Kali/Workflow - Revision history

Admin: /* Flags */

2016-08-23T07:00:15Z

Flags

← Older revision		Revision as of 07:00, 23 August 2016
Line 73:		Line 73:

	{{KaliAttackLayersFlag}}		{{KaliAttackLayersFlag}}

			{{KaliFlag}}

	[[Category:August 2016]]		[[Category:August 2016]]

Admin: /* Transport Attacks (Layer 4 Attacks) */

2016-08-19T18:59:39Z

Transport Attacks (Layer 4 Attacks)

← Older revision		Revision as of 18:59, 19 August 2016
Line 64:		Line 64:
	==Transport Attacks (Layer 4 Attacks)==		==Transport Attacks (Layer 4 Attacks)==

	~~Not sure~~ what ~~kind~~ of ~~attacks these would include~~.		Layer 4 is the transport layer. This is the layer that specifies how packets get routed through systems, what information packets are required to have, and how computers treat different kinds of packets. Attacks on the transport layer can be intended to jam up the normal workings of the transport layer, creating a denial of service, as in a [[SYN Flood]].

	==Session Attacks (Layer 5 Attacks)==		==Session Attacks (Layer 5 Attacks)==

Admin at 08:32, 19 August 2016

2016-08-19T08:32:34Z

← Older revision		Revision as of 08:32, 19 August 2016
Line 72:		Line 72:
	=Flags=		=Flags=

	{{~~KaliFlag~~}}		{{KaliAttackLayersFlag}}

	[[Category:August 2016]]		[[Category:August 2016]]

Admin: /* Physical/Data Attacks (Layer 1 and Layer 2 Attacks) */

2016-08-19T08:13:53Z

Physical/Data Attacks (Layer 1 and Layer 2 Attacks)

← Older revision		Revision as of 08:13, 19 August 2016
Line 29:		Line 29:
	* Network attacks - these attacks occur on the network layer (i.e., IP addresses, Layer 3, Network). These attacks are conducted by an attacker who is on the same network as the sheep. ARP spoofing is an example of an attack at the network layer.		* Network attacks - these attacks occur on the network layer (i.e., IP addresses, Layer 3, Network). These attacks are conducted by an attacker who is on the same network as the sheep. ARP spoofing is an example of an attack at the network layer.

	Different kinds of ~~physical~~ attacks:		Different kinds of Layer 1/Layer 2 attacks:
	* Deauth attacks - using aircrack-ng or besside-ng to listen for and capture handshake packets for offline cracking, usually deauthing nearby clients.		* Deauth attacks - using aircrack-ng or besside-ng to listen for and capture handshake packets for offline cracking, usually deauthing nearby clients.
	* Rogue AP attacks - using airobase-ng or other tool to create a fake AP, with the intention of tricking clients into revealing wifi credentials.		* Rogue AP attacks - using airobase-ng or other tool to create a fake AP, with the intention of tricking clients into revealing wifi credentials.

Admin: /* Attack Procedure */

2016-08-19T08:00:13Z

Attack Procedure

← Older revision		Revision as of 08:00, 19 August 2016
Line 14:		Line 14:
	* Determine your initial starting layer (e.g., a foreign wireless network starts at Layer 1, while another computer on a local area network starts at Layer 3).		* Determine your initial starting layer (e.g., a foreign wireless network starts at Layer 1, while another computer on a local area network starts at Layer 3).
	* Gather information, reconnoiter the situation. What kind of hardware/device/router are you looking at? What version? Is there a default username/password? Is the network busy and in use, or is it dead quiet? Is there an IDS or IPS system on the network? Are there any zero-day vulnerabilities or CVEs? What operating system is running on each device on the network?		* Gather information, reconnoiter the situation. What kind of hardware/device/router are you looking at? What version? Is there a default username/password? Is the network busy and in use, or is it dead quiet? Is there an IDS or IPS system on the network? Are there any zero-day vulnerabilities or CVEs? What operating system is running on each device on the network?
	* Tally potential footprints and records you may create in logs, client lists, etc. What information will be revealed, and how ~~soon~~?		* Tally potential footprints and records you may create in logs, client lists, etc. What can be removed, and what cannot? Is additional access required to modify logs? If information is left behind, what information will be revealed, and how promoptly?
	* Utilize the information to formulate an initial attack plan. Determine the tools required for the attack plan.		* Utilize the information to formulate an initial attack plan. Determine the tools required for the attack plan.
	* Carry out the attack, and revise the attack plan based on results. Continue until access is achieved.		* Carry out the attack, and revise the attack plan based on results. Continue until access is achieved.

