DEV Community: Timothy Imanuel

Network Forensics: Evidence Acquisition (Week 4)

Timothy Imanuel — Tue, 06 Oct 2026 14:21:16 +0000

This week, we fovus on the phase of evidence acquisition, focusing on how investigators capture network traffic using physical interception, acquisition software, and active collection methods.

Physical Interception (Passive Acquisition)

Capturing packets as data is transmitted normally over the wire is known as passive acquisition. Investigators use several hardware methods to achieve this:

Inline Network Taps: These are Layer 1 devices inserted between physically connected devices. They cause minor data disruption during installation and physically replicate copies of traffic to separate sniffing ports.
Vampire Taps: These puncture the coating on the wire to physically touch the core, and they are standard issue in phone company "butt kits".
Radio Frequency (802.11 Wi-Fi): Wireless signals travel through the air as a shared medium, allowing stations to capture RF traffic regardless of whether they are part of the link. Anyone with access to the Pre-Shared Key (PSK) can monitor the traffic. Capturing this traffic requires special hardware, as many standard NICs do not support passive monitor mode.
Hubs: These dumb Layer 1 devices transmit all packets to every port, allowing for easy monitoring.
Switches: These Layer 2 (and sometimes Layer 3) devices use CAM tables to track port assignments and forward packets accordingly. To intercept traffic, investigators must have administrative access to configure port mirroring.

Traffic Acquisition Software

Once hardware is in place, investigators rely on specialized software libraries and tools to capture and filter the data.

Libpcap & WinPcap: Libpcap is a UNIX C library providing an API for capturing and filtering data link-layer frames, while WinPcap is the Windows equivalent. Popular tools like Tcpdump, Wireshark, Snort, and Nmap rely on these libraries.
Berkeley Packet Filter (BPF): Included in libpcap, BPF is a powerful filtering language that filters traffic based on comparison values at Layers 2, 3, and 4 (such as host, net, port, or specific byte/bit values).
Tcpdump: A UNIX command-line tool (WinDump for Windows) used to capture network traffic bit-by-bit for later analysis.
Wireshark Suite: This includes Wireshark (an open-source GUI for capturing and analyzing traffic), tshark (a command-line network protocol analyzer), and dumpcap (a tool specifically designed for packet capturing).

Active Acquisition

Active acquisition modifies the target environment, so investigators must carefully minimize their impact to preserve evidence.

Console Access: Connecting directly via a serial port or USB-to-serial adapter is the best practice. Remote connections should be avoided because they create excess traffic and can change CAM tables.
SSH & SCP/SFTP: Secure Shell (SSH) replaces insecure telnet by encrypting credentials, while SCP and SFTP handle secure file transfers.
Telnet: Telnet transmits credentials and data in plaintext and has limited security. It should be avoided unless it is the only option on older, un-upgradable network devices.
SNMP: The Simple Network Management Protocol is used to poll devices (GET, GETNEXT), interrupt via notifications (TRAP, INFORM), and control remote configurations (SET).
TFTP: Trivial File Transfer Protocol transfers files without authentication over UDP port 69. Forensic investigators often use it to export files from devices that do not support SCP or SFTP.

Acquisition Strategy & Clean Captures

When securing a scene, investigators must follow a strict methodology to ensure evidence is legally defensible.

Prioritize Volatile Data: Do not reboot or power down devices, as you will lose volatile data like ARP tables and the current state of the devices. Collect evidence according to its volatility.
Document Everything: Record all system times, check for time skew, record all terminal commands using tools like screen or script, and take screenshots of any GUI activities.
Forensically Clean Capture: You must not add any of your own traffic (evidence) to the network. To achieve this, use an acquisition system equipped with two network interface cards (e.g., eth0 and eth1). Run two separate tcpdump sessions: collect incoming traffic on one interface (filtering for the suspect's destination IP) and outgoing traffic on the other interface (filtering for the suspect's source IP). These isolated captures can later be merged and analyzed within Wireshark.

Network Forensics: Understanding TCP/IP Protocols (Week 3)

Timothy Imanuel — Tue, 06 Oct 2026 14:16:35 +0000

This week, we are focusing into the analysis of TCP/IP protocols, focusing on how to examine network flows, extract data, and analyze higher-layer traffic.

What is Flow Analysis?

Flow analysis is the "examination of sequences of related packets ('flows')". This process is typically conducted to identify traffic patterns, isolate suspicious activity, analyze higher-layer protocols, or extract data.

