filename` flag, this is why we used `> output.txt` instead. ### Questions {% hint style="info" %} Question 1) A popular GitHub Repo for Windows privilege escalation is WinPEAS. Can you find any file downloads for winPEAS.bat in the BitsParser output? What is the associated job name? (Format: BITSJobName)*(3 points)* 💡Answer: **privesctools** {% endhint %} After the command is done running, open the `output.txt` file which should be in same folder as the python script we just ran. You can also open it using cmd by entering the command `"output.txt"`, be sure to include the quotation marks. Here we can see different jobs were carved, we are looking for the job associated with winPEAS.bat, press `ctrl+f` and type in `winPEAS.bat` ![](https://1432198867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fsngedy7Q6PXyOr2kzcDl%2Fuploads%2FCYrKkblwuJe8RrWFPm9S%2FScreen%20Shot%202022-03-08%20at%2010.32.25%20PM.png?alt=media\&token=d6d86a32-4345-41c4-9a90-a4b1cd7bf6ab) Here we can see winPEAS.bat was downloaded, we know this because by looking at the "`JobType"`, we can see the value is "`download"`. We also see `"JobName": "privesctools"`, there is our answer! {% hint style="info" %} Question 2) What is the Creation Time of this job? (Format: YYYY-MM-DDTHH:MM:SSZ)*(3 points)* *💡*Answer: **2022-01-07T13:32:19Z** {% endhint %} To get this answer, we are still using the previous text file `output.txt` scroll down below and you will find the `"CreationTime": "2022-01-07T13:32:19Z"`field which gives us our answer. ![](https://1432198867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fsngedy7Q6PXyOr2kzcDl%2Fuploads%2FSgwjmEJvgNrprUqUo6K6%2FScreen%20Shot%202022-03-08%20at%2010.38.01%20PM.png?alt=media\&token=536dea22-95b4-4aff-860d-36bf3ef7e354) {% hint style="info" %} Question 3) BITS can be used to download files from other systems. What is the IP address that originally hosted the file downloaded to the victim machine? (Format: X.X.X.X)*(3 points)* *💡*Answer: **10.0.12.228** {% endhint %} To solve this question, the same output.txt file was used, the IP address that originally hosted the file downloaded to the victim machine can be found by looking at the `"SourceURL"` field, this field identifies the source the file **winPEAS.bat** was requested from, the source being **"10.0.12.228"** ![](https://1432198867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fsngedy7Q6PXyOr2kzcDl%2Fuploads%2FcLJOEhe65haJiYArcXrK%2FScreen%20Shot%202022-03-11%20at%208.31.12%20PM.png?alt=media\&token=0b2112df-fb9c-4763-b904-bff87164f8d2) {% hint style="info" %} Question 4) What is the folder and filename used when this file was downloaded to the victim machine? (Format: \\\folder\\\file.extension)*(3 points)* *💡*Answer: **\\\Music\\\winPEAS.bat** {% endhint %} Using the same output.txt file, this question is fairly easy and can be found by looking at the `"DestFile"` field above the `"SourceURL"` field from the previous question. {% hint style="info" %} Question 5) Is there any evidence of other files that include the string "winPEAS"? What is the original filename? Make sure the DownloadByteSize or TransferByteSize is greater than 0 to identify a successful download/transfer. (Format: filename.extension)*(4 points)* *💡*Answer: **winPEASx64.exe** {% endhint %} To solve this question, since it's asking for evidence of other files that contain the string "winPEAS", all i did was use the search function to look for instances of "winPEAS" in the output.txt file. {% hint style="info" %} Question 6) What is the folder and filename used when this second file was downloaded to the victim machine? (Format: \\\folder\\\file.extension)*(3 points)* Answer: **\\\Music\\\WindowsUpdater.exe** {% endhint %} To solve this question, we used to same step as question number four. # TCM Security Notes # Viewing, Creating, and Editing Files echo can be used to write to a file i.e echo "hey" > hey.txt To append to hey.txt echo "Hey again dude" **>>** hey.txt touch newfile.txt can also be used to create a file na # Users and Privileges Looking at the screenshot a **"-"** means its a file if we se a "d" it is a directory rwxr **R**ead **W**rite E**x**ecute When doing pentesting, we're looking for