Agile Vs. Lean: Yeah Yeah, What’s the Difference?

• Lean

Lean comes from Lean Manufacturing and is a set of principles for achieving quality, speed & customer alignment
Agile
Agile refers to a set of values and principles put forth in the Agile Manifesto. The Manifesto was a reaction against heavyweight methodologies that were popular, yet crippling software projects from actually doing what they needed to do
http://hackerchick.com/agile-vs-lean-yeah-yeah-whats-the-difference

Credential Theft

• Credential Theft and How to Secure Credentials

Prevent network logon for local accounts
Prevent access to in-memory credentials
Prevent credentials from remaining in-memory when connecting remotely
Leverage protected users and control privileged users
https://technet.microsoft.com/en-us/security/dn920237.aspx

• Unofficial Guide to Mimikatz & Command Reference

Mimikatz is one of the best tools to gather credential data from Windows systems
https://adsecurity.org/?page_id=1821

• Credential stuffing

Credential stuffing is the automated injection of breached username/password pairs in order to fraudulently gain access to user accounts. This is a subset of the brute force attack category: large numbers of spilled credentials are automatically entered into websites until they are potentially matched to an existing account, which the attacker can then hijack for their own purposes.

Anatomy of Attack

    The attacker acquires spilled usernames and passwords from a website breach or password dump site.
    The attacker uses an account checker to test the stolen credentials against many websites (for instance, social media sites or online marketplaces).
    Successful logins (usually 0.1-0.2% of the total login attempts) allow the attacker to take over the account matching the stolen credentials.
    The attacker drains stolen accounts of stored value, credit card numbers, and other personally identifiable information
    The attacker may also use account information going forward for other nefarious purposes (for example, to send spam or create further transactions)

https://www.owasp.org/index.php/Credential_stuffing

Difference Between CPU and MicroProcessor

• Difference Between CPU and MicroProcessor

The technology of the microprocessor has become so advanced that it has the ability to contain not just one but up to four CPUs inside it
The GPU (Graphics Processing Unit) is also contained in a microprocessor
All CPUs are microprocessors, but not all microprocessors are CPUs.
http://www.differencebetween.net/technology/difference-between-cpu-and-microprocessor

• The CPU is combined with memory and I/O on the same chip, creating a complete computer on a single chip. This is called a microcontroller (uC).

http://electronics.stackexchange.com/questions/44740/whats-the-difference-between-a-microprocessor-and-a-cpu

Manually creating a shortcut for the Web Start client

• Manually creating a shortcut for the Web Start client

On Windows, the Web Start executable file for the default Java™ JVM is copied to a Windows system directory. When you let Web Start create a short cut for launching the desktop client, it uses the file in the system directory as the target. You can create a shortcut manually.
http://www.ibm.com/support/knowledgecenter/SSATHD_7.7.0/com.ibm.itm.doc_6.3/install/webstart_shortcut.htm

Virtualization Security

• Microsoft fixes Hyper-V bug in Windows

Guests on a Hyper-V system could trigger the flaw in the CPU chip set to issue instructions that could place the host system into a nonresponsive state, resulting in a denial-of-service condition for guest operating systems. The attacker would have to first secure kernel-mode code execution privileges on the guest operating system in order to trigger this denial-of-service condition.
Unlike Xen and VMware, Hyper-V functions only on systems with hardware support for virtualization, such as servers with Intel VT-x and AMD-V hardware virtualization extensions. As a result, Hyper-V is typically not at risk for escape attacks, where the attackers target the guest system in order to compromise the host.
http://www.infoworld.com/article/3005238/security/microsoft-fixes-hyper-v-bug-in-windows.html

• Common Virtualization Vulnerabilities and How to Mitigate Risks

VM escape:A guest OS escapes from its VM encapsulation to interact directly with the hypervisor.This gives the attacker access to all VMs and, if guest privileges are high enough, the host machine as well. Although few if any instances are known, experts consider VM escape to be the most serious threat to VM security.

