Introduction to NMAP!

So what exactly is nmap? Nmap is a linux-based (though now available on windows as well)  terminal/command-line application used for port scanning, as well as vulnerability scanning. NMAP can also detect Operating systems and OS versions.NMAP can also be used to detect Operating systems and OS versions as well as MAC address (and by using the “Organizationally Unique Identifier” within the MAC address it can then in turn tell you the device type as well). Focusing in on the scanning aspect, NMAP comes with a plethora of different options for the types of scans it can do and the settings associated with those scans.

-sS scan stealth scan -  The key difference of a stealth scan from a regular scan is that it does not complete the 3 way tcp handshake. A successful 3way tcp handshake is what would normally occur as the result of a normal (non-stealth) port scan, but the problem with that is that it gets saved in network monitoring logs, triggering alerts and giving the defensive/blue team the upper hand in spotting you as the pentester. The goal of the stealth scan is just that. To go in unnoticed as you compile information about the target system and sneak out without ever having been detected.

The stealth scan begins with the sending of a SYN packet to the victim/target machine, with the victim/target machine then responding back with a SYN/ACK packet, at which point the attacking machine returns back an RST or RESET packet ( a packet which signifies that it will not accept or receive any more data). This is in contrast to our attacking machine returning an ACK packet to the victim/target, which which would instead mark the completion of the data/packet transfer process as part of the normal non-stealth scan process. As we talk about SYN, SYN/ACK, ACK and RST packets, we are referring to data that can be viewed in a packet sniffer/network traffic analyzer such as the very common Wireshark (shown in screenshot below).

In essence, because the data transfer was never fully completed in the scenario we are referring, it’s not easily detectable, even by the defense. An even better breakdown of how NMAP’s popular stealth scan works can be found right here from the official NMAP site: https://nmap.org/book/synscan.html .For a listing and explanation of all the types of scans NMAP can run, this link is a great resource: https://nmap.org/book/port-scanning-options.html But I would be remiss if I failed to mention that the manual that is built in with NMAP is a highly-detailed and very helpful resource as well. Just be ready to do some reading because it is stacked with details. The command is man nmap Here is a screenshot from the man nmap built-in manual discussing port statuses in NMAP's outputs after a scan:

A handy cheat sheet of all different types of Nmap options (beyond just scans) can be found here:

https://www.tutorialspoint.com/nmap-cheat-sheet

In Pursuit of the Pentest+

                                                     

Hello all!

It's been some time since I have updated this blog, so I thought I would get everyone up to speed with my current status in my IT journey. Having now obtained 3 certifications (A+,Net+, and Sec+) and amassed 5 years of IT Support experience, I decided that the best move from here certification-wise toward my ultimate goal of breaking into the InfoSec realm would be pursuing the CompTIA Pentest +. While the Sec+ covered the basic foundation of essentially all aspects of infosec, the Pentest+ focuses on, obviously, pentesting specifically (ethical, red-team-type offensive hacking). Everything from planning an engagement in the administrative sense to doing passive and active reconnaissance/research of a target prior to the pentest, laying out the scope, length, etc of what the pentesting will include) to running port/vulnerability scanners like NMAP and Nessus to using many dozens of specific tools of the trade in an offensive hacker's arsenal. A large amount of the apps that are covered are included in a pentesting-specific distro of linux known as Kali. This distro includes many different tools and breaks them all up by category (wireless, packet sniffing/packet capture, social engineering, honeypots, etc).

A plethora of tools are covered in the Pentest+. They include:

Scanners - Nikto - OpenVAS - SQLmap - Nessus 
Credential testing tools - Hashcat - Medusa - Hydra - Cewl - John the Ripper - Cain and Abel - Mimikatz - Patator - Dirbuster - W3AF -
Debuggers - OLLYDBG - Immunity debugger - GDB - WinDBG - IDA -
Software assurance - Findbugs/findsecbugs - Peach - AFL - SonarQube - YASCA 
OSINT - Whois - Nslookup - Foca - Theharvester - Shodan - Maltego - Recon-NG - Censys -
Wireless - Aircrack-NG - Kismet - WiFite -
Web proxies - OWASP ZAP - Burp Suite -
Social engineering tools - SET - BeEF -
Remote access tools - SSH - NCAT - NETCAT - Proxychains -
Networking tools - Wireshark - Hping -
Mobile tools - Drozer - APKX - APK studio -
Miscellaneous tools  - Searchsploit - Powersploit - Responder - Impacket - Empire - Metasploit framework 

