1 · Wireless: WLANs, SSIDs and rogue APs

The components

• Access Point (AP) — essentially a hub that lets different WLANs connect to a network backbone. APs are what attackers look for.
• Router / Modem — modulates the analog signal to encode/decode digital information, and gives APs their connection to the Internet.
• Wireless Adapter — transmits and receives wireless signals, configured to talk to other adapters in range. The WNIC (Wireless Network Interface Card) in your laptop is one.

SSIDs — the name badge of a WLAN

A Service Set Identifier identifies a WLAN much the way a workgroup does on a Windows network. Memorise the spec exactly, because it is a perfect MCQ target:

• 1 to 32 characters, case-sensitive, alphanumeric, configured on the AP.
• The AP beacons the SSID several times a second so WNICs in range can display the available WLANs.
• One AP can beacon multiple SSIDs.
• Many vendors ship default SSIDs that companies never change — an inherent weakness, because the default tells the attacker the vendor and often the default credentials too.

Probes vs beacons — don't mix these up

The underlying problem: an uncontrolled RF medium

With APs beaconing their information, walls are no longer barriers. A wired network has a physical perimeter you can lock; radio spills into the car park. Tools like Vistumbler let an attacker sit outside and enumerate everything in range.

Rogue AP

An unmanaged (unauthorised) AP attached to the enterprise network — a significant potential backdoor. It is very easy to install one: modern operating systems help you share your internet connection, and plenty of software will turn a laptop into a software AP (Connectify). The intent is sometimes malicious, but it is just as often an unwitting, impatient employee who wanted better Wi-Fi at their desk.

What a rogue AP enables: attacks on the wired infrastructure (ARP poisoning, DHCP attacks, STP attacks, DoS), mapping the network for targeted attacks, scanning, and man-in-the-middle with data sniffing.

Solutions, and their honest limits: Network Access Control — not always effective, because MAC addresses can be spoofed — and scheduled periodic manual surveys.

Evil twin

A specific, nastier rogue AP. The recipe from the slides:

1. Get a wireless access point.
2. Configure it the same way as an existing network — same SSID and same security settings.
3. Overpower the existing AP. You do not need to be in the same vicinity.

It works because most clients associate to the AP with the strongest signal. Once they do, the evil twin sees the network traffic of every associated client, and can additionally use MAC address spoofing to trick clients into sending passwords and sensitive information. Wi-Fi hotspots are easy bait.

Why the client can't tell — the one-way authentication flaw

This is the single most important "why" in the whole wireless deck:

And to stand up an evil twin, the attacker needs the SSID of the trusted AP and to activate it without authentication. If the AP broadcasts the SSID (or uses the default one), the attacker can simply obtain it with a sniffer.

AP honeypot

The attacker sets up a rogue AP, often as a Soft AP — software converts a laptop or USB Wi-Fi adapter into an access point (Virtual Router, Connectify). The soft AP broadcasts the spoofed SSID of the legitimate AP, and the attacker may even alter the MAC to that of the legitimate AP. The user connects assuming it's legitimate, and the attacker harvests personal information from the link.

Windows 7 introduced "SoftAP" for Internet Connection Sharing. The command on the slide:

netsh wlan set hostednetwork mode=allow ssid="ssid" key="passphrase" keyUsage=persistent

Soft AP configuration tools named in the deck: Virtual WiFi Router, My Public WiFi, My WiFi Router.

2 · Wireless: MAC addresses, filtering and spoofing

The two identifiers visible in the air

• SSID — 32 byte unique Service Set Identifier of the AP, sent when the AP receives a probe request from a station. "Visible" in the air.
• MAC address — a unique 48-bit identifier that must exist for each network device in order to deliver traffic. Written as six octets, e.g. 00-04-5a-03-3c-0f.

The OUI

The first 3 octets are the Organizationally Unique Identifier — they name the vendor. The last three are the serial number. The deck's examples:

Also worth knowing: BSSID (Basic SSID) is the MAC address of the access point. The Windows command to scan the neighbourhood and see it is netsh wlan show networks mode=bssid.

MAC address filtering

Allowing or denying access to a wireless network based on the hardware address of the connecting device. Only permitted MACs get on. The allow-list can live on the AP, or on a RADIUS server the AP talks to.

Why it is weak: MAC addresses are sent in the clear on wireless networks and can be sniffed, so it is relatively easy to discover the authorised addresses — and then simply become one.

Four ways to spoof a MAC

So what does spoofing actually buy the attacker?

The deck gives exactly two answers, and both are fair game as "select all that apply":

1. AP honeypot — configure a fake/rogue AP's MAC to divert legitimate Wi-Fi traffic into MITM attacks, replay attacks and so on.
2. Bypass MAC address filtering — spoofing an authorised device's MAC defeats the allow-list, e.g. to exploit free Wi-Fi usage.

3 · Wireless: WEP → WPA → WPA2 → WPA3

This is the densest, most examinable part of the wireless deck. Learn the cipher, key size, IV size and integrity check for each generation — that grid alone will answer a lot of questions.

