Network Solutions

CCNA books by todd lammle

2018-04-21T16:08:00.004+05:30

Download CCNA books in one click.

Types of routing

2018-03-15T16:38:00.000+05:30

It is a very very very important topic in networking whether you are looking for career in security then also you have to have knowledge of routing and its protocols.

Once you create an inter network by connecting your WAN and LAN to a router, you will need to configure logical network address, such as IP address to all hosts on the inter network so that they communicate across network.

The term routing is used for taking a packet from one device and sending to another across the network.

To be able to route a packets a route must know at a minimum the following:

Destination address

Neighbor routers from which it can learn about remote networks

Possible routes to all network

The best route to each network

How to maintain and verify routing information

Routing are of three types :

1) Static Routing

2) Dynamic Routing

3) Default Routing

Static Routing: In This Type of routing all the routes are assigned to the routers by administrator manually. Each route is known by System admin. if network is large then it is difficult to remember all the path and most important thing is if any network is down then it took lots of time of admin to find out which network is down and what is the issues.

Dynamic Routing: In dynamic routing best path to reach network is selected by router. There are different routing protocols to calculate best path to reach network. Best path is calculated on hop count , bandwidth ,delay etc.

Default Routing:

Default route which is also known as the gateway of last resort, is used in forwarding packets whose destination address does not match any route in the routing table. In IPv4 the CIDR notation for a default route is 0.0.0.0/0 and ::/0 in IPv6. Now since the both the host/network portion and the prefix length is zero a default route is the shortest possible match. In previous lessons in which we discussed basics of IP Routing we know that a router when performing a route lookup will select a route with longest possible match based on CID specifications, however if packet does not match any route in the routing table it will match a default route, the shortest possible route, if it exists in the routing table. A default route is very useful in network where learning all the more specific routes is not desirable such as in case of stub networks. A default is immensely useful when a router is connected to the Internet as without a default route the router must have the routing entry for all networks on the Internet which are in numbers of several hundred thousand, however with single route configured as the default the router will only need to know the destinations internal to the administrative domain and forward IP packets for any other address towards the Internet using the default router. The default gateway is a device such as a router that serves as the edge devices providing an access point to other networks and is used to forward IP packets which does not match any routes in the routing table. We usually encounter the concept of default gateways in our daily computer life. The LAN configuration in our windows requires us to specify the IP address, Subnet Mask and the Default Gateway to access the Internet. The default gateway IP address is the IP address of the CPE or Internet modems which provide the connectivity to the Internet, now since the Internet has several hundred thousand routes which we cannot install in our table, we simply tell our computer to forward all packets destined to the Internet to this device. Again the CPE will itself have a default route and gateway configured which will point to the ISP access device.

STP

2018-03-13T15:45:00.000+05:30

The Spanning Tree Protocol (STP) is a network protocol that builds a loop-free logical topology for Ethernet networks. The basic function of STP is to prevent bridge loops and the broadcast radiation that results from them. Spanning tree also allows a network design to include backup links to provide fault tolerance if an active link fails.

Protocol Operation:

The need for the Spanning Tree Protocol (STP) arose because switches in local area networks (LANs) were often interconnected using redundant links to improve resilience should one connection, called a link, fail. However, this was found to create transmission loops, broadcast storms and MAC address table trashing. If redundant links are used to connect switches, then transmission loops need to be avoidedbecause data link layer 2 Ethernet frames do not expire. Potentially an Ethernet frame with a destination MAC address that is not in the MAC address table of the immediate switch can be bounced around between switches in the local area network. Redundant links between these switches could result in the Ethernet frame never reaching a Switch that has the destination MAC address in its MAC address table. In such cases switches also broadcast the Ethernet frames to all ports, except the one from which it entered. This can create a broadcast storm. However, if only one link between switches exists, entire segments of the local area network would become unavailable should this one link fail. Thus it has become best practice to establish a second redundant link between critical switches.^[5] If more than one link between two switches are used to transmit Ethernet frames, a switch will receive Ethernet frames with the same source MAC address through two ports, resulting in what is known as MAC address table trashing.

To avoid the problems associated with redundant links in a switched LAN the Spanning Tree Protocol (STP) is implemented on switches to monitor the network topology. Every link between switches, and in particular redundant links, are catalogued. STP then disables redundant links by setting up one preferred and optimized link between switches in the LAN. This preferred link is used for all Ethernet frames unless it fails, in which case the non-preferred redundant link is enabled. When implemented in a network, STP designates one layer 2 switch as root bridge. On this root bridge the preferred and non-preferred links are calculated. The root bridge switch constantly communicates with the other switches in the LAN that implement STP, called non-root bridges, using Bridge Protocol Data Units(BPDUs).

Provided there is more than one link between two switches, the STP root bridge calculates the cost of each path based on bandwidth. STP will select the path with the lowest cost, that is the highest bandwidth, as the preferred link. STP will enable this preferred link as the only path to be used for Ethernet frames between the two switches, and disable all other possible links by designating the switch ports that connect the preferred path as root port.The STP path cost default was originally calculated by the formula

1 Gigabit / second / bandwidth

. When faster speeds became available, the default values were adjusted as otherwise speeds above 1 Gbit/s would have been indistinguishable by STP. Its successor RSTP uses a similar formula with a larger numerator:

20 Terabit / second / bandwidth

. These formulas lead to the sample values in the table on the right.

