Instructor: Security Tools.
In this lesson, we're going to talk about
some of the different tools that you may use
as you're assessing your organization security.
Now, as we go through this lesson,
we are going to talk about various areas and various tools.
For instance, we're going to talk about Networking tools
File Manipulation tools, Shells and Scripts,
Packet Capture tools, Forensic tools
and Exploitation tools.
Now, before we get started I want to point out,
you do not need to know how to use all of these tools,
but you should be aware of what they're used for
as a security professional.
Now, a lot of the tools we're going to mention in this lesson
are ones you should already be familiar with
and know how to use from A+ or Network+.
But for the Security+ Exam,
we are much more focused on
you knowing the ability of each tool
and what you would choose to use it for.
For example, if I wanted to find out
if a host was up or down, what tool might I use?
I would probably use something like ping
because by doing a ping to it,
I can get a response and see if the host is online
and available or if it's not.
That's the level of detail we want to talk about
in this lesson.
Now, the first category of tools we're going to talk about
is networking.
And this is specifically going to be focused on
reconnaissance tools and discovery tools
to find hosts and servers and different systems
across your network.
The first tools we're going to talk about is traceroute
and that's comes as either tracert in Windows
or traceroute in a Unix or Linux system.
This is a network diagnostic command tool
that will allow us to display possible routes
and measuring transit delays of packets
as they go across an IP network.
So whether using IPv4 or IPv6,
this tool will help you out.
For example, if I wanted to find out
the route between my computer and my web server,
I can type in traceroute diontraining.com
and hit enter.
If I do that, I'm going to go and see
all of the different routers I went through
from where I'm sitting right now,
until I get to my web server
located back in the United States.
The next one we have is Nslookup and Dig.
Both of these are utilities
that are used to determine the IP address
associated with the domain name.
They're going to be used to obtain
mail server settings for domain
and other DNS related information.
Nslookup is the name server lookup
and Dig allows you to dig through those DNS records
and get information.
When you're using windows, Nslookup is your tool,
if you're using Unix or Linux,
you can use either Nslookup or Dig.
The next one we're going to talk about
is ipconfig and ifconfig.
Ipconfig is used in Windows,
Ifconfig is used in Linux or Unix.
Now these are utilities that display
all the network configurations
of the currently connected network devices
and they can be used to modify DHCP
and DNS settings as well.
So if I wanted to go and use a static IP address
instead of a dynamic IP address,
I can do that using these tools.
If I wanted to then revert and go back to DHCP,
I could do that using these tools as well.
The next tool we have is Nmap.
Nmap is an open source network scanner
that's used to discover hosts
and services on a computer network
by sending packets and analyzing the responses.
Now, again, for the Security+ Exam
you don't have to be an expert at Nmap,
but you should be able to look at the output from Nmap,
be able to read it and then pick out
what are the open ports or closed ports
over some basic vulnerabilities
based on those Nmap scans.
When you move on into CySA+ later on,
you are going to have to be very familiar with Nmap
and the way to use it.
The same thing with PenTest+,
because this is used by both analysts
and penetration testers.
The next one we have is ping or PathPing.
These are utilities that are used to determine
if a host is reachable on an internet protocol network.
So for example, if I wanted to see
if my website was up or down,
I could use ping or PathPing
to be able to see if that machine was up
by sending a ping message to it
and I would then get an echo reply message back.
If that echo reply message comes back
that means I have a successful connection
between me and that Nhost.
That tells me the server's up.
The next one we have is Hping.
An Hping is an open source packet generator
and it's also an analyzer.
It's used for the TCP/IP protocol
and it's used for security auditing and testing of firewalls
and networks.
The great thing about Hping is that you can really configure
exactly what is being sent.
It's actually used by Nmap as part of its package as well.
Hping is really this underlying tool
that really allows us to craft the packet however we want.
So that way if we have something like ping
and it's unresponsive,
we can try Hping with a better crafted packet
and see if we can get the response we want.
