Downloaded 176 times
![Metasploit – Main ModulesExploits – Main module – used to pwn shit! :]Encoders – Used to transform raw versions of payloadsPayload – Used to connect to the shit u pwn!](https://image.slidesharecdn.com/practicalexploitationandsocialengineering-110705120836-phpapp02/75/Practical-exploitation-and-social-engineering-51-2048.jpg)
Uploaded byTiago Henriques
Practical exploitation and social engineering
This document provides an overview of a presentation on practical exploitation and cyberstalking. The presentation introduces tools like Metasploit and Social Engineering Toolkit (SET) and demonstrates how they can be used for both legal and illegal purposes, like cyberstalking. It discusses how easy it is to profile and target individuals online to steal identities or spread misinformation. The document emphasizes that while hacking can be fun, the implications of cyberstalking should be taken seriously due to its potential real-world consequences.
More Related Content
Similar to Practical exploitation and social engineering
Practical exploitation and social engineering
- 1. Practical Exploitation: Introductionto Metasploit, Social Engineering and a few other tools
- 2. SpeakersBSc, MSc, CEH,CHFI,thought I was going to be a PhD decided to become a ninja instead.BSc, MSc-Now works for ABBANBreaking servers, sip trunks, and doing research into VoIP and IMS
- 3. Synopsis – wrongorder, all contentIntroduction to practical exploitationIntroduction to cyberstalkingIntroduction to Metasploit(short) History of metasploitModulesExploitsPayloadsToolsMetasploit fundamentalsVulnerability ScanningMSF Databases commandsClient side exploitsPost ExploitationMeterpreter ArmitageSocial EngineeringSETTypes of attacksInfection MediaPractical workshopPs: I know you have high hopes that it will go by this order, but it wont, we are not that organized, and apologize in advance.
- 4. WorkshopDuring the practicalworkshop, you will work in pairs, you will be given an IP address to a virtual machine.The objective of this workshop is very simplePWN the living crap out of these virtual machines using techniques that were taught to you during this presentation and read the file password.txt located at Windows/System32 or /home/just4meeting (depending if you get a windows box or a linux box), and sucessfully create your own account on the remote system.
- 5. Seriouz BusinessWhen presenting,we like to talk about both the fun side of things and the bit about serious implications these “fun things” can have in life.During this presentation you will hear a bit about cyberstalking and how these tools work from a cyberstalker perspective and a victim.To write this part of the presentation we worked along side with the brand new UK National Center for Cyberstalking Research, they are cool people and provided us with lots of data and information.http://www.beds.ac.uk/nccr/news
- 6. Practical exploitationQ:What dowe call practical exploitation?On the interwebz you can find many definitions created by “security professionals”, we are not (security professionals), so here is our definition of practical exploitation:Get root and learn how to use current tools to automate and increase the speed when doing a penetration test. Understand how to use the tools past a script kiddie level – aka being able to extend the tool code if needed or combine multiple tools to achieve a target (!!root!!)
- 7. CyberstalkingQ: What isCYBERSTALKING?A: Cyberstalking is the use of internet and/or other electronic means to stalk or harass an individual. However cyberstalking can be legal and illegal.(To be explained further)
- 8. CyberstalkingQ: Who practicescyberstalking?YouMe
- 9.
- 10. CyberstalkingRemember when 2slides back we said cyberstalking could be both legal and illegal ? This is what we meant...Lets go through a scenario where Cyberstalking would be legal!
- 11. CyberstalkingMeet Tiago:As youcan see, Tiago is ur average 23 year old stud, he likes to go out and party, when he does so he meetssssssssssssss
- 12.
- 13. CyberstalkingTiago has certainthings he likes in girls and things he dislikes!Tiago like more then 500million people has a facebook accountSo Tiago goes and does a bit of Cyberstalking to decide which girls he wants to be friends with or not. Or even possible future girlfriends.
- 14. CyberstalkingEven without addingthese girls to facebook he gets plenty information sometimes to decide if he wants to go further with them.
- 15. CyberstalkingSo, as youcan see this is an example of a situation where cyberstalking is perfectly acceptable and legal. You access public information about someone that is in the “cyber” world.This is also an action done sometimes by companies that are considering hiring a certain person, to get some background information on the person.
- 16.
- 17. Cyberstalking – Scenario2Tiago also knows his way around computers and specifically security and the tools used in infosec. He also knows how to check securitytube and common security websites for different types of attacks.BLACKHAT ON!
- 18. Cyberstalking – Scenario2Analyzing the profiles Tiago decides he wants to go further and know a bit too much about one of these girls.