After STP enabled switches in a LAN have elected the root bridge, all non-root bridges assign one of their ports as root port. This is either the port that connects the switch to the root bridge, or if there are several paths, the port with the preferred path as calculated by the root bridge. Because not all switches are directly connected to the root bridge they communicate amongst each other using STP Bridge Protocol Data Units (BPDUs). Each switch adds the cost of its own path to the cost received from the neighboring switches to determine the total cost of a given path to the root bridge. Once the cost of all possible paths to the root bridge have been added up, each switch assigns a port as root port which connects to the path with the lowest cost, or highest bandwidth, that will eventually lead to the root bridge

STP Switch Port States:

Blocking - A port that would cause a switching loop if it were active. No user data is sent or received over a blocking port, but it may go into forwarding mode if the other links in use fail and the spanning tree algorithm determines the port may transition to the forwarding state. BPDU data is still received in blocking state. Prevents the use of looped paths.
Listening - The switch processes BPDUs and awaits possible new information that would cause it to return to the blocking state. It does not populate the MAC address table and it does not forward frames.
Learning - While the port does not yet forward frames it does learn source addresses from frames received and adds them to the filtering database (switching database). It populates the MAC address table, but does not forward frames.
Forwarding - A port receiving and sending data in Ethernet frames, normal operation. The Forwarding port monitors incoming BPDUs that would indicate it should return to the blocking state to prevent a loop.
Disabled - A network administrator has manually disabled a switch port

Subnetting

2018-03-12T17:50:00.004+05:30

In simple words subnetting means divide a large or huge network into a small and simple network. A large network is complicated to manage or if any fault occur in the network it consume lots of time of network administrator to find out exact location of the issue.

In Subnetting you have to answer 5 question specifically while you designing a network for any enterprises.

Here are the 5 question you have to keep in your mind.

Firstly client provide you pool of addresses then as per client requirement you have to design the LAN network at customer's office.

These are the basic question you have to answer .

1) How many subnet does the choosen subnet mask produce?

2) How many Valid host / subnet will be availble ?

3) What are the valid Subnet ?

4) What does the network and broadcast address of each subnet ?

5) What are the valid host in each subnet ?

Lets do the subnetting of class C IP address.

For class C ip address for practice is 192.168.1.0

Subnet Mask	How Many Subnet 2^x Where x is mask bit	Host per subnet 2^y-2 Where y is unmask bit	Valid Subnet 256-subnet mask	Broadcast address of each subnet	Valid host
255.255.255.0 /24	1	254	256-0=256	192.168.1.255	192.168.1.1to 192.168.1.254
255.255.255.128 /25	2	126	256-128=128	192.168.1.128 192.168.1.255	192.168.1.1 to 192.168.1.127 192.168.1.129 to 192.168.1.254
255.255.255.192 /26	4	62	256-192=64	192.168.1.63 192.168.1.127 192.168.1.191 192.168.1.255	192.168.1.1 to 192.168.1.62 192.168.1.64 to 192.168.1.126 192.168.1.128 to 192.168.1.190 192.168.1.192 to 192.168.1.254
255.255.255.224 /27	8	30	256-224=32	192.168.1.31 192.168.1.63 192.168.1.95 192.168.1.127 192.168.1.159 192.168.1.191 192.168.1.223 192.168.1.255	192.168.1.1 to 192.168.1.30 192.168.1.33 to 192.168.1.62 192.168.1.65 to 192.168.1.94 192.168.1.97 to 192.168.1.126 192.168.1.129 to 192.168.1.158 192.168.1.161 To 192.168.190 192.168.1.193 to 192.168.1.222 192.168.1.225 to 192.168.254
255.255.255.240 /28	16	14	256-240=16	192.168.1.15 192.168.1.31 192.168.1.47 192.168.1.63 192.168.1.79 192.168.1.95 192.168.1.111 192.168.1.127 192.168.1.143 192.168.1.159 192.168.1.175 192.168.1.191 192.168.1.207 192.168.1.223 192.168.1.239 192.168.1.255	192.168.1.1 to 192.168.1.14 192.168.1.17 to 192.168.1.30 192.168.1.33 to 192.168.1.46 192.168.1.49 to 192.168.1.62 192.168.1.65 to 192.168.1.78 192.168.1.81 to 192.168.1.94 192.168.1.97 to 192.168.1.110 192.168.1.113 to 192.168.1.126 192.168.1.129 to 192.168.1.142 192.168.1.145 o 192.168.1.158 192.168.1.161 to 192.168.174 192.168.1.177 to 192.168.1.190 192.168.1.193 to 192.168.1.206 192.168.1.209 to 192.168.1.222 192.168.1.225 to 192.168.1.238 192.168.1.241 to 192.168.1.254
255.255.255.248 /29	32	for practice	practice	practice	practice
255.255.255.252 /30	64	practice	practice	practice	practice

We will learn Class B and Class A subnetting in coming posts on our blog so stay tune...

If You have any doubt our requirement you can comment on our fb page.

cisco ios

2018-02-28T15:22:00.003+05:30

Cisco IOS (originally Internetwork Operating System) is a family of software used on most Cisco Systems routers and current Cisco network switches. (Earlier switches ran CatOS.) IOS is a package of routing, switching, internetworking and telecommunications functions integrated into a multitasking operating system. Although the IOS code base includes a cooperative multitasking kernel, most IOS features have been ported to other kernels such as QNX and Linux for use in Cisco products or simulators such as Cisco VIRL.

Not all Cisco products run IOS. Notable exceptions include ASA security products, which run a Linux-derived operating system, and carrier routers which run IOS-XR.

Interface

The IOS command line interface provides a fixed set of multiple-word commands. The set available is determined by the "mode" and the privilege level of the current user. "Global configuration mode" provides commands to change the system's configuration, and "interface configuration mode" provides commands to change the configuration of a specific interface. All commands are assigned a privilege level, from 0 to 15, and can only be accessed by users with the necessary privilege. Through the CLI, the commands available to each privilege level can be defined.

Most builds of IOS include a Tcl interpreter. Using the Embedded event manager feature, the interpreter can be scripted to react to events within the networking environment, such as interface failure or periodic timers.

Available command modes include:

· User EXEC Mode

· Privileged EXEC Mode

· Global Configuration Mode

· ROM Monitor Mode

· Setup Mode

· More than 100 configuration modes and submodes.