The next one we have is netstat.
And netstat is a utility that displays
the network connections
for the transmission control protocol, TCP
as well as routing tables
and a number of other network interface
and network protocol statistics.
Essentially, if you go into your window system
and type netstat,
you're going to be able to see
all of the different things
that your computer is connected to right now.
If you're doing an incident response
using netstat-ano as the command is really useful,
'cause it will show you everything
that has a persistent connection.
This can help you identify if there's any back doors
or connections that are remote access Trojan may be using.
The next one we have is Netcat.
And netcat is a utility for reading from
and writing to network connections
using their TCP or UDP,
which allows it to be used as a dependable backend
that can be used directly or easily
driven by other programs and scripts.
Now, what do we use Netcat for?
Well, there's a couple of things we might use it for.
The first is banner grabbing.
You can use Netcat and connect to a web server,
you'll get a text based response back
and you'll be able to read the code
that the web server is sending back to you.
That way you can understand what operating system it is
or what type of software it's being used on that web server.
Another thing we use Netcat for
is to be able to have a shell connection
and remotely control a machine.
For this reason, Netcat is blocked by most security
inside of most enterprise organizations
and you won't build a run it
without an exception to policy.
But if you play with it on your own system,
there's no blocking there.
And so you can try it out there
and see how it's used.
When you go into PenTest+
or if you go into a Certified Ethical Hacker,
you will be expected at that time to understand Netcat
and how to use it.
The next one we have is ARP.
ARP is utility for viewing and modifying
the local address resolution protocol or ARP cache
on a given host or server.
If you think back to your Network+ days,
you'll remember that ARP is a layer two protocol.
Instead of IP addresses
when you're on the local area network,
we actually use ARP messages
and we transfer information
based on their MAC address, not their IP address.
The ARP cache actually is that mapping.
If you think about how DNS is used
for IP addresses to domain names, ARP is like that,
but going from MAC addresses to IP addresses.
And you can use the ARP tool to be able to see that table
to see what IP addresses and what MAC addresses
are bound together.
Similar to how he used Dig or Nslookup
when we're talking about IP addresses to domain names.
The next tool we're going to talk about is route,
and route is utility to be able to view and manipulate
the IP routing table on a given host or server.
Did you know that every computer
has its own router inside of it?
Well, it does.
And the route tool is what allows it to know that.
When you go into the route tool by default
everything is going to be sent out to the default gateway
which is your router on your network.
But you may not want that.
You may want to be able to modify that
and send it in different ways.
This again is something that a lot of pentesters will do.
They'll go in and modify that route tool
to send traffic a different way.
The next thing we're going to talk about is cURL.
Now cURL is a command line tool
that's used to transfer data to or from a server
using any of a number of different protocols.
cURL can be used with HTTP for web, FTP for file transfer,
IMAP for mail, POP3 for mail,
SEP for secure file copying,
SFTP for secure file transfer,
SMTP for outbound email,
TFTP for trivial file transfer,
Telnet for unsecure remote access,
LDAP for directory access
and FILE to send and receive files
over the local network.
cURL can do all of these
and that's why it's used by analysts
when they're trying to test different protocols
over a given network or different server.
The next tool we're going to talk about is the Harvester.
The Harvester is just a Python script
but it's used to gather emails, subdomains, hosts,
employee names, open ports and banners
from different public sources,
like search engines PGP key servers
and SHODAN databases.
All of this information can be gathered
using the Python script.
This is a reconnaissance tool.
It's used by penetration testers and attackers
when they're doing this against your network.
And that's why you have to be aware of it
because it could be something
you might want to run against your own network
to see what type of information you can find
as an outsider looking in.
The next tool we're going to talk about is Sn1per.
This is an automated scanner
that can be used during a penetration test
to enumerate and scan for vulnerabilities
across your network.
Personally, this isn't one I heavily use.
Instead, I like to use things like Nessus instead.
The next tool we have is scanless.
