namishelex01

Core Information Security

• What is information security and how is it achieved?

• What are the core principles of information security?

• What is the CIA triangle?

• What is non-repudiation (as it applies to IT security)?

namishelex01

-------------------------------------
INITIAL ACCESS
-------------------------------------

$ Drive-by Compromise
A drive-by compromise is when an adversary gains access to a system through a user visiting a website over the normal course of browsing.
Multiple ways of delivering exploit code to a browser exist, including:
    > A legitimate website injected with JavaScript, iFrames, XSS.
    > Malicious ads
    > Built-in web application interfaces (e.g. forum posts, comments, and other user controllable web content)

namishelex01

CAM table Poisoning
Content Addressable Memory table poisoning attack on network switches. 
This attack intends to corrupt the entries in the switch's CAM table so that the network traffic will be directed, causing a DoS attack attack situation

ARP Cache Poisoning-Based MiM
Introducing a spurious IP address to MAC address mapping in another host's ARP cache.

Abnormal ARP Traffic Detection

namishelex01

> WordPress Plugin Quizlord 2.0 - XSS	
> WordPress Plugin Jibu Pro 1.7 - XSS	
> phpMyAdmin 4.7.x - XSRF	
> WordPress Plugin Plainview Activity Monitor 20161228 - (Authenticated) Command Injection	
> Responsive FileManager < 9.13.4 - Directory Traversal	
> LiteCart 2.1.2 - Arbitrary File Upload	
> Gleez CMS 1.2.0 - XSRF (Add Admin)	
> WordPress Plugin Gift Voucher 1.0.5 - 'template_id' SQLi	
> UltimatePOS 2.5 - RCE	
> Twitter-Clone 1 - 'code' SQLi	

namishelex01

RSA 2017 DevOOPS: Attacks And Defenses For DevOps Toolchains Talk Links  SessionID: HTA-W02

https://www.slideshare.net/chrisgates/devoops-attacks-and-defenses-for-devops-toolchains

Recording of talk from CERN
https://indico.cern.ch/event/622483/  (click the recording button)

Past talks:
http://www.slideshare.net/KenJohnson61/aws-surival-guide

namishelex01

Main Project Page -> github.com/corelan/mona

Download the file and save it to this typical location -> 
C:\Program Files\Immunity Inc\Immunity Debugger\PyCommands

BASIC USAGE :
!mona in the input box and press enter
For more information = Open log window (ALT-L)

For Help options ->

namishelex01

[Learning Exploit Development from fuzzysecurity.com]
Tools Needed:-
> Immunity debugger
> Mona.py
> Pvefindaddr.py
> Metasploit
> Virtual Box

Overflows to play with:-
1. Buffer overflow - A memory location receives more data than it was meant to

namishelex01

[This is the gist version of the wiki page of Shellcode.]
[For elaborated explaination, please visit:- en.wikipedia.org/wiki/Shellcode]
SHELLCODE is a small piece of code used as the payload in the exploitation of a spftware vulnerability
Its called shellcode because it typically starts a command shell from which attacker can control the compromised machines
TYPES:
  Local - Used by attacker who has limited access to a machine but can exploit a vulnerability
  Remote - Used to target a remote machine, if the shellcode establishes the connection, it called reverse-shell or connect-back shell.
           If attacker establishes the connection, shellcode is called bindshell because it binds certain port of victim's machine
  Download & execute - Type of remote shellcode that downloads and executes some form of malware on target system
  Staged - When amount of data that an attacker can inject into the target process is too limited to execute useful shellcode directly, it may be possible to execute it in stages

namishelex01

Bluetooth technology
> bluetooth basic rate/enhanced data rate
 >> High speed
> Low energy 
> Attribute protocol/ generic attribute profile

------------
V2.1 - 2007 + EDR | secure device pairing by button press
V3.0 - 2009 + HS | MAC/PHY
V4.0 - 2010 + LE 

namishelex01

CISSP Notes

CIA Triad

• Confidentiality
  • Resources should be protected from unauthorized access
  • Prioritized by governments
  • Concepts
    • Sensitivity
      • How harmful is disclosure
• Discretion