Hints:

• The person with username “user” has a very easy password.

Click on Sign In

Input the following:

Username: user

Password: < I think you can guess it >

Once you’ve successfully logged in, you will capture your first FLAG!

Flag 1

Hints:

• Try viewing your own post and then see if you can change ID.

To capture this flag we have to try to view another user’s post.

This can be done by clicking on one of the posts to view it. Then change the ID # on the URL path and press Enter.

Tip: Go lower

You captured another FLAG!

Flag 2

Hints:

• You should definitely use “Inspect Element” on the form when creating a new post.

On the Home page we need to inspect the What’s on your mind? field.

Look for the user_id and change the value.

Write something to post and click on Create post.

Now, you have captured the FLAG.

Flag 3

Hints:

• 189*5

This flag really works our critical thinking and problem solving skills.

Find the product of this multiplication.

Then insert the product inside the URL path.

You have captured the FLAG!

Flag 4

Hints:

• You can edit your own posts. What about someone else’s?

Right now we have user access and the only post we can see that does not belong to user is the one posted by admin.

So, let’s attempt to edit an admin post.

Click on one of your post to edit it. Then on the URL path you will have to change the ID number.

Tip: Go lower.

It should take you to the admin’s post where you can edit. I suggest you add “EDITED” on the title so you can see the difference.

Click on Save post.

You’ve captured another FLAG!

Flag 5

Hints:

• The cookie allows you to stay signed in. Can you figure out how they work so you can sign in to user with ID 1?

To capture this flag we need to look for our cookie ID.

On the Home page right-click and Inspect.

Click on the Storage tab > look for Cookies > look for ID.

Click > copy the value.

Find a MD5 decrypt and encrypt engine by doing a quick Google search.

First you must decrypt the value to see which number it is. This will show you which user you are.

Admin must have an ID # 1.

So, now encrypt the #1 and obtain its MD5 hash.

Copy the MD5 hash for #1 and paste it in the table, replacing the other cookie ID.

Refresh the page.

FLAG 5 is now captured!

Flag 6

Hints:

• Deleting a post seems to take an ID that is not a number. Can you figure out what it is?

We have admin access now so we must delete one of the user’s post.

1. View one of the user’s post. Notate the post ID number.

2. Hover over the delete button for one of the admin’s post > right click > Inspect > find the delete hash ID.

3. Go back to the MD5 encrypt engine and generate the hash for the user’s post ID number.

4. Copy it > paste it on the delete hash ID section.

Now click the Delete button you inspected.

The FLAG should appear!

The first hint tells us we need to look at the source code.

Go ahead and take a look …

Do you spot anything out of the ordinary?

You should’ve found something is missing from the webpage.

The code indicates that there should be an image displayed but there isn’t.

To view the image copy the file name and insert it to the end of the URL path.

Congrats, you captured the FLAG!

Hackers are constantly finding creative ways to penetrate a network to extract sensitive data. Imagine if there was a way to entrap hackers in a fake network environment and get front-row seats to witness their attack tactics. Well, there is a way and it’s called honeypots! Honeypots are decoy environments set up near the actual network to lure hackers and gather insights into their attack methods. Once the hacker is inside the honeypot security teams can monitor their activities and help keep them from reaching the real network.

Main Honeypot Types

Production

This type of honeypot is very popular due to how relatively easy it is to implement and the amount of information gathering it does. It collects IP addresses, traffic volume, intrusion date and time, etc. It is commonly used by corporations, private businesses, politicians, and many others.

Research

A research honeypot is very sophisticated and collects various details about attack techniques used. It is commonly used by governments, intelligence agencies, research organizations, and more. This type of honeypot is great at providing a deeper insight into how attackers perform attacks and the techniques they use.

Specialized Honeypot Types

Malware

The environment is exposed to known vulnerabilities to attract attacks and gather intelligence to better understand how attackers execute these attacks. Organizations can use the information gathered and make necessary changes to strengthen their security posture.

Spam

Focuses on capturing spam emails by creating a dedicated spam email address that can be scrapped by attackers using an email harvester. Once the attacker has the email address they will begin sending spam emails. The information gathered can be used to block the sender and similar emails.

Database

Houses fake datasets in an environment vulnerable to software and architecture structures to attract attackers. Information is gathered on injection attack techniques, credential hijacking, and various similar attacks.

Spider

This honeypot targets web and ad-network crawlers to collect the necessary information to help better understand malicious bots and blocking methods.

Honeypot Complexity Classification

Low-interaction

A low-interaction honeypot complexity environment collects basic information about an attacker as it contains low resources which results in advanced attackers easily spotting them. It is a convenient and commonly used complexity due to how easy it is to set up and maintain.