According to RFC 3679, a flow is "a sequence of packets sent from a particular source to a particular unicast, anycast, or multicast destination that the source desires to label as a flow". In modern network analysis, the terms "flow" and "stream" are increasingly becoming interchangeable.

Core Flow Analysis Tools

To analyze these flows, investigators rely on several key tools:

Wireshark: Provides a highly visual "Follow TCP Stream" feature to read conversations.
Tshark: A command-line network protocol analyzer.
Tcpflow: Parses non-fragmented IP packets and reassembles the TCP stream into a file.
Pcapcat: Lists all the streams it sees and can dump individual streams.
Tcpxtract: Uses file signatures (magic numbers) to extract and reconstruct payload data.

Flow Analysis Techniques

1. Listing Conversations and Flows

You can view packet conversations directly from the command line using Tshark. For example, to view TCP conversations from a capture file:

$ tshark -qn -z conv,tcp -r evidence01.pcap

You can also use Pcapcat to list specific TCP flows to identify IP addresses and ports of interest.

2. Exporting a Flow

Once you identify the conversation containing potential evidence, you can export it. Pcapcat and Tcpflow are highly effective for this.

$ tcpflow -r evidence01.pcap 'host 192.168.1.158 and port 5190'

3. File and Data Carving

Data carving is the process of extracting files directly from the raw data payload.

Manual Carving: Involves opening the exported flow in a hex editor and looking for "magic numbers" (file signatures). For example, a JPEG file always begins with 0xffd8 and ends with 0xffd9. Once extracted, you should gather hashes (using md5sum or sha256sum) and confirm the file size.
Automatic Carving: Tools like Tcpxtract automate this process by scanning the packet capture for known file signatures and exporting the discovered files automatically:

$ tcpxtract -f evidence01.pcap

Higher-Layer Traffic Analysis

Beyond raw data extraction, forensic investigators must understand higher-layer protocols to contextualize network activity.

HTTP (Hypertext Transfer Protocol)

Defined in RFC 2616, HTTP uses specific methods for communication:

GET: Retrieve information identified by a URI.
POST: Send data to a URI for processing.
HEAD: Retrieve information without the message body.
PUT: Upload information to a specified URI.
DELETE: Delete a specified resource.
OPTIONS: Obtain information about communication options.

SMTP (Simple Mail Transfer Protocol)

When investigating email traffic, it helps to know the architecture and basic commands:

Architecture: Mail User Agent (MUA), Mail Submission Agent (MSA), Mail Transfer Agent (MTA), Mail Delivery Agent (MDA), and Mail eXchanger (MX).
Basic Commands: HELO (opens connection), MAIL (identifies return address), RCPT (identifies recipient address), and DATA (message content).

DNS & DHCP

DNS (Domain Name System): A query-response protocol where both the client question and the server response are typically sent as single UDP packets.
DHCP (Dynamic Host Configuration Protocol): Handles the automated assignment of IP addresses and network configurations.

Higher-Layer Analysis Tools

For higher-layer analysis, investigators choose between specialized and multipurpose tools:

Small Specialized Tools: Great when you have a good idea of what the packet contains. Examples include Oftcat (for protocol summaries of OFT activity and recovered files), Smtpdump (for extracting email information and attachments), and Findsmtpinfo.py (for extracting authentication data and mail headers).
Multipurpose Tools: Best when a wide range of information is needed. NetworkMiner is an excellent example of a multipurpose traffic analyzer that can sort hosts, extract files, and parse credentials in a highly visual interface.

Works Cited

The contents of this post are based on the week3.pptx presentation by S. Pradono Suryodiningrat.

Davidoff, S., & Ham, J. (2012). Network Forensics Tracking Hackers Through Cyberspace. Boston: Prentice Hall.

Network Forensics: Sources of Evidence & Network Security (Week 2)

Timothy Imanuel — Tue, 29 Sep 2026 15:25:07 +0000

This week, we explore the sources of digital evidence, the history of early malware, and the core protocols used to secure network communications, specifically VPNs and IPSec.

The Dawn of Malware: Viruses and Worms

Understanding the history and behavior of malicious software is critical for any forensic investigator.

Early Milestones

The First Virus: Created in 1983 by Len Adelman, five years before a virus was released onto the broader internet. It was implanted into the UNIX vd command and successfully granted all system rights within an hour during controlled lab tests. It was later tested on VMS, VM/370, and Tops-20 with the same results.
The Morris Worm: Launched by Robert Morris on November 2, 1988. It invaded approximately 6,000 computers, which was 10% of the internet at the time, within hours. Instructions to stop the worm were posted online, but the hosting computer was disabled by the worm before anyone could read them. Estimated damage ranged from $10,000 to $97 million, highlighting how difficult it is to estimate the cost of cybercrime.

