SSH Tunneling Explained

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhg8KQYOOliUpzjKKDd95ywURiCiVXpB08b3ruIW6FTXhnc1h2Cg_hiqGZYtZ0JkddDz20IoM4ik-1fTRXg_13Npcmg7Batl2IDnG_lzZ6yM-KNhDf_uINRpS_qLDaR-KCD-VpXkNvoAhet/s1600/localportforwarding.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="152" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhg8KQYOOliUpzjKKDd95ywURiCiVXpB08b3ruIW6FTXhnc1h2Cg_hiqGZYtZ0JkddDz20IoM4ik-1fTRXg_13Npcmg7Batl2IDnG_lzZ6yM-KNhDf_uINRpS_qLDaR-KCD-VpXkNvoAhet/s320/localportforwarding.jpg" width="320" /></a></div>Recently I wanted to set up a remote desktop sharing session from home pc to my laptop. While going through the set up guide I came across ssh tunneling. Even though there are many articles on the subject still it took me a considerable amount of googling, some experimenting and couple of Wireshark sessions to grasp what’s going under the hood. Most of the guides were incomplete in terms of explaining the concept which left me desiring for a good article on the subject with some explanatory illustrations. So I decided to write it my self. So here goes…<br /> <h3 style="text-align: justify;">Introduction</h3><div style="text-align: justify;">A SSH tunnel consists of an encrypted tunnel created through a SSH protocol<br />connection. A SSH tunnel can be used to transfer unencrypted traffic over a<br />network through an encrypted channel. For example we can use a ssh tunnel to<br />securely transfer files between a FTP server and a client even though the FTP<br />protocol itself is not encrypted. SSH tunnels also provide a means to bypass firewalls that prohibits or filter certain internet services. For example an organization will block certain sites using their proxy filter. But users may not wish to have their web traffic<br />monitored or blocked by the organization proxy filter. If users can connect to<br />an external SSH server, they can create a SSH tunnel to forward a given port on<br />their local machine to port 80 on remote web-server via the external SSH<br />server. I will describe this scenario in detail in a little while.</div><div style="text-align: justify;">To set up a SSH tunnel a given port of one machine needs to be forwarded (of<br />which I am going to talk about in a little while) to a port in the other<br />machine which will be the other end of the tunnel. Once the SSH tunnel has been<br />established, the user can connect to earlier specified port at first machine to<br />access the network service.</div><h3 style="text-align: justify;">Port Forwarding</h3><div style="text-align: justify;">SSH tunnels can be created in several ways using different kinds of port forwarding<br />mechanisms. Ports can be forwarded in three ways.</div><ol style="text-align: justify;"><li>Local port forwarding</li><li>Remote port forwarding</li><li>Dynamic port forwarding</li></ol><div style="text-align: justify;">I didn’t explain what port forwarding is. I found Wikipedia’s definition more explanatory.</div><blockquote>Port forwarding or port mapping is a name given to the combined technique of<br /> <ol><li>translating the address and/or port number of a packet to a new destination</li><li>possibly accepting such packet(s) in a packet filter(firewall)</li><li>forwarding the packet according to the routing table.</li></ol></blockquote><div style="text-align: justify;">Here the first technique will be used in creating an SSH tunnel. When a client application connects to the local port (local endpoint) of the SSH tunnel and transfer data these data will be forwarded to the remote end by translating the host and port values to that of the remote end of the channel.</div><div style="text-align: justify;">So with that let’s see how SSH tunnels can be created using forwarded ports with an examples.