How to Mitigate Risk
VM traffic monitoring:The ability to monitor VM backbone network traffic is critical.Conventional methods will not detect VM traffic because it is controlled by internal soft switches.However, hypervisors have effective monitoring tools that should be enabled and tested.
https://pentestlab.wordpress.com/2013/02/25/common-virtualization-vulnerabilities-and-how-to-mitigate-risks/

• Top Virtualization Security Mistakes (and How to Avoid Them)

Mistake #1: Misconfiguring virtual hosting platforms, guests, and networks
Mistake #2: Failure to properly separate duties and deploy least privilege controls
Mistake #3: Failure to integrate into change/lifecycle management
Mistake #4: Failure to educate other groups, particularly risk management and compliance staff 
Mistake #5: Lack of availability or integration with existing tools and policies
Mistake #6: Lack VM visibility across the enterprise
Mistake #7: Failure to work with an open ecosystem
Mistake #8: Failure to coordinate policy between virtual machines and network connections   
Mistake #9: Failure to consider hidden costs
Mistake #10: Failure to consider user-installed VMs
https://www.sans.org/reading-room/whitepapers/analyst/top-virtualization-security-mistakes-and-avoid-them-34800

• Kernel exploits

Unlike in a VM, the kernel is shared among all containers and the host, magnifying the importance of any vulnerabilities present in the kernel. Should a container cause a kernel panic, it will take down the whole host. In VMs, the situation is much better: an attacker would have to route an attack through both the VM kernel and the hypervisor before being able to touch the host kernel.
Denial-of-service attacks
If one container can monopolize access to certain resources–including memory and more esoteric resources such as user IDs (UIDs)—it can starve out other containers on the host, resulting in a denial-of-service (DoS), whereby legitimate users are unable to access part or all of the system.
Container breakouts
By default, users are not namespaced, so any process that breaks out of the container will have the same privileges on the host as it did in the container; if you were root in the container, you will be root on the host.2 This also means that you need to worry about potential privilege escalation attacks–whereby a user gains elevated privileges such as those of the root user, often through a bug in application code that needs to run with extra privileges.
Poisoned images
If an attacker can trick you into running his image, both the host and your data are at risk. Similarly, you want to be sure that the images you are running are up-to-date and do not contain versions of software with known vulnerabilities.
https://www.oreilly.com/ideas/five-security-concerns-when-using-docker

User and Entity Behavior Analytics ("UEBA")

• User and Entity Behavior Analytics ("UEBA")

User Behavior Analytics ("UBA") as defined by Gartner, is a cybersecurity process about detection of insider threats, targeted attacks, and financial fraud. UBA solutions look at patterns of human behavior, and then apply algorithms and statistical analysis to detect meaningful anomalies from those patterns - anomalies that indicate potential threats
User and Entity Behavior Analytics ("UEBA"). This expanded definition includes devices, applications, servers, data, or anything with an IP address.
https://en.wikipedia.org/wiki/User_behavior_analytics

• user behavior analytics (UBA)

User behavior analytics (UBA) is the tracking, collecting and assessing of user data and activities using monitoring systems.
user behavior analytics tools have more advanced profiling and exception monitoring capabilities than SIEM systems and are used for two main functions. First, UBA tools determine a baseline of normal activities specific to the organization and its individual users. Second, they identify deviations from normal. UBA uses big data and machine learning algorithms to assess these deviations in near-real time.
http://searchsecurity.techtarget.com/definition/user-behavior-analytics-UBA

• User Behavior Analytics ("UBA") as defined by Gartner, is a cybersecurity process about detection of insider threats, targeted attacks, and financial fraud. UBA solutions look at patterns of human behavior, and then apply algorithms and statistical analysis to detect meaningful anomalies from those patterns - anomalies that indicate potential threats

https://en.wikipedia.org/wiki/User_behavior_analytics

• Defending Against Pass-The-Ticket Attacks

How Pass-the-Ticket Attacks Are Launched
Pass-the-Ticket attacks are typically launched in one of two ways:
The hacker steals a Ticket Granting Ticket or Service Ticket from a Windows machine and uses the stolen ticket to impersonate a user, or
The hacker steals a Ticket Granting Ticket or Service Ticket by compromising a server that performs authorization on the users’ behalf.
http://www.identityweek.com/defending-against-pass-the-ticket-attacks/