Types of Viruses and Worms

Macro Virus: Usually infects Microsoft Office and Outlook Express. They are cross-platform, as the Microsoft products give them a base platform to run in. They are usually passed by trading documents, and the viruses can email themselves out using the address book in Outlook. They automatically activate by being named the same as macros (e.g., AutoOpen, AutoClose), which run automatically when opening or closing a document.
Multipartite: Infects both the boot sector and files. It spreads via the network, infecting files which in turn infect the boot sector.
Stealth: Inserts code between the end application and the kernel. It gives results to the application that the application would expect. It may remove itself from the media while the system is running to avoid virus detection, then copies itself back to the media when the system is shut down.

Securing Communications: VPNs and IPSec

To protect data, modern networks rely on Virtual Private Networks (VPNs) and the IPSec protocol suite.

Virtual Private Networks (VPNs)

A VPN is a connection between private networks over a public network, and it is most likely encrypted. There are two main types:

Remote Access (Transport Mode): Allows access to the private network for mobile or home users, acting as an extension of the traditional dial-up network.
Site-to-Site (Tunnel Mode): Used to connect remote corporate networks, replacing leased and frame relay lines.

IPSec Fundamentals

IPSec provides several vital layers of protection:

Data Integrity: IPSec uses HMAC (Hashed Message Authentication Code) to verify that packets are not altered in transit. It appends a secret key to a message, hashes it, and sends both to the remote site. The remote site compares the hashes to ensure integrity. It currently uses HMAC-MD5 (128-bit hash) or the stronger HMAC-SHA-1 (160-bit hash).
Origin Authentication: Verifies the true sender of the information.
Anti-Replay: Prevents an attacker from intercepting and reusing a data packet.
Data Confidentiality: Ensures the actual data remains hidden.

IPSec Security Protocols

IPSec uses two primary protocols to send data:

Authentication Header (AH): Used when confidentiality is not an issue. It ensures data integrity, provides origin authentication, and provides anti-replay protection.
Encapsulating Security Payload (ESP): Provides encryption for confidentiality, plus all the protections offered by AH.

Both protocols can operate in two modes:

Transport Mode: Used between two hosts and secures the higher layer protocols only. For ESP, it takes the data in the IP packet and encrypts it, then creates another IP packet with an ESP header, the encrypted data, and a hash.
Tunnel Mode: Used between two security gateways (e.g., VPN router, firewall) and secures the entire IP packet. It provides confidentiality by encrypting the IP header itself. Because the entire IP packet is encrypted, the outside world has no idea about the design and layout of the LAN, nor do they know what specific machine it came from or is going to.

The 5 Steps of Setting Up a VPN

Establishing a secure VPN connection involves five distinct steps:

Determine Data: Determine what data needs to go through the VPN.
IKE Phase 1 (Internet Key Exchange): Negotiate policy sets, authenticate peers, and set up the secure channel between peers.
IKE Phase 2: Negotiate the security parameters used in the IPSec tunnel. This creates a Security Association (SA) that dictates the algorithms and transport mode. Security Parameter Indexes (SPIs) are sent with each packet to index back to this transform information.
IPSec Session: Data is sent to the remote site using the negotiated SA information.
Tunnel Termination: The SA information and shared key are removed. If more data needs to be communicated, the VPN restarts at Step 2.

Network Forensics Week 1

Timothy Imanuel — Tue, 29 Sep 2026 14:52:02 +0000

In this post, we will dive into the fundamentals of network forensics, how it compares to traditional digital forensics, and the methodology used by investigators to track down cybercriminals.

What is Network Forensics?

Network forensics is defined as "a sub-branch of digital forensics relating to the monitoring and analysis of computer network traffic for the purposes of information gathering, legal evidence, or intrusion detection".

Unlike traditional "dead box" forensics (where data is static, preserved once power is removed, and relatively easy to image), network data is constantly changing. Because of this, investigators face unique challenges:

Pinpointing the direct location of the necessary evidence is problematic.
Physical access to network devices can be difficult, and most network devices lack persistent data storage.
Investigators must minimize the investigation's impact on the business network.
Legal precedence is sometimes conflicting and not yet fully standardized.

Why Do We Need to Worry About Network Crime?

Cybercrime is an incredibly expensive problem. The FBI estimates that cybercrime costs more than $100 billion per year.