</div><h3 style="text-align: justify;">Tunnelling with Local port forwarding</h3><div style="text-align: justify;">Let’s say that yahoo.com is being blocked using a proxy filter in the University.<br />(For the sake of this example. :d   . Cannot think any valid reason why yahoo would be blocked). A SSH tunnel can be used to bypass this restriction. Let’s name my machine at the university as ‘work’ and my home machine as ‘home’. ‘home’ needs to have a public IP for this to work. And I am running a SSH server on my home machine. Following diagram illustrates the scenario.</div><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgR-_hURyN78Rva5rD_GInfTGE76iX3dm7AF4slGnsz7EnG_4N2go8LSkbd5zwa6iACZLpWUH0QaPTLlX8rKd1nyv6URWrQi4v9JsOwXUC0p0AwNuY_APHojxD7MX6YNFXJcJAmKabZ5VKJ/s1600/scenario.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="184" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgR-_hURyN78Rva5rD_GInfTGE76iX3dm7AF4slGnsz7EnG_4N2go8LSkbd5zwa6iACZLpWUH0QaPTLlX8rKd1nyv6URWrQi4v9JsOwXUC0p0AwNuY_APHojxD7MX6YNFXJcJAmKabZ5VKJ/s640/scenario.jpg" width="640" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;"> </div><div style="text-align: justify;">To create the SSH tunnel execute following from ‘work’ machine.</div><div style="text-align: justify;"><br /></div><pre class="brush: xml; title: ; notranslate" title="">ssh -L 9001:yahoo.com:80 home</pre><pre class="brush: xml; title: ; notranslate" title=""> </pre><div style="text-align: justify;">The ‘L’ switch indicates that a local port forward is need to be created. The switch syntax is as follows.</div><div style="text-align: justify;"><br /></div><pre class="brush: xml; title: ; notranslate" title="">-L <local-port-to-listen>:<remote-host>:<remote-port></pre><pre class="brush: xml; title: ; notranslate" title=""> </pre><div style="text-align: justify;">Now the SSH client at ‘work’ will connect to SSH server running at ‘home’ (usually running at port 22) binding port 9001 of ‘work’ to listen for local requests thus creating a SSH tunnel between ‘home’ and ’work’. At the ‘home’ end it will create a connection to ‘yahoo.com’ at port 80. So ‘work’ doesn’t need to know how to connect to yahoo.com. Only ‘home’ needs to worry about that. The channel between ‘work’ and ‘home’ will be encrypted while the connection between ‘home’ and ‘yahoo.com’ will be unencrypted.</div><div style="text-align: justify;"><br /></div><div style="text-align: justify;">Now it is possible to browse yahoo.com by visiting <a href="http://localhost:9001/" rel="nofollow">http://localhost:9001</a> in the web browser at ‘work’ computer. The ‘home’ computer will act as a gateway which would accept requests from ‘work’ machine and fetch data and tunnelling it back. So the syntax of the full command would be as follows.</div><div style="text-align: justify;"><br /></div><pre class="brush: xml; title: ; notranslate" title="">ssh -L <local-port-to-listen>:<remote-host>:<remote-port> <gateway></pre><pre class="brush: xml; title: ; notranslate" title=""> </pre><div style="text-align: justify;">The image below describes the scenario.</div><div style="text-align: justify;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjoPnKAoQyFG-xFyASM2iI7o1lK_akQ1YhQer3ayUILVrQKFYEQucGhzaxynLALSIXoI2ob1pk2ggp8f8ohN46fwoDn4uJhYd5AcGexO5HrNBjkZoSoHmu6Ve2sOjSy2UCOy0el9L-BxZbY/s1600/localportforwarding.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="304" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjoPnKAoQyFG-xFyASM2iI7o1lK_akQ1YhQer3ayUILVrQKFYEQucGhzaxynLALSIXoI2ob1pk2ggp8f8ohN46fwoDn4uJhYd5AcGexO5HrNBjkZoSoHmu6Ve2sOjSy2UCOy0el9L-BxZbY/s640/localportforwarding.jpg" width="640" /></a></div><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><br /></div><div style="text-align: justify;">Here the ‘host’ to ‘yahoo.com’ connection is only made when browser makes the<br />request not at the tunnel setup time.