WEP — Wired Equivalent Privacy

Based on the RC4 cipher. A secret key of 40 or 104 bits is combined with a 24-bit Initialisation Vector to encrypt plaintext M. The Integrity Check Value is computed as the CRC-32 checksum for M. The ciphertext:

C = [ M + ICV(M) ]  XOR  [ RC4(WEP Key + IV) ]

The six WEP limitations — learn all six

1. Key management and key size — typically only 1 to 4 shared keys, and they are not changed often.
2. A dictionary attack against the WEP key generator can succeed in a short time.
3. The 24-bit IV is too short for cryptographic purposes — weak security.
4. IV reuse produces identical keystreams. Different client adapters from the same vendor may even generate the same IV.
5. The IV is part of the RC4 encryption key — the seeding of RC4 is weak.
6. The 32-bit ICV protects the payload/data in the frame but not the header.

WPA — the interim fix

A subset of the 802.11i standard offering improved encryption and authentication (e.g. an IEEE 802.1X authentication server). Still RC4, but with 128-bit keys and a 48-bit IV that may be split into a 24-bit IV and a 24-bit extended IV.

TKIP — Temporal Key Integrity Protocol

• The key is different for each user and dynamically changes during the session — the key changes for every frame.
• Every key is associated with a sequence number.
• The key mixing function takes the sequence number + the base WPA key + the transmitter MAC address and outputs a new key per packet.
• That new key is used with the IV to generate the keystream; the IV also provides the key sequence number.
• A 64-bit MIC computed by the Michael algorithm is placed before the ICV, with a frame counter to defeat replay attacks.

WPA authentication — Personal vs Enterprise

WPA limitations

• Weaker authentication via PSK — same passphrase for everybody, no authentication server required.
• No standardised way of changing the shared secret.
• PSK is vulnerable to eavesdropping and dictionary attack.
• Subject to DoS via a flood of EAPOL messages requesting 802.1X authentication — the authentication server cannot respond.
• TKIP was a stopgap — still RC4.
• TKIP is vulnerable to the Beck-Tews keystream recovery attack, but it can only decrypt small portions of data, compromising confidentiality — a single ARP frame takes about 14–17 minutes to decrypt.

WPA2 — the real standard

Uses AES-CCMP (Advanced Encryption Standard – Counter Mode Cipher Block Chaining Message Authentication Code Protocol). Authentication is similar to WPA (Personal and Enterprise) but AES-based, and it provides RSN — Robust Security Network.

802.1X / EAP: the three players

RSN is delivered via 802.1X, which uses the Extensible Authentication Protocol (EAP), between three players: the Client, the Access Point, and the Authentication Server (AS). The exchange, in order:

1. The AP sends a "request identity" message to the client.
2. The client responds with its identity and preferred authentication method.
3. The AP relays the client identity and authentication preferences to the AS.
4. EAP messages are exchanged between the client and the authentication server to generate a common Master Key (MK).
5. The AS sends a "Server Accept" message to the AP, containing the MK.
6. The AP sends a final EAP Success message to the client.

WPA2 key hierarchy — the chain to memorise

• WPA2-Personal generates a 256-bit pre-shared key from a plain-text passphrase.
• PSK + SSID + SSID length → PMK (Pairwise Master Key).
• PMK → PTK (Pairwise Transient Key). The PTK is the session key between the wireless client and the AP, used to encrypt and decrypt unicast messages.
• WPA2-Enterprise requires an external server — RADIUS (Remote Authentication Dial In User Service) / AS. The AS supplies a different master key to each client.
• In both Personal and Enterprise, a GTK (Group Temporal Key) is created during the client–AP exchange and is used for multicast/broadcast messages.

WPA2 limitations

• Vulnerable to physical layer attacks — RF jamming, data flooding, access point failure.
• Vulnerable to DoS attacks.
• Vulnerable to layer 2 session hijacking.
• Unprotected control and management frames.
• Vulnerable to AP spoofing — but in Enterprise mode the attacker needs to be an authenticated client.

WPA3 — SAE

• Secure handshakes. Old WPA protocols connect device and router via a pre-shared key, which is relatively easy to break by brute force. WPA3 uses SAE — Simultaneous Authentication of Equals, making passwords much harder to eavesdrop.
• Stronger protections. A user can make one offline password guess. Brute-force attacks, where a hacker uses hundreds of tries, aren't possible.

KRACK — Key Reinstallation Attack

The exception that proves WPA2 isn't bulletproof, and a favourite exam question because it is not a cracking attack:

• Not a brute force attack.
• It interrupts the 4-way handshake to reset the nonce.
• Mechanism: block Msg4 from the user → this makes the AP resend Msg3 → when the user receives Msg3 it reinstalls the key → the nonce is reset (on some devices the nonce changes to 0).
• Once the nonce is reset, the same nonce is used for encryption, which creates scope for a replay attack.

4 · Wireless: attack techniques, tools and defences

The attack-techniques table — memorise the tool→attack mapping

Wardriving

• Detects APs that have not been properly secured; many have no passwords or security measures at all, so it can be rewarding.
• Wardriving isn't illegal; exploiting discovered network resources without permission is. ← almost certainly a quiz question.
• How: drive or move around with a laptop containing a WNIC, an antenna, and software that scans for APs/SSIDs.
• Warflying — the same thing done with a drone carrying an antenna and the same software.

DoS and DDoS

An attempt to deny access to one or more resources, usually by cutting off access to the service or network as a whole, typically achieved by flooding the system's or server's request queue with fake requests so the server can no longer handle legitimate users. In a DDoS, many computers attack the same target — attackers typically use a zombie network: a group of infected computers on which the DoS attacking tool has been installed.