High-interaction

A high-interaction honeypot complexity environment consists of multiple levels making it interactive to hold an attacker’s attention. Implementing a “honeywall” or perimeter around the honeypot is highly recommended to protect the real network as it allows the security team to control the inbound/outbound traffic.

Pure

A pure honeypot complexity environment is a full-scale environment mimicking the real production environment making it highly interactive. This complexity allows the security team to track the attackers’ activity and is mostly used for research purposes.

And Then There are Honeynets

A honeynet consists of two or more interconnected honeypots and they are designed to collect data from sophisticated attacks like ransomware and DDoS. Honeynets offer a more realistic feel for attackers making them believe they are successfully moving from one point to another. This allows the security team to gather information on the techniques attackers use to launch sophisticated attacks and how they move about once inside the network.

Benefits & Risks

Benefits

• Test incident response

• Slow down or deter attackers

• Gather intelligence and use it to strengthen the security posture

Risks

• Cannot detect data breaches

• Improper configuration can lead to attackers breaching the real network

• Attackers can use false attacks on honeypots to distract the security team from a real attack

Sticky Situation…

Honeypots enhance cybersecurity by providing intelligence to organizations and enabling researchers to study attack techniques and attacker methods. These controlled environments allow malicious actors to launch attacks without causing real damage, offering insights unattainable until after a data breach. However, honeypots also carry risks, and acknowledging them and their limitations is crucial to keeping the real network secure.

We have seen an incline in data breaches through ransomware attacks, with big corporations headlining such as the Colonial Pipeline and most recently Caesars Entertainment. Bringing penetration testing into focus as a great security preventative measure.

Penetration testers act as malicious actors attempting to breach an organization by finding and exploiting vulnerabilities. In simplest terms, organizations contract penetration testers to act as adversaries and exploit vulnerabilities to aid the organization in understanding its security landscape.

Penetration testing allows for a deeper look at the damage a breach can cause. Of course, there are a lot of moving parts before, during, and after a penetration test which I will cover in-depth in other posts. For now, I just want to provide a general overview of what penetration testing is.

Why is penetration testing important?..

Having a penetration test done is the best investment an organization can make. How can organizations defend their assets against malicious actors when they are unaware of how they could be potentially breached? Most organizations will implement basic security practices which is a great start but in today’s ever-evolving technological world much more is needed. When organizations are informed of where their weaknesses lie they can better protect their assets by strengthening those areas.

Additionally, many organizations are required to undergo penetration testing to remain compliant and abide by the laws and regulations pertaining to their specific industry. Some of these regulations include PCI DSS, HIPPA, GDPR, and many others.

Breaking it down ...

To get a more rounded basic understanding of what penetration testing is, it’s important to break it down into its categories, types, environments, and stages.

Categories

Types

Environments

Stages

1. Pre-engagement: The penetration tester and organization agree on what is to be tested (in scope) and what is not (out of scope). The legal implications for both sides are discussed and mutually agreed on. The organization specifies its goals, business requirements, and much more.

2. Reconnaissance: The penetration testers will begin gathering as much information about the organization and its network as possible. There are two types of reconnaissance, passive and active. The information gathered can be used to formulate an appropriate approach for later stages.

3. Discovery: A combination of additional reconnaissance and vulnerability discoverability. Here a penetration tester can find additional information such as IP addresses, DNS details, directories, usernames, etc. A vulnerability scan is also performed to find any potential known vulnerabilities.

4. Vulnerability Assessment: Vulnerabilities found are scored based on their severity level using The Common Vulnerability Scoring System. This helps determine which vulnerabilities need to be urgently addressed by the organization and the damage they can cause. These vulnerabilities are used to gain access in the next stage of the penetration test.

5. Exploitation: This stage requires the exploitation of the vulnerabilities found previously. Notes are taken on the exploitation process so it can be replicated by the organization if needed.

6. Post-Exploitation: This stage is all about maintaining access and documenting the data encountered throughout the exploitation. Important things to note are how long access was maintained and if the breach was noticed at any point.

7. Reporting & Risk Analysis: All the information gathered in previous stages is compiled into a comprehensive report. This report includes a risk analysis of the vulnerabilities found. Recommendations are also made to the organization on how to mitigate the vulnerabilities.

8. Remediation: The organization is now tasked with addressing the vulnerabilities and implementing the recommendations. After they complete their tasks the penetration tester will go back and reassess the vulnerabilities.

Let's Wrap It Up ...

This concludes the quick overview of penetration testing and its basic concepts. There is a lot more that goes into penetration testing which I will be breaking down further in upcoming posts. Performing a penetration test against an organization requires authorization from the organization's stakeholders, otherwise it is considered illegal and punishable by the law.

