4.Tools-and-Methods-Used-in-Cybercrime-part-1.ppt

Cybercrime tools and methodologies

1. 4. Tools and Methods Used in
Cybercrime

2. Unit4:ToolsandMethodsUsedinCybercrime
•Introduction
•Proxy servers and
anonymizers
•Phishing
•Password cracking
•Keyloggers and spywares
•Virus and Worms
•Trojan horses and
backdoors
•DoSandDDoSattacks
•SQLinjection
•Bufferoverflow
•Attacksonwirelessnetworks
•Phishing(indetail)
•Identitytheft

3. Introduction
•Basicstagesofanattack:
–Initialuncovering
–Networkprobe
–Crossingthelinetowardelectroniccrime
–Capturingthenetworktraffic
–Grabthedata
–Coveringtracks

4. ImportantTerms
•Scareware

5. ImportantTerms
•Scareware
•Malvertising

6. ImportantTerms
•Scareware
•Malvertising
•Clickjacking

7. ImportantTerms
•Scareware
•Malvertising
•Clickjacking
•Ransomware

8. ProxyServersandAnonymizers
•Proxy server is a computer on a network which comes in
between the client (user) and other computers
Internet

9. ProxyServersandAnonymizers...

10. ProxyServersandAnonymizers...
•Purposeofproxyserver:
–Hidecompanyserversorsystems
–Caching
–Filterunwantedcontent(ex:advertisements)
–IPaddressmultiplexer

11. ProxyServersandAnonymizers...
•Anonymizer is an anonymous proxy which
allows the user to browse Internet
anonymously
•Generally used by crackers to cover their
tracks

12. Typesofproxies
•Transparent –Victim will know you are using a
proxy and can trace your real IP
•Anonymous –Victim will know you are using a
proxy, but, cannot trace your real IP
•Elite –Victim doesn’t know if the
communication is from a proxy or not

13. Typesofproxies...
TypeofProxy UsingaProxy TraceRealIP Anonymity
Transparent
Anonymous
Elite

14. ProxySoftwareExamples

16. Tor vs.VPN
Source:https://thebestvpn.com/tor-vs-vpn/
PrivacyAnonymity

17. Demonstration
•Proxychains(built-inintoKaliLinux)
–UsesTornetwork
–Needtomodify configfile(/etc/proxychains.conf)
•Anonsurf(availableon Github)
–UsesTornetwork

18. Phishing
•Steps inphishingcampaign:
1.Planning(gatherinformation)
2.Setup(createemailsorwebsite)
3.Attack(sendthemessagewithfakelinks)
4.Collection(gatherdata)
5.Identitytheftandfraud

19. Demonstration
•Maltego
•Shodan.io
•FOCA (Fingerprinting Organisations with Collected
Archives)
•Theharvester
•Recon-ng
•SET (Social Engineering Toolkit)

20. Demonstration...
•Passive reconnaissance –Maltego
–Maltego is a passive and semi-active reconnaissance
software
–Available in commercial and as well as community
editions
–Community edition is free, but has limited functionality

21. Demonstration...
•Shodan.io
–SearchengineforIoT
–GoogleindexesonlyWWW
–ShodanindexeseverythingconnectedtoInternet
–We cansearchforvariousdevicesusingdifferentfilters

22. Demonstration...
•FOCA
–Downloadsfilesfromsearchenginesand otherpublicrepositories
–Gathersmeta datafromthosefiles
–Analyzesthatmeta dataandpresentsinterestinginformation

23. Demonstration...
•theharvester
–Pythontoolfor passivereconnaissance
–Usage:theharvester-dvishnu.edu.in-l100-ball
•-dspecifiesdomain
•-lspecifieslengthofresultstobefetched
•-bspecifiessourcestosearchinformationfrom

24. Demonstration...
•Recon-ng
–Pythontoolfor passivereconnaissance
–LookandfeelisverysimilartoMetasploit
–Containsseveralmodules(scripts)
–Usage: Demo

25. Demonstration...
•SET(SocialEngineeringToolkit)
–Open-sourcetooldevelopedbyTrustedSec
–Python-driven
–Standardforsocial-engineeringpenetrationtests
•ngrok
–Reverseproxysoftwareforestablishingatunnelbetweenourmachine
andtheInternet

26. Demonstration...
•SET(SocialEngineeringToolkit)
Internet
Router
Host Machine
(Windows 8.1)
Guest
Machine 1
(Kali Linux)
Guest
Machine 2
(Metasploitabl
e 2)
Guest
Machine 3
(OWASP
BWA)
Guest
Machine 4
(Ubuntu)
NATNetwork

27. Demonstration...
•SET(SocialEngineeringToolkit)
Internet
Router
Host Machine
(Windows 8.1)
Guest
10.0.2.15
(Kali Linux)
Guest
Machine 2
(Metasploitabl
e 2)
Guest
Machine 3
(OWASP
BWA)
Guest
10.0.2.6
(Ubuntu)
NATNetwork

28. ForwardProxyvs.ReverseProxy

29. PasswordCracking

30. PasswordCracking
•Purposeofpasswordcracking:
–Torecoveraforgottenpassword
–Testingthestrengthofapassword
–Togainunauthorizedaccesstoasystem

31. PasswordCracking...
•Manualprocessofpasswordcracking:
1.Find avaliduser account
2.Createalistofpossiblepasswords(dictionary)
3.Rankthepasswordsfromhightolowprobability
4.Key-in eachpassword
5.Tryagainuntilasuccessfulpasswordisfound