</div><div style="text-align: justify;"><br /></div><div style="text-align: justify;">It is also possible to specify a port in the ‘home’ computer itself instead of<br />connecting to an external host. This is useful if I were to set up a VNC session<br />between ‘work’ and ‘home’. Then the command line would be as follows.</div><div style="text-align: justify;"><br /></div><pre class="brush: xml; title: ; notranslate" title="">ssh -L 5900:localhost:5900 home (Executed from 'work')</pre><pre class="brush: xml; title: ; notranslate" title=""> </pre><div style="text-align: justify;">So here what does localhost refer to? Is it the ‘work’ since the command line is executed from ‘work’? Turns out that it is not. As explained earlier is relative to the gateway (‘home’ in this case) , not the machine from where the tunnel is initiated. So this will make a connection to port 5900 of the ‘home’ computer where the VNC client would be listening in.</div><div style="text-align: justify;"><br /></div><div style="text-align: justify;">The created tunnel can be used to transfer all kinds of data not limited to web browsing sessions. We can also tunnel SSH sessions from this as well. Let’s assume there is another computer (‘banned’) to which we need to SSH from within University but the SSH access is being blocked. It is possible to tunnel a SSH session to this host using a local port forward. The setup would look like this.</div><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj4RLdF0NbO1OrESbJF7RaXFboIKAaoJFqSeRlJbdmseXxwL0yob6KKlufRiAMSOeyiC4f95K5DtdjvI1rKH7oRYNdJUCbWYoSpuGzmQwY4NvNB-NRhc6UgUrt_Ondj1TGTODX_EHw9NxSC/s1600/sshsessionforwarding.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="260" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj4RLdF0NbO1OrESbJF7RaXFboIKAaoJFqSeRlJbdmseXxwL0yob6KKlufRiAMSOeyiC4f95K5DtdjvI1rKH7oRYNdJUCbWYoSpuGzmQwY4NvNB-NRhc6UgUrt_Ondj1TGTODX_EHw9NxSC/s640/sshsessionforwarding.jpg" width="640" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div style="text-align: justify;">As can be seen now the transferred data between ‘work’ and ‘banned’ are encrypted end to end. For this we need to create a local port forward as follows.</div><div style="text-align: justify;"><br /></div><pre class="brush: xml; title: ; notranslate" title="">ssh -L 9001:banned:22 home</pre><pre class="brush: xml; title: ; notranslate" title=""> </pre><div style="text-align: justify;">Now we need to create a SSH session to local port 9001 from where the session<br />will get tunneled to ‘banned’ via ‘home’ computer.</div><div style="text-align: justify;"><br /></div><pre class="brush: xml; title: ; notranslate" title="">ssh -p 9001 localhost</pre><pre class="brush: xml; title: ; notranslate" title=""> </pre><div style="text-align: justify;">With that let’s move on to next type of SSH tunnelling method, reverse tunnelling.</div><div style="text-align: justify;"><br /></div><h3 style="text-align: justify;">Reverse Tunnelling with remote port forwarding</h3><div style="text-align: justify;">Let’s say it is required to connect to an internal university website from home.<br />The university firewall is blocking all incoming traffic. How can we connect from ‘home’ to internal network so that we can browse the internal site? A VPN setup is a good candidate here. However for this example let’s assume we don’t have this facility. Enter SSH reverse tunnelling..</div><div style="text-align: justify;"><br /></div><div style="text-align: justify;">As in the earlier case we will initiate the tunnel from ‘work’ computer behind the firewall. This is possible since only incoming traffic is blocking and outgoing traffic is allowed. However instead of the earlier case the client will now be at the ‘home’ computer. Instead of -L option we now define -R which specifies<br />a reverse tunnel need to be created.