Tools: LOIC (Low Orbit Ion Cannon), HOIC (High Orbit Ion Cannon), XOIC, HULK, Golden Eye.

Jamming

• Occurs when a very powerful RF signal cuts off the signals from APs and clients in a WLAN.
• Can be deliberate or unintentional — legitimate devices in the same frequency range can interfere with Wi-Fi.
• Similar to DoS attacks.
• Jamming equipment is expensive, so these attacks are rare.
• Users need a spectrum analyser to find the jamming signal.

Wireless network sniffing

• An attacker can passively scan without transmitting at all — a passive scanner instructs the wireless card to listen to specific or all channels. It is the prelude to the remaining attack types.
• A WNIC may be configured in RF monitor mode and promiscuous mode.
• A WNIC in monitor mode can capture packets without associating with an AP or ad-hoc network. Many wireless cards permit RF monitor mode.

The CIA attacking tools tables

These four tables are image slides, so they're easy to skip — and exactly the kind of thing that gets asked. Learn at minimum the tool → type of attack column.

Confidentiality attacking tools

Integrity attacking tools

Availability attacking tools

Bluetooth attacking tools

Wi-Fi security measures — the defence list

• Change the default router authentication.
• Use WPA or WPA2 if your equipment supports it — better encryption than WEP.
• Always check for updates to your router.
• Use a router to filter unauthorised MAC addresses — noting the slide's own caveat, (can spoof).
• Change default AP settings, e.g. default SSIDs, and disable broadcast.
• Measures to prevent radio waves leaving or entering a building — Wi-Fi-proof paint, Wi-Fi-proof windows, Faraday cages.
• Turn off your router or AP when not using it.

5 · Web: architecture, URLs and footprinting

The client–server picture

Web client → HTTP request (cleartext or SSL) → firewall → web server → web apps → SQL databases. The reply comes back as HTML, JavaScript, VBscript etc. The named examples from the slide:

• Web servers: Apache, IIS, Netscape.
• Plugins: Perl, C/C++, JSP.
• Database connections: ADO, ODBC.

Why web hacking replaced traditional network hacking

Traditional client-side hacking went after OS network services — WU-FTPD exploits, Sun RPC, NT IPC$ — and those hacks on OS network services can be prevented by firewalls. Internal back-end servers also sit on a non-routable private IP network. So the attacker's problem became: how do I get in at all?

The answer:

• IANA assigned TCP port 80 for HTTP and TCP port 443 for HTTPS.
• HTTP is typically perceived as "friendly" traffic.
• Why fight the firewall? Entry via port 80, port 443, or tunnelling.
• The web application is typically less secure than the web server.

And the deck's punchline: essentially all that is needed is a web browser, an Internet connection… and a clear mind.

The URL, component by component

Manual web footprinting

The goal: identify the functionality of a web application to gain insight into its workflow, features and user interactions, which helps in identifying potential attack surfaces. The checklist:

• Browse the application and explore all visible features (login, file upload, search).
• Locate input fields — forms, search boxes, file uploads.
• Note all GET/POST parameters from URLs and forms.
• Explore links — internal, external, anchor and mailto:.
• Review URL patterns for hidden resources or flows.
• Inspect page sources.

The footprinting toolkit

Why intercept HTTP at all?

• Verify HTTP headers while the browser processes them — gives insights on the server, scripting environment and OS, which helps in planning the attack.
• Examine the request and response — helps identify implementation vulnerabilities, lets you play MITM to change the message, and perform brute-force attacks.

The lab example is the PortSwigger "excessive trust in client-side controls" logic-flaw lab — log in as wiener / peter, add an item to the cart, intercept the request and change the price value to 1, then forward all messages. The lesson: if the price is decided by the client, the client can decide the price.

Web application vulnerability scanning

The deck's local target is OWASP Juice Shop in Docker:

sudo systemctl enable docker
sudo systemctl start docker
docker run --rm -p 3000:3000 bkimminich/juice-shop
# then open 127.0.0.1:3000

And the scanner is wmap inside MSFConsole:

sudo systemctl status postgresql
sudo systemctl enable postgresql
sudo msfdb init
msfconsole
load wmap
wmap_sites  -a http://<IP>      # define the site
wmap_targets -t <URL>           # add the target

6 · Web: the four-tier escalation and directory traversal

The escalation ladder

The deck builds the "Types of Web Hacks" slide up one layer at a time. Learn the ladder — it explains why these attacks are described as "part of a larger spectrum":

URL manipulation in practice

• Tampering with URL parameters, e.g. products.php?id=-1.
• Modifying status, e.g. products.php?id=7&status=del.
• Entering ' or ; to provoke an error that reveals the backend.

URL interpretation

• DETURL.com — bypass download restrictions, no additional downloader needed.
• robots.txt — a reference to search engine robots about what parts of a website NOT to index. It is found at the root of a website (http://<root>/robots.txt), and it helps interpret the URL and reveal hidden paths.

Directory / path traversal

The mechanism: ..\ instructs the system to go one directory up. From C:\xx\yy\zz, to reach abc.txt in xx you type ..\..\abc.txt. It is ..\ on Windows and ../ on UNIX-like OSs.

The definition to quote: it exploits inadequate security mechanisms to access directories and files stored outside of the web root folder, and the vulnerability is the result of insufficient filtering/validation of browser input from users.

