Oficina Mental

JR

Are you tired of reading endless news stories about ethical hacking and not really knowing what that means? Let's change that!

This Post is for the people that:

Have No Experience With Cybersecurity (Ethical Hacking)
Have Limited Experience.
Those That Just Can't Get A Break

OK, let's dive into the post and suggest some ways that you can get ahead in Cybersecurity.

I receive many messages on how to become a hacker. "I'm a beginner in hacking, how should I start?" or "I want to be able to hack my friend's Facebook account" are some of the more frequent queries. Hacking is a skill. And you must remember that if you want to learn hacking solely for the fun of hacking into your friend's Facebook account or email, things will not work out for you. You should decide to learn hacking because of your fascination for technology and your desire to be an expert in computer systems. Its time to change the color of your hat 😀

I've had my good share of Hats. Black, white or sometimes a blackish shade of grey. The darker it gets, the more fun you have.

If you have no experience don't worry. We ALL had to start somewhere, and we ALL needed help to get where we are today. No one is an island and no one is born with all the necessary skills. Period.OK, so you have zero experience and limited skills…my advice in this instance is that you teach yourself some absolute fundamentals.

Let's get this party started.

What is hacking?

Hacking is identifying weakness and vulnerabilities of some system and gaining access with it.

Hacker gets unauthorized access by targeting system while ethical hacker have an official permission in a lawful and legitimate manner to assess the security posture of a target system(s)

There's some types of hackers, a bit of "terminology".
White hat — ethical hacker.
Black hat — classical hacker, get unauthorized access.
Grey hat — person who gets unauthorized access but reveals the weaknesses to the company.
Script kiddie — person with no technical skills just used pre-made tools.
Hacktivist — person who hacks for some idea and leaves some messages. For example strike against copyright.

Skills required to become ethical hacker.

Curosity anf exploration
Operating System
Fundamentals of Networking

*Note this sites

Continue reading

JR

This blog based on two major concepts:

Understand password-cracking techniques
Understand different types of passwords

The simplest way to crack the passwords

The first step is to access the system is that you should know how to crack the password of the target system. Passwords are the key element of information require to access the system, and users also selects passwords that are easy to guess such as mostly people has a passwords of their pet's name or room number etc to help them remember it. Because of this human factor, most password guessing is successful if some information is known about the target. Information gathering and reconnaissance can help give away information that will help a hacker guess a user's password.

Once a password is guessed or cracked, it can be the launching point for escalating privileges, executing applications, hiding files, and covering tracks. If guessing a password fails, then passwords may be cracked manually or with automated tools such as a dictionary or brute-force method.

Types of Passwords

Only numbers
Only letters
Only special characters
Letters and numbers
Only letters and special characters
Numbers, letters and special characters

A strong password is less susceptible to attack by a hacker. The following rules, proposed by the EC-Council, should be applied when you're creating a password, to protect it against attacks:

Must not contain any part of the user's account name
Must have a minimum of eight characters
Must contain characters from at least three of the following categories:
- Non alphanumeric symbols ($,:"%@!#)
- Numbers
- Uppercase letters
- Lowercase letters

A hacker may use different types of attacks in order to identify a password and gain further access to a system. The types of password attacks are as follows:

Passive Online

Eavesdropping on network password exchanges. Passive online attacks
include sniffing, man-in-the-middle, and replay attacks. Moreover, a passive online attack is also known as sniffing the password on a wired or wireless network. A passive attack is not detectable to the end user. The password is captured during the authentication process and can then be compared against a dictionary file or word list. User account passwords are commonly hashed or encrypted when sent on the network to prevent unauthorized access and use. If the password is protected by encryption or hashing, special tools in the hacker's toolkit can be used to break the algorithm.

Another passive online attack is known as man-in-the-middle (MITM). In a MITM attack, the hacker intercepts the authentication request and forwards it to the server. By inserting a sniffer between the client and the server, the hacker is able to sniff both connections and capture passwords in the process.

A replay attack is also a passive online attack; it occurs when the hacker intercepts the password en route to the authentication server and then captures and resend the authentication packets for later authentication. In this manner, the hacker doesn't have to break the password or learn the password through MITM but rather captures the password and reuses the password-authentication packets later to authenticate as the client.

Active Online

Guessing the Administrator password. Active online attacks include auto-
mated password guessing. Moreover, The easiest way to gain administrator-level access to a system is to guess a simple password assuming the administrator used a simple password. Password guessing is an active online attack. It relies on the human factor involved in password creation and only works on weak
passwords.

