Vulnerability Analysis in Android Applications (1)
1. Introduction and Objectives According to “OWASP Mobile Security Testing,” the phases for conducting a pentest on a mobile application are as follows: In this article, we will learn the basics and methodology of manual static analysis of Android applications. We will not use automated vulnerability detection tools for this purpose. Instead, we will demonstrate this process using a specific example. 2. Setting Up the Analysis Environment The first step is to create and set up a secure and suitable analysis environment. The tools you’ll need to set up are as follows: By setting up this environment, you’ll have access …
Covering Tracks After an Intrusion
1. Introduction and Objectives This phase, not covered in the cycle of “professional ethical hacking” but indeed in “Red Team Operations,” is necessary to gain a deeper understanding of the MITRE methodology used by many black/grey hats. Furthermore, it’s also valuable for those tasked with performing forensic analysis on the victim system. After the attacker has completed their intrusion into the victim system, they should erase their tracks by deleting system event log files, as well as other specific programs and services that were used for exploitation. This action makes detection and forensic analysis more challenging. During a “Red Team …
Man In The Middle (MITM): Capturing Credentials with SSLStrip2 and Delorean
Introduction and Objectives This attack, as its name suggests, involves positioning oneself in the middle of the data transmission between the machines that make up the network and the router. Its main objective is espionage, capturing sensitive data that flows through the network, obtaining access credentials to devices and user accounts for potential privilege escalation, conducting subsequent phishing attacks by knowing the websites that organization users frequently visit, using a “remote browser” attack, among many other intriguing activities. Initially, we will use basic auditing tools to conduct an attack of this kind. These tools are “ettercap” and “Wireshark”. With “ettercap,” …
Netcat, Cryptcat, and Ncat: The Swiss Army knives of hacking.
Introduction and objectives We are going to study the functioning and behavior of these tools, which provide the pentester with a range of opportunities in system auditing. You can download them from the following links: In the practical exercise we are going to perform in this article, we will learn how to obtain a remote machine’s command shell by using these tools. Subsequently, we will also conduct a study of the network traffic generated using each of these tools, with the aim of understanding communication security. Obtaining a “bind shell” in a LAN. a) Machines used for the practice To …
Analysis of the EvilPDF tool
Description and installation of EvilPDF We are going to study the operation of this tool, which provides the user with the ability to embed an executable file in a PDF document. In its Github repository it is defined as such, although it is not really the most accurate definition, as we will see throughout the analysis. The tool can be found in its github repository. https://github.com/JAYMONSECURITY/evilpdf As we can see below, the project consists of several files, the most important of which are the following: The first thing we are going to do is to follow the instructions to download …
Understanding a DNS Spoofing + Phishing Attack
What is a DNS Spoofing and Phishing attack? The term “Spoofing” refers to “spoofing” carried out by a cyber attacker using various techniques to falsify data in a communication. Thus, a DNS spoofing attack is the forgery of an IP address (spoofing) when a name resolution query is made to the Domain Name System (DNS). Therefore, if we launch a “DNS Spoofing” (Domain Name System) attack, what we are doing is that, when the victim enters a web address (domain name) in their browser, such as “www.google.com”, this is redirected to another web address (to another domain name) previously established …
Understanding a DNS Spoofing Attack + Evilgrade
What does this type of attack consist of? One of the most dangerous attacks that we can encounter is the self-downloading and execution of malicious software without user interaction. With an attack of these characteristics an intrusion can be made in any type of system, even if it is at its last version and completely patched, not presenting any type of vulnerability more than the one that represents in itself the ignorance of the own user. Design of the attack and tools used To demonstrate this attack we are going to use the “Evilgrade” framework. As a brief description of …
Latest News