Classic targets from the cheat sheet slide:

/etc/master.passwd
/master.passwd
/etc/passwd
/etc/shadow%00
../../etc/passwd%00
../apache/logs/access.log

Bypassing path traversal filters — the encoding table

Two separate tricks here; keep them apart.

(a) Defeating an extension check. Some websites test whether the file has the correct extension, or append one themselves. This can be subverted by introducing a URL-encoded NULL byte — everything after it is removed — or a URL-encoded newline:

../../../../etc/password%00.jpg     # NULL byte
../../../../etc/password%0a.jpg     # newline

The check works because it is implemented by an API call that does not resolve URL encoding.

(b) Defeating a character blacklist. If the webserver disallows specific characters, try forward and backward slashes, then escalate through the encodings:

7 · Web: SQL injection, end to end

The definition

A code injection technique that exploits a vulnerability in the backend SQL database or web app. It happens when user input is not filtered for string literal characters embedded in SQL statements, or when the web application uses user-supplied data without proper input validation and encoding, as part of a command or query. Attackers submit specially crafted input to the SQL interpreter and trick the interpreter into executing unintended commands.

Step 1 — find out whether it's vulnerable

Add a ' to the password or username field. A system error caused by the password with ' shows the SQLI vulnerability — the unbalanced quote broke the query. Adding '' (two quotes) rebalances it and the error goes away, which confirms it.

Step 2 — bypass the login

Trace the three attempts from the demo, because the exam likes asking why attempt two failed:

-- indicates a comment, so everything after it is ignored. Sometimes comments are defined by # or /*.

Balancing parentheses

If the application wraps your input in brackets, you have to close them too:

<username>' --
<username>') or 1 = 1 --
<password>' OR 1 = 1 )#

SQLI variations — when the obvious payload is blocked

• The single quotation mark is not required for injection into a numeric data field.
• If the comment character is blocked, craft the injection so it does not break the surrounding query: instead of ' or 1 = 1 -- use ' or 'a' = 'a.
• If you suspect the input sits inside parentheses: ' or 1 = 1)#.

The six-step attack procedure

1. App sends form to user.
2. Attacker submits form with SQL exploit data.
3. Application builds a string with the exploit data.
4. Application sends the SQL query to the DB.
5. DB executes the query, including the exploit, and sends data back to the application.
6. Application returns data to the user.

Finding vulnerable sites with Google dorks

inurl:index.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurl:page.php?file=
inurl:portfolio.php?cat_id=

And in the Web Hacking 2 deck, for SQLI Hunter: inurl:".php?id=" intext:"View cart".

The full exploitation chain (MySQL demo)

This sequence is heavily examinable. Learn what each command is for, not just its syntax.

The same chain on OWASP Juice Shop (SQLite)

Juice Shop is the modern version of the demo, and the syntax differs because the backend is SQLite, not MySQL. The injection point is the REST endpoint http://localhost:3000/rest/products/search?q= — that is where your input lands in a raw SQL query, and all manipulation is done on that URL in the browser address bar.

Behind the scenes the server builds roughly:

SELECT * FROM Products
WHERE ((name LIKE '%apple%' OR description LIKE '%apple%')
AND deletedAt IS NULL) ORDER BY name

Which is why the escape prefix is ')) — you must close the quote and the two brackets. The chain:

Impact of SQL injection — the six

1. Leakage of sensitive information
2. Modification of sensitive information
3. Loss of data
4. Loss of reputation
5. Loss of control of DB server
6. Denial of service

Vulnerabilities exploited, and the core security problems

Why it keeps working: HTTP variables passed in the URL are easily accessible; attacks can also manipulate specific system variables; the web app may respond with detailed error information, which attackers use to discover more about the app and its backend.

The five organisational "core security problems": ignoring where sensitive information is stored and not understanding how it is at risk; underutilisation of existing network and web security tools (application-aware firewall, web vulnerability scanners); remediation without understanding what your tools are trying to tell you; assuming it's someone else's problem (responsibility deflected to the cloud); and misunderstanding the larger goals of the business and what management needs to hear and see.

8 · Web: XSS, XSRF and defacement

XSS — the four-step cycle

The framing sentence from the deck: the attacker does not target the victim directly.

1. Attacker injects malicious code into a vulnerable web server.
2. Victim visits the vulnerable web server.
3. Malicious code is served to the victim by the web server.
4. Malicious code executes on the victim's computer with the web server's privileges.

What arbitrary JavaScript in another browser buys you

The three types of XSS

DOM = Document Object Model, a convention for representing and working with objects in an HTML document.

The step sequences — note the count

Persistent (4 steps): attacker uses one of the website's forms to insert malicious script into the DB → victim requests website page → website includes the malicious script from the database and sends it to the victim → victim's browser executes it, sending the victim's cookies to the attacker's server.

Reflected (4 steps): attacker crafts a URL containing malicious script and sends it to the victim → victim is tricked into requesting the URL → website includes the malicious script from the URL in the response → victim's browser executes it.

DOM-based (5 steps): attacker crafts a URL containing malicious script → victim is tricked into requesting it → the website receives the request but does NOT include the malicious script in the response → the victim's browser executes the legitimate script in the response, which inserts the malicious script into the page → the browser executes the inserted script, sending cookies to the attacker.