Admin: /* Review of Network Stack */

2016-08-19T07:59:04Z

Review of Network Stack

← Older revision		Revision as of 07:59, 19 August 2016
Line 8:		Line 8:

	{{NetworkStack}}		{{NetworkStack}}

			==Attack Procedure==

			Whatever level you happen to be trying to attack at, it's important to follow a procedure. My procedure looks something like this:
			* Determine your initial starting layer (e.g., a foreign wireless network starts at Layer 1, while another computer on a local area network starts at Layer 3).
			* Gather information, reconnoiter the situation. What kind of hardware/device/router are you looking at? What version? Is there a default username/password? Is the network busy and in use, or is it dead quiet? Is there an IDS or IPS system on the network? Are there any zero-day vulnerabilities or CVEs? What operating system is running on each device on the network?
			* Tally potential footprints and records you may create in logs, client lists, etc. What information will be revealed, and how soon?
			* Utilize the information to formulate an initial attack plan. Determine the tools required for the attack plan.
			* Carry out the attack, and revise the attack plan based on results. Continue until access is achieved.
			* Advance up to the next layer. Rinse and repeat.

	==Physical/Data Attacks (Layer 1 and Layer 2 Attacks)==		==Physical/Data Attacks (Layer 1 and Layer 2 Attacks)==

Admin: /* Physical/Data Attacks (Layer 1 and Layer 2 Attacks) */

2016-08-19T07:52:11Z

Physical/Data Attacks (Layer 1 and Layer 2 Attacks)

← Older revision		Revision as of 07:52, 19 August 2016
Line 10:		Line 10:

	==Physical/Data Attacks (Layer 1 and Layer 2 Attacks)==		==Physical/Data Attacks (Layer 1 and Layer 2 Attacks)==

			{{Main\|Kali/Layer 1 Attacks}}

			{{Main\|Kali/Layer 2 Attacks}}

	In the beginning, you're scanning the attack surface and looking for your attack vector. For wireless specifically, we have a couple of different layers of attack, and means of doing so.		In the beginning, you're scanning the attack surface and looking for your attack vector. For wireless specifically, we have a couple of different layers of attack, and means of doing so.

Admin: /* Network Attacks (Layer 3 Attacks) */

2016-08-19T07:47:55Z

Network Attacks (Layer 3 Attacks)

← Older revision		Revision as of 07:47, 19 August 2016
Line 27:		Line 27:

	==Network Attacks (Layer 3 Attacks)==		==Network Attacks (Layer 3 Attacks)==

			{{Main\|Kali/Layer 3 Attacks}}

	Let's suppose you found a wifi network, and you have obtained wifi credentials. What comes next?		Let's suppose you found a wifi network, and you have obtained wifi credentials. What comes next?

Admin: /* Network Attacks (Layer 3 Attacks) */

2016-08-19T07:42:04Z

Network Attacks (Layer 3 Attacks)

← Older revision		Revision as of 07:42, 19 August 2016
Line 45:		Line 45:

	If you want to tamper with traffic, or view images passing through a traffic stream live, use... [[Ettercap]]?		If you want to tamper with traffic, or view images passing through a traffic stream live, use... [[Ettercap]]?

			==Transport Attacks (Layer 4 Attacks)==

			Not sure what kind of attacks these would include.

			==Session Attacks (Layer 5 Attacks)==

			True session hijacking occurs at level 5, which is the layer at which computers are maintaining connections with each other.

	=Flags=		=Flags=

Admin: /* Network attacks */

2016-08-19T07:40:46Z

Network attacks

← Older revision		Revision as of 07:40, 19 August 2016
Line 26:		Line 26:
	(The wired network equivalent would be a physical network tap.)		(The wired network equivalent would be a physical network tap.)

	==Network ~~attacks~~==		==Network Attacks (Layer 3 Attacks)==

	Let's suppose you found a wifi network, and you have obtained wifi credentials. What comes next?		Let's suppose you found a wifi network, and you have obtained wifi credentials. What comes next?