</div><div style="text-align: justify;"><br /></div><pre class="brush: xml; title: ; notranslate" title="">ssh -R 9001:intra-site.com:80 home (Executed from 'work')</pre><pre class="brush: xml; title: ; notranslate" title=""> </pre><div style="text-align: justify;">Once executed the SSH client at ‘work’ will connect to SSH server running at home creating a SSH channel. Then the server will bind port 9001 on ‘home’ machine to listen for incoming requests which would subsequently be routed through the created SSH channel between ‘home’ and ‘work’. Now it’s possible to browse the internal site</div><div style="text-align: justify;"><br />by visiting <a href="http://localhost:9001/" rel="nofollow">http://localhost:9001</a> in ‘home’ web browser. The ‘work’ will then create a connection to intra-site and relay back the response to ‘home’ via the created SSH channel.</div><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjTFtXqrots51sJc9oX8Xdmu2vF80iSLg4GyNzOXhwlp741arzRP6c401eHDIwztHuK5KpiDX-nsTxiklJ3IusBOjR3qV06yrfqbTH4Auh6xR1UaEreC8MmKNZgvC959qyLkbBerC-8AhlE/s1600/remoteportforwarding.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="334" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjTFtXqrots51sJc9oX8Xdmu2vF80iSLg4GyNzOXhwlp741arzRP6c401eHDIwztHuK5KpiDX-nsTxiklJ3IusBOjR3qV06yrfqbTH4Auh6xR1UaEreC8MmKNZgvC959qyLkbBerC-8AhlE/s640/remoteportforwarding.jpg" width="640" /></a></div><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><br /></div><div style="text-align: justify;">As nice all of these would be still you need to create another tunnel if you need to connect to another site in both cases. Wouldn’t it be nice if it is possible to proxy traffic to any site using the SSH channel created? That’s what dynamic port forwarding is all about.</div><h3 style="text-align: justify;">Dynamic Port Forwarding</h3><div style="text-align: justify;">Dynamic port forwarding allows to configure one local port for tunnelling data to all remote destinations. However to utilize this the client application connecting to local port should send their traffic using the SOCKS protocol. At the client side of the tunnel a SOCKS proxy would be created and the application (eg. browser) uses the SOCKS protocol to specify where the traffic should be sent when it leaves the other end of the ssh tunnel.</div><div style="text-align: justify;"><br /></div><pre class="brush: xml; title: ; notranslate" title="">ssh -D 9001 home (Executed from 'work')</pre><pre class="brush: xml; title: ; notranslate" title=""> </pre><div style="text-align: justify;">Here SSH will create a SOCKS proxy listening in for connections at local port<br />9001 and upon receiving a request would route the traffic via SSH channel<br />created between ‘work’ and ‘home’. For this it is required to configure the<br />browser to point to the SOCKS proxy at port 9001 at localhost.</div><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgvV73IbcbD9BWSSSDdDloXNVNP0QqWYtCfzpABh7mkcCK89DFuot64z5JwrlE7rR_kArD-sSn2Dm1YHe3sqf6VDcumme39YU2TOGzTHX0ZY4pTFwNojVAUwdD1lJi-SDllmImwnjD1WQEA/s1600/dynamicportforwarding.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="240" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgvV73IbcbD9BWSSSDdDloXNVNP0QqWYtCfzpABh7mkcCK89DFuot64z5JwrlE7rR_kArD-sSn2Dm1YHe3sqf6VDcumme39YU2TOGzTHX0ZY4pTFwNojVAUwdD1lJi-SDllmImwnjD1WQEA/s640/dynamicportforwarding.jpg" width="640" /></a></div><div style="text-align: justify;"><br /></div><div style="text-align: justify;">thats all hope you enjoy this tutorial   :>)    </div></div>