• Windows Credentials Editor (WCE) – List, Add & Change Logon Sessions

Perform Pass-the-Hash on Windows
‘Steal’ NTLM credentials from memory (with and without code injection)
‘Steal’ Kerberos Tickets from Windows machines
Use the ‘stolen’ kerberos Tickets on other Windows or Unix machines to gain access to systems and services
Dump cleartext passwords stored by Windows authentication packages
http://www.darknet.org.uk/2015/02/windows-credentials-editor-wce-list-add-change-logon-sessions

• Windows Credentials Editor

Windows Credentials Editor (WCE) is a security tool to list logon sessions and add, change, list and delete associated credentials (ex.: LM/NT hashes, plaintext passwords and Kerberos tickets).
This tool can be used, for example, to perform pass-the-hash on Windows, obtain NT/LM hashes from memory (from interactive logons, services, remote desktop connections, etc.), obtain Kerberos tickets and reuse them in other Windows or Unix systems and dump cleartext passwords entered by users at logon.
WCE is a security tool widely used by security professionals to assess the security of Windows networks via Penetration Testing. It supports Windows XP, 2003, Vista, 7, 2008 and Windows 8.
http://www.ampliasecurity.com/research/windows-credentials-editor/

• Using WCE (Windows Credential Editor)

C:\Users\Ale\Desktop>wce -l

WCE v1.4beta (X64) (Windows Credentials Editor) – (c) 2010-2013 Amplia Security

– by Hernan Ochoa (hernan@ampliasecurity.com)

Ale:WIN71_64:960407EE2F0ED879AAD3B435B51404EE:95947E88DC144165EEC12CC2039E56B6



C:\Users\Ale\Desktop>wce -w

WCE v1.4beta (X64) (Windows Credentials Editor) – (c) 2010-2013 Amplia Security

– by Hernan Ochoa (hernan@ampliasecurity.com)

Ale\WIN71_64:ceh123!
https://alexandreborges.org/2014/02/14/using-wce-windows-credential-editor

• Pass the hash

In cryptanalysis and computer security, pass the hash is a hacking technique that allows an attacker to authenticate to a remote server/service by using the underlying NTLM and/or LanMan hash of a user's password, instead of requiring the associated plaintext password as is normally the case.
https://en.wikipedia.org/wiki/Pass_the_hash

• UEBA is new class of security technology that is designed to identify next-generation security threats that have penetrated traditional firewalls and other perimeter systems. 

"User and Entity Behavior Analytics offers profiling and anomaly detection based on a range of analytics approaches, usually using a combination of basic analytics methods and advanced analytics…
Examples of these activities include unusual access to systems and data by trusted insiders or third parties, and breaches by external attackers evading preventative security controls.
The Niara behavioral analytics solution seamlessly integrates with the ClearPass network security platform to create the industry's most complete visibility and attack detection system.
The Niara behavioral analytics solution seamlessly integrates with the ClearPass network security platform to create the industry's most complete visibility and attack detection system.
The Niara behavioral analytics solution seamlessly integrates with the ClearPass network security platform to create the industry's most complete visibility and attack detection system.   
http://www.marketwired.com/press-release/hpe-acquires-niara-to-enhance-security-at-the-intelligent-edge-nyse-hpe-2192822.htm

pcap analysis

• Exposing One of China’s Cyber Espionage Units

aPt1: attaCk LIFeCyCLe
They begin with aggressive spear phishing, proceed to deploy custom digital weapons, and end by exporting compressed bundles of files to China – before beginning the cycle again.
These attacks fit into a cyclic pattern of activity that we will describe in this section within the framework of Mandiant’s
Attack Lifecycle model. In each stage we will discuss APT1’s specific techniques to illustrate their tenacity and the
scale at which they operate.
http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf

• 8 cyber security technologies DHS is trying to commercialize

REnigma
This software runs malware within a virtual machine and records what it does so it can be played back and analyzed in detail.

Socrates
This software platform automatically seeks patterns in data sets, and can tease out those that represent cyber threats.

PcapDB
This is a software database system that captures packets to analyze network traffic by first organizing packet traffic into flows.