a folder we can drop files in a directory that has full permissions i.e the /tmp/ folder on Linux **chmod** this command can be used to change permissions 777 = full read write chmod 777 hello.txt will change the permissions of hello.txt to full read/write Add a new user command **adduser** adduser john cat /etc/passwd to find new users added, this file contains all the users /etc/shadow contains the passwords switch users command **su** su john sudoers file contains users with root access # sudo and other commands Super user do Run this command as a higher user, basically root. To run the terminal as root **sudo su -** This command switches your permissions to root, which makes it so that you don't have to keep using **sudo** **pwd command** this stands for present working directory to change directory we use **cd** to go backwards, we use **cd ..** **ls command** You can also ls /folder/ to display the contents of that folder without navigating to it (cd) To create a new directory use **mkdir** To remove a directory use **rmdir** To display hidden folders we can use **ls -la** Most hidden folders start with . i.e .cache, .config To copy files, use cp test.txt i.e cp test.txt Downloads/ This copies test.txt to /Downloads/ To move files, use mv test.txt Downloads/ To find a file, you can use **locate bash** use updatedb frequently To change a password **passwd** enter this command Instructions for any command, most commands have it **man** i.e ***man ls*** ping a number of times instead of unlimited ping ip **-c** # The OSI Model Pneumonic **P**hysical (Data cables, Cat6 for example) **D**ata Link (MAC Addresses, Switching, **N**etwork (IP Addresses, Routing) **T**ransport (TCP, UDP) **S**ession (session management) **P**resentation (WMV, JPEG, MOV, Media) **A**pplication (HTTP, SMTP, FTP) Please do not throw sausage pizza away When we say, my home router is a layer 2,3 It does both routing and switching When we receive data, it goes from layer 1 to 7 When we transmit data, it goes from layer 7 to 1 When we're troubleshooting, always start with the physical and go down # Scripting with Bash cat ip.tx | grep "64 bytes" | cut -d " " -f 4 grep searches for results that have 64 bytes in the line cut -d -d is used as a delimiter if -d option is used then it considered space as a field separator or delimiter this will result in the terminal outputting to get rid of the **:** cat ip.txt | grep "64 bytes" | cut -d " " -f 4 | tr -d ":" # TCP, UDP, and the Three way Handshake **TCP (Transmission Control Protocol)** Connection oriented protocol **UDP (User Datagram Protocol)** Connection-less protocol TCP is better used for reliability UDP is better used for stuff like DNS, Streaming, Vo-IP **Scanning is important** Most commonly scanned protocol **(TCP)** **Three-way Handshake** SYN (hello) SYN ACK (response, hey SYN) ACK (good to go, handshake established) To connect to port 443 on a website SYN packet is sent to the website (Hey i want to connect to you on port 443) If port 443 is open and available for connection Web server responds with SYN ACK When you want to establish connection, ACK is sent # Common Network Commands **ifconfig iwconfig** (wireless) ifconfig is becoming deprecated the new and improved version is **ip** ip n (arp table) ip r (routing table) **arp** associate IP addresses with MAC addresses After I pinged the kali box using my macos machine, my macos machine's IP is now listed when we used arp -a **netstat** shows you active connections running on your machine Comes in handy to see if a machine is talking to somebody else **route** this command prints out your routing table # Installing and Updating Tools To update your system (Linux) **apt update && apt upgrade** && means **also** To grab a tool use apt install **tool** apt install python-pip to clone a github repo git clone **url** ctrl+shift+v to paste in terminal # IP Addresses **Layer 3** IP Addresses **Layer 2** MAC Addresses, identified as ether when using ifconfig. These can be thought of as physical addresses. **Switches communicate over this physical address.** This is how switches determine what device is what. Anything that uses a network interface will have a MAC Address.