*taken from the Comptia Pentest Objectives list

This, among many other topics make up the Pentest+. It is becoming a competitive market for cybersecurity/infosec certifications and some hold more weight than others, but cost, current experience, and time commitment all factor in when deciding which one is right for you. I chose Pentest+ because I felt it was a great compilation of all the tools and concepts one would need to build an initial foundation in offensive security. It tells you what you need to be aware of and implores you to lab it up with each of the tools. While it may not be the most advanced certification out there or run you through a real-word hacking scenario simulation as part of the exam like some others do (It's all multiple choice and drag and drop-type simulations), it felt like a good grounding in the concepts, a perfect fit for me as someone on a little bit of a budget (competing certs can run twice as much, if not more..that could amount to $1,000-$1,500 for a pass or fail test, whereas the Pentest+ is a modest $370). As of the writing of this post, Pentest+ is now in its second iteration, but I am currently studying objectives based around the first iteration as they mostly all carry over and resources for the 2nd iteration are still being created (ITPROTV is set to unveil their training for Pentest+ PT0-002 in December of this year, 2021, I believe). For a great comparison video on which entry-level infosec/pentesting cert might be right for you, you, check out this video by Daniel Lowrie https://www.youtube.com/watch?v=NjSZJ-IUhXI

But where does one go to "lab it up" exactly or to study for this exam in general?
I have previously relied on Udemy in part for my certifications, but have since moved on. Udemy is great for the price, but as VM lab-interactivity is needed more and more for exam objectives, I have found myself looking for a more interactive course.  A quick shoutout should always go to Professor Messer as far as free video courses go. On the free-ish side of things so far as InfoSec resources, many out there recommend www.tryhackme.com and www.hackthebox.com.

 My opinion is that tryhackme.com courses range from pretty decent to total garbage and I say that because there are some unforgivable bugs in some of their VM labs (passwords in the instructions that do not work, for instance). I paid temporarily for their premium service (which is required for most of their advanced courses), dropping it immediately upon realizing there was no actual support even for their paying members. If they ever learn how to run a business and support their end users, I might contemplate returning as a subscriber. Overall though, they have an impressive library of tutorials/VMs and different learning paths depending on what aspects of security you want to pursue. Hackthebox is known to be more advanced and when I looked into it, I found it intimidating and confusing for my relative n00b level of infosec knowledge. I moved on from it to find other alternatives and have not looked back. I finally settled on ITPRO.TV . You can pay $30 a month for video courses and practice tests or $50 a month to also have access to their VM labs which come with very detailed step by step instructions with screenshots at every single one of those steps. This is great for anyone starting out that may be new to some of the nuances that other online courses tend to gloss over. Also, consider reaching out to their support email to ask if there are any promotional specials and they just might give you a decent discount your first month. The VMs run simultaneously alongside each other so you can jump back in forth between them with ease. They have the VMs baked into the ITPROTV-partnered "practicelabs" site which is accessible via the Virtual Labs icon on ITPROTV's site interface (as opposed to using Virtual box/Fusion) and they run surprisingly fast considering I am on a machine with just 8gb of ram and a moderate 150mbps download speed internet connection. Their VMs, because they are browser-based/SAAS, work with both MacOS and Windows. In the Practice labs/Virtual Lab interface, you'll find a roster of several different virtual machines running different operating systems. One VM is a Windows server/domain controller, the other is a kali linux VM, the other a Windows 10 client machine. You will find yourself using these all in conjunction with each other throughout the labs. 

 I am roughly 30% through the objectives so far and have learned a lot. Daniel Lowrie teaches the Pentest+ course and is engaging and thorough in his teaching style. While there are alternative resources out there that you can get for free, you really do get what you pay for and when you sign up for ITPROTV, you can see where your money is going. They market themselves as "edutainers" which is refreshing in a world full of dull, dry, sleep-inducing tutorial videos. If I had to compare his teaching style to another, it would be Mike Meyers who I am also a big fan of. Time will tell if it is all paying off, but I am feeling more confident in my infosec knowledge every day and am happy to return day in and day out to keep learning with them. As a bonus, signing up with itprotv gives you not only access to the specific course you joined for, but ALL of their courses (and there are a TON!). A far better deal than CBT Nuggets, which is probably it's most similar competitor. As yet another added bonus, ITPROTV has a mobile app and even a Roku app for viewing their video courses. They also have email and chat support and they are very helpful, as I can attest to. Here's a link comparing the two sites (CBTNuggets and ITOROTV :

https://www.itpro.tv/compare/cbt-nuggets-vs-itprotv/

Stay tuned for an upcoming blog post on... NMAP!

Keylogging!