Assuming that the NetBIOS TCP 139 port is open, the most effective method of breaking into a Windows NT or Windows 2000 system is password guessing. This is done by attempting to connect to an enumerated share ( IPC$ or C$ ) and trying a username and password combination. The most commonly used Administrator account and password combinations are words like Admin, Administrator, Sysadmin, or Password, or a null password.
A hacker may first try to connect to a default Admin$ , C$ , or C:\Windows share. To connect to the hidden C: drive share, for example, type the following command in the Run field (Start ➪ Run):

\\ip_address\c$

Automated programs can quickly generate dictionary files, word lists, or every possible combination of letters, numbers, and special characters and then attempt to log on using those credentials. Most systems prevent this type of attack by setting a maximum number of login attempts on a system before the account is locked.

In the following sections, we'll discuss how hackers can perform automated password guessing more closely, as well as countermeasures to such attacks.

Performing Automated Password Guessing

To speed up the guessing of a password, hackers use automated tools. An easy process for automating password guessing is to use the Windows shell commands based on the standard NET USE syntax. To create a simple automated password-guessing script, perform the following steps:

Create a simple username and password file using Windows Notepad. Automated tools such as the Dictionary Generator are available to create this word list. Save the file on the C: drive as credentials.txt.
Pipe this file using the FOR command: C:\> FOR /F "token=1, 2*" %i in (credentials.txt)
Type net use \\targetIP\IPC$ %i /u: %j to use the credentials.txt file to attempt to log on to the target system's hidden share.

Offline Attacks

Offline attacks are performed from a location other than the actual computer where the passwords reside or were used. Offline attacks usually require physical access to the computer and copying the password file from the system onto removable media. The hacker then takes the file to another computer to perform the cracking. Several types of offline password attacks exist.

Types of Attack	Characteristics	Password Example
Dictionary attack	Attempts to use passwords from a list of dictionary words	Administrator
Hybrid attack	Substitutes numbers of symbols for password characters	Adm1n1strator
Brute-force attack	Tries all possible combinations of letters, numbers, and special characters	Ms!tr245@F5a

A dictionary attack is the simplest and quickest type of attack. It's used to identify a password that is an actual word, which can be found in a dictionary. Most commonly, the attack uses a dictionary file of possible words, which is hashed using the same algorithm used by the authentication process. Then, the hashed dictionary words are compared with hashed passwords as the user logs on, or with passwords stored in a file on the server. The dictionary attack works only if the password is an actual dictionary word; therefore, this type of attack has some limitations. It can't be used against strong passwords containing numbers or other symbols.

A hybrid attack is the next level of attack a hacker attempts if the password can't be found using a dictionary attack. The hybrid attack starts with a dictionary file and substitutes numbers and symbols for characters in the password. For example, many users add the number 1 to the end of their password to meet strong password requirements. A hybrid attack is designed to find those types of anomalies in passwords.

The most time-consuming type of attack is a brute-force attack, which tries every possible combination of uppercase and lowercase letters, numbers, and symbols. A brute-force attack is the slowest of the three types of attacks because of the many possible combinations of characters in the password. However, brute force is effective; given enough time and processing power, all passwords can eventually be identified.

New Course Announcement:
Python Based Blockchain Hacking, Smart Contract exploitation and Automation

Twitter: https://twitter.com/ficti0n
Website: http://cclabs.io

This is the course announcement for part 2 of our smart contract hacking journey, this time we are going to pick up where we left off leveraging frameworks, automation, other tools.. Starting out learning all the ways to interact with things programmatically with python... Then automate it, attack it, and get into all kinds of other things you have not seen before...

Note: This is NOT a re-hash of old material, NOR is it an update of the previous course.. This is all new material and the old course stands on its own as a Pre-Requisite to this course.. Also requiring knowledge of basic python scripting to follow along...

This course has 3 sections:

Web3.py in depth, Manual attacks and interactions
Automation, Frameworks, Fun things and Automated Attacks
Forensics and DEFI Attacks, Blockchain IDS and information gathering

Here is the Course intro Overview Outline:

Here is the Overview of Section 1 which is in depth Web3.py basics:

To keep up to date follow the following playlist and follow on twitter:

https://www.youtube.com/playlist?list=PLCwnLq3tOElrubfUWHa1qKrJv1apO8Aag

More info

JR

New Course Announcement:
Python Based Blockchain Hacking, Smart Contract exploitation and Automation

Twitter: https://twitter.com/ficti0n
Website: http://cclabs.io

This is the course announcement for part 2 of our smart contract hacking journey, this time we are going to pick up where we left off leveraging frameworks, automation, other tools.. Starting out learning all the ways to interact with things programmatically with python... Then automate it, attack it, and get into all kinds of other things you have not seen before...

Note: This is NOT a re-hash of old material, NOR is it an update of the previous course.. This is all new material and the old course stands on its own as a Pre-Requisite to this course.. Also requiring knowledge of basic python scripting to follow along...

