Threats and Threat Actors | System Hardening

Exercise 1

Basic ping command:

1. Ping the IP address 192.168.1.169

   Terminal

   ping -c4 192.168.1.169 
   

   • Take note of the default packet size

   Output

   

2. Increase the packet size to [1024, 4098] and set the count to 4:

   Output

   

3. Try and go larger, use 65536 (\(2^{16}\)), did it succeed?

   Output

   

4. Try again using the maximum as suggested:

   Output

   

5. Warning

   Hitting the target with heavier packets from multiple machines against a weak or already loaded server, it may crash.

   Doing this on a computing device to another computing device you do not own on a network you do not own is technically against the law.

Exercise 2

2.1 Web Admins

On your device you need to start your apache2 server.

1. First check to see if it exists

   Terminal

   command -v apache2
   

   Output

   /usr/sbin/apache2
   

2. Then check the status of the service

   Terminal

   systemctl status apache2
   

   Output

   

3. Start the service, you will need to enter your root password.

   Terminal

     systemctl start apache2  
   

   Output

   

4. Check the IP addrees of your service, i.e your devices IP on wlan0

   Terminal

   ifconfig | grep wlan0 -A7
   

   Output

   Sample output, you need to find the inet 192.168.1.[###]

   wlan0: ....
            inet 192.168.1.[###]  netmask...
            ...
   

5. apache2 will launch a webpage located in /var/www/html/index.html

2.2 Users

1. Open a browser

2. Enter the IP Address of the web server in the URL field and hit ENTER

   Output

   

3. Refresh twice and take note of the loading speed/refresh rate, you can also bring up network status of the page in the url using F12

   Output

   

4. Wait for the attacker to launch the first attack, then refresh and take note of the loading speed/refresh rate.

   Output

   

5. Reload the page when the attacker halts the first attack. Repeat the same process for the second attack.

2.3 Attackers

1. hping3 can be used for launching mild DoS attacks.

   Regular SYN Flood attack against a web server.

   Make the source random i.e., attackers aim to be as untraceable as possible.

   The attack here is from a single source (DoS)

   Terminal

   hping3 --flood --rand-source [target IP]
   

   Note your observation on the server

   Output

2. Smurf attack, will broadcast to all machines on the subnet

   Warning

   Get permission from the lab instructor before performing this as it may affect all machines on the LAN

   Terminal

   hping3 --flood -a [target IP] 
   

3. You can check more hping3 options/tags using:

   Terminal

   hping3 –help
   

2.4 Questions

Exercise 3

Discovering System Vulnerabilities and Hardening Systems

[Target IP: Provided in the lab] [Target NW: Provided in the lab]

1. Using Nmap [network scanning tool]

   Terminal

   **Replace the IP addresses here with the appropriate IP address/Network address of your target.

   //Perform a Ping Scan (Ping Sweep or Network Scan or Discovery Scan)

   *this will scan the entire network for live hosts

   nmap -sn  192.168.0.0/24 
   

   Output

   

2. A basic scan instead:

   Terminal

   #nmap 192.168.0.64 
   

   Output

   

3. Try a Version Scan

   Now that you have ports that are open from the port scan, from the basic host scan, scan for version of services running on those ports

   Terminal

   nmap 192.168.0.64 -sV -p 80  
   

   Output

   

4. Perform an Operating System Scan (Protocol Scan)

   Terminal

   nmap 192.168.0.64 -O -p 80,445 
   

   Output

   

Exercise 4

You are to manipulate flags to get different results from a victim machine

1. SYN Scan, Stealth Scan (Half-Open scan)

   Terminal

   nmap -sS -p80,445 192.168.0.64  
   

   Output

   

2. FIN Scan, Stealth Scan (Finish Scan)

   On an Open Port Windows cannot understand this scan and therefore responds differently and with lots of flags, in comparison to Linux that does not respond.

   Terminal

   nmap 192.168.0.64 -sF -p80,445
   

   Output

   

3. ACK Scan, Stealth Scan (Acknowledge Scan)

   This scan is not usually used for port scanning but rather to discover if the firewall is on (filtered) or off (unfiltered).

   Terminal

   nmap 192.168.0.64 -sA -p80,445
   

   Output

   

4. XMas, Stealth Scan (XMas Scan)

   Terminal

   nmap 192.168.0.64 -sX -p80,445 
   

   Output