Cybersecurity Blog

Using Command Line Interface in Kali Linux

Hello everyone! Today, I'd like to discuss my experience using the Command Line Interface (CLI) in Kali Linux!

Command Line Interface: a text-based tool that allows users to interact with computer software by typing commands. Using commands, users can perform tasks such as navigating files, running programs, and configuring settings.

Kali Linux: a Linux operating system (os) designed for ethical hacking and cybersecurity. This operating system comes with pre-installed software tools used for tasks such as network analysis, vulnerability seeking, and system security assessments,

Using Commands

Here is a link to my Kali Linux and CLI lab >> Link. I was able to test out a plethora of basic commands!

Sudo: Stands for "SuperUserDo", and is used to grant users admin rights and full control over system resources.

Grants user "root" access to the computer system.

pwd: Stands for "print working directory", and is used to show users the directory or folder that they are currently in.

Each "/" separates a directory. After the last "/" shows the directory (folder) that you are currently in.

ls: Stands for "list", and is used to show users a list of all the folders and or files within a directory.

Simply type "ls" into the terminal, and all of the folders and files within your current directory will be listed.

cd: Stands for "change directory", and allows a user to move to another directory.

Utilize the "ls" command to provide you with a list of all possible directories to enter, then use the "cd" command to choose one.

Thanks!

Sandboxing with Windows 10

Hello All! Welcome back to my cybersecurity blog! Today I will be experimenting in VirtualBox on a Windows 10 iso, testing out different types of malware.

Here is a link to my "Sandboxing Malware Lab" if you want to follow along with me. >> Link

Virtual Machine: A software-based emulation of a physical computer that can run operating systems like a real machine.

Virtualbox: A free and open-source software application used for running virtual machines.

Windows 10 iso: A file that contains all the installation data for the Windows 10 operating system.

Malware: A software designed to harm a computer system or network.

Disabling "Virus and Threat Protection"

Before downloading malware onto the virtual machine, it is important to disable all "Virus and Threat Protection" options in Windows Security.

Disabling all options will maximize the potential of malware harming the virtual machine. We want this!

Ransomware

The first malware that I downloaded was ransomware.

Ransomware is a type of malware that locks/encrypts your files or computer system and demands payment to restore access.

*Note: Although ransomware may promise restored access after payment, this doesn't guarantee that you will be granted access after paying. Payment isn't the optimal way of resolving a ransomware attack.

Findings

Upon downloading the ransomware, I noticed my virtual machine...

- Began slowing down in performance.
- Applications become inaccessible.
- The ransomware page kept popping up, making it extremely difficult to open other applications and tabs.
- The Windows Home Screen was changed to a ransomware message.
- My .jpeg files extension was changed to end in .WNCRY

Trojan

The second and last malware that I downloaded was a Trojan/Adware.

Trojans are a type of malware that appears as a trustworthy program/application but secretly causes harm to your system.
Adware is software that shows unwanted ads on your machine. Although usually harmless, adware can still interfere heavily with the user experience.

*Note: A great preventative measure against unintentionally downloading a Trojan application is running it through a malware analysis tool such as VIRUSTOTAL before opening it. Malware analysis tools check for malware within a file.

Findings

Upon downloading the ransomware, I noticed my virtual machine...

- Began slowing down in performance.
- Files that I didn't download began appearing in my files.
- Applications that I didn't download began to appear in my downloads.
- It didn't show up for me, but my browser was supposed to show an insulting message every time I tried to use it.

Remediation

In the case that you accidentally download malware, and begin to experience the indicators of an infected system such as...
- Slowed system performance
- Pop-ups and unwanted ads
- Increased network activity
- Crashes
A good first action on a Windows operating system would be to run a "virus and threat protection" scan. This will let you know if there is malware on your machine, and the type of malware it is.

My official first step in remediation was going through my files and deleting any files I suspected contained malware, or files I didn't recognize.

The next step was to run scans on the system to wipe out the malware. I started with a "Microsoft Defender Offline Scan", which checks your computer for malware while the system isn't fully running. This makes it easier to detect hidden threats that typical scans fail to detect.

*Note: I ran this scan about three different times. These scans don't take too long. The longest scan process in my findings was the "full scan".

Findings

Upon running multiple scans through my virtual machine...

- The malware was successfully removed from my system.
- Windows security was unable to detect any threats in my system.
- My machine's performance improved, and no more crashes occurred.

*Note: Running multiple scans until zero threats are detected at least 3 times is the strongest indicator that your system no longer has malware.

Thanks!

Malware Analysis

Welcome Back! Today I will be discussing "VIRUSTOTAL", a tool used for malware analysis!

Here is a link to my "Malware Analysis" lab assignment >> Link

To the left is the application tool I used to import files and scan them for malware. This tool is great if you ever plan on downloading a file, and are unsure if it is safe to open.

I visited Malware Bazar in order to retrieve and download my infected files, and imported each file to VirusTotal.com.

In scanning some of the files, the website gives detailed descriptions of the files that you import, alongside information about the type of malware infecting the file.

Thanks!

Password Cracking

Hello everyone! Today, I will be Password Cracking!

Here is the Link to the lab to follow along! >>> Link

Goal: Hack into the Raspberry Pi server!

***The images below provide us with the necessary information to hack into the server. Let's analyze them closely.

***The images above provide us the necessary information to hack into the server. Let's analyze them closely.

Image 1

Image 2

In analyzing this message, we receive the objective of our mission from "Agent Hakhter".

We must retrieve the secret code to successfully enter the server.
Create our own folder and leave a secret message within it. ***Must notify Agent Hakhter that the server has been hacked.***

Looking at this image, we see that the server has searched their IP address. From this we know...

The public IP address is 165.155.130.24
*** Because we are seeking to gain access to the server, we need to obtain the private IP address.***

Image 3

This image holds lots of sensitive information, including...

MAC address: b8 : 27 : eb : eb : 42 : 6b
Broadcasting IP address: 10 . 197 . 151 . 255
Private IP address: 10 . 197 . 145 . 185 ***The Private IP is important upcoming commands that we will run***

Password-cracking via Dictionary Attacks

Vocabulary

Brute Force Attack: a trial and error method of password cracking, which involves using every possible combination to hopefully retrieve a password.

SSH: a network protocol that secures remote access through encryption (the successor of Telnet).

***To the left is a regular login attempt via SSH***

Command: sudo ssh Hakhter@10.197.145.185

Sudo: Grants administrative rights

ssh: Allows you to remotely access a server securely.

Hakhter: The hostname of the server.

@10.197.145.185: The private IP of the server.

Dictionary Attack

Vocabulary

Dictionary Attack: a method of password crack that involves referencing a list of values (typically previously known passwords) to guess someone's login credentials. This attack is more accurate and faster than a brute-force attack.

***To the left is a regular login attempt via SSH***

Command

[sudo ssh Hakhter@10.197.145.185]

( Green sections must be modified to align with the system you are attempting to access remotely.)

What is going on in this image?

We are attempting to SSH into a server by guessing the password. All we needed was the hostname and private IP address of our target.
In this, you can see the failed login attempts.

Dictionary Attack (Continued)

Now, we move on to the dictionary attack!

What is "hydra"?

Hydra is a popular software tool used to run through a list of values quickly. Hydra is used in brute force and dictionary attacks and is commonly used in cybersecurity.