And this is a utility that's used to create
an exploitation website
that can perform open port scans in a more stealthy manner.
Now, essentially when you have scanless,
you can set up a web server
and that web server can then do all of your scans for you
against those given targets.
That way, if they see the scan coming,
it's coming from this web server
and not from your own hosts,
and it's harder to detect you.
The next tool we have is dnsenum.
This is a utility that's used for DNS enumeration
and it's used to locate all the DNS servers
and DNS entries for a given organization.
When you're using dnsenum,
you could do the exact same thing
using something like Nslookup or Dig,
but using dnsenum, is a little bit easier
because it automates a lot of this process for you.
Again, this is the reconnaissance tool or discovery tool
that's used by penetration testers as well as hackers.
The next tool we have is Nessus.
And this is by far my favorite vulnerability scanner.
It is a proprietary vulnerability scanner
that can remotely scan a computer or a network
for different vulnerabilities.
When you hear about Nessus, remember,
this is an infrastructure scanner.
So we're talking about things like routers and switches
and hosts and servers when we're using Nessus.
The next one we have is cuckoo.
Now cuckoo is an open source software
for automating analysis of suspicious files.
Essentially, it's a sandboxed environment.
So if I have a file that I'm looking at
during instant response,
I go, "Hmm, this looks suspicious.
Is this malware?"
Well, I can take that and put inside the cuckoo sandbox,
run it and then see what type of bad things
that file is doing.
This can help you very quickly and easily identify
what that file is
as either friend or foe,
malware or benign,
because it can run it inside the sandbox environment
and do some automated processing for you.
All right, that was a lot of different tools
in the network section.
Next, we're going to talk about the file manipulation section.
And in here, we're going to talk about a bunch of tools
that are really specific to Linux.
When we talk about file manipulation
the first one we want to talk about is head.
Head is a command-line utility
for outputting the first 10 lines of a file
that's provided to it.
So for example, if I typed in head, log file
it will show me the first 10 lines of that log file.
This is more helpful when you're looking at something like
a file or a folder,
and you want to get information about it.
Now, on the other hand,
if I'm looking at a log file
the first headlines aren't nearly as useful,
instead, I'd rather see the last 10 lines
and that's what tail is used for.
So I typed tail, log file,
I would have this command line utility
that outputs the last 10 lines of that file provided to it.
Because if I'm thinking about,
"Hey, I just saw something weird on my network."
I can log in immediately,
check the last 10 lines and see if I have it in my logs,
that will be very quick and easy to do.
The next thing we have is cat,
where head does the first 10 tail does the last 10
cat does the entire file.
Cat stands for concatenate.
This is a command line utility
for outputting the contents of a file to your screen.
All of that file.
Now this could be something
that can overwhelm your screen though
because if you're doing something like a log file,
there might be a million entries in there.
So you might want to actually bring it down
and look for something specific.
To do that we would use grep.
Grep is a command-line utility
for searching plain text data sets
for lines that match a regular expression or a pattern.
For example if I wanted to find all the cases
where Jason logged into the system,
I can do grep, authentication log
and then the thing I'm looking for, Jason's username.
And if I hit enter,
it will show me all the cases in that log file
where it finds the word Jason.
The great thing about grep is that
it can also support these regular expressions.
So even if I don't know the exact thing I'm looking for
but I know the format of it, I can search for it using grep.
For example if I'm looking for
all the social security numbers,
I know those come in a format of three digits,
dash two digits, dash four digits.
And so I could put that in with a regular expression
and find all the cases of that through a given file
or across the entire system.
The next tool we have is chmod.
And this is a command-line utility
that's used to change the access permissions
of file system objects.
So if I'm working on analytic system
and I go and look at a file and I say,
"Huh, this file has execute permissions
but it should only have right permissions."
I can fix that using chmod.
That's the benefit of chmod.
The last, the next tool we're going to talk about
in this section here is logger.
Now logger is a utility that provides an easy way
to add messages to the /var/log/syslog file
from the command line or from other files.