The demo makes this concrete: the XSS triggers because the client-side script uses part of window.location to set the innerHTML of an element. The substring of location.hash (the string after the #) is passed as the argument to the chooseTab function, so the image src variable can be controlled:

https://xss-game.appspot.com/level3/frame#2'><img src=x onerror=alert(/DOM-XSS/)

How the payload is delivered

The victim must either visit any page controlled by the attacker — which might include an invisible iframe pointing at the vulnerable site along with the payload — or click a URL link from the attacker, possibly obscured by a URL shortener. The payload can be in a parameter of an HTTP POST request, as part of the URL, or even within the web browser cookie — basically anywhere a user can supply input.

XSRF / CSRF — Cross-Site Request Forgery

The four steps:

1. Victim is logged into the vulnerable web site.
2. Victim visits a malicious page on the attacker's web site.
3. Malicious content is delivered to the victim — e.g. <img src=http://vuln/delete>.
4. Victim involuntarily sends a request to the vulnerable web site, carrying their session cookie.

The XSRF demo details

• Save the target page locally and change the form's relative addressing to absolute (action="http://localhost:8080/WebGoat/csrf/basic-get-flag").
• To bypass HTTP GET filtering/prevention, use an HTTP POST to implement the attack.
• It is very difficult for the target website to distinguish between legitimate and rogue HTTP GET or POST requests, since the requests are sent from a "trusted" browser.
• Target: http://testphp.vulnweb.com/userinfo.php. The input fields are urname, ucc, uemail, uphone, uaddress.
• The attacker embeds the actual code of the update form in another website inside a hidden iframe; when the victim is tricked into visiting, the form submits the attacker's desired information. Hosted locally with XAMPP.

Website defacement and the automation tools

• Website defacement — gain account access, then change the webpage with admin rights.
• SQLI Hunter — used to find SQLI vulnerable websites using Google dorks.
• SQLMAP — a powerful tool for automatic SQL injection and database takeover.

The SQLMAP command structure from the Juice Shop demo — note how it mirrors the manual steps:

sqlmap -u "http://localhost:3000/rest/products/search?q=apple" \
  --prefix="')) " --suffix="-- -" --union-cols=9 \
  --dbms=sqlite --technique=U --no-cast --batch --tables

# then dump credentials:
sqlmap ... --batch -T Users -C email,password --dump

And the older MySQL target, showing the classic three-stage drill-down:

sqlmap.py -u http://testphp.vulnweb.com/listproducts.php?cat=1 -D acuart --tables
sqlmap.py -u ... -D acuart -T users --columns
sqlmap.py -u ... -D acuart -T users -C email,name,pass --dump

9 · Binary: memory, the stack and buffer overflow

Why C and C++ are the problem

In C/C++ the program is responsible for its own memory management, which is very error-prone. The typical bugs:

• Writing past the bound of an array.
• Pointer trouble — missing initialisation, bad pointer arithmetic, use after free, double free, memory leaks.

Why it still matters: C and C++ are still popular (Microsoft Windows, Microsoft Excel, Linux, Mozilla, MySQL) and critical systems are written in C/C++ — OS kernels and utilities, high-performance servers like Apache and nginx, and embedded systems.

The minimal example

char buffer[4];
buffer[4] = 'a';     // buffer ends at buffer[3]

That is a buffer overflow: C lets you overwrite buffer[4] even though the buffer ends at buffer[3]. And the key sentence: if the data written is user input that can be controlled by an attacker, this vulnerability can be exploited.

Normally a program with this bug will simply crash. But an attacker can alter the situation so the program does much worse: steal private information (e.g. Heartbleed), corrupt valuable information, or run code of the attacker's choice.

Memory layout — bottom to top

Learn this stack of regions in order, with what lives in each. Addresses run from 0x00000000 at the bottom to 0xffffffff (4G) at the top.

• The stack and the heap grow in opposite directions. The heap is provisioned by the OS and managed in-process by malloc; the compiler emits instructions and adjusts the size of the stack at run time.
• The process's view is that it owns all of memory. In reality these are virtual addresses; the OS/CPU maps them to physical addresses.

What a function call puts on the stack

The frame layout, and the two orderings

For void foo(char *arg1, int arg2, int arg3) with locals loc1, loc2, the frame reads (low → high):

... | loc2 | loc1 | %ebp | %eip | arg1 | arg2 | arg3 | caller's data | → 0xffffffff
              [ stack frame for foo ]

• Local variables are pushed in the same order as they appear (ultimately up to the compiler — they may not be allocated, or may be stored only in registers, depending on optimisation level).
• Arguments are pushed in reverse order.

Accessing a variable

You can't know the absolute address at compile time, but the relative address of loc2 is always 8 bytes before the frame pointer (base pointer, %ebp). That is the entire reason the frame pointer exists.

The three registers

x86 calling conventions — the three roles

The three-step version for setting up the callee, from the slide: (1) push %ebp — backing up the caller's base pointer on the stack; (2) set %ebp to the current %esp — %esp has changed because of step 1, so the top of the stack becomes the callee's base pointer; (3) set %ebp to (%ebp) at return — restoring the backed-up value.

The actual overflow

void f(int x) {
    char[8] buf;
    gets(buf);        // what if gets() reads more than 8 bytes?
}
void main() { f(…); … }
void format_hard_disk(){…}

The frame is buf[0..3] | buf[4..7] | Return addr | x | main(). Write past buf[7] and you are writing into the return address. Since the returning function does %eip = 4(%esp), whatever sits there is where execution resumes — which is how the attacker redirects control to something like format_hard_disk().