SSH Tunneling Explained

Recently I wanted to set up a remote desktop sharing session from home pc to my laptop. While going through the set up guide I came across ...

Read more »

DNS poisoning - EXPLANATION | hacking trick

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;"><span style="font-family: "Courier New",Courier,monospace;"><span style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;">DNS poisoning is a technique that tricks a DNS</span><br style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;" /><span style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;">server into believing that is has received authentic</span><br style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;" /><span style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;">inforamtion when, in reality, it has not. It results in</span><br style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;" /><span style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;">substitution of a false Ineternet provider address at</span><br style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;" /><span style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;">the domain name service level where web addresses</span><br style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;" /><span style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;">are converted into numeric internet provider</span><br style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;" /><span style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;">addresses. It allows attacker to replace IP address</span><br style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;" /><span style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;">DNS entries for a target site on a given DN</span><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;">S server<br />with IP addresses of the server he/she controls.<br />Attacker can create fake DNS entries for files with<br />same names as that of target server.<br />The DNS provides a way for computers to translate<br />the domain names we see to the physical IPs they<br />represent. When you load a webpage, your browser<br />will ask its DNS server for the IP of the host you<br />requested, and the server will respond. Your browser<br />will then request the webpage from the server with<br />the IP address that the DNS server supplied.<br />To launch a DNS poisoning attack, follow these<br />steps:</span></span><span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;"><br />+ set up a fake website on your computer</span></span><span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;"><br />+ Install treewalk and modify the file mentioned in<br />the readme.txt to your IP address. Treewalk will<br />make you the DNS server.</span></span><span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;">+ Modify the file dns-spoofing.bat and replace the IP<br />address with your IP address.</span></span><span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;"><br />+ Trojanize the dns-spoofing.bat file and send it</span></span><span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;">+ When the host clicks the Trojanned file, it will<br />replace DNS-entry in her TCP/IP properties to that of<br />your machine.</span></span><span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;">+ You will become the DNS server and her DNS<br />requests will go through you<br />There are four types of DNS poisoning attacks using<br />which you can compromise the target system:</span></span><span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;">+ Intranet DNS spoofing (local network)<br />When an attacker performs DNS poisoning on a locl<br />area network (LAN), it is called intranet DNS<br />spoofing. An attacker can perform intranet DNS<br />spoofing attack with the help of the ARP poisoning<br />technique. THis is usually conducted on a swithced<br />LAN. To perform this attack, you must be connected<br />to the LAN and be able to sniff the traffic or packets.<br />Once the attacker succeds in sniffing the ID of the<br />DNS request from the intranet, he or she can send a<br />malicious reply to the sender before the actual DNS<br />server.</span></span><span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;">+ Internet DNS spoofing (remote network)<br />Internet DNS poisoning is also known as remote<br />DNS poisoning. This attack can be performed either<br />on asingle or multiple victims anywhere in the world.<br />In order to perform this attack, you need to set up a<br />rouge DNS server with a static IP address.<br />Internet DNS spoofing is performed when the<br />victim's system is connedted to the Internet. It is<br />done with the help of Trojans. It is one of the MITM<br />types of attacks, where the attacker changers the<br />primary DNS entries of the victim's computer. The<br />attacker replaces the victim's DNS IP address with<br />the fake IP address that refers t the attacker's<br />system; thus all traffic will be redirected to the<br />attacker's machine. Now the aatcker can easily sniff<br />the victim's confidential information.</span></span><span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;">+ Proxy server DNS poisoning<br />In the proxy server DNS posoning technique, tha<br />taattacker changes the proxy server setting of the<br />victim to that of the attacker. This is done with the<br />help of a Trojan. This redirects the victim's request<br />to the attacker's fake website where the attacker can<br />sniff the confidential information of the victim.</span></span><span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;">+ DNS cache poisoning<br />The DNS system uses cache memory to hold the<br />recently resolved domain names. It is populated<br />with recently used domain names and respective IP<br />address entries. When the user request comes, the<br />DNS resolver first checks the DNS cache; if the<br />domain name that the user requested is found in the<br />cache, then the resolver sends its respective IP<br />address quickly. Thus, it redueces the traffic and<br />time of DNS resolving.<br />Attacker target this DNS cache and make changes or<br />add entries to the DNS cache. The attacker replaces<br />the user-requested IP address with the fake IP<br />address. Then, after when user requests that domain<br />name, the DNS resolver checks the entry in the DNS<br />cache and picks the matched entry. Thus, the victim<br />is rediirected to the attacker's fake server instead of<br />the authorized server.</span></span><span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;"><br /></span></span><span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;">How to defend against DNS spoofing:</span></span><span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;"><br /></span></span><span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;">Resolve all DNS queries to local DNS servers<br />Block DNS requests from going to external severs<br />Implement DNSSEC<br />Configure the DNS resolver to use a new random<br />source prot from its available range for each<br />outgoing query<br />Configure the firewall to restrict external DNS lookup<br />Restrict the DNS recuring service, either full or<br />partial, to authorized users<br />Use DNS Non-Existent Domain rate limitng<br />Secure your internal machines<br />Implement IDS and deploy it correctly<br />Use static ARP and IP table<br />Use SSH encryption<br />Use sniffing detection tools<br />Do not open suspicious files<br />Always use trusted proxy sites<br />Audit your DNS server regularly to remove<br />vulnerabilities</span></span></div></div>