Now, why would we want to do this?
Well, maybe we want to make sure
that we're writing a new script or a new tool
and we want to log any errors when we've run that tool.
We can do that by using logger
and then send that data to that syslog file.
The next section we're going to talk about
is shells and scripts.
Now inside of shells and scripts,
the first one we're going to talk about is secure shell or SSH.
This is utility that supports encrypted data transfer
between two computers and it's used for secure logins,
file transfers or general purpose connections.
SSH is a great tool and we use it a lot in security.
Why?
Because it is an encrypted tunnel.
So if I'm sitting at my desk
and I need to log into my server
that may be across the hall
or across the world,
I can do that using SSH.
And it gives me a shell interface where everything is secure
and I can then go ahead and command and control it.
The next thing we have is PowerShell.
Now PowerShell is used only in Windows.
PowerShell is a task automation
and configuration management framework from Microsoft
and it consists of a command line shell
and the associated scripting language
which is known as PowerShell.
Again, you don't need to know how to read PowerShell
or use PowerShell for this course or for this exam.
But as a security analyst,
you will be using PowerShell a lot
if you're working in a Windows environment.
Now, if you're working in a Linux environment
on the other hand,
you'll probably use Python instead.
Python isn't interpreted high-level
and general-purpose programming language.
But a lot of times we use it as a way to do scripting
as well as create our own programs
for vulnerability scans
or using something for penetration testing
or things like that.
If you're going to learn one programming language
as a security analyst, I recommend it's Python.
It is really easy to learn.
It is really powerful
and is used for most employers in their systems.
The next one we're going to talk about is OpenSSL.
Now this isn't necessarily a shell
or a script environment itself,
but more of a software library for applications
that will help us secure communications
over computer networks
against eavesdropping or the need to identify the party
at the other end.
When you go and connect to a website
you're using SSL or TLS,
and OpenSSL is used by a lot of places.
Now, the reason why OpenSSL is being talked about here
in shell and script environments
is because if you're using secure shell,
you're going to be using OpenSSL to protect it.
If you're going to do a remote connection
to a Windows server to use PowerShell,
you should have an SSL tunnel or a TLS tunnel
using OpenSSL to protect it.
This will allow us to make sure that
what we're sending to and from our servers
and to and from our shells is secure.
The next thing we want to talk about is packet captures.
Now, the first thing we're going to talk about is tcpdump.
This is a command line utility that allows you to capture
and analyze network traffic going through your system.
So for example, if I put a network tap on my system
and I'm connecting my laptop to it,
I can use tcpdump on that laptop to connect the data
crossing that network segment.
Once I have that data
I can then analyze it either using tcpdump or another tool.
Now, another thing I can do if I have that data
is I can actually replay it.
So I can actually use TCP replay
which is a suite of free open source utilities
for editing and replaying
previously captured network traffic.
As a penetration tester,
this is something I do often.
I might capture a handshake of a wireless network
and then I can replay it to get myself onto that network.
That's the benefit of using something like tcpreplay.
The next one we have is Wireshark.
And I know we've talked about Wireshark before
but if you went and did a dump using tcpdump,
you now have this pcap file.
How are you going to look at it?
Well, you can do it in the text mode using tcpdump
but honestly it's a lot easier to open it up in Wireshark.
Wireshark is a popular network analysis tool
and it can be used to capture network packets
and display them at a granular level
for real time or offline analysis.
You actually don't even have to capture them
using Wireshark,
you can capture them using tcpdump
and then load them up inside Wireshark as well.
If you're capturing an inside Wireshark
it does use a lot of the same code as tcpdump.
The next section we're going to talk about is Forensics.
Now in forensics, we only have a handful of tools
that we need to know for the exam.
The first one is the dd.
And dd is a command line utility
that's used to copy disk images
using a bit by bit copying process.
So if I have a hard disk
that I need to collect evidence from,
I can do a dd image of that hard disk
to a secondary hard disk.
