system hacking

types of password attacks

non-electronice attacks
active online attacks
passive online attacks
offline attack
====================

active online attacks

trojan/spyware/keylogger/usb drive
dictionary
brute forcing
rule based attack
Hash injection attack
===========================

default passwords
switches routers hubs

online tools to search default passwords
====================

passive online attack: wire sniffing
attackers run packet sniffer tools
MITM and replay attack
=====================

offline attack:
rainbow table attack === rtgen and winrtgen
compare the hashes
easy to recover
offline attack:  distrubuted network attack
elcomsoft  : distrubuted password recovery

microsoft authentication
SAM

NTLM authentication == NTLM auth process
LM authentication
kerbros authentication

how hash passwords are stored in windows

SAM

C:\windows\sysytem32\config\sam
password salting
pwdump7 and fgdump

password cracking tools
L0phtcrack
ophcrack
cain and abel
rainbow crack
john the ripper
windows password cracker
========================

types of privilege escalation

veritical
horizontal

DLL hijacking
==================
defend against privilege escalation
=================================

restrict the interactive logon privilege
use encryption
run users and applications on the least

privileges
implemention multi factor authentication and

authorization

debugging
patch the system
===============================

executing applications

owing the system

gain unauthorized access == system resources
crack the password
capture the screenshots
install backdoor

key loggers
backdoors
spyware
crackers
==============================


executing applications
remote exec == remotely install applications

scripts, execute programs
modify registry, change, local admin passwords
disable local accounts
copy/update/del the files and folders

=======================
PDQ deploy==
is a software depyment tool  that allows
admin to silently install almost any application

or patch

remote appl== dameware
===========================

keyloggers
hardware and software key loggers

hardware key loggers
1.keystorke loggers
2.pc/bios
3.keyboard
4.external

external
1. ps/2
2.
acoustic/cam
bluetooth
wifi
====================

software

1. application
2.kernel
3.hypervisor
4.grabbing based
===============================

========================

spyware  == hidden application===its like

throjan
======================
spytech spyagent
usbspy
audiospy  == voice recoder and sound recorder
========================

defend
1.popup blocker
2.install anti spyware,antivirus
3.install firewall software and anti keylogger

software
4.recognize phishing emails and delete them
5.change password frequently
6.avoiding opening junk emails
7.dnt click on doudful mail. and sites
8.key stroke interference software
9.scan the files before installing the files
10.use windows on screen keyboard
11. install host based IDS
12.virtual keyborad
13. anti key logger : zemana anti logger
14. check task manager
15. outbond firewall
16.update antivirus definatins
17..super antispyware
18.dnt open public sites
dnt use pop-up blocker
========================
hidding files
rootkits

wrapping it in special package like games
launching zero day atack


types of rootkits

hypervisor level rootkit
hardware/firmware rootkit
kernel level
boot loader level
application level
library level
rootkit == avatar,necurs,azazel,zero access
=======================================

=======================

detecting rootkits

RUN DIR /S/B/AH
DIR /S/B/A-H

BOOT INTO CLEAN

DIR /S /B /AH
DIR /S /B /AH

DIR /S /B/A-H
WINDIFF
check kernal memory dump

=================

ntfs data stream
file integrity checker
stream armor -- applicaion
=====================
steganography
image  == quick stego
bit insterion
white space
document,video,audio,deepsoundfolder
spam email
masking and filtering
algorithms and tranformation
==============================

clearing track







































Comments

Post a Comment

Popular posts from this blog

Siem architecture

What is SIEM?   Security Information and Event Management solutions are a combination of the formerly disparate product categories of SIM (security information management) and SEM   (security event management). SIEM technology provides real-time analysis of security alerts generated by network hardware and applications. The objective: To help companies respond to attacks faster and organize mountains of log data. Security Information and Event Management (SIEM) technologies take part in a crucial role in addressing the compliance, efficiency, and security needs of an enterprise. The central part of SIEM technologies is the ability to collect security data from all the critical assets on a network and present that data as actionable information via a single interface. SIEM solutions come as software, appliances, or managed services. Increasingly, SIEM solutions are being used to log security data and generate reports for compliance purposes.     SIEM S...
Read more

ESXI REMOVE ALL SNAPSHOTS HANGS AT 99%

Image
Check and make sure that the process is actually stuck and not just taking a very long time. To do this, follow these steps: 1. Make sure SSH service is running on the ESXi host Navigate to configuration -> security profile -> services -> Click on Properties Choose the ‘SSH’ service, ‘Options’, and click ‘Start’ Once SSH is enabled, connect to the ESXi host using your favorite ssh client. 2. Run ->   vim - cmd  vmsvc / getallvms Find the vmid of the virtual machine, in this case its 20. 3. Now run ->   vim - cmd  vmsvc / get . tasklist   20 <-   this is the # of the vm from above 4. Find the removeallsnapshots task # then run: vim - cmd  vimsvc / task _ info   185720854  <- this # will be different for you If you see:   “The object has already been deleted or has not been completely created”  or similar, your snapshot removal is probably frozen, but in order to be sure, let’s loo...
Read more

SharesFacebookTwitterGoogle+PinterestEmailSumoMe VMware ESX – “Unable to access a file since it is locked

Image
After transferring and/or trying to restart a VM in ESX you may be presented with the error message “Unable to access a file since it is locked”. Now what you need to do is work out what is actually locking this file and then (unsurprisingly) find a way to unlock it. Generally the problem will be caused by one of three things. 1.  Process Lock:  There is a process on the ESX server that still has hold of a file(s) used by the VM.  This is one of the most common causes.  To resolve this there have been a couple of good VMware Forum postings  here  and  here  that have been consolidated to  this useful posting over  at  GabesVirtualWorld.com   (*Note: It is worth checking out the comment by Kent at the bottom of the posting).  Also, check out Tecumseh’s posting  here . 2.  Disk Naming Conflict:  Two or more disks with the same VMDK name. This can be caused by another disk with the same VMDK file name...
Read more