Furthermore, attacks are no longer just coming from "basement hackers". Threats can originate from both inside and outside the network, including:

Employees
Business competition
Professional hackers for hire
City-states

Types of Evidence in an Investigation

Understanding the various types of evidence is crucial when conducting an investigation:

Real evidence: Physical objects that play a relevant role in the crime (e.g., physical HDD, USB, computer box, keyboard).
Best evidence: Primary evidence that can be produced in court (e.g., a recovered file, or a bit-for-bit snapshot of a network transaction).
Direct evidence: Eyewitness accounts.
Circumstantial evidence: Evidence linked with other evidence to draw a conclusion (e.g., an email signature, USB serial number).
Hearsay: Second-hand information (e.g., a text file containing a personal letter).
Business records: Routinely generated documentation, like contracts, employee policies, and system logs.
Digital evidence: Electronic evidence, including emails, IMs, and logs.

The OSCAR Investigative Methodology

To effectively and legally handle network incidents, investigators often rely on the OSCAR methodology: Obtain, Strategize, Collect, Analyze, and Report.

1. Obtain Information

The first step involves gathering all preliminary information regarding the incident:

Incident description: How the incident was discovered, known persons involved, systems and/or data involved, and actions taken by the organization since discovery.
The Environment: Understanding the working business model, enforceable policies, network topology, available resources (staff, equipment, funding, time), and incident response management procedures.

2. Strategize

With the initial information in hand, investigators need to build a plan:

Understand the goals and timeframe for the investigation.
Organize resources and document potential evidence sources.
Estimate the value of the evidence versus the effort to obtain it, and prioritize based on this estimate.
Set up a schedule for regular communication between investigators.
Note: This plan is fluid and will most likely need adjustments.

3. Collect Evidence

This phase requires extreme care to ensure the evidence remains legally admissible:

Document, document, document!
Lawfully capture evidence and make cryptographically verifiable copies.
Setup secure storage of collected evidence and establish a chain of custody.
Crucial Rule: Use legally obtained, reputable tools, and analyze the copies only.

4. Analyze

Now it is time to dig into the collected data:

Establish a well-documented timeline of activities.
Show correlation with multiple sources of evidence.
Highlight and further investigate events that are potentially more relevant to the incident, corroborating all evidence.
Make educated interpretations of the evidence to build working theories, but always separate your interpretations from the facts.

5. Report

The final step is to present the findings. Every report must be:

Understandable by non-technical people.
Complete and meticulous.
Defensible in every detail.
Completely factual.

Week 12

Timothy Imanuel — Fri, 05 Jun 2026 15:37:17 +0000

Documentation & Reporting (Session 12 Summary)

A successful penetration test is only as good as its documentation. The final report is the actual deliverable that communicates discovered security risks to different audiences within an organization and provides a clear path for fixing them.

1. The Three Types of Penetration Testing Reports

Organizations require different levels of detail depending on who is reading the report. Pentesters split their findings into three target views:

Executive Report: Designed for high-level business leaders (like the CEO or CISO). It focuses on the big picture, business impact, and overall risk posture using charts, high-level metrics, and risk matrices.
Management Report: Tailored for operational management and compliance officers. It focuses on regulatory compliance goals, testing scope limitations, methodology verification, and change management workflows.
Technical Report: Built directly for system administrators, developers, and security analysts. It provides the deep technical mechanics, vulnerability/exploit maps, precise reproduction steps, and technical best practices.

2. Standard Structure of a Security Report

A professional penetration testing report follows a well-organized layout to ensure completeness:

Legal Foundations: Legal notice and the official penetration testing agreement.
Project Constraints: Introduction, clear project objectives, and document assumptions/limitations.
Risk Evaluation: A standardized vulnerability risk scale, an executive summary of overall findings, and a descriptive risk matrix.
Technical Analysis: The specific testing methodology applied, an overview of discovered security threats, detailed vulnerability/exploit maps, and compliance assessments.
Remediation & Annexes: Concrete technical recommendations, best practices guidance, and deep technical annexes.

3. Post-Testing & Remediation Procedures

After the report is delivered, the security team and client collaborate to systematically secure the infrastructure using a multi-layered post-testing workflow:

Network & Infrastructure Hardening

Segment Isolation: Apply a divide-and-conquer approach to strictly isolate secure internal network zones away from insecure, public-facing server entities.
Edge-Level Defenses: Maximize edge-level and data-centric protection controls to neutralize potential threats before they can spread to internal backend servers and user workstations.
Deploy Security Solutions: Implement and fine-tune trusted third-party security platforms, including IDS/IPS, next-generation firewalls, data content protection engines, antivirus suites, and Identity & Access Management (IAM) technologies.
Vulnerability Revalidation: Actively revisit network architectures to inspect vulnerable points specified in the report and ensure all configurations are regularly updated.