Social engineering is the most common threat companies and individuals alike face. Malicious actors launch social engineering attacks in an attempt to gain access to information they can further exploit. There are several social engineering attacks such as Baiting, Pretexting, Quid Pro Quo, Phishing, etc. So, which social engineering attack is most commonly used? Phishing! That’s right, phishing has a high success rate making it a favorite among malicious actors. But how effective are we at detecting phishing emails? Well, the answer is … we are not as effective as we like to think. Even cybersecurity professionals have fallen victim to phishing attacks!

Hooking The Bait ...

Malicious actors have a way of making their phishing emails sound important and urgent. They hook the victim by making them think that they must take action and if not there will be a negative consequence in return. Phishing emails will usually contain a malicious link or attachment.

Let's look at the following email ...

... Do you spot any red flags?

Although phishing emails vary in content, they all tend to contain the same red flags. Let's examine the above email in detail ...

The subject line of this email suggests that the contents of the email are important and action must be taken. To be fair sometimes providers do send emails with subjects similar to this one. But it is important to note the sense of urgency the malicious actor is implementing here as it sets the tone for the rest of the email.

Next, take a look at the sender's name and email address. This is the first clear red flag encountered in this email. The sender's name indicates that this email should be coming from Zelle® but the name is zelle fast and the email address is bakaretracy123@gmail.com which shows that this email is not coming from Zelle® but rather from someone attempting to impersonate the company. Why would a legitimate company use a regular Gmail account to send its customers emails?

Phishy ...

The UNDER REVIEW purple button is clickable although at first glance it does not show any indication that it is. If the victim of this email had clicked on the button they would have been taken to a website that prompts them to input their login credentials. Many times malicious actors will include buttons like these to trick the victim into clicking it either out of curiosity or accidentally.

Upon further inspecting the body of the email many red flags can be spotted. The name of the person who is "sending" money is inside parentheses which is unusual. Malicious actors tend to use phishing templates for a faster creation process which contain fill-in fields and we can assume that they placed the name "Brett Trent" as one of the fillers.

The second paragraph also urges the victim to take action in order to receive payment by following the given instructions. It also fails to mention the name of the sender's bank. Another thing to note here is the use of the word usually which hints at a may or may not meaning.

"You'll may or may not get their payment once you follow the instructions below."

Smells real phishy ...

Again, pay attention to word usage. Here the malicious actor used the word hereby to sound authoritative. At the beginning of the email, there is an amount of $85 USD shown but in this paragraph, it is stated that the victim will receive an additional $315.00 USD in order to obtain a certificate that provides an unrestricted zelle account. The malicious actor is promising more money than expected plus an unrestricted account, sounds too good to be true. The last sentence contains incorrect grammar which is typical for phishing emails. Grammar mistakes are not spotted right away and can be easily missed if not thoroughly read.

The malicious actor uses persuasive language to put the victim at ease and ensure them that they will receive their payment and an unrestricted zelle account. But hold on! They finish off by stating "neither the buyer nor the seller will lose a dime", this is an odd statement to make. I have not come across a company that uses language like this.

Lastly, at the end of the email, the malicious actor added a copyright stamp to further legitimatize the email. The legitimate Zelle® has the trademark symbol and it is owned by Early Warning Services, LLC.

Spotting The Phish ...

Here are the main takeaways to help spot phishing emails:

• Email address - Pay attention to the structure of the email address and the sender's name. Often the name will look legitimate but the email address will contain an error and give it away.

• Tone & Timing - Malicious actors are notorious for setting a tone of urgency on their email subject lines and email bodies. If an email is prompting you to take action make sure you are expecting such email and if not it is best to call your provider directly to verify.

• Color scheme & graphics - If the email contains any graphics such as logos pay close attention to them as they will often seem a bit off (pixelated) and the color scheme will not match the actual legitimate company. This might not always be the case since some phishing emails are more sophisticated than others.

• Grammar - This is probably one of the best things to look for because 9/10 times the phishing email contains misspelled words, improper sentence structure, slang, etc. However often these errors are overlooked because most people just skim through the email instead of reading it thoroughly.

• Too good to be true offers - Some phishing emails will promise something in return for doing what is being asked of them but the reward sounds too good to be true. No one gives away money via email ... yea I know bummer.

• Greeting - Phishing emails will contain a generalized greeting such as Hello Customer or Dear Customer. This is because malicious actors do not know your name or as explained earlier they are using fill-in phishing templates. Any service provider you use will always greet you by your first name or last name or both.

• Attachments & Links - Be on the lookout for weird attachments and links since these can be malicious. Malicious attachments will have the file extension ending in something unfamiliar like .exe.

• Requesting sensitive data - Credentials, financial information, and any Personal Identifiable Information (PII) are considered sensitive data. If an email is asking you to verify or provide sensitive data it is most likely a phishing email.

Phish Me Not ...