32. PasswordCracking...
•Guessable password characteristics:
–Blank (no password)
–General passwords like password, admin, 123456, etc.
–Series of letters like QWERTY
–User’s name or login name
–Name of user’s friend/relative/pet
–User’s birth date or birth place
–User’s vehicle number, office number, residence or mobile number
–Name of a celebrity or idol
–Simple modification of the above mentioned passwords (like adding
numbers)

33. PasswordCracking...
•Classification of password cracking attacks:
–Online attacks
–Offline attacks
–Non-electronic attacks (social engineering,
shoulder surfing, dumpster diving etc)

34. PasswordCracking...
•Online attacks
–Use a program or script
–Attacks the target machine directly
–MITM (also called bucket-brigade or
Janus attack)
•Offline attacks
–Performed on machines other than the target
location
–Requires physical access to the target for
copying password files
Hacker/Cracker
Victim
Machine
Hacker/Cracker
Victim
Machine

35. PasswordCracking...
Passwordhashingprocess

36. Strong,Weak,andRandomPasswords
•Refertextbookpages135,136,and137

37. Demonstration
•OWASPBWA(VulnerableVirtualMachine)
•Hydra(onlineattack-webpage)
•Hydra(onlineattack-SSH)
•CainandAbel(offlineattack)
•JohntheRipper(offlineattack)

38. Demonstration...
Internet
Router
Host Machine
(Windows 8.1)
Guest
Machine 1
(Kali Linux)
Guest
Machine 2
(Metasploitabl
e 2)
Guest
Machine 3
(OWASP
BWA)
Guest
Machine 4
(Ubuntu)
NATNetwork

39. Demonstration...
Internet
Router
Host Machine
(Windows 8.1)
Guest
10.0.2.15
(Kali Linux)
Guest
Machine 2
(Metasploitabl
e 2)
Guest
10.0.2.5
(OWASP BWA)
Guest
Machine 4
(Ubuntu)
NATNetwork

40. Demonstration...
•Hydra(onlineattack-webpage)
–Anonlinepasswordcrackingtool
–Commandoptions:
•-l forusername
•-Lforuserlist
•-pforpassword
•-Pforpasswordlist
•-fexitatfirstsuccessfulresult
•-Vprintusernameandpasswordcombinations
•IPaddress
•http(s)-post-form for form basedauthentication
•<URL>:<FormParameters>:<Failedattemptkeyword>-serviceparameters

41. Demonstration...
•Hydra (online attack -webpage)
–Example
hydra-l admin-P 10-million-password-list-top-
1000000.txt192.168.91.160 http-post-form
"/dvwa/login.php:username=^USER^&password=^PASS^&
Login=Login:Login failed"–f–V

42. Demonstration...
•Hydra (online attack -SSH)
–Scan the victim machine ports for SSH availability
–Command: nmap 192.168.91.160 --top-ports 100 –sV
–Now use Hydra
–Command:
•hydra -l root -P 10-million-password-list-top-1000000.txt -f -V
192.168.91.160 ssh -t 5
•-V prints the username and password combination
•-t maintains number of connections in parallel to the target server

43. Demonstration...
•CainandAbel(offlineattack)
–Dictionaryattack
–Bruteforceattack
–Rainbowtableattack

44. Demonstration...
•JohntheRipper(offlineattack)
–Oneofthemostpopularpasswordcrackers
–Auto-detectspasswordhashtypes
–AvailableforUnixandWindows
–Availablein3differentversions:
•Freeandopensourceversion
•Professionaledition
•Communityedition

45. Demonstration...
•John the Ripper (offline attack)
–Example:
•john MD5.txt --wordlist=10-million-password-list-top-
1000000.txt --format=Raw-MD5

46. KeyloggerandSpyware
•Keylogger is used to capture passwords and other
information while the user is keying
•Types of keyloggers:
–Software keyloggers
–Hardware keyloggers

47. KeyloggerandSpyware...
•Softwarekeyloggers:
–Softwareprograminstalledonthevictimmachineforkeylogging
–Generallyspreadastrojansorviruses
–AkeyloggergenerallycontainsaDLLfileandanEXEfile

48. Demonstration
•Nifty keylogger
–Akeyloggerforfirefox
–Add-onthatlogskeysincludingsuchkeysasALT,SHIFT,andBACKSPACE
–Hardtodetectthiskeyloggerthroughanti-virussoftware
–Toaccessthelog,simultaneouslypress ALT +SHIFT+KorALT+SHIFT+O

49. KeyloggerandSpyware...
•Hardwarekeyloggers:
–Smallhardwaredevices
–Requiresphysicalaccesstothevictimmachine
–GenerallyinstalledonATMs

50. KeyloggerandSpyware...
Source:https://thehackernews.com/2016/05/usb-charger-keylogger.html

51. KeyloggerandSpyware...
Source:http://www.keelog.com/airdrive-keylogger/

52. KeyloggerandSpyware...
•Anti-keylogger:
–Programthatdetectskeyloggers
–PreventsInternetbankingfrauds
–PreventsIDtheft
–ItsecuresE-Mailandinstantmessaging/chatting

53. KeyloggerandSpyware...
•Spyware:
–Malwareinstalledtospyonvictim’sactivities
–Sometimes,spywareisinstalledpurposefullybyadministration
–Spywaremonitorsvictim’ssurfingpatterns
–Spywarecanalsomodifysystemsettings
–Installanti-spywareforprotection

54. VirusandWorms
•Typesofvirus:
1.Bootsectorvirus
2.Programvirus
3.Multipartitevirus(bootsector+programvirus)
4.Stealthvirus
5.Polymorphicvirus(changesvirussignature)
6.Macrovirus
7.ActiveXandJavavirus

55. TrojanHorseandBackdoor
•Backdoor:
–A backdoor is a means of access to computer program that bypasses
security mechanisms
–Hackers use backdoor to maintain access to the victim system