10 · Binary: format string attacks

The setup

Format string attacks are described as another way of corrupting the stack. Strings in C can contain special characters such as %s — these are format strings:

printf("Cannot find file %s", filename);   // fine — one specifier, one argument
printf("Cannot find file %s");             // no argument supplied!
printf(string);                            // string is user-supplied — the bug

Why the missing argument matters

The deck walks it through with printf("%d %d %d", a, b, c). The arguments a, b and c are pushed onto the stack along with the format string, forming printf's stack frame. Now remove them:

printf("%d %d %d") — printf will take whatever values are available on the stack and print those as a, b and c. It has no way to know the arguments were never supplied; it simply walks up the stack reading whatever is there.

Read vs write — the two specifiers that matter

Advanced format string attacks

By combining them, an attacker can try to control which address is used for reading from memory using %s, or for writing to memory using %n, with specially crafted format strings. The two patterns on the slide:

\xEF\xCD\xCD\xAB %x %x ... %x %s
   → with the right number of %x, prints the string located at address ABCDCDEF

\xEF\xCD\xCD\xAB %x %x ... %x %n
   → with the right number of %x, writes the number of characters printed
     so far to location ABCDCDEF

The leading bytes are the target address placed on the stack as data; the run of %x specifiers is a counter that walks printf's argument pointer along until it lands exactly on those bytes. Then the final %s or %n acts on the address you planted.

The fix

The deck is emphatic that this one is easy: format string attacks are easy to stop and fix.

printf(str)          // vulnerable — user data is the format string
printf("%s", str)    // safe — user data is an argument

The principle generalises neatly to the rest of the module: the bug is always data being treated as instructions. In SQLi the user's string became part of the query; here the user's string became the format specification. The fix is the same shape both times — keep the user's data in the slot reserved for data.

11 · Keeping access: backdoors and Netcat

What a backdoor is

• An access point created to bypass normal target defences.
• Sometimes these are due to vulnerabilities in the system; in other cases the attacker installs an entry point on a compromised target to complete the attack later.
• Most frequently found in Advanced Persistent Threats.
• A backdoor must be hidden or disguised to be effective.

The real-world examples list

Sniffing backdoors — the stealth upgrade

The logic: attackers don't want to get caught, so they increasingly use stealthy backdoors. The key insight is that a backdoor does not need to wait listening on a port — a listening port shows up in a port scan and in netstat. Instead, a sniffer gathers traffic rather than listening to an open port.

cd00r — port knocking

cd00r only starts listening on a pre-programmed port after a sequence of TCP SYN packets are received on a defined port list, and in the correct order. In the diagram: SYN to port X, SYN to port Y, SYN to port Z → after the SYN to Z is received, activate a temporary listener on port 5002 → attacker connects to a root shell on port 5002.

The promiscuous backdoor scenario

Worth understanding because of why it is clever: the backdoor is located on the DNS server, while all the packets are sent to the WWW server (which has no backdoor on it). The DNS server's backdoor sniffs promiscuously and picks up the commands meant for the web server. In a switched environment the attacker may use ARP cache poisoning to make that traffic reach them. The result: confusing for investigators — they analyse the machine that received the traffic and find nothing wrong with it.

Netcat — "the Swiss army knife of hackers"

A tool that can read and write to TCP/UDP ports. Installed on the victim's machine, the attacker can connect to it, chat with the victim, or execute a shell to access the internals. Learn these four invocations — flags and all.

Decoding the flags: -n no DNS resolution, -l listen mode, -v verbose, -p port, -e execute a program on connect. The -e flag is the one that turns Netcat from a networking utility into a backdoor: port 6666 is bound to /bin/sh and the output from the shell is redirected to the network.

12 · Keeping access: trojans, rootkits and keyloggers

Trojans

A Trojan horse is any malicious computer program used to hack into a computer by misleading its true intent, named from the Ancient Greek story of the wooden horse in Troy. Typically aimed at taking control of a victim computer, stealing data, or inserting more malware.

• ProRAT — a Remote Access Trojan known for unauthorised access and control of compromised systems. Stealthy installation, runs in the background, enables remote control, accesses sensitive information, keystrokes and files without user consent, and allows arbitrary commands. In the demo it automatically disables antivirus/firewall once installed, and connects via server port 5110. (RAT = Remote Administration Tool.)
• EXE wrappers — the delivery trick: embed a backdoor application in another innocent-looking program. Wrappers pack files into an archive executable that can extract and execute them visibly or hidden from users, and may cause false positives in anti-virus applications.
• Weevely — a web backdoor. Generate with weevely.py generate mypassword agent.php, copy the generated .php backdoor to xampp\htdocs, then launch the script to connect and get a remote shell.

Rootkits

A type of Trojan that keeps itself hidden from detection and enables an attacker to have root / administrator access. What it actually does:

• Intercepts common API calls so antivirus scans never see the rootkit programs — e.g. calls to FindFirstFile / FindNextFile.
• Modifies commands like dir, ls and ps so they don't report files and processes belonging to the rootkit.
• Can clean up any log messages that might have been created by the exploit.