Versioning

Cisco IOS is versioned using three numbers and some letters, in the general form a.b(c.d)e, where:

· a is the major version number.

· b is the minor version number.

· c is the release number, which begins at one and increments as new releases in a same way a.b train are released. "Train" is Cisco-speak for, "...a vehicle for delivering Cisco software to a specific set of platforms and features.."

· d (omitted from general releases) is the interim build number.

· e (zero, one or two letters) is the software release train identifier, such as none (which designates the mainline, see below), T (for Technology), E (for Enterprise), S (for Service provider), XA as a special functionality train, XB as a different special functionality train, etc.

Rebuilds – Often a rebuild is compiled to fix a single specific problem or vulnerability for a given IOS version. For example, 12.1(8)E14 is a Rebuild, the 14 denoting the 14th rebuild of 12.1(8)E. Rebuilds are produced to either quickly repair a defect, or to satisfy customers who do not want to upgrade to a later major revision because they may be running critical infrastructure on their devices, and hence prefer to minimise change and risk.

Interim releases – Are usually produced on a weekly basis, and form a roll-up of current development effort. The Cisco advisory web site may list more than one possible interim to fix an associated issue (the reason for this is unknown to the general public).

Maintenance releases – Rigorously tested releases that are made available and include enhancements and bug fixes. Cisco recommend upgrading to Maintenance releases where possible, over Interim and Rebuild releases.

Architecture

In all versions of Cisco IOS, packet routing and forwarding (switching) are distinct functions. Routing and other protocols run as Cisco IOS processes and contribute to the Routing Information Base (RIB). This is processed to generate the final IP forwarding table (FIB, Forwarding Information Base), which is used by the forwarding function of the router. On router platforms with software-only forwarding (e.g., Cisco 7200) most traffic handling, including access control list filtering and forwarding, is done at interrupt level using Cisco Express Forwarding (CEF) or dCEF (Distributed CEF). This means IOS does not have to do a process context switch to forward a packet. Routing functions such as OSPF or BGPrun at the process level. In routers with hardware-based forwarding, such as the Cisco 12000 series, IOS computes the FIB in software and loads it into the forwarding hardware (such as an ASIC or network processor), which performs the actual packet forwarding function.

Cisco IOS has a "monolithic" architecture, which means that it runs as a single image and all processes share the same memory space. There is no memory protection between processes, which means that bugs in IOS code can potentially corrupt data used by other processes. It also has a run to completion scheduler, which means that the kernel does not pre-empt a running process — the process must make a kernel call before other processes get a chance to run. For Cisco products that required very high availability, such as the Cisco CRS-1, these limitations were not acceptable. In addition, competitive router operating systems that emerged 10–20 years after IOS, such as Juniper's JUNOS, were designed not to have these limitations.^[5] Cisco's response was to develop a new version of Cisco IOS called IOS XR that offered modularity and memory protection between processes, lightweight threads, pre-emptive scheduling and the ability to independently restart failed processes. IOS XR uses a 3rd party real-time operating system microkernel (QNX), and a large part of the current IOS code was re-written to take advantage of the features offered by the new kernel. But the microkernel architecture removes from the kernel all processes that are not absolutely required to run in the kernel, and executes them as processes similar to the application processes. Through this method, IOS XR is able to achieve the high availability desired for the new router platform. Thus IOS and IOS XR are very different codebases, though related in functionality and design. In 2005, Cisco introduced IOS XR on the Cisco 12000 series platform, extending the microkernel architecture from the CRS-1 to Cisco's widely deployed core router.

In 2006, Cisco has made available IOS Software Modularity which extends the QNX microkernel into a more traditional IOS environment, but still providing the software upgrade capabilities that customers are demanding. It is currently available on the Catalyst 6500 enterprise switch.

IP ADDRESSING

2018-02-27T19:44:00.001+05:30

IP Addressing Is very important topic in networking. IP address is an identifier for any machine which is use in communication. It designates the specific location of device on the network.

An IP address is software address, not a hardware address. The address codes on NIC(Network Interface Card) is konwn as MAC address and it is used to find host on local network, but IP address is used to communicate between network and it is used to locate host in different network.

IP Terminology:

Bit : A bit is one digit, either a 1 or a 0.

Byte: A byte is 7 or 8 bits depending upon on whether parity is used.

Octet: An octet is made up of just 8 bits and it is binary number combination of 1s or 0s.

Network Address : This is the designation or notation used in routing to send packets across network.

For e.g. 10.0.0.0 172.16.0.0 and 192.168.10.0

Broadcast address: The address used by applications and hosts to send information to all nodes on a network is called the broadcast address.

For e.g. 10.255.255.255 172.16.255.255 and 192.168.255.255

The Hierarchical IP Addressing Scheme

An IP address is consist of 32 bits . These bits divided into four parts referred as octet.

you can depict an IP address using one of the three methods .

Dotted-decimal as 172.16.0.0

Binary as in 11000000.00010000.00000000.00000000

Hexadecimal, as in AC.10.1E.38

The 32-bit IP address is structured or hierarchical address, as opposed to flat or non hierarchical address. Although either type of addressing scheme could have been used, hierarchical addressing was chosen for good reason.

By this scheme we have nearly 4.3 billion ip addresses.

The Disadvantage of of the flat addressing scheme, and the reason its not used for IP addressing, relates to routing . If every address were unique, all the routers on the internet would need to store the address of each and every machine on the internet . This would make efficient routing impossible , even if only a fraction of the possible address were used.

Classification Of IP Addresses

IP address is divided or classified in 5 classes based on host bit and network bit.

Lets understand what is Host bit and Network bit by an example.
Suppose you want to call your friend who is living in another city so you have your friends contact number but when you make a call you fist dial area code followed by friends contact number.

For e.g 011-22087213 here 011 is area code and rest digits are specific host number. From anywhere in the world you dial this number you will able to talk to you friend.\

Network bit is like area code and host bits are like contact number.