Code & Application Security

Secure Development: Train software engineering staff in secure coding principles.
Security Audits: Perform regular application code reviews and structural code audits to catch implementation bugs early.

Human & Physical Protection

Staff Security Awareness: Human-targeted social engineering attacks are incredibly difficult to block purely with software. Organizations must run continuous security awareness training to help staff spot modern phishing and impersonation tactics.
Physical Countermeasures: Enforce multi-layered physical perimeter security using secure environmental designs, mechanical or electronic access control gates, functional intrusion alarms, comprehensive CCTV loops, and robust personnel identification protocols.

Week 10 & 11

Timothy Imanuel — Fri, 05 Jun 2026 15:26:16 +0000

Maintaining Access: Post-Exploitation Foundations (Session 10 Summary)

This summary covers the primary theoretical concepts and definitions from Session 10 on Maintaining Access within a structured security assessment infrastructure.

1. Why Maintain Access?

Once initial access to a target network is achieved, establishing a persistent foothold is evaluated for several key reasons:

Efficiency: Avoids needing to repeat the initial exploitation phase ("reinventing the wheel").
Configuration Resilience: Ensures continuity if the original entry vector or vulnerability is patched or fixed by administrators.
System Hardening Adjustments: Allows analysts to continue testing even if basic perimeter firewalls or filters are updated.
Operational Considerations: Saves significant resource time during prolonged penetration testing engagements while always remaining within legal and ethical boundaries.

2. Core Persistence Frameworks

Security testing architectures classify persistence mechanisms into three primary methods: OS Backdoors, Protocol Tunneling, and Web-Based Backdoors.

A. Operating System (OS) Backdoors

An OS backdoor provides a method to access a host environment while completely bypassing standard authentication pathways to remain undetected.

Process Injection (Cymothoa): A utility designed to inject shellcode directly into the memory space of an existing, legitimate running system process (such as a system daemon). By attaching to a running Process ID (PID), the backdoor execution inherits the privilege context of that application securely without spawning a highly visible standalone process.
Advanced Frameworks: Platforms like Meterpreter or Intersect are applied to automate the management of local environment persistence.

B. Protocol Tunneling

Tunneling refers to the practice of encapsulating one network protocol inside another network protocol to safely navigate past perimeter defenses.

Purpose: Its main objective is to bypass protocol-specific restrictions or egress rules established on the target network.
Common Transport Channels: Highly trusted, standard outbound channels are favored to mask traffic, including DNS, HTTP/HTTPS, and SSH.
Common Tunneling Tools: * dns2tcp and iodine (encapsulating raw data traffic inside standard DNS queries).
- ptunnel (ICMP packet tunneling).
- proxychains, socat, stunnel4, and netcat.

C. Web-Based Backdoors

When the target infrastructure hosts web-based applications, testers can plant web shells as normal standalone scripts or inject minor payload logic directly into pre-existing source files (like themes or modules).

WeBaCoo (Web Backdoor Cookie): A stealthy web backdoor tool that uses the HTTP Cookie header to obfuscate command-and-control communication parameters, executing them via native PHP execution functions (system, shell_exec, exec, passthru, or popen).
Weevely: A tiny, highly optimized PHP web shell that acts as a stealthy terminal simulation tool, enabling filesystem browsing and remote command execution over standard web traffic vectors.
PHP Meterpreter: A payload module generated via msfvenom (reverse_tcp) that links web application code directly back to a waiting handler interface in Metasploit, opening interactive post-exploitation sessions inside the web daemon runtime environment.

Week 9

Timothy Imanuel — Thu, 21 May 2026 16:01:53 +0000

Target Exploitation & Privilege Escalation (Session 10 Summary)

🔬 1. Vulnerability Research Foundations

Programming: Code analysis using C/C++, Python, Perl, or Assembly.
Reverse Engineering: Analyzing compiled software binaries without original source code.
Instrumented Tools: Monitoring application runtime behaviors with debuggers and fuzzers.
Payload Construction: Engineering reliable shellcode execution pathways.

🗂️ 2. Public Exploit Directories

Public PoCs: Used by penetration testers to safely evaluate software version vulnerabilities.
Platforms: Exploit-DB , Packet Storm, SecurityFocus, NVD, US-CERT , Secunia , and XSSed.