Sony XCP — the case study

Mark Russinovich was developing a rootkit scanner for Windows, and while testing it discovered his machine already had a rootkit on it. The source turned out to be Sony audio CDs equipped with XCP "copy protection". Inserting such a CD runs an autorun.exe, which installs the rootkit.

• Primary purpose: modify the CD driver in Windows so that any process that tried to read from an XCP-protected CD would get garbled output.
• Secondary purpose: make itself hard to find and uninstall.
• After people complained, Sony eventually released an uninstaller.

The three-tier comparison — the single most examinable table in this deck

Traditional rootkits in detail

• A tool suite that allows the attacker to maintain root-level access via a backdoor and hide evidence of a system compromise.
• More powerful than application-level Trojan horse backdoors (e.g. BO2K, Netcat), since the latter run as separate programs which are less easily hidden.
• Existing critical system components are replaced — e.g. taskmgr.exe, rundll32.exe.

Kernel-level rootkits in detail

• Critical system files such as ls, ps, du, ifconfig are left UNMODIFIED. ← the discriminator
• The operating system kernel is replaced (partially) by a Trojan; the attacker has complete control of the target machine.
• Capabilities: hide specific processes, files and folders; hide network use (sniffers and port listeners); redirect execution.
• Three ways of implementing: (1) Loadable Kernel Module — kernel-mode drivers in Windows; (2) patch the kernel image on the hard drive; (3) alter the kernel in memory on a running system.

Defences against application-level trojans

• Use antivirus tools — they can detect fingerprints of attack tools by checking filenames, registry key settings and services. Update virus definition files weekly.
• Know your software — only run software from trusted developers; programs may be digitally signed; software should include a digital fingerprint (e.g. MD5 hash) to allow checking for a trojanised program.
• Don't use single-purpose checkers (e.g. one that only checks for BO2K) — the application itself may be a Trojan horse which installs BO2K but tells the user the machine is clean.

Keyloggers

The rationale: almost all of the information flow from the user to the computer (or beyond, to the Internet) is via the keyboard — a little from the mouse, a bit from devices like USB keys. So an attacker installs a key logger to keep a record of all email/IM you send, websites you visit, and all passwords you type. Certain keyloggers are installed by malware — e.g. KeyBase, since Feb 2015, which captures passwords, especially banking passwords, and sends the information to the remote attacker. The data can be accessed locally, or sent to a remote machine over the Internet.

Tool specifics from the demos:

• Key Logger Pro — SHIFT-CTRL-ALT-K to make visible. Website Visited Monitoring and Clipboard Logging don't work on the free edition.
• Actual Key Logger — SHIFT+CTRL+ALT+F7 to make visible. Captures internet as well as keyboard activity, can send collected information via email, LAN or FTP, and can manage screen captures automatically at minute intervals.

13 · Covering tracks: hiding, steganography and logs

The framing: after an attacker compromises a machine and completes the attack or creates a back door, he has to ensure that his presence is removed or remains hidden. Four sub-topics: hiding files and folders; undeletable files and folders; clean up log files; clean up target machine.

Hiding files and folders

Steganography and the LSB technique

Why images work as containers:

• Image files contain header information and image pixels. The header is usually quite precise, with little spare capacity; much of the file comprises image pixels — so the pixels are where the room is.
• Each pixel contains the 3 primary colour components: red, green and blue.
• Each colour component is 8 bits long, giving 256 different possible values.
• A full colour image contains 3 colour component planes.

The deck then shows bit-plane images from bit 0 up to bit 7 of the green plane. The observation that matters: the LSB of each colour component is often quite random, so replacing it with a different value will likely not be noticed.

The capacity arithmetic — a guaranteed calculation question

The logic generalises: each component is 8 bits, so using n of them gives n/8 capacity. Replacing all the LSBs is likely to result in an indifferent image (the cover image) — i.e. visually unchanged.

LSB storage issues

• The baboon cover image is quite good, as the colours change quite rapidly over the whole image — busy detail hides the noise.
• Some scenery-type pictures have large areas where the colour doesn't change very much — sky, sea, mountains — so pixel values do not change very much, and replacing the LSBs with changing payload values will then be quite noticeable.
• Public domain steganalysis tools are available.

Making files "undeletable"

Log files

Viewing them: Start → Control Panel → System and Security → Administrative Tools → Event Viewer. The logs available are for application, security-related, setup and forwarded events, and the event type can be information, warning, error or audit.

Clearing vs editing — Winzapper

• To clear: select the event level(s) to filter for, then click the Action column entry on the right → Clear Log…. This wipes everything, which is itself extremely suspicious.
• Opening or editing event log files cannot be done with a standard file editing tool.
• Winzapper lets an attacker selectively delete events from logs — and needs an Admin account to run.

Cleaning up the target — Traceless

What it clears: History, temporary internet files, cookies, Recent Documents list. Its features: password protected, runs at start-up, can be scheduled to run when you want, comprehensive help file.

14 · Advanced Persistent Threats

The definition

APTs refer to tools and techniques that can be used to launch an attack that cannot be stopped by conventional security mechanisms.

Unpacking the three words

The APT attack cycle

An APT attack phase is:

• Gradual and incremental — extended and repetitive reconnaissance, scanning and enumeration.
• Coordinated across attack points.
• A continuous strive for stealth — may make use of repetitive track-covering attempts.
• Will try multiple times using different methods (persistent).
• A C&C (Command and Control) server directs further attacks.