Class A

Network

Host

Class B

Network

Host

Class C

Network

Host

Class D is used for multi casting

Class E is used for Research purpose.

.........In Next post I will xplain you range of IP address and its uses. stay tune...........

Penetration Testing

2018-02-24T13:26:00.001+05:30

Penetration Testing is a method that many companies follow in order to minimize their security breaches. This is a controlled way of hiring a professional who will try to hack your system and show you the loopholes that you should fix.

Before doing a penetration test, it is mandatory to have an agreement that will explicitly mention the following parameters −

what will be the time of penetration test,
where will be the IP source of the attack, and
what will be the penetration fields of the system.

Penetration testing is conducted by professional ethical hackers who mainly use commercial, open-source tools, automate tools and manual checks. There are no restrictions; the most important objective here is to uncover as many security flaws as possible.

Types of Penetration Testing

We have five types of penetration testing −

Black Box − Here, the ethical hacker doesn’t have any information regarding the infrastructure or the network of the organization that he is trying to penetrate. In black-box penetration testing, the hacker tries to find the information by his own means.
Grey Box − It is a type of penetration testing where the ethical hacker has a partial knowledge of the infrastructure, like its domain name server.
White Box − In white-box penetration testing, the ethical hacker is provided with all the necessary information about the infrastructure and the network of the organization that he needs to penetrate.
External Penetration Testing − This type of penetration testing mainly focuses on network infrastructure or servers and their software operating under the infrastructure. In this case, the ethical hacker tries the attack using public networks through the Internet. The hacker attempts to hack the company infrastructure by attacking their webpages, webservers, public DNS servers, etc.
Internal Penetration Testing − In this type of penetration testing, the ethical hacker is inside the network of the company and conducts his tests from there.

Penetration testing can also cause problems such as system malfunctioning, system crashing, or data loss. Therefore, a company should take calculated risks before going ahead with penetration testing. The risk is calculated as follows and it is a management risk.

RISK = Threat × Vulnerability

Example

You have an online e-commerce website that is in production. You want to do a penetration testing before making it live. Here, you have to weigh the pros and cons first. If you go ahead with penetration testing, it might cause interruption of service. On the contrary, if you do not wish to perform a penetration testing, then you can run the risk of having an unpatched vulnerability that will remain as a threat all the time.

Before doing a penetration test, it is recommended that you put down the scope of the project in writing. You should be clear about what is going to be tested. For example −

Your company has a VPN or any other remote access techniques and you want to test that particular point.
Your application has webservers with databases, so you might want to get it tested for SQL injection attacks which is one of the most crucial tests on a webserver. In addition, you can check if your webserver is immune to DoS attacks.

Punch Line:

Before going ahead with a penetration test, you should keep the following points in mind −

First understand your requirements and evaluate all the risks.
Hire a certified person to conduct penetration test because they are trained to apply all the possible methods and techniques to uncover possible loopholes in a network or web application.
Always sign an agreement before doing a penetration test.

SQL injection

2018-02-24T13:19:00.003+05:30

SQL injection is a set of SQL commands that are placed in a URL string or in data structures in order to retrieve a response that we want from the databases that are connected with the web applications. This type of attacks generally takes place on webpages developed using PHP or ASP.NET.

An SQL injection attack can be done with the following intentions −

To dump the whole database of a system,
To modify the content of the databases, or
To perform different queries that are not allowed by the application.

This type of attack works when the applications don’t validate the inputs properly, before passing them to an SQL statement. Injections are normally placed put in address bars, search fields, or data fields.

The easiest way to detect if a web application is vulnerable to an SQL injection attack is to use the " ‘ " character in a string and see if you get any error.

Example 1

Let’s try to understand this concept using a few examples. As shown in the following screenshot, we have used a " ‘ " character in the Name field.

Now, click the Login button. It should produce the following response −

It means that the “Name” field is vulnerable to SQL injection.

Example 2

We have this URL − http://10.10.10.101/mutillidae/index.php?page=site-footer-xssdiscussion.php

And we want to test the variable “page” but observe how we have injected a " ‘ " character in the string URL.

When we press Enter, it will produce the following result which is with errors.

SQLMAP

SQLMAP is one of the best tools available to detect SQL injections. It can be downloaded from http://sqlmap.org/

It comes pre-compiled in the Kali distribution. You can locate it at − Applications → Database Assessment → Sqlmap.

After opening SQLMAP, we go to the page that we have the SQL injection and then get the header request. From the header, we run the following command in SQL −

./sqlmap.py --headers="User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:25.0) 
Gecko/20100101 Firefox/25.0" --cookie="security=low;
PHPSESSID=oikbs8qcic2omf5gnd09kihsm7" -u '
http://localhost/dvwa/vulnerabilities/sqli_blind/?id=1&Submit=Submit#' -
level=5 risk=3 -p id --suffix="-BR" -v3

The SQLMAP will test all the variables and the result will show that the parameter “id” is vulnerable, as shown in the following screenshot.

SQLNinja

SQLNinja is another SQL injection tool that is available in Kali distribution.

JSQL Injection

JSQL Injection is in Java and it makes automated SQL injections.

Punch Line :

To prevent your web application from SQL injection attacks, you should keep the following points in mind −

Unchecked user-input to database should not be allowed to pass through the application GUI.
Every variable that passes into the application should be sanitized and validated.
The user input which is passed into the database should be quoted.

cross site

2018-02-24T13:17:00.004+05:30

Cross-site scripting (XSS) is a code injection attack that allows an attacker to execute malicious JavaScript in another user's browser.

The attacker does not directly target his victim. Instead, he exploits a vulnerability in a website that the victim visits, in order to get the website to deliver the malicious JavaScript for him. To the victim's browser, the malicious JavaScript appears to be a legitimate part of the website, and the website has thus acted as an unintentional accomplice to the attacker. These attacks can be carried out using HTML, JavaScript, VBScript, ActiveX, Flash, but the most used XSS is malicious JavaScript.