🛠️ 3. Metasploit Console Basics (`msfconsole`)

Execution: Terminal interface tool for launching framework scans and exploits.
Global Show: Commands like show exploits or show payloads view platform-wide modules.
Contextual Show: Module-specific settings reveal options like show targets or `show advanced.

🚀 4. Privilege Escalation Mechanics

Vertical Escalation: Gaining higher system permissions (e.g., web user to root admin).
Horizontal Escalation: Lateral movement between accounts with matching privilege levels.
Vectors: Local kernel exploits, open home directories exposing stored SSH private keys, weak passwords, network sniffing, and packet spoofing.

🔐 5. Password Auditing Strategy & Tools

Online Guessing Attacks

Mechanics: Remote login attempts over production networks; limited by latency and lockouts.
Tools: Hydra, Medusa, and CeWL (web wordlist scraper).

Offline Cracking Attacks

Mechanics: Reversing stolen database file hashes locally on attacker hardware without network restrictions.
Tools: Hashcat, John the Ripper, Rainbow crack, Ophcrack, Crunch, and Hash-identifier.

🔄 6. Man-in-the-Middle (MitM) & ARP Spoofing

Normal Condition: Nodes exchange standard ARP requests and replies to map local IPs to hardware MAC addresses.
Spoofed Condition: The attacker broadcasts fake ARP responses to poison targets' cache tables.
Sniffing intercept: Traffic routes through the attacker to be read via Tcpdump, Wireshark, or Dsniff before forwarding.

Week 8

Timothy Imanuel — Thu, 21 May 2026 15:45:31 +0000

Social Engineering (Session 8 Notes)

The Psychology of the Attack

Social engineering focuses heavily on human psychology, mapping human senses into sight, hearing, taste, touch, smell, balance and acceleration, temperature, kinesthetic, pain, and direction. The primary goal of these methods is to obtain confidential information through human communication. This approach relies fundamentally on establishing a relationship of "trust" with the victim.

Two common tactics are applied to accomplish this task and guide conversations:
Interview: A structured approach used to gather initial data from a subject.
Interrogation: A more intensive, direct method applied to extract specific information from the target.

The Social Engineering Lifecycle

An effective social engineering engagement follows a clearly defined, iterative four-stage attack process:
[ Intelligence gathering ] --> [ Identifying vulnerable points ] --> [ Planning the Attack ] --> [ Execution ]

Intelligence gathering: Collecting open-source background data regarding the target organization or individual.
Identifying vulnerable points: Analyzing the gathered intelligence to isolate human, technical, or procedural weaknesses.
Planning the Attack: Designing a highly believable scenario or pretext tailored specifically to exploit those weaknesses.
Execution: Launching the designed operation to capture credentials, sensitive data, or gain initial system access.

🎭 Core Attack Methods (Psychological Triggers)

Attackers manipulate natural human biases and social constraints to bypass logical defenses using specific methods:

Impersonation: Pretending to be an authorized entity, employee, or trusted identity to deceive the victim.
Reciprocation: The art of exchanging favors in terms of getting mutual advantage, creating a psychological obligation for the victim to comply.
Influential Authority: Leveraging a real or perceived position of high status or corporate power to command compliance.
Scarcity: Creating an artificial sense of urgency or limited availability to force a rushed, unverified decision.
Social Relationship: Exploiting natural human tendencies to cooperate with people within a shared social network or established rapport.

🛠️ The Technical Toolkit

To automate and scale these psychological vectors, penetration testers use dedicated open-source utilities to profile targets and deploy credential capture systems.

1. Common User Passwords Profiler (CUPP)

The Common User Passwords Profiler (CUPP) is a profiling tool used to find valid passwords based on the target's personal, psychological, and social characteristics.

By executing the interactive command ./cupp.py -i , the tester can insert information about the victim to automatically build a highly customized password dictionary:

Name and Surname: The target's legal name identifiers (e.g., Name: Karen, Surname: Smith).
Nickname: The target's common online handle or casual name (e.g., karsmith).
Birthdate: Formatted explicitly as DDMMYYYY (e.g., 03101976).
Wife's (husband's) details: The spouse's legal name, nickname, and birthdate information.
Child's details: The child's name (e.g., Rohan) and birthdate metrics.
Pet's name: The identifier of the target's pet (e.g., Katie).

Note: If you do not know all the info, you can simply hit enter when asked to skip fields dynamically.