Today I utilized my first keylogger. A keylogger is an application which secretly records every key you press to a well-hidden text file for later viewing. This would be a good time to bring up something known in the Information Security world as ethical hacking philosophy. In a nutshell, this means understanding that with great power comes great responsibility. The responsibility to help make this world a better place, not a more dangerous and divided one. Techniques like this should not be used for petty gain or malicious purposes. What exactly constitutes ethical vs unethical can become blurred as white hat hackers (legal hackers tasked with protecting an organization or agency) attack back against blackhat hackers (illegal, criminal hackers with malicious intent who initiate a breach with the purpose of stealing data, shutting down a company's infrastructure, or compromising their target nation's national security.) So if a blackhat hacker set off the chain of events by stealing data or shutting down a company's infrastructure, and in response, a remote keylogger is placed on the attacker's machine by a whitehat hacker to gather data or access their system and stop the threat, is that considered ethical? How about using "honeying" methods to have a blackhat hacker open up a decoy file on your website or server containing a geolocation tracker that alerts you to where exactly in the world the attacker is based? I would argue that in both these cases, it is ethical as these techniques were not done pre-emptively, but rather in response to a malicious action. Many, though perhaps not all, top information security experts would agree.

My understanding so far of keyloggers is that many run on Python. Some can even be customized to automatically send the log of keystrokes to your email. After having spent some time experimenting with different ones and running into issues with several, I have settled on recommending the one at the link below, which features a custom Python script created by network/security expert and instructor, David Bombal:
https://www.youtube.com/watch?v=XKoTwepEzPI
Here is the link for his Python script:
https://github.com/davidbombal/CompTIA-Security-Plus/blob/main/python-keylogger

This video shows how you can use the author's custom-created Python script to log keystrokes on a Windows machine and have them automatically send to a text file. This involves downloading Python, creating a new project, and copying and pasting the code provided in the link in the video's description, then saving the file.

Important note: When downloading Python, check off all of the options for additional features in it's setup screen including "pip path". Afterward, hop into command prompt (run as admin) and type: pip install pynput This installs a module required for keyboard input to properly work. If you are running Windows Defender (which, on a Windows machine, you should be), it will likely trigger an alert at the suspicious executable .pyw file (python file) you created. Choose "allow" so we can see it working for test purposes. There are actually ways to disguise this file and keep it from being detected as a threat by Windows Defender, a technique known as "obfuscation". But I will not be getting into that on this particular post. 

Once the Python file is double clicked.....nothing happens......well......at least it looks that way. But now start typing. Do a search in the Windows start flag, open up Chrome and search for a website on google. Hop onto Gmail and enter your username and password as an example and you will soon discover that it is all being recorded in the keylogs.txt file. Open that file to see a plethora of sensitive data you've typed, going vertically down the page, key by key. What you did when you double clicked that Python file was launched an executable file that shows no indication of itself opening or running to the naked eye. Hop into task manager, however, and you will see Python running. That is the service cleverly collecting your keystrokes. Ending the Python task(s) will immediately end the keylogging process, though all that is logged already will remain on record.

   

Dipping into Python!

The time has come for me to get over my fear of programming. My first experience with Python was actually back in college when I was still pursuing computer animation. Python seems to be used in everything today from scripting by InfoSec engineers to being used for particle effects / dynamic visual effects by computer animators. I have discovered an absolutely fantastic intro to Python basics at this link:
 https://www.youtube.com/watch?v=rfscVS0vtbw
Sections are broken up into small chunks and easy to follow along to. The instructor is great at breaking down just how the syntax in Python works and what it means. From lists to tuples to floats to integers, I cannot recommend this free course enough. As per the instruction in the video, I am using an app called PyCharm to enter my python code and then execute it. Think of PyCharm as a text editor...like notepad, but way smarter. It will immediately detect errors in your syntax in real-time as you type them by popping up with an exclamation point or display a green checkmark if your syntax contains no errors. A green play button then allows you to execute the code. Here is an example of an interactive, albeit very simple program I created where inputting my name, age, and hobby results in a declaratory sentence containing those values.

Python is extremely important in information security as it can be used to automate attack techniques for pentesting purposes, initiate keylogging, and much much more. Although I am not yet at the stage of fully understanding how to incorporate Python for the many security purposes out there, I am understanding it a little bit more with each small chunk of training I complete. Although I could just copy and paste code given to me by a programmer, it will never replace the value of truly understanding it's components. 