DNS poisoning - EXPLANATION | hacking trick

DNS poisoning is a technique that tricks a DNS server into believing that is has received authentic inforamtion when, in reality, it has not...

Read more »

Botnets - full Explanation

<div dir="ltr" style="text-align: left;" trbidi="on"><span class="userContent" data-ft="{"tn":"K"}">Botnets  </span><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZakamQTJYJuxVf4X6vwePjYukYD579aeraq2PTdZibq9Kwxe8Q8tyz-IZJX6t1UHDONEXvhrOFDyZ02WTSFAJ7QC_Ob9ZSHQLRoEQzI_S5W2L3fe7J2sMVU90q8wUa0YsLP8Aqk99Zm-M/s1600/explain+botnets.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZakamQTJYJuxVf4X6vwePjYukYD579aeraq2PTdZibq9Kwxe8Q8tyz-IZJX6t1UHDONEXvhrOFDyZ02WTSFAJ7QC_Ob9ZSHQLRoEQzI_S5W2L3fe7J2sMVU90q8wUa0YsLP8Aqk99Zm-M/s1600/explain+botnets.jpg" /></a></div><br /> <br /> A botnet or robot network is a group of computers running a computer application controlled and manipulated only by the owner or the software source. The botnet may refer to a legitimate network of several computers that share program processing among them.<br /> <br /> Usually though, when people talk about botnets, they are talking about a group of computers infected with the malicious kind of robo<span class="text_exposed_show">t software, the bots, which present a security threat to the computer owner. Once the robot software (also known as malicious software or malware) has been successfully installed in a computer, this computer becomes a zombie or a drone, unable to resist the commands of the bot commander.<br /> <br /> A botnet may be small or large depending on the complexity and sophistication of the bots used. A large botnet may be composed of ten thousand individual zombies. A small botnet, on the other hand may be composed of only a thousand drones. Usually, the owners of the zombie computers do not know that their computers and their computers’ resources are being remotely controlled and exploited by an individual or a group of malware runners through Internet Relay Chat (IRC)<br /> <br /> There are various types of malicious bots that have already infected and are continuing to infect the internet. Some bots have their own spreaders – the script that lets them infect other computers (this is the reason why some people dub botnets as computer viruses) – while some smaller types of bots do not have such capabilities.<br /> <br /> Different Types of Bots<br /> <br /> Here is a list of the most used bots in the internet today, their features and command set.<br /> <br /> XtremBot, Agobot, Forbot, Phatbot<br /> <br /> These are currently the best known bots with more than 500 versions in the internet today. The bot is written using C++ with cross platform capabilities as a compiler and GPL as the source code. These bots can range from the fairly simple to highly abstract module-based designs. Because of its modular approach, adding commands or scanners to increase its efficiency in taking advantage of vulnerabilities is fairly easy. It can use libpcap packet sniffing library, NTFS ADS and PCRE. Agobot is quite distinct in that it is the only bot that makes use of other control protocols besides IRC.<br /> <br /> UrXBot, SDBot, UrBot and RBot<br /> <br /> Like the previous type of bot, these bots are published under GPL, but unlike the above mentioned bots these bots are less abstract in design and written in rudimentary C compiler language. Although its implementation is less varied and its design less sohisticated, these type of bots are well known and widely used in the internet.<br /> <br /> GT-Bots and mIRC based bots<br /> These bots have many versions in the internet mainly because mIRC is one of the most used IRC client for windows. GT stands for global threat and is the common name for bots scripted using mIRC. GT-bots make use of the mIRC chat client to launch a set of binaries (mainly DLLs) and scripts; their scripts often have the file extensions .mrc.<br /> Malicious Uses of Botnets<br /> <br /> Types Of Botnet Attack<br /> <br /> Denial of Service Attacks<br /> A botnet can be used as a distributed denial of service weapon. A botnet attacks a network or a computer system for the purpose of disrupting service through the loss of connectivity or consumption of the victim network’s bandwidth and overloading of the resources of the victim’s computer system. Botnet attacks are also used to damage or take down a competitor’s website.