REDUCE
This is a software analysis tool to reveal relationships between malware samples and to develop signatures that can be used to identify threats.

Dynamic Flow Isolation
DFI leverages software defined networking to apply security policies on-demand based on current operational state or business needs.

TRACER
Timely Randomization Applied to Commodity Executables at Runtime (TRACER) is a means to alter the internal layout and data of closed-source Windows applications such as Adobe Reader, Internet Explorer, Java and Flash.

FLOWER
Network FLOW AnalyzER inspects IP packet headers to gather data about bi-directional flows that can be used to identify baseline traffic and abnormal flows as a way to spot potential breaches and insider threats.

SilentAlarm
This platform analyzes network behaviors to identify likely malicious behavior to stop attacks including zero-days for which there are no signatures.

http://www.networkworld.com/article/3056624/security/8-cyber-security-technologies-dhs-is-trying-to-commercialize.html

• Inspection of packet captures

–
PCAP-for signs of intrusions, is a typical everyday task for security analysts and an essential skill analysts should develop. Malwares have many
ways to hide their activities on the system level (i.e. Rootkits), but at the end, they must leave a visible trace on the network level, regardless if it's obfuscated or encrypted. This paper guides the reader through a structured way to analyze a PCAP trace, dissect it using Bro Network Security Monitor (Bro) to facilitate active threat hunting in an efficient time to detect possible intrusions. The detection arm itself can be broken down into two major parts, reactive and proactive On the network level –the scope of this paper, one widespread reactive detection example is SNORT (SANS, n.d.), which used to be an effective approach, but it has two significant shortcomings.Firstly, SNORT depends on static signatures, which determined attackers could easily bypass. The second is that security analysts operate into
a more passive mode, waiting for something malicious to happen that might –or might not- trigger an alert and only then, an investigatio attacks have evolved and require more than traditional NIDS –reactive detection- to detect adversaries (Ashford, n.d.). Active detection (aka threat hunting) was
introduced to fill this gap.

https://www.sans.org/reading-room/whitepapers/threathunting/hunting-threats-packet-captures-37765

• Source Routing

Source Routing is a technique whereby the sender of a packet can specify the route that a packet should take through the network
network administrators block all source-routed packets at their border routers.

Unless a network depends on it, source routing should be disabled.
Source routing is a technique whereby the sender of a packet can specify the route that a packet should take through the network. As a packet travels through the network, each router will examine the destination IP address and choose the next hop to forward the packet to. In source routing, the "source" (i.e., the sender) makes some or all of these decisions.
Attackers can use source routing to probe the network by forcing packets into specific parts of the network. Using source routing, an attacker can collect information about a network's topology, or other information that could be useful in performing an attack. During an attack, an attacker could use source routing to direct packets to bypass existing security restrictions.
https://superuser.com/questions/924633/why-doesnt-ping-j-work

• Source routing has been around for a very long time. In fact, it’s a part of the specification of the IP protocol.

many network engineers fail to understand the potential dangers in allowing source routed packets to pass through internal routers.
http://www.enclaveforensics.com/Blog/files/dbe04629c14a2d07495a38bbf2fc98d9-5.html

• Wireshark

Wireshark is the world's foremost network protocol analyzer. It lets you see what's happening on your network at a microscopic level.
http://www.wireshark.org

• Wireshark shows all the action in the bottom pane like this:

    Frame (Physical Layer)
    Ethernet II (Data Link Layer)
    Internet Protocol Version 4 (Network Layer)
    User Datagram Protocol (Transport Layer)
    Domain Name System (response) Application Layer

So here’s the big review:

    Routers are layer 3 devices because they make forwarding decisions based on layer 3 addresses.
    Switches are considered layer 2 devices because they make forwarding decisions based on layer 2 addresses.
    Hubs, NICS, Wi-Fi cards, cables, and connectors are at layer 1.

Layer 2 has MAC addresses, the NIC is also a Layer 2 device because it has the MAC address.  Switches are bridges with more ports they also work at layer 2 since they understand physical addresses.

At Layer 3 we use IPv4 and IPv6.  Routers live here and the protocol data units (PDUs) used here are called Packets.