Http vs. Https and Telnet vs Secureshell

Maybe you've noticed that mostly all the websites you visit show a little lock symbol next to them in your internet browser's address bar and begin with "https"(the "s" standing for "secure"). It wasn't always this way. It wasn't too long ago that many sites were ordinary http (non-secure) sites. According to Stat Operator , a global web statistics organization, 57.1% of the most popular 137,971 websites are now "https". In fact, popular search engines like Google have been known to punish websites who did not convert over to the secure format by booting them from their search results. Most sites will redirect automatically to their https site even if you only typed it in with http. It's an understandable move, as Google naturally wants to lessen the risk of hacking for their end users and for those websites/companies that make up their results. You might be wondering "What's the difference and what makes one secure and the other not?"


To best understand this, we need to hop into Wireshark, a program that is in every Network and Cybersecurity Technician's toolbox without question. Wireshark is a free packet analyzer application and is available for Windows, Mac, and Linux. While it is often used to diagnose network traffic issues by administrators, it can just as well be used for malicious purposes by those looking to steal sensitive information. It will give you a nitty-gritty, sometimes brain-overloading display of network traffic and everything in those internet packets that allows them to route from their source to the destination, wherever that might be. Wireshark takes some time to start to understand. It's best not to let it intimidate you right off the bat with all the details it shows you. It will take time to understand the relevancy of some of the data that may seem like minutia at first.



Just know for now that in Wireshark, you can capture traffic and easily see any information that the visitor of a non-secure (http) website entered on there, be it the username field, the password field, the search field, etc. It doesn't matter! That is what 100% unencrypted internet traffic looks like. You can now see why this is so risky.

To test this out yourself, you can hop onto Aliweb, which is said to be the oldest search engine ever and amazingly enough is still hosted and online and non-secure in all it's ..uhh..."glory".... http://www.aliweb.com/ .





Try typing into the search field and see if you can locate the packet in Wireshark that contains what you typed in there. In the screenshot pictured above, I am looking for the word "search" because the information I typed was into a search field on the unsecured website. But this could just as well be a search for any of the following keywords: login, pass, password, username, email. Anything that we get a hit on will show us what was entered in it's field back on the non-secure website. Since it's becoming increasingly difficult to find a non-secure http site that contains login fields (and thank goodness), the above scenario is a good comparison.

This of course, is in contrast to any information you would enter on an https site. With encryption now occurring on the secure site ( www.google.com for instance ), that turns any of your entered information into nothing but jumbled gobbledygook to anyone trying to snoop in and view it on a packet analyzer like Wireshark.

The relationship between http and https can be directly tied to the one between Telnet and SecureShell (SSH). Telnet is an administrative terminal session that you create inside of a command prompt window to be able to configure the device on the other end, be it a router, switch, or firewall. A password is entered, disguised by asterisks, but don't let that fool you. We face the exact same vulnerability here and this too will show up in good ol cleartext (immediately understandable, unencrypted data). Just as HTTPS has resolved this issue for HTTP, Telnet has since been replaced by SSH. SSH acts pretty much identical on the surface to Telnet aside from the initial configuration, which presents several options for RSA Key length, etc.

Telnet login screen examples (non-secure, should not be used)




See below, encryption options when initially configuring a SecureShell (SSH) terminal line.

Pivoting to Security and taking the Security+!

It has been quite some time since I have updated this blog, so here we go. If you've been following me, you know that I was studying hard for the CCNA. Long story short, I did not pass it. I missed it by about 150 points. I then retook the exam after more labbing and studying and failed the exam again by a similar amount of points. I decided to change course for the time being and focus on cybersecurity. With my Comptia A+ and Network+ expiring in February of 2022, I decided now was a better time than ever to recertify them for another 3 years and gain knowledge in information security by going for the Security+. I put in about 3 months of studying and passed my first try! The Security+ is considered e"entry-level" as far as infosec certs, but was by no means an easy exam, especially for someone relatively new to security and with no professional security experience. I had to memorize about 20 pages worth objectives, which you can see here:
https://www.comptia.jp/pdf/Security%2B%20SY0-501%20Exam%20Objectives.pdf




I passed with a 763, so ..it was close. I have been doing IT Support/helpdesk for about 4 and a half years now and this completes the holy trio (A+,Net+,Sec+) for me. My best advice to those planning to go for this cert is to power through those questions. You don't want the clock to run out with 10 or 20 questions still left (granted, I am a sloooww test taker.) I know you can flag the questions, but I always tell people - Just hit the question once and give it your best. Don't bother going back to any. Here's what worked for me, if anyone cares:

*Mike Meyers Sec+501 course on Udemy (Mike Meyers is tha man, his nack for breaking things down and keeping the energy on is the best thing about his courses)
*Professer Messer's 501 videos and his practice question sessions (though I probably watched more videos from Meyers)
*Jason Dion's 501 practice exams on Udemy (comes with 6 practice exams, questions were good. I would say they were fairly in line with the real thing...though the real thing DEF hit me with some curveballs!
*Black Hills Infosec Intro to Security online 4-day course. I cannot say enough great things about these guys and gals. Pay-what-you-want, interactive labs provided via VM, and taught by some of the absolute best in the industry. This course really let me get my hands dirty with infosec and was really awesome. I'll be attending many more of their events in the future.*Printed out the objectives list and put chickenscratch notes all over all 20 pages of that sucker, highlighted ALL the acronyms I didn't have memorized and did my best (though to be honest, I never succeeded in memorizing absolutely ALL the acronyms. There's just SO many on there).

Next on the agenda: Labbing and getting more hands-on with with tools like Wireshark, Metasploit, netcat, and more! Stay tuned for more of my IT journey!

The Myth of the Cybersecurity Candidate Drought

“There are nearly 465,000 unfilled cyber jobs across the nation, according to data gathered under a Commerce Department grant”.

This is a quote from a Washington Post article dated August 2nd, 2021 on the subject of unfilled cybersecurity roles in the United States.

Cybersecurity is an immensely expansive field. From Application security to Network security to Network monitoring to Client/end-user security to Pentesting and malware development to social engineering to wireless attacks to physical security to compliance /legal frameworks, there are hundreds upon hundreds of tools and applications available for the plethora of different Infosec/Cybersecurity roles existing, many open source, and many with a hefty price tag. It takes lots of time to master any single one and can often be difficult to try to predict what any particular prospective company might want you to know, but as students in the realm of cybersecurity, we learn to delve into nearly everything we can, while obviously focusing in on tools we know to be popular (NMAP, BURP, OWASP ZAP, Nessus, Wireshark, John the Ripper, Metasploit, Cain and Abel, and Nikto are just a few that come to mind). But where does that leave us in the end as it relates to bringing on fresh talent in cybersecurity departments? If you ask most directors or CEOs or hiring managers, you’re likely to hear the same tired, perpetuated myth of the “drought of candidates in cybersecurity”. This claim could not be any further from the truth and it’s time we started facing the reality of the situation. The “drought” that is often referred to has been imagined. Fabricated, if you will, by companies who will not entertain the idea of hiring absolutely any cybersecurity candidates who have anything less than mid to senior-level corporate cybersecurity work experience. Herein lies the problem.

It stands to reason that companies would want absolute cream-of-the-crop experts handling something as important as their digital security. But where then do we draw the line between hiring experienced candidates and acting as old guard gatekeepers that keep out those who have worked tirelessly through the years to build a foundation in IT and Cybersecurity that just haven’t yet been graced with the opportunity to work an outright Cybersecurity role? As all things do, it comes down to the bottom line, money. Who wants to train a competent candidate with a solid foundation when they can just hire someone who has been in a Senior-level security engineer role for the past 5-10 years? Well, they can certainly find these candidates if they look hard enough but enticing them to apply and keeping them on is a different story entirely. Candidates such as these have any option in the world as far as employment opportunities, and rightly so. They’ve earned it. Top-tier pentesters, for instance, have their pick of the litter among fortune 500 companies with six figure offers. But how many of these candidates exist in the United States? I’ll give you a hint: Not 465,000 of them.

So what’s the solution? It’s time to face the facts. Cybersecurity roles that are lower-tier than Senior need to be embraced and introduced as a standard at more companies alongside the Senior-level roles which already exist. While nobody expects any company to put a candidate through a bachelors or masters degree's-worth of training, a lot more needs to be done on the part of employers to grow their cybersecurity departments organically. Perhaps not from an absolute beginner standpoint, but certainly from an upper-entry-level to intermediate one. Junior SOC Analyst and Jr Incident Response Analyst roles need to be introduced for candidates who are fit to fill those roles, with Senior-level engineers offering even just a few short weeks worth of training to overlay the Junior's already existing knowledge and perhaps help in filling in some gaps along the way. Some companies already have scenarios like this in place, but if we are to understand that 465,000 desks are sitting empty, then it’s time to face reality instead of continuing to perpetuate this long-told myth of the “Cybersecurity candidate drought”.

Naomi Buckwalter, a seasoned Cybersecurity professional, has actually started a foundation called Gate Breakers dedicated to addressing this topic as well. You can see a great, albeit heated, interview with Naomi here: 
https://www.youtube.com/watch?v=pAvfW0_FvqI

For more information on Naomi's foundation itself, please visit:
 https://www.cybersecuritygatebreakers.org/