<br /> <br /> Fast flux is a DNS technique used by botnets to hide phishing and malware delivery sites behind an ever-changing network of compromised hosts acting as proxies.<br /> Any Internet service can be a target by botnets. This can be done through flooding the website with recursive HTTP or bulletin-board search queries. This mode of attack in which higher level protocols are utilized to increase the effects of an attack is also termed as spidering.<br /> <br /> Spyware <br /> Its a software which sends information to its creators about a user's activities – typically passwords, credit card numbers and other information that can be sold on the black market. Compromised machines that are located within a corporate network can be worth more to the bot herder, as they can often gain access to confidential information held within that company. There have been several targeted attacks on large corporations with the aim of stealing sensitive information, one such example is the Aurora botnet.<br /> <br /> Adware<br /> Its exists to advertise some commercial entity actively and without the user's permission or awareness, for example by replacing banner ads on web pages with those of another content provider.<br /> <br /> Spamming and Traffic Monitoring<br /> A botnet can also be used to take advantage of an infected computer’s TCP/IP’s SOCKS proxy protocol for networking appications. After compromising a computer, the botnet commander can use the infected unit (a zombie) in conjunction with other zombies in his botnet (robot network) to harvest email addresses or to send massive amounts of spam or phishing mails.<br /> <br /> Moreover, a bot can also function as a packet sniffer to find and intercept sensitive data passing through an infected machine. Typical data that these bots look out for are usernames and passwords which the botnet commander can use for his personal gain. Data about a competitor botnet installed in the same unit is also mined so the botnet commander can hijack this other botnet.<br /> <br /> Access number replacements are where the botnet operator replaces the access numbers of a group of dial-up bots to that of a victim's phone number. Given enough bots partake in this attack, the victim is consistently bombarded with phone calls attempting to connect to the internet. Having very little to defend against this attack, most are forced into changing their phone numbers (land line, cell phone, etc.).<br /> <br /> Keylogging and Mass Identity Theft<br /> An encryption software within the victims’ units can deter most bots from harvesting any real information. Unfortunately, some bots have adapted to this by installing a keylogger program in the infected machines. With a keylogger program, the bot owner can use a filtering program to gather only the key sequence typed before or after interesting keywords like PayPal or Yahoo mail. This is one of the reasons behind the massive PayPal accounts theft for the past several years.<br /> <br /> Bots can also be used as agents for mass identity theft. It does this through phishing or pretending to be a legitimate company in order to convince the user to submit personal information and passwords. A link in these phishing mails can also lead to fake PayPal, eBay or other websites to trick the user into typing in the username and password.<br /> <br /> Botnet Spread<br /> Botnets can also be used to spread other botnets in the network. It does this by convincing the user to download after which the program is executed through FTP, HTTP or email.<br /> <br /> Pay-Per-Click Systems Abuse<br /> Botnets can be used for financial gain by automating clicks on a pay-per-click system. Compromised units can be used to click automatically on a site upon activation of a browser. For this reason, botnets are also used to earn money from Google’s Adsense and other affiliate programs by using zombies to artificially increase the click counter of an advertisement.<br /> </span></div>

Botnets - full Explanation

Botnets  A botnet or robot network is a group of computers running a computer application controlled and manipulated only by the owner or...

Read more »