Exploitations

Learning outcomes:

List the aspects of systems that are vulnerable to exploitation
List several ways people can be exploited including common Social Engineering techniques and preventions
Explain what an exploit is, how it is labeled and classified
Describe the importance of patch management in relationship to exploits
Describe some examples of risky applications, and how code can be tested including the use of fuzzers

Recon shows us where the vulnerabilities are
Exploitation gives us access to systems/resources by taking advantage of those vulnerabilities
Exploitation is a precision thing, think scalpel not shotgun or smash and grab
We should have a high value target (or list of targets) we're aiming for
Look at the success probability and impact on the organization
Remember we're the good ones! If the attack takes down the system and the company loses money, we're not doing good

Tailoring requires more skill, in depth programming and systems knowledge
Known exploit for XP SP2, can we get something similar to work on XP SP3?
Zero-day is a last resort. Most malicious attackers aren't sophisticated enough for a zero-day
These need to be tested on your own systems that match the target systems as well as you can

Zero day exploitation
Pivoting
Use a compromised system to exploit others
If you compromise a printer on the network, use the printer to attack the computers to hide your trail and guard against restrictions such as firewalls
Also called Island Hopping
Proxy Pivoting is channeling all your traffic through your pivot point
VPN pivot directs traffic using an encrypted layer to tunnel into your target
Appears as if the attacker is in system

Exploits are scored using the Common Vulnerability scoring system to determine the risk
The databases are used as reference for vulnerability scanners

Public bug bounties have 6x the amount of people working to find bugs then invite only, however almost 80% are private programs
Some companies start invite only/private until they are comfortable with the scary hackers
Vulnerability disclosure policies - clear guidelines for reporting

This is a process companies use to update software, OS and applications
Patch management classifies and prioritizes vulnerabilities and bugs that are found
Patches usually comes from the vendor, but can also be public

DevOps vs DevSecOps
DevOps is when you can developers who automate manually done processes
DevSecOps is when you actually care about the security of your operations and have security measures in your development process
DevSecOps is still new because security can slow down development
Tools to test your programs

Most languages have tools to test your code
Fuzzers
Black box testing technique
Uses malformed or semi-malformed data and injects it into your software using automation
For example, your program adds two numbers? Cool, what happens if I use very very large numbers? Small ones? Binary sequences? Chars or strings? Unsigned?

Suggested Activities and Discussion Topics:

Go to this list of Public Bug and Security Vulnerability Disclosure Programs and pick one to research and then share your thoughts. Would you be comfortable participating? What are the rules? What are the limits? What safeguards do they have in place?
Find an interesting exploit at one of the following links, be ready to share what you found.

Would you like to see some more classes? Click here