This course has 3 sections:

Web3.py in depth, Manual attacks and interactions
Automation, Frameworks, Fun things and Automated Attacks
Forensics and DEFI Attacks, Blockchain IDS and information gathering

Oficina Mental

segunda-feira, 22 de janeiro de 2024

How To Start | How To Become An Ethical Hacker

Continue reading

System Hacking: Password Cracking Techniques And Types Of Passwords

The simplest way to crack the passwords

Types of Passwords

Passive Online

Active Online

Performing Automated Password Guessing

Offline Attacks

Related posts

domingo, 21 de janeiro de 2024

Blockchain Decentralized Application Hacking Course Part 2 - A Continuation Into Smart Contract Hacking And DApp Penetration Testing (Web 3) With Python

New Course Announcement:
Python Based Blockchain Hacking, Smart Contract exploitation and Automation

Twitter: https://twitter.com/ficti0n
Website: http://cclabs.io

This course has 3 sections:

Web3.py in depth, Manual attacks and interactions
Automation, Frameworks, Fun things and Automated Attacks
Forensics and DEFI Attacks, Blockchain IDS and information gathering

Here is the Course intro Overview Outline:

Here is the Overview of Section 1 which is in depth Web3.py basics:

Other Videos to follow...

To keep up to date follow the following playlist and follow on twitter:

https://www.youtube.com/playlist?list=PLCwnLq3tOElrubfUWHa1qKrJv1apO8Aag

Blockchain Decentralized Application Hacking Course Part 2 - A Continuation Into Smart Contract Hacking And DApp Penetration Testing (Web 3) With Python

New Course Announcement:
Python Based Blockchain Hacking, Smart Contract exploitation and Automation

Twitter: https://twitter.com/ficti0n
Website: http://cclabs.io

This course has 3 sections:

Web3.py in depth, Manual attacks and interactions
Automation, Frameworks, Fun things and Automated Attacks
Forensics and DEFI Attacks, Blockchain IDS and information gathering

Here is the Course intro Overview Outline:

Here is the Overview of Section 1 which is in depth Web3.py basics:

Other Videos to follow...

To keep up to date follow the following playlist and follow on twitter:

https://www.youtube.com/playlist?list=PLCwnLq3tOElrubfUWHa1qKrJv1apO8Aag

Continue reading

Links

Categorias

Arquivo do blog

Quem sou eu

Oficina Mental

segunda-feira, 22 de janeiro de 2024

How To Start | How To Become An Ethical Hacker

Continue reading

System Hacking: Password Cracking Techniques And Types Of Passwords

The simplest way to crack the passwords

Types of Passwords

Passive Online

Active Online

Performing Automated Password Guessing

Offline Attacks

Related posts

domingo, 21 de janeiro de 2024

Blockchain Decentralized Application Hacking Course Part 2 - A Continuation Into Smart Contract Hacking And DApp Penetration Testing (Web 3) With Python

New Course Announcement: Python Based Blockchain Hacking, Smart Contract exploitation and Automation

Twitter: https://twitter.com/ficti0nWebsite: http://cclabs.io

This course has 3 sections:

Web3.py in depth, Manual attacks and interactionsAutomation, Frameworks, Fun things and Automated AttacksForensics and DEFI Attacks, Blockchain IDS and information gathering

Here is the Course intro Overview Outline:

Here is the Overview of Section 1 which is in depth Web3.py basics:

Other Videos to follow...

To keep up to date follow the following playlist and follow on twitter:

https://www.youtube.com/playlist?list=PLCwnLq3tOElrubfUWHa1qKrJv1apO8Aag

Blockchain Decentralized Application Hacking Course Part 2 - A Continuation Into Smart Contract Hacking And DApp Penetration Testing (Web 3) With Python

New Course Announcement: Python Based Blockchain Hacking, Smart Contract exploitation and Automation

Twitter: https://twitter.com/ficti0nWebsite: http://cclabs.io

This course has 3 sections:

Web3.py in depth, Manual attacks and interactionsAutomation, Frameworks, Fun things and Automated AttacksForensics and DEFI Attacks, Blockchain IDS and information gathering

Here is the Course intro Overview Outline:

Here is the Overview of Section 1 which is in depth Web3.py basics:

Other Videos to follow...

To keep up to date follow the following playlist and follow on twitter:

https://www.youtube.com/playlist?list=PLCwnLq3tOElrubfUWHa1qKrJv1apO8Aag

Continue reading

Links

Categorias

Arquivo do blog

Quem sou eu

New Course Announcement:
Python Based Blockchain Hacking, Smart Contract exploitation and Automation

Twitter: https://twitter.com/ficti0n
Website: http://cclabs.io

Web3.py in depth, Manual attacks and interactions
Automation, Frameworks, Fun things and Automated Attacks
Forensics and DEFI Attacks, Blockchain IDS and information gathering

New Course Announcement:
Python Based Blockchain Hacking, Smart Contract exploitation and Automation

Twitter: https://twitter.com/ficti0n
Website: http://cclabs.io

Web3.py in depth, Manual attacks and interactions
Automation, Frameworks, Fun things and Automated Attacks
Forensics and DEFI Attacks, Blockchain IDS and information gathering