Then all my analysis will be done
on that secondary hard disk
to make sure I'm not messing with the evidence
on that primary disk.
That's what dd is used for.
The second tool we're going to talk about is FTK Imager.
Now where dd is a command line tool,
FTK Imager works on Windows
and it is a graphical user interface based tool.
FTK Imager is a data preview and imaging tool
and it's going to let you quickly access electronic evidence
to determine if you need to do further analysis
with a forensic tool like FTK or EnCase or Autopsy.
The next tool we have is Memdump.
Now Memdump is a Linux command line utility
that's used to dump system memory
to the standard output stream
by skipping over holes and memory maps.
So we can output this to the screen
or we can output it to an image on an external hard disk
and then analyze it later.
So essentially if you want to capture
that volatile information in memory before it changes,
Memdump is a great tool to use for that.
The next tool we use in forensics is known as WinHex.
Now this is a commercial product
meaning you have to pay for it.
It's a disk editor and universal hexadecimal editor
it can be used for data recovery and digital forensics.
Now, I don't know why CompTIA
decide to use Windex as the example,
there's lots of other tools out there for hex editing
but this is the one they listed in the objectives.
So that's why I'm bringing it up here for you.
The last one we're going to talk about in forensics is Autopsy.
Now Autopsy is a digital forensics platform
and graphical user interface
that is laid on top of The Sleuth tool Kit.
It also is used with other digital forensic tools as well.
So when we as Autopsy,
there's an imaging function in there.
It relies on dd.
There's an analyst function in there
that's where we start getting things
from The Sleuth tool Kit.
There's ways to Sleuth disk files.
And so we can do different ways of file carving in there.
Autopsy is trying to make
all these hard to use command line tools easier
by providing a graphical user interface to them.
The last section we want to talk about is exploitation,
and this is going to be more focused
on our penetration testers.
Now we talk about exploitation
the first framework we need to talk about is Metasploit.
Merasploit is also known as the Metasploit Framework or MSF
and it is a computer security tool
that offers information about software vulnerabilities,
intrusion detection signature development
and improves penetration testing.
It is a great tool that is used
from the command line interface and allows you to go through
and search this database of known vulnerabilities,
and you may have found while using something like Nessus.
And then you can exploit that machine
using that vulnerability
because there's already exploits
built into the Metasploit Framework.
It really is being a script kiddie in a sense
because a lot of the functionality
is really easy to use,
but then it actually goes beyond that
and you could develop your own plugins
and use them inside this framework too.
The next one we want to talk about
is the Browser Exploitation Framework or BeEF.
This is a tool that can hook one or more browsers
and then use them as a beachhead
for launching various direct commands
and further attacks against the system
from within the browser context.
When we talk about BeEF,
it can be used as a penetration tester
as a man in the middle,
between them and the system they're trying to connect to.
Where they can get the information,
they can request it through the browser
pause that information before sending it back
modifying it, and then sending it back.
BeEF is a very, very powerful thing
and it's something you should learn as a penetration tester
but not something you need to learn in depth
for Security+.
The next thing we want to talk about
is a couple of password cracking tools.
The first of these is Cain and Abel.
Cain and Abel is a password recovery tool
that can be used to sniff the network,
cracking crypted passwords using dictionary,
brute-force or cryptanalysis attacks.
It can also record VOiP conversations,
decoding scrambled passwords, reveal password boxes
or analyze routing protocols.
Cain and Abel is a great tool
and it is really, really powerful.
It runs on Windows.
The next one we have is Jack the Ripper
and this is a cross platform password cracker.
It's also an open source password cracker.
It is known as a password security auditing tool
and password recovery tool
that's available for most operating systems.
Just like Cain and Abel,
Jack the Ripper can do dictionary
or brute-force password attacks.
All right, I know that was a ton of different tools,
but again remember,
you don't need to know how to operate these,
you just need to know which category they belong to
and which one you use for a given situation.