- 19. ProfilingTiago starts bygetting all sorts of information he can on this girl that might be useful in any way:From the facebook profile we get that:Her name is Anna KonovaShe is both a Chelsea and Barça fanShe likes Burberry, fashion events, dominoes pizza, and something called SIFEHer favorite music: MJ, Lady gaga, Beyoncé, Alicia Keys, Cheryl ColeUsing the information collected from this facebook profile we go to google...
- 20. Profiling<<- OH LOOKTHE SIFE THINGQuite a few results lets have a look at a few....
- 21. ProfilingFrom the facebookprofile we get that:Her name is Anna KonovaShe is both a Chelsea and Barça fanShe likes Burberry, fashion events, dominoes pizza, and something called SIFEHer favorite music: MJ, Lady gaga, Beyoncé, Alicia Keys, Cheryl ColeFrom twitter we get 0From linkedIN:Project manager at Innovate Went to University of BedfordshireIs looking for new career opportunities etc etc etcSIFE - SIFE is an international non-profit organization that works with leaders in business and higher education to mobilize university students to make a difference in their communities while developing the skills to become socially responsible business leaders.
- 22. Going over thelineHow can all this simple, easily accesible information help Tiago cyberstalk someone?Well let me introduce you to METASPLOIT.
- 23. DEMO 1 –PDF + EmailDEMO
- 24. DEMO 1 –PDF + EmailAs you can see it wasn’t an attack hard to setup and easily a real life scenario.For those of you that find that attack complicated, we have something for you later on....
- 25. A bit moreon cyberstalking....Following we will present some data that was provided to us by the Research Center! coz stats are always fun n giggles!
- 26. StatsHarrasser – Environmentwhere they are first met
- 27.
- 28. StatsFears experienced bythose who are harassed
- 29. StatsConsequences on thosebeing harrased
- 30. Types of attacksIdentitytheft – controlling victim’s credentials
- 31.
- 32. Posing as thevictim and attacking others
- 33. Discrediting in onlinecommunities
- 34. Discrediting victim inworkplace
- 35. Direct threats throughemail/instant messaging
- 36. Constructing websites targetingthe victim
- 37. Transferring attack tovictim’s relatives
- 38. Use of thevictim’s image
- 39. Provoking others toattack the victim
- 40. Following the victimin cyberspaceToolsSo what other tools does a cyberstalker have that are easily accesible and with a high ease of use?SETMetasploitEvilgrade
- 41. MetasploitExploitation frameworkLots ofother tools and utilitiesFirst written in PERLThen changed to RUBY (THANK GOD)3 versions – Pro, Express, free
- 42. Metasploit nowadays...We wontbe able to look at all the different components so we will try to focus on the more commonly used ones.
- 43.
- 44. Metasploit - InteractionThereare many ways a user can access metasploit features:Msfconsole
- 45.
- 46.
- 47.
- 48.
- 49.
- 50.
- 51. Metasploit – MainModulesExploits – Main module – used to pwn shit! :]Encoders – Used to transform raw versions of payloadsPayload – Used to connect to the shit u pwn!
- 52. Metasploit – QuickIntroStep 1 – Open msfconsoleStep 2 – Choose exploitStep 3 – Configure exploit and payloadStep 4 – exploit!
- 53. Metasploit – IntroDEMODEMO 0
- 54.
- 55. Metasploit - Essentialsusemodule- start configuring moduleshow options - show configurable options set varnamevalue - set optionexploit - launch exploit modulerun - launch non-exploitsessions –i n - interact with a sessionhelp command - get help for a command
- 56.
- 57. But but but...Ama lazy bastard and I think all the methods uve shown me are too hard
- 58.
- 59. MeterpreterMeterpreter is COOLMeterpreteris VERY COOLMeterpreter because of a thing called RAILGUN = Full access to windows APIWhat does that mean? This is what it means... You cyberstalkers!
- 60.
- 61. Back to seriouzThisis all good fun, but shows how easy you can “pwn” and cyberstalk some1 or even be cyberstalked. Advices are the usual: Anti virus updated, Software updated, Firewalls up and running (However that probably wont do you much)2 best advices I can give:Do not read PDF’s, or if u do read them inside google chrome (coz at least ur sandboxed n shit :D )ANDDDDDDDDDDD
- 62.
- 63. KUDOSFILIPE REIS!!!!!!! ONEELEVEN!!!!! And more FILIPE REIS! He helped recording the demos and is awesome. Center for Research on Cyberstalking for the data providedThe girls for accepting that we had to stay up late. Oh and Chris Bockermann, Bruno Morisson and Oli for allowing me to go home yesterday to write these slides instead of getting us drunk.
- 64.