2. Social-Engineer Toolkit (SET)

The Social-Engineer Toolkit (SET) is an exploitation framework managed via directories like /pentest/exploits/SET/ and launched via ./set. The platform offers multiple attack options from its primary menu, including:

Automatic E-Mail Attacks: Automated options for crafting phishing email campaigns.
Website Attack Vectors: Web-based attack channels such as Java Applet Attacks, Metasploit Browser Exploits, Tabnabbing, and Web Jacking.
Credential Harvester Attack Method: A specialized web vector that utilizes clone capabilities within SET to harvest credentials or parameters from a website as well as place them into a report.

Week 7

Timothy Imanuel — Mon, 13 Apr 2026 11:57:01 +0000

Ethical Hacking Week 7: Target Exploitation

This week, we’ve finally moved into the hands-on phase of the course: Target Exploitation. This is where we stop looking for doors and start attacking our target.

Metasploit

Our primary focus this week was the Metasploit Framework, the world’s most used penetration testing software. Metasploit is essentially a giant library of pre-made exploits, payloads, and auxiliary tools that simplify the complex process of attacking a target.

Exploiting EternalBlue

In our lab, we tackled one of the most famous vulnerabilities in recent history: EternalBlue. This is a flaw in the Windows SMB protocol that allows for unauthenticated Remote Code Execution.

Here is the standard workflow we used to compromise the target:

Search: Finding the right module for the job (e.g., search eternalblue).
Select: Loading the exploit module (e.g., use exploit/windows/smb/ms17_010_eternalblue).
Configure: Setting our parameters, like RHOSTS (the target’s IP) and the PAYLOAD.
Exploit: Running the command and waiting for the magic to happen.

The Meterpreter Shell

Once the exploit was successful, we dropped into a Meterpreter shell. Meterpreter is an advanced, extensible payload that runs in memory to avoid detection.

Common commands we used to control the target:

sysinfo: Displays the target's OS and architecture.
getuid: Shows which user we are running as (usually SYSTEM after EternalBlue!).
shell: Drops us into a standard Windows Command Prompt for deeper control.

The Rules of Engagement

Even in a lab environment, ethical hacking has strict rules. For our final projects, we have clear boundaries:

No DoS/DDoS: We are here to learn, not to crash the server.
Integrity: Never change passwords after gaining access.
Persistence: Leave a simple text file or post on the target to prove you were there.

Target exploitation is intense and requires precision. Seeing a session open for the first time is an incredible feeling, but it’s a reminder of why security configuration is so important.

Week 6

Timothy Imanuel — Mon, 13 Apr 2026 11:49:41 +0000

Ethical Hacking Week 6: Vulnerability Mapping

This week in Ethical Hacking and Penetration Testing, we go into the critical phase of Vulnerability Mapping. Once we know our target exists and what services it’s running, we need to find the vulnerabilities that they have.

What is Vulnerability Mapping?

Vulnerability mapping is the process of identifying, classifying, and prioritizing weaknesses in a system. Not all bugs are created equal, and understanding their origin helps us decide how to exploit or fix them.

The Three Main Types of Vulnerabilities

We categorize vulnerabilities based on where they come from:

Design Vulnerabilities: Flaws in the actual specifications of the software or protocol. These are "broken by design."
Implementation Vulnerabilities: Mistakes made while writing the code, such as poor error handling or logical flaws.
Operational Vulnerabilities: Weaknesses caused by improper configuration or poor deployment choices in live environment.

Local vs. Remote Attacks

Local Vulnerabilities: The attacker needs physical access or a local account to trigger the flaw. These are often used for Privilege Escalation (moving from a standard user to an Admin/Root access).
Remote Vulnerabilities: The attacker can trigger and exploit the flaw over the network without needing any prior access. These are the "holy grail" for external attackers.

Web Application Auditing

A large part of our lab focused on the unique vulnerabilities found in websites. We looked at how to audit applications for:

SQL Injection (SQLi): Attacking the database by inserting malicious SQL commands into input fields.
Cross-Site Scripting (XSS): Injecting malicious scripts into web pages viewed by other users.
Cookie Security: Checking for missing security flags like HttpOnly (prevents JS access) and Secure (prevents transmission over unencrypted connections).

The Pentester's Toolkit

To find these flaws efficiently, we use a variety of specialized auditing tools:

Burp Suite: The industry standard for intercepting and modifying web traffic.
Nikto / Nikto2: A powerful web server scanner that looks for dangerous files and outdated software.
SQLmap: An automated tool that detects and exploits SQL injection flaws.
W3af: A web application attack and audit framework.

Vulnerability mapping turns a list of open ports into a prioritized list of targets. By understanding the taxonomy of these flaws, we can move from simple scanning to high-impact exploitation.