These attacks also can gather data from account hijacking, changing of user settings, cookie theft/poisoning, or false advertising and create DoS attacks.

Example

Let’s take an example to understand how it works. We have a vulnerable webpage that we got by the metasploitable machine. Now we will test the field that is highlighted in red arrow for XSS.

First of all, we make a simple alert script

<script>  
   alert(‘I am Vulnerable’)  
</script>

It will produce the following output −

Types of XSS Attacks

XSS attacks are often divided into three types −

Persistent XSS, where the malicious string originates from the website's database.
Reflected XSS, where the malicious string originates from the victim's request.
DOM-based XSS, where the vulnerability is in the client-side code rather than the server-side code.

Generally, cross-site scripting is found by vulnerability scanners so that you don’t have to do all the manual job by putting a JavaScript on it like

<script>  
   alert('XSS') 
</script>

Burp Suite and acunetix are considered as the best vulnerability scanners.

Punch Line:

To prevent XSS attacks, keep the following points in mind −

Check and validate all the form fields like hidden forms, headers, cookies, query strings.
Implement a stringent security policy. Set character limitation in the input fields.

ddos attack

2018-02-24T13:13:00.003+05:30

A Distributed Denial of Service (DDoS) attack is an attempt to make an online service or a website unavailable by overloading it with huge floods of traffic generated from multiple sources.

Unlike a Denial of Service (DoS) attack, in which one computer and one Internet connection is used to flood a targeted resource with packets, a DDoS attack uses many computers and many Internet connections, often distributed globally in what is referred to as a botnet.

A large scale volumetric DDoS attack can generate a traffic measured in tens of Gigabits (and even hundreds of Gigabits) per second. We are sure your normal network will not be able to handle such traffic.

What are Botnets?

Attackers build a network of hacked machines which are known as botnets, by spreading malicious piece of code through emails, websites, and social media. Once these computers are infected, they can be controlled remotely, without their owners' knowledge, and used like an army to launch an attack against any target.

A DDoS flood can be generated in multiple ways. For example −

Botnets can be used for sending more number of connection requests than a server can handle at a time.
Attackers can have computers send a victim resource huge amounts of random data to use up the target's bandwidth.

Due to the distributed nature of these machines, they can be used to generate distributed high traffic which may be difficult to handle. It finally results in a complete blockage of a service.

Types of DDoS Attacks

DDoS attacks can be broadly categorized into three categories −

Volume-based Attacks
Protocol Attacks
Application Layer Attacks

Volume-Based Attacks

Volume-based attacks include TCP floods, UDP floods, ICMP floods, and other spoofedpacket floods. These are also called Layer 3 & 4 Attacks. Here, an attacker tries to saturate the bandwidth of the target site. The attack magnitude is measured in Bits per Second (bps).

UDP Flood − A UDP flood is used to flood random ports on a remote host with numerous UDP packets, more specifically port number 53. Specialized firewalls can be used to filter out or block malicious UDP packets.
ICMP Flood − This is similar to UDP flood and used to flood a remote host with numerous ICMP Echo Requests. This type of attack can consume both outgoing and incoming bandwidth and a high volume of ping requests will result in overall system slowdown.
HTTP Flood − The attacker sends HTTP GET and POST requests to a targeted web server in a large volume which cannot be handled by the server and leads to denial of additional connections from legitimate clients.
Amplification Attack − The attacker makes a request that generates a large response which includes DNS requests for large TXT records and HTTP GET requests for large files like images, PDFs, or any other data files.

Protocol Attacks

Protocol attacks include SYN floods, Ping of Death, fragmented packet attacks, Smurf DDoS, etc. This type of attack consumes actual server resources and other resources like firewalls and load balancers. The attack magnitude is measured in Packets per Second.

DNS Flood − DNS floods are used for attacking both the infrastructure and a DNS application to overwhelm a target system and consume all its available network bandwidth.
SYN Flood − The attacker sends TCP connection requests faster than the targeted machine can process them, causing network saturation. Administrators can tweak TCP stacks to mitigate the effect of SYN floods. To reduce the effect of SYN floods, you can reduce the timeout until a stack frees memory allocated to a connection, or selectively dropping incoming connections using a firewall or iptables.
Ping of Death − The attacker sends malformed or oversized packets using a simple ping command. IP allows sending 65,535 bytes packets but sending a ping packet larger than 65,535 bytes violates the Internet Protocol and could cause memory overflow on the target system and finally crash the system. To avoid Ping of Death attacks and its variants, many sites block ICMP ping messages altogether at their firewalls.

Application Layer Attacks

Application Layer Attacks include Slowloris, Zero-day DDoS attacks, DDoS attacks that target Apache, Windows or OpenBSD vulnerabilities and more. Here the goal is to crash the web server. The attack magnitude is measured in Requests per Second.

Application Attack − This is also called Layer 7 Attack, where the attacker makes excessive log-in, database-lookup, or search requests to overload the application. It is really difficult to detect Layer 7 attacks because they resemble legitimate website traffic.
Slowloris − The attacker sends huge number of HTTP headers to a targeted web server, but never completes a request. The targeted server keeps each of these false connections open and eventually overflows the maximum concurrent connection pool, and leads to denial of additional connections from legitimate clients.
NTP Amplification − The attacker exploits publically-accessible Network Time Protocol (NTP) servers to overwhelm the targeted server with User Datagram Protocol (UDP) traffic.
Zero-day DDoS Attacks − A zero-day vulnerability is a system or application flaw previously unknown to the vendor, and has not been fixed or patched. These are new type of attacks coming into existence day by day, for example, exploiting vulnerabilities for which no patch has yet been released.

How to Fix a DDoS Attack

There are quite a few DDoS protection options which you can apply depending on the type of DDoS attack.

