Gaining Access

Once the target has been scanned and any vulnerabilities and potential access points have been identified, the gaining access phase begins. If the reconnaissance and scanning aspects have been thoroughly carried out, you should have a good understanding of the targeted environment, such as the network ranges, operating systems, and services running in the network. With this knowledge, you can begin attacking the network and attempting to gain access to the target environment. Generally, if the previous steps have been undertaken correctly, the attack to gain initial access should go smoothly.

In this chapter, we will cover the following main topics:

• Social engineering
• Phishing
• IP address sniffing and spoofing
• Code-based attacks
• Exploiting services
• Exploiting cloud services
• Gaining access exercise and best practices

Technical requirements

To follow along with this chapter, you will need the following:

• Kali Linux 2022.1 or later
• Metasploitable 2
• Bed
• Hydra (or THC Hydra)
• John the Ripper
• Pass-the-hash (PtH) tools
• SQLMap
• XSSer
• Wireshark
• macchanger

Social engineering

Social engineering is the process by which an unknown entity or person gains access to or trust within an organization or another person. This trust is used to gain access to information or data that can help the entity infiltrate the environment or the other person’s information. For example, they pretend to be upper management, a recruiter, an old friend, a help desk, a customer, a services provider, or any other regular entity to initiate this communication. Once convinced, the victims are asked to provide sensitive information, reset their passwords, open email attachments, accept remote access, or any other activity that will result in the entity gaining access to the environment.

Social engineering is based on human intuition to trust and work with others. Nowadays, it is more popular, as people tend to publish personal information on the internet and social media. This information can be used to target individuals or organizations. Furthermore, it...

IP address sniffing and spoofing

Sniffing and spoofing are two related processes that can work hand in hand when analyzing and exploiting a network. Sniffing involves monitoring all data packets going through the local area network (LAN), while spoofing involves introducing fake traffic in the network to present to someone else.

Many tools are used for sniffing and spoofing. In this section, we will look at two of the most commonly used by attackers: Wireshark and macchanger.

Wireshark

Wireshark (https://www.wireshark.org/) is an open source tool and one of the most common network analyzers that can be used to see what is happening in a network. Its network monitoring capabilities allow you to see details about all traffic passing through, such as time, source, destination, protocol, length, and more. By default, Wireshark is installed in Kali Linux; you can use the Wireshark command in a Terminal to launch the Wireshark GUI. The following screenshot shows an example of Wireshark...

Code-based attacks

Code-based attacks imply using vulnerabilities or weak/unsecure coding practices that can lead to exploitable applications. These exploits can allow attackers to modify or run executables or commands that result in gaining access to the system, reading data, modifying data, and more. In this section, we will discuss two very common types of attacks: buffer overflow and format string attacks.

Buffer overflow

Buffer overflow is one of the most common code-based attacks. It simply sends more or additional data into applications that don’t parse inputs. It works by moving data into memory if the applications don’t have a proper way to do limit checking and parsing on data. A simple example of a buffer overflow attack is a login page that is expecting an input of 8 bytes. If you send more than 8 bytes of data, the additional data will be written to an overflow buffer. This overflow buffer would be a piece of memory that is allocated to a different...

Exploiting services

Exploiting services and systems is one of the most common methods used to test gaining access to an environment. These types of exploitations count as misconfigurations or weak configurations that can be exposed for access. We will talk about a few common methods in the following subsections:

• Password cracking
• Pass-the-hash attacks
• Web app attacks

Password cracking

Password cracking attacks are one of the most popular methods used to exploit services. The minute you publish any service publicly, you will notice attackers trying to gain access to the service using one of the many password-cracking methods available.

Passwords used to be the first and only defense mechanism to protect access to services and systems. Lately, most organizations have gradually started to configure and enforce multi-factor authentication (MFA) to reduce the risk of password-cracking attacks and techniques. However, you might be surprised that password cracking...

Exploiting cloud services

The methods, techniques, and tools explained in this chapter can be used for services or applications hosted in the cloud, specifically Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS). These types of cloud architecture usually expose applications or services in close similarity to the on-premises environment and therefore are prone to the same types of attacks.

SaaS services within the cloud usually require different tools and techniques. One example is checking for weaker protocols implemented in such a setup and looking for a way to bypass the controls implemented – for example, bypassing MFA when legacy protocols are enabled.

Common vulnerabilities or misconfigurations in cloud services can be exploited. The following are a few examples:

• Incomplete or lack of MFA: Account passwords are vulnerable to theft or cracking when using some of the tools and techniques mentioned earlier in this chapter. The lack of or incomplete...

Exercises on gaining access

As you work through the gaining access phase, please keep in mind that this stage is where you begin using what you learned and the information you collected during the reconnaissance and scanning phases to exploit openings, weaknesses, and vulnerabilities to gain access to environments. During this phase, you have initial access to the environment.

The following list of activities aims to give you a feel for using the tools. Please remember to stay ethical and don’t conduct these activities on any organization that would be deemed illegal.

IP address sniffing and spoofing:

• Try to use Wireshark to monitor network communications
• Try to use macchanger to spoof MAC addresses within a network

Code-based attacks:

• Try to use the Bed tool to find potential buffer overflow and format string exploits on applications

Exploiting services:

• Password cracking:
  • Try to use Hydra (both the command line and GUI) for dictionary...

Summary

In this chapter, we covered a few options to exploit services so that we can gain access to environments. We started by explaining social engineering and phishing techniques. Then, we worked through the various tools that can be used for IP address sniffing and spoofing, as well as code-based, password cracking, web apps, and cloud services exploitations.

In the next chapter, we will talk about how to maintain and retain access to an environment.