And the modern aggravator: cloud computing and BYODs increase the target attack surface.

APT attack characteristics — the six-item list

1. Targeted, low-profile attacks
2. Extremely stealthy
3. Highly motivated and determined
4. Well-financed
5. Coordinated across attack points
6. Very low to zero target down time

Hence the consequence: many organizations operate for years without knowing that they have been breached.

The phishing attack cycle

• Target user / subset of users determined (e.g. via social engineering).
• Repeated different email if the first is ignored/deleted.
• Downloaded malicious payload (e.g. a backdoor).
• Stealth needs to be maintained so that phase 1 can be repeated.

The spear phishing demo uses Kali Linux and the SET — Social Engineering Toolkit: Social-Engineering Attacks → Spear-Phishing Attack Vectors → option 2 to create a FileFormat payload → type 5, which creates a Word document that will overflow a buffer and enable us to put a listener or rootkit on the victim's machine → then choose the listener (aka rootkit, aka payload), type 5 to get the Metasploit meterpreter → after the listener's IP and port are entered, SET creates the malicious file template.rtf.

The Targeted Attack Model — seven numbered steps

1. Attacker initiates the targeted attack by sending phishing emails with malicious attachments (DOC, PDF, XLS).
2. User interacts with an email.
3. System is compromised.
4. Remote management and administration tools are deployed on the infected system.
5. Other machines are attacked and compromised.
6. The infected network is used to reach sensitive information and critical data.
7. Data is exfiltrated from remote machines.

Intelligence gathering and threat modeling

Case study 1 — the RSA breach (March 2011)

• RSA had a data breach; the attacker stole information which affected some 40 million two-factor authentication tokens.
• The devices are used in private industry and government agencies and produce a 6-digit number every 60 seconds.
• The method: spear phishing with a backdoor APT. Attackers sent two different targeted phishing emails to four workers at RSA's parent company EMC.
• The emails contained a malicious attachment identified in the subject line as "2011 Recruitment plan.xls".
• When one of the four recipients clicked on the attachment, it installed a backdoor — Poison Ivy.

Case study 2 — Shadow Force and DLL hijacking

The general technique

• Windows has a search path for DLLs (the Dynamic-Link Library Search Order), similar to $PATH for executables.
• The attacker's objective is merely to figure out where to place a hostile DLL in the earlier part of the search path.
• Rename the hostile DLL as a legitimate system DLL.
• When Windows searches for the legitimate DLL, it will locate the hostile one and use this instead.

The actual Shadow Force attack, step by step

1. Windows starts the MSDTC (Microsoft Distributed Transaction Coordinator) service, which coordinates transactions that span multiple resource managers, such as databases, message queues and file systems. On start it searches the registry.
2. Specifically, the MTxOCI component in MSDTC searches for three DLLs: oci.dll, SQLLib80.dll and xa80.dll. oci.dll is from an Oracle installation — so on a machine with no Oracle, it will simply never be found.
3. The attacker creates a backdoor component, renames it oci.dll, and places it in %SystemRoot%\system32\.
4. The attacker uses a remote job command to kill the MSDTC service — taskkill /im msdtc.exe /f — causing MSDTC to reload itself.
5. The reloaded MSDTC now looks for and finds the hostile oci.dll. Calling this DLL opens up Shadow Force.

The variants and the clever bit

• Shadow Force has variations in DLL and EXE formats, 32-bit and 64-bit. The variation depends on install.exe: if it runs in 32-bit mode it downloads SuperBot.exe, otherwise SuperBotx64.exe.
• The .exe version connects to a C&C server (irc[.]itembuy[.]org) like a normal IRC bot.
• The DLL version downloads and installs npf.sys — which comes from the open source project Wireshark, a well-known network protocol analyzer. Therefore npf.sys has a valid signature and can be loaded in Windows, to be used in capturing network packets.

Anatomy of an APT attack — the five components

1. Malware Infection Frameworks
2. Browser Exploit Packs and Glype Proxies
3. RATs and Rootkits
4. Morphing and Obfuscation Toolkits
5. Interface with an Underground Market

On that last point: TheRealDeal Market appeared in March 2015 and is focused on commercialization of zero-day exploits; the marketplace is hosted on the popular TOR network.

APT targets

And the current example: Salt Typhoon — an alleged attack on US ISPs; the attack group is tracked as Salt Typhoon, FamousSparrow, GhostEmperor.

Quasar RAT — the demo tool

• It demonstrates remote management and administration in the targeted attack model — your platform is the C&C server.
• Settings: decide the port to listen to, then start listening for any connection to that port.
• Builder → Basic settings: name the client tag and set a Mutex, which ensures only one instance runs on a system.
• Connection settings: specify the attack machine's port number and IP address — and remember to port forward.
• Installation settings (where to install the RAT on the client's machine), Assembly settings (how you want the file to look), Monitor settings (keyboard logging).
• Then build the client and install the executable on the victim machine — via phishing email, USB dropping etc.

Defence: the dual protection strategies

The relationship between them: boundary protection is a necessary but not sufficient condition for Agile Defense.

Agile Defense measures

• Compartmentalization and segregation of critical assets
• Targeted allocation of security controls
• Virtualization and obfuscation techniques
• Encryption of data at rest
• Reconstitution to known secure state after failure

Preventive solutions — the three columns

15 · The night-before cram sheet