Book 5: Hijacking Attacks

Question 1

A way in which we can hijack system information?

Answer 1

LLMNR

Question 2

what is Link-Local-Multicast Name Resolution?

Answer 2

NetBIOS and LLMNR are protocols used to resolve host names on local networks. Their main function is to resolve host names to facilitate communication between hosts on local networks

Question 3

Any time there is a system or service blindy reaching out for help to identify a system or service, an attacker can hijack that response and redirect the victim system through a computer we control.

Answer 3

true

Question 4

what is responder?

Answer 4

a tool that is designed to launch LLMNR attacks.
Automatically launches a number of services to redirect victim systems in order to harvest credentials
- HTTP, HTTPs, SQL Server, Kerberos, FTP, IMAP, SMTP, DNS, LDAP.

Question 5

Responder launches not only LLMNR attacks but also can launch __, ___ attacks

Answer 5

NBTS-NS

DNS/MDNS

Question 6

What tool automatically launches a number of services to redirect victim systems to harvest credentials?

Answer 6

responder

Question 7

what is the goal of responder?

Answer 7

spoof a system, then be ready to intercept the authentication requests on the fly. In addition serve up malicious .exe files and force downgrade for LANMAN authentication (easier to crack)

Question 8

Responder is a tool dedicated to answering stray LLMNR/MNT-NS/proxy requests

Answer 8

true

Question 9

When a windows host cannot resolve a hostname using DNS, it uses the LLMNR protocol (Link-Local Multicast Name Resolution) to ask neighboring computers about it. If that also fails, then it uses the NBT-NS (NetBios Name Service).
When LLMNR/NBT-NS is used to resolve a name, any host on the network can reply. So, Responder is one of such tools that poisons the request.

Answer 9

true

Question 10

Responder will not only harvest credentials, but can stand up a number of services, because the victim has to go to that server and do something. Whatever request the victim is making, the attacker needs to have that service running so the victim can authenticate in order to grab their credentials. in addition, servinig malicious files.

Answer 10

true.

Question 11

Responder will not only harvest credentials, but can stand up a number of services, because the victim has to go to that server and do something. Whatever request the victim is making, the attacker needs to have that service running so the victim can authenticate in order to grab their credentials. in addition, serving malicious files.

Answer 11

true.

Question 12

Responder will try and have a service that the victim can authenticate to in order to grab credentials?

Answer 12

true

Question 13

responder can force the victim to downgraded its authentication to LANMAN?

Answer 13

true. because they are easier to crack

Question 14

How to start responder?

Answer 14

sudo /opt/Responder/Responder.py -I eth0

Question 15

When a user requests a service where hostname isnt answered. Responder will reply to the final resolution attempt(Multicast DNS) with the attacksers IP address, forcing the user to connect to attacker service, potentially disclosing password hash info

Answer 15

yes.

Question 16

session hijacking involves sniffing and spoofing?

Answer 16

yes.

Question 17

Defenses of session hijacking:

Answer 17

• be careful with incoming connections.
• Do not telnet to firewall
• Do not telnet to CA
• Utilize sstrong authentication and encryption path SSH or VPN

Question 18

As a defense to session hijacking you sould hard code your ARP tables.

Answer 18

yes

Question 19

hard coded arp tables cannot be overwritten by gratutious arps.

Answer 19

yes, BUT creates overhead because they must be updated in each system if and when changes occur

Question 20

Defenses

Answer 20

1. activate port level security on switches
2. dynamic ARP inspect with DHCP snooping
3. Disable LLMNR
4. ) use strong authentication and encrypted sessions (SSH or VPN)

Question 21

if originating host is compromised, strong authentication and encrypted paths do not help because session is stolen at the originating machine

Answer 21

yes

Question 22

Defense in Identification

Answer 22

arp -a on both linux and windows. checks for spurious Arp entries.

Question 23

what tools can be used for identifcation of sesion hijacking?

Answer 23

ARPwatch on LAN

CAMTableExport: across Network

Question 24

Identifcation of session hijacking from windows?

Answer 24

arp -a

ipconfig /displaydns

Question 25

Identification of session hijacking from UNIX?

Answer 25

arp -a or arp -e

strings /var/cache/nscd/hosts

Question 26

Containment of session hijacking?

Answer 26

drop spurious sessions : change password and restarting service to which attacker connected

Question 27

Erad/Rec

Answer 27

change passwords, rebuild systems

Question 28

hard coded ARP tables (having only a specific IP to MAC address mapping) cannot be overwritten by gratutious ARPS

Answer 28

true.