And here’s a quick review of the terms:

    MAC address and Physical Address and Layer 2 addresses are the same thing.
    Frames are Protocol Data Units (PDUs) at Layer 2
    Packets are PDUs at Layer 3
    Segments are PDUs at Layer 4
    Data is just called a PDU at the Application Layer


http://www.fixedbyvonnie.com/2015/05/networking-101-layers-part-3-of-3/#.WhVetjdRWUk

• wireshark

Use ping -l 2500 <default gateway address> to ping the default gateway address with a 2,500 byte packet. Notice that because the default maximum transmission unit (MTU) for Ethernet frames is 1,500 bytes, this should generate fragmented packets
https://en.wikiversity.org/wiki/Wireshark/IPv4_fragments

• Packets 8, 9, 10, 11

These are the four “handshake” WPA packets.
These are the four critical packets required by aircrack-ng to crack WPA using a dictionary.
The first pair of packets has a “replay counter” value of 1.
The second pair has a “replay counter” value of 2.
Packets with the same “replay counter” value are matching sets.

 If you have only one packet for a specific “replay counter” value then you are missing it from the capture and packet you do have cannot be used by aircrack-ng. That is why sometimes you have four EAPOL packets in your capture but aircrack-ng still says there are “0” handshakes. You must have matching pairs.

EAPOL packets 1 and 3 should have the same nonce value. If they don't, then they are not part of the matching set.

Aircrack-ng also requires a valid beacon. Ensure this beacon is part of the same packet sequence numbers. For example, if the beacon packet sequence number is higher then the EAPOL packet sequence numbers from the AP, the handshake will be ignored. This is because the aircrack-ng “resets” handshake sets when association packets and similar are seen.

Packets 12, 13, 14, 15
These are data packets to/from the wireless client to the LAN via the AP. You can view the TKIP Parameters field to confirm that WPA is used for these packets:

In Wireshark, use “eapol” as a filter. This will show only handshake packets and is useful for analyzing why you don't have the full handshake

http://aircrack-ng.org/doku.php?id=wpa_capture

• tcpdump -nnvvS src 172.5.2.3 and dst port 3389

tcpdump -nnvvS src 172.22.92.62 and dst port 80

tcpdump -nnvvS src 172.22.92.62 and dst port 80 -w capture2 -i wlo1

tcpdump -nnvvS not src 172.22.92.62 and dst port 80 -w capture2

tcpdump -i wlo1 port 80 -w capture1

sudo tcpdump -i wlo1 port 80 -w capture1

• netcat

Netcat is a computer networking service for reading from and writing network connections using TCP or UDP. Netcat is designed to be a dependable “back-end” device that can be used directly or easily driven by other programs and scripts
http://en.wikipedia.org/wiki/Netcat

Port Scanning with Netcat
For port scanning with Netcat use the following syntax:

nc –[options] hostname [ports]

As we said, you scan use range, commas and name of port for scanning. Below we show you some examples:

nc –v 192.168.1.4 21, 80, 443
nc –v 192.168.1.4 1-200
nc –v 192.168.1.4 http

http://linux.devicegadget.com/attack/netcat/167/

• hping

hping is a command-line oriented TCP/IP packet assembler/analyzer.
http://www.hping.org/ 

• PassiveDNS sniffs traffic from an interface or reads a pcap-file and outputs

the DNS-server answers to a log file. PassiveDNS can cache/aggregate duplicate
DNS answers in-memory, limiting the amount of data in the logfile without
losing the essence in the DNS answer.

https://github.com/gamelinux/passivedns

• CIRCL Passive DNS is a database storing historical DNS records from various resources including malware analysis or partners. The DNS historical data is indexed, which makes it searchable for incident handlers, security analysts or researchers.

https://www.circl.lu/services/passive-dns/

• TCP reset attack

TCP reset attack, also known as "forged TCP resets", "spoofed TCP reset packets" or "TCP reset attacks", is a way to tamper and terminate the Internet connection by sending a forged TCP reset packet. This tampering technique can be used by a firewall in goodwill, or abused by a malicious attacker to interrupt Internet connections.

https://en.wikipedia.org/wiki/TCP_reset_attack