Your DDoS protection starts from identifying and closing all the possible OS and application level vulnerabilities in your system, closing all the possible ports, removing unnecessary access from the system and hiding your server behind a proxy or CDN system.

If you see a low magnitude of the DDoS, then you can find many firewall-based solutions which can help you in filtering out DDoS based traffic. But if you have high volume of DDoS attack like in gigabits or even more, then you should take the help of a DDoS protection service provider that offers a more holistic, proactive and genuine approach.

You must be careful while approaching and selecting a DDoS protection service provider. There are number of service providers who want to take advantage of your situation. If you inform them that you are under DDoS attack, then they will start offering you a variety of services at unreasonably high costs.

We can suggest you a simple and working solution which starts with a search for a good DNS solution provider who is flexible enough to configure A and CNAME records for your website. Second, you will need a good CDN provider that can handle big DDoS traffic and provide you DDoS protection service as a part of their CDN package.

Assume your server IP address is AAA.BBB.CCC.DDD. Then you should do the following DNS configuration −

Create a A Record in DNS zone file as shown below with a DNS identifier, for example, ARECORDID and keep it secret from the outside world.
Now ask your CDN provider to link the created DNS identifier with a URL, something like cdn.someotherid.domain.com.
You will use the CDN URL cdn.someotherid.domain.com to create two CNAME records, the first one to point to www and the second record to point to @ as shown below.

You can take the help from your system administrator to understand these points and configure your DNS and CDN appropriately. Finally, you will have the following configuration at your DNS.

Now, let the CDN provider handle all type of DDoS attacks and your system will remain safe. But here the condition is that you should not disclose your system's IP address or A record identifier to anyone; else direct attacks will start again.

Punch Line:

DDoS attacks have become more common than ever before, and unfortunately, there is no quick fix for this problem. However, if your system is under a DDoS attack, then don’t panic and start looking into the matter step by step.

social engineering

2018-02-24T13:11:00.002+05:30

Let us try to understand the concept of Social Engineering attacks through some examples.

Example 1

You must have noticed old company documents being thrown into dustbins as garbage. These documents might contain sensitive information such as Names, Phone Numbers, Account Numbers, Social Security Numbers, Addresses, etc. Many companies still use carbon paper in their fax machines and once the roll is over, its carbon goes into dustbin which may have traces of sensitive data. Although it sounds improbable, but attackers can easily retrieve information from the company dumpsters by pilfering through the garbage.

Example 2

An attacker may befriend a company personnel and establish good relationship with him over a period of time. This relationship can be established online through social networks, chatting rooms, or offline at a coffee table, in a playground, or through any other means. The attacker takes the office personnel in confidence and finally digs out the required sensitive information without giving a clue.

Example 3

A social engineer may pretend to be an employee or a valid user or an VIP by faking an identification card or simply by convincing employees of his position in the company. Such an attacker can gain physical access to restricted areas, thus providing further opportunities for attacks.

Example 4

It happens in most of the cases that an attacker might be around you and can do shoulder surfing while you are typing sensitive information like user ID and password, account PIN, etc.

Phishing Attack

A phishing attack is a computer-based social engineering, where an attacker crafts an email that appears legitimate. Such emails have the same look and feel as those received from the original site, but they might contain links to fake websites. If you are not smart enough, then you will type your user ID and password and will try to login which will result in failure and by that time, the attacker will have your ID and password to attack your original account.

Punch Line :

You should enforce a good security policy in your organization and conduct required trainings to make all the employees aware of the possible Social Engineering attacks and their consequences.
Document shredding should be a mandatory activity in your company.
Make double sure that any links that you receive in your email is coming from authentic sources and that they point to correct websites. Otherwise you might end up as a victim of Phishing.
Be professional and never share your ID and password with anybody else in any case.

wireless attack

2018-02-23T16:45:00.001+05:30

A wireless network is a set of two or more devices connected with each other via radio waves within a limited space range. The devices in a wireless network have the freedom to be in motion, but be in connection with the network and share data with other devices in the network. One of the most crucial point that they are so spread is that their installation cost is very cheap and fast than the wire networks.

Wireless networks are widely used and it is quite easy to set them up. They use IEEE 802.11 standards. A wireless router is the most important device in a wireless network that connects the users with the Internet.

In a wireless network, we have Access Points which are extensions of wireless ranges that behave as logical switches.

Although wireless networks offer great flexibility, they have their security problems. A hacker can sniff the network packets without having to be in the same building where the network is located. As wireless networks communicate through radio waves, a hacker can easily sniff the network from a nearby location.

Most attackers use network sniffing to find the SSID and hack a wireless network. When our wireless cards are converted in sniffing modes, they are called monitor mode.

Kismet

Kismet is a powerful tool for wireless sniffing that is found in Kali distribution. It can also be downloaded from its official webpage − https://www.kismetwireless.net/index.shtml

Let’s see how it works. First of all, open a terminal and type kismet. Start the Kismet Server and click Yes, as shown in the following screenshot.

As shown here, click the Start button.

Now, Kismet will start to capture data. The following screenshot shows how it would appear −

NetStumbler

NetStumbler is another tool for wireless hacking that is primarily meant for Windows systems. It can be downloaded from http://www.stumbler.net/

It is quite easy to use NetStumbler on your system. You just have to click the Scanning button and wait for the result, as shown in the following screenshot.

It should display a screenshot as follows −

It is important to note that your card should support monitoring mode, otherwise you will fail to monitor.

Wired Equivalent Privacy

Wired Equivalent Privacy (WEP) is a security protocol that was invented to secure wireless networks and keep them private. It utilizes encryption at the data link layer which forbids unauthorized access to the network.

The key is used to encrypt the packets before transmission begins. An integrity check mechanism checks that the packets are not altered after transmission.

Note that WEP is not entirely immune to security problems. It suffers from the following issues −

CRC32 is not sufficient to ensure complete cryptographic integrity of a packet.
It is vulnerable to dictionary attacks.
WEP is vulnerable to Denial of Services attacks too.

WEPcrack

WEPcrack is a popular tool to crack WEP passwords. It can be downloaded from − https://sourceforge.net/projects/wepcrack/

Aircrack-ng

Aircrak-ng is another popular tool for cracking WEP passwords. It can be found in the Kali distribution of Linux.

The following screenshot shows how we have sniffed a wireless network and collected packets and created a file RHAWEP-01.cap. Then we run it with aircrack-ng to decrypt the cypher.

Wireless DoS Attacks

In a wireless environment, an attacker can attack a network from a distance and therefore, it is sometimes difficult to collect evidences against the attacker.

The first type of DoS is Physical Attack. This type of attack is very basic and it is in the base of radio interferences which can be created even from cordless phones that operate in 2.4 GHz range.

Another type is Network DoS Attack. As the Wireless Access Point creates a shared medium, it offers the possibility to flood the traffic of this medium toward the AP which will make its processing more slow toward the clients that attempt to connect. Such attacks can be created just by a ping flood DoS attack.

Pyloris is a popular DoS tool that you can download from − https://sourceforge.net/projects/pyloris/

Low Orbit Ion Cannon (LOIC) is another popular tool for DoS attacks.

Punch Line:

To secure a wireless network, you should keep the following points in mind −

Change the SSID and the network password regularly.
Change the default password of access points.
Don’t use WEP encryption.
Turn off guest networking.
Update the firmware of your wireless device.

Password Hacking

2018-02-23T16:35:00.004+05:30

We have passwords for emails, databases, computer systems, servers, bank accounts, and virtually everything that we want to protect. Passwords are in general the keys to get access into a system or an account.

In general, people tend to set passwords that are easy to remember, such as their date of birth, names of family members, mobile numbers, etc. This is what makes the passwords weak and prone to easy hacking.

One should always take care to have a strong password to defend their accounts from potential hackers. A strong password has the following attributes −

Contains at least 8 characters.
A mix of letters, numbers, and special characters.
A combination of small and capital letters.

Dictionary Attack

In a dictionary attack, the hacker uses a predefined list of words from a dictionary to try and guess the password. If the set password is weak, then a dictionary attack can decode it quite fast.

Hydra is a popular tool that is widely used for dictionary attacks. Take a look at the following screenshot and observe how we have used Hydra to find out the password of an FTP service.

Hybrid Dictionary Attack

Hybrid dictionary attack uses a set of dictionary words combined with extensions. For example, we have the word “admin” and combine it with number extensions such as “admin123”, “admin147”, etc.

Crunch is a wordlist generator where you can specify a standard character set or a character set. Crunch can generate all possible combinations and permutations. This tool comes bundled with the Kali distribution of Linux.

Brute-Force Attack

In a brute-force attack, the hacker uses all possible combinations of letters, numbers, special characters, and small and capital letters to break the password. This type of attack has a high probability of success, but it requires an enormous amount of time to process all the combinations. A brute-force attack is slow and the hacker might require a system with high processing power to perform all those permutations and combinations faster.

John the Ripper or Johnny is one of the powerful tools to set a brute-force attack and it comes bundled with the Kali distribution of Linux.

Rainbow Tables

A rainbow table contains a set of predefined passwords that are hashed. It is a lookup table used especially in recovering plain passwords from a cipher text. During the process of password recovery, it just looks at the pre-calculated hash table to crack the password. The tables can be downloaded from http://project-rainbowcrack.com/table.htm

RainbowCrack 1.6.1 is the tool to use the rainbow tables. It is available again in Kali distribution.

Punch Line:

Don’t note down the passwords anywhere, just memorize them.
Set strong passwords that are difficult to crack.
Use a combination of alphabets, digits, symbols, and capital and small letters.
Don’t set passwords that are similar to their usernames.

Email Spoofing

2018-02-23T16:33:00.003+05:30

Email Hijacking, or email hacking, is a widespread menace nowadays. It works by using the following three techniques which are email spoofing, social engineering tools, or inserting viruses in a user computer.

Email Spoofing

In email spoofing, the spammer sends emails from a known domain, so the receiver thinks that he knows this person and opens the mail. Such mails normally contain suspicious links, doubtful content, requests to transfer money, etc.

Social Engineering

Spammers send promotional mails to different users, offering huge discount and tricking them to fill their personal data. You have tools available in Kali that can drive you to hijack an email.

Email hacking can also be done by phishing techniques. See the following screenshot.

The links in the email may install malware on the user’s system or redirect the user to a malicious website and trick them into divulging personal and financial information, such as passwords, account IDs or credit card details.

Phishing attacks are widely used by cybercriminals, as it is far easier to trick someone into clicking a malicious links in the email than trying to break through a computer’s defenses.

Inserting Viruses in a User System

The third technique by which a hacker can hijack your email account is by infecting your system with a virus or any other kind of malware. With the help of a virus, a hacker can take all your passwords.

How to detect if your email has been hijacked?

The recipients of spam emails include a bunch of people you know.
You try to access your account and the password no longer works.
You try to access the “Forgot Password” link and it does not go to the expected email.
Your Sent Items folder contains a bunch of spams you are not aware of sending.

Punch Line:

In case you think that your email got hijacked, then you need to take the following actions −

Change the passwords immediately.
Notify your friends not to open links that they receive from your email account.
Contact the authorities and report that your account has been hacked.
Install a good antivirus on your computer and update it.
Set up double authentication password if it is supported.

TCP/IP Hijacking

2018-02-23T16:32:00.002+05:30

TCP/IP Hijacking is when an authorized user gains access to a genuine network connection of another user. It is done in order to bypass the password authentication which is normally the start of a session.

In theory, a TCP/IP connection is established as shown below −

To hijack this connection, there are two possibilities −

Find the seq which is a number that increases by 1, but there is no chance to predict it.
The second possibility is to use the Man-in-the-Middle attack which, in simple words, is a type of network sniffing. For sniffing, we use tools like Wireshark or Ethercap.

Example

An attacker monitors the data transmission over a network and discovers the IP’s of two devices that participate in a connection.

When the hacker discovers the IP of one of the users, he can put down the connection of the other user by DoS attack and then resume communication by spoofing the IP of the disconnected user.

Shijack

In practice, one of the best TCP/IP hijack tools is Shijack. It is developed using Python language and you can download it from the following link − https://packetstormsecurity.com/sniffers/shijack.tgz

Here is an example of a Shijack command −

root:/home/root/hijack# ./shijack eth0 192.168.0.100 53517 192.168.0.200 23

Here, we are trying to hijack a Telnet connection between the two hosts.

Hunt

Hunt is another popular tool that you can use to hijack a TCP/IP connection. It can be downloaded from − https://packetstormsecurity.com/sniffers/hunt/

Punch Line:

All unencrypted sessions are vulnerable to TCP/IP session hijacking, so you should be using encrypted protocols as much as possible. Or, you should use double authentication techniques to keep the session secured.

Trojans

2018-02-23T16:01:00.001+05:30

Trojans are non-replication programs; they don’t reproduce their own codes by attaching themselves to other executable codes. They operate without the permissions or knowledge of the computer users.

Trojans hide themselves in healthy processes. However we should underline that Trojans infect outside machines only with the assistance of a computer user, like clicking a file that comes attached with email from an unknown person, plugging USB without scanning, opening unsafe URLs.

Trojans have several malicious functions −

They create backdoors to a system. Hackers can use these backdoors to access a victim system and its files. A hacker can use Trojans to edit and delete the files present on a victim system, or to observe the activities of the victim.
Trojans can steal all your financial data like bank accounts, transaction details, PayPal related information, etc. These are called Trojan-Banker.
Trojans can use the victim computer to attack other systems using Denial of Services.
Trojans can encrypt all your files and the hacker may thereafter demand money to decrypt them. These are Ransomware Trojans.
They can use your phones to send SMS to third parties. These are called SMS Trojans.

Trojan Information

If you have found a virus and want to investigate further regarding its function, then we will recommend that you have a look at the following virus databases, which are offered generally by antivirus vendors.

Kaspersky Virus database − https://www.kaspersky.com
F-secure − https://www.f-secure.com
Symantec – Virus Encyclopedia − https://www.symantec.com

Punch Line:

Install a good antivirus and keep it updated.
Don’t open email attachments coming from unknown sources.
Don’t accept invitation from unknown people in social media.
Don’t open URLs sent by unknown people or URLs that are in weird form.

Metasploit

2018-02-23T15:56:00.001+05:30

Metasploit is one of the most powerful exploit tools. Most of its resources can be found at: https://www.metasploit.com. It comes in two versions − commercial and free edition. There are no major differences in the two versions, so in this tutorial, we will be mostly using the Community version (free) of Metasploit.

As an Ethical Hacker, you will be using “Kali Distribution” which has the Metasploit community version embedded in it along with other ethical hacking tools. But if you want to install Metasploit as a separate tool, you can easily do so on systems that run on Linux, Windows, or Mac OS X.

The hardware requirements to install Metasploit are −

2 GHz+ processor
1 GB RAM available
1 GB+ available disk space

Matasploit can be used either with command prompt or with Web UI.

To open in Kali, go to Applications → Exploitation Tools → metasploit.

After Metasploit starts, you will see the following screen. Highlighted in red underline is the version of Metasploit.

Exploits of Metasploit

From Vulnerability Scanner, we found that the Linux machine that we have for test is vulnerable to FTP service. Now, we will use the exploit that can work for us. The command is −

use “exploit path”

The screen will appear as follows −

Then type mfs> show options in order to see what parameters you have to set in order to make it functional. As shown in the following screenshot, we have to set RHOST as the “target IP”.

We type msf> set RHOST 192.168.1.101 and msf>set RPORT 21

Then, type mfs>run. If the exploit is successful, then it will open one session that you can interact with, as shown in the following screenshot.

Metasploit Payloads

Payload, in simple terms, are simple scripts that the hackers utilize to interact with a hacked system. Using payloads, they can transfer data to a victim system.

Metasploit payloads can be of three types −

Singles − Singles are very small and designed to create some kind of communication, then move to the next stage. For example, just creating a user.
Staged − It is a payload that an attacker can use to upload a bigger file onto a victim system.
Stages − Stages are payload components that are downloaded by Stagers modules. The various payload stages provide advanced features with no size limits such as Meterpreter and VNC Injection.

Payload Usage − Example

We use the command show payloads. With this exploit, we can see the payloads that we can use, and it will also show the payloads that will help us upload /execute files onto a victim system.

To set the payload that we want, we will use the following command −

set PAYLOAD payload/path

Set the listen host and listen port (LHOST, LPORT) which are the attacker IPand port. Then set remote host and port (RPORT, LHOST) which are the victim IP and port.

Type “exploit”. It will create a session as shown below −

Now we can play with the system according to the settings that this payload offers.

Enumeration

2018-02-23T15:54:00.003+05:30

Enumeration belongs to the first phase of Ethical Hacking, i.e., “Information Gathering”. This is a process where the attacker establishes an active connection with the victim and try to discover as much attack vectors as possible, which can be used to exploit the systems further.

Enumeration can be used to gain information on −

Network shares
SNMP data, if they are not secured properly
IP tables
Usernames of different systems
Passwords policies lists

Enumerations depend on the services that the systems offer. They can be −

DNS enumeration
NTP enumeration
SNMP enumeration
Linux/Windows enumeration
SMB enumeration

Let us now discuss some of the tools that are widely used for Enumeration.

NTP Suite