As technology evolves so do social engineering attacks and phishing emails are getting more sophisticated every day. Staying informed about phishing email trends and learning more about social engineering can save you from becoming a victim. Successful phishing attacks can cause devastating damage to companies and individuals. Data has become one of the most valuable assets that must be protected. Stay vigilant and say phish me not to malicious actors.

Social engineering is a form of attack that exploits humans by using manipulative tactics to trick victims into doing what the malicious actor needs to further perform an attack. Humans are inherently trusting in the workforce and attackers use this to their advantage. There are many forms of social engineering such as phishing, baiting, tailgating, quid pro quo, and more.

The first step malicious actors take is to investigate the target which is also referred to as the reconnaissance phase. They will find information regarding the organization, employees, emails, phone numbers, social media, third-party vendors, etc. Malicious actors will use this information to determine which social engineering attack to launch.

Social Engineering Attacks …

Phishing – An attacker sends an email to its victim masquerading it as legitimate communication to trick them into clicking on a link that either takes the victim to a site where they are asked to input login or personal information or the link downloads malware.

Baiting – This attack involves leaving a physical device such as a USB stick containing malware in a location where it could be found by the target or someone with access to the target.

Tailgating – Also known as “piggybacking”, tailgating is when an attacker follows an authorized party into a secured area. An authorized party will often just hold the door open for the attacker under the assumption that they also are allowed in the secure area.

Quid Pro Quo – This term translates to “a favor for a favor” and involves an attacker pretending to be someone exchanging a favor with the victim. This attack is best explained by using an example: An attacker pretends to be someone from the IT department calling the victim to help walk them through the steps to update their system or install a required software. The attacker is pretending to help the victim when in reality they are using them to gain access to the network by obtaining credentials or remote access.

Prevention …

Avoid clicking on links sent via email or other forms of communication if it is from an unknown source. Always double-check the email address of the sender and be aware that attackers can spoof a legitimate email address so always double-check by contacting the source.

Provide training to your employees on cybersecurity awareness and all the different social engineering attacks they might face. Education is knowledge and employees need to be aware of what these attacks might look like to help them prevent attacks.

Keep software up to date on all devices as updates usually offer security patches. When there is a known vulnerability and your systems are not patched against it attackers will exploit it to gain access.

Always verify the identities of individuals you do not know to ensure they are who they say they are. Be wary of calls claiming to be from IT, any other department, third-party vendors, or anyone claiming to need a favor from you or is offering to help you.

Maintain anti-malware up to date so the most recent version is running on the systems. Anti-malware companies send out updates to patch vulnerabilities and because they have added detection tools for new attack vectors.

Don’t Be Fooled …

Social engineering is meant to trick, fool, and manipulate individuals into doing what an attacker wants without much resistance. It is vital for companies to invest in cybersecurity training as employees are vulnerable to these types of attacks. If an employee is not informed on what to look out for the attacker will use that to gain access and compromise the network. DON'T BE FOOLED!!!

Human error is the main culprit behind security breaches and employees are at the forefront when it comes to keeping them at bay. Human error can be the result of erroneous execution of daily tasks, uninformed decision-making, or a combination of both. Most companies fail to invest in cybersecurity education and when their employees come face to face with a potential attack, they fail to recognize it as such.

Given that human error is considered the number one cause of security breaches the best defense against it, is end-user education. Providing company employees with cybersecurity education can better equip them to detect and even stop a breach before it even begins. But how can companies do this?

Cybersecurity & End-user Education Starting Point ...

Finding topics to cover can be overwhelming because there are so many attack vectors out in the wild. The best thing to do is to focus on one of the most common forms of attacks such as social engineering which gives you plenty of coverage. Social engineering is the most common form of attack companies face and this is where most attackers begin. There are many subcategories to social engineering such as phishing, vishing, baiting, pretexting, and so many more.

Building simple and easy-to-digest educational material around social engineering and its subcategories will help employees understand, recognize, and potentially prevent these types of attacks. Conduct regular training or workshops and promote a security focus work environment to encourage employees to participate.

Human Error …

The two most common human errors are those involving daily tasks and decision-making. Employees are required to make decisions and if not well informed they can make the wrong decision thinking they made the correct one. One example of this is clicking on a link from a phishing email that looks legitimate but it is not. The employee does not know what to look for in phishing emails or the tactics used by attackers. By the employee clicking on that link the network is now compromised.

Human error involving daily tasks can be something like sending an email containing sensitive information to the wrong person. This can occur due to the employee being distracted, tired, or simply because of the suggestion feature most email providers offer. Something so minuscule can place company security at risk of a security breach.

Combating Human Error …

As previously stated, the best way to combat human error is by providing end-user education through workshops or regular training. The material provided should be informative and easy to understand. Take into consideration that everyone has different learning styles and try to incorporate them as best as possible in your workshops or training. Every company operates differently therefore implement solutions to employee tiredness, distraction, etc. that best suits your company's needs.