Week 4

Timothy Imanuel — Wed, 11 Mar 2026 15:23:29 +0000

Ethical Hacking Week 4: Target Discovery & OS Fingerprinting 🎯🔍

In Week 4 of Ethical Hacking and Penetration Testing, we officially started mapping out our targets. Before you can exploit a system, you have to find it and figure out exactly what it’s running. This phase is all about Target Discovery and OS Fingerprinting.

Finding the Target (Discovery)

We looked at the command-line tools used to identify live machines on a network. The classic ping sweep is great, but we also explored arping, fping, hping, and nbtscan for mapping out local networks. For modern setups, we even touched on IPv6 discovery tools like alive6.

OS Fingerprinting (Who are we talking to?)

Once we know a machine is alive, we need to know what operating system it’s running so we can look up vulnerabilities. There are two ways to do this:

Active Fingerprinting: We send carefully crafted packets to the target and analyze the unique ways its TCP/IP stack responds. Tools like Nmap do this perfectly. It’s fast, but very noisy (firewalls will log you).
Passive Fingerprinting: We quietly sniff the network traffic without sending anything. Tools like p0f let us figure out the OS just by observing how the target naturally communicates. It's slower, but totally stealthy.

TCP vs. UDP (The Delivery Methods)

To understand port scanning, you have to understand how data moves across the network.

TCP (Transmission Control Protocol): Connection-oriented and highly reliable. It uses a strict 3-way handshake (SYN ➔ SYN-ACK ➔ ACK) before sending data, and will automatically retransmit lost packets and reorder them at the destination.
UDP (User Datagram Protocol): Connectionless and fast. It just fires datagrams at the target without checking if they arrive. It's up to the application (like DNS or SNMP) to handle lost data.

We also learned the layout of the port neighborhood:

0 - 1,023: Well-Known Ports
1,024 - 49,151: Registered Ports
49,152 - 65,535: Dynamic/Private Ports

Reading Port Scans like a Pro

When we use a network scanner like Nmap, Unicornscan, or Amap, the target's response tells us exactly what state the port is in.

Decoding a TCP Scan:

Gets a SYN+ACK? The port is open and listening.
Gets an RST+ACK? The target explicitly rejected you (Port Closed).
Gets an ICMP Unreachable or absolutely nothing? The port is Filtered by a firewall.

Decoding a UDP Scan:

Gets a UDP response? The port is open.
Gets an ICMP Port Unreachable? The port is closed.
Gets nothing? The firewall might be dropping it, or the inbound packet was blocked.

Wrapping Up

We are officially mapping networks! Understanding how TCP and UDP respond to our probes is the difference between guessing and knowing. Stay tuned for the next phase. Keep hacking!

cybersecurity #infosec #ethicalhacking #nmap #networking

Week 5

Timothy Imanuel — Tue, 10 Mar 2026 14:33:07 +0000

Ethical Hacking Week 5: The Art of Target Enumeration 🕵️‍♂️🔍

This week in Ethical Hacking and Penetration Testing, we moved into Enumeration—the intrusive phase where we actively communicate with targets to extract actionable intelligence like network shares, usernames, and passwords.

The Core of Windows Enumeration: NetBIOS

Because many attacks on older Windows systems still work today, enumerating Microsoft targets is a major focus. To do this, you must understand NetBIOS (Network Basic Input Output System).

NetBIOS Names: These are limited to 16 characters and must be unique on the network. The final character is a hex suffix that identifies the specific service running.
- <00>: Workstation service
- <20>: Server service (sharing enabled)
- <1C>: Domain Controller or IIS
Null Sessions: An infamous, unauthenticated connection to a Windows system that doesn't require a username or password. Surprisingly, it still exists on systems like Windows XP!

The Enumeration Toolkit 🧰

We covered a mix of command-line and GUI tools used to pull this data directly from targets:

Command-Line Essentials

nbtscan: Scans a range of IP addresses for NetBIOS information.
nbtstat: Displays the NetBIOS table of a remote machine.
net view: Checks for shared resources on a specific network host.
net use: Connects to those shared folders or files.

GUI & Advanced Tools

NetScan Tools Pro: Graphically maps NetBIOS services and verifies access to shared resources.
DumpSec: Connects to a server to "dump" detailed permissions, user tables, policies, and registry details.
Hyena: A management tool that visually maps shares, user logins, and terminal services.
Nessus Client: A heavy hitter that identifies OS versions, open shares, and even firewall vulnerabilities across large networks.

Beyond Windows

While NetBIOS is the star of the show for Windows, we also briefly explored service enumeration tools for other protocols, including Amap, Httprint, Httsquash, and Ike-scan.