⚔️ Attacks DB

📚 Technical Reference

Network Topology It’s a geometric arrangment of hosts and network devices. Can be physical (cables and PCs’ layout) or logical (informaiton transmission methods).

⛔️ Access Controls

DAC I am the leader! I’m the one that says when we go. A user, who’s the owner of the file or another object defines who can and who cannot view it.

Gaining Initial Access

📚 Network Anonymity Techniques

Evasion techniques and what possible forensic footprints they are likely to leave? VPN Virtual private network.

Binary Attacks

Recent Activity

Application Attacks

Pipes

A named pipe is not exactly the same as a reverse shell, but it can be used in a similar way to establish a remote connection between two systems.

Persistence and Escalation Mechanisms

DoS Attacks and Mitigations

In this article, I will cover the main DoS techniques and how they look in the logs. I will also cover some main mitigation techniques.

Evasion Techniques

This is about … .

📚 Cloud

📚 Containers

Host-based IDP/IPS

Host-based IDS look for local system configurations and behaviour, while network-based IDS look for network connections and looks for anomalies and common signatures.

IDS and IPS as firewall’s filters. There are Control Plane (looks after the OS and routing table) and the Forwarding Plane (makes decisions on routing and discarding). If something happens to the Control Plane, the device will still forward the traffic (really???).

By default IDS only listens 👂 the traffic. It’s usually connected to the span port on a switch. Looks for anomalies and sends alerts. Won’t take any actions by default, but can be configured in such a way. If the IDS is down, nothing is changed for the rest of the network, it’s still operating.

IPS takes actions on its own. It is not connected to the span port, but rather is a gateway. Before it inspects and allows a packet through, nothing can move forward. So, if IPS is down, everyone is down (unless there is some load balancing enabled or may be some policy for such cases). Positioned right after the router, edge device or a firewall.

Network Recon

traceroute, tracert On Windows, it’s tracert (due to some legacy max-name-size limitations). On Linux and macOS - traceroute.

Port Scanning

There are several techniques for port scanning. Some of them work for one OS only.

📘 BTFM

dshell # MacOSX path to directory with pyenv (example): /Users/[user_name]/.pyenv/versions/3.8.5/envs/python3/lib/python3.8/site-packages/dshell/ decode -l # list decoders decode -d [decoder_name] # decoder info # who talked to whom decode -d ip [capture_file_name].

📚 Network Protocols

This set of articles describe network protocols for each layer separately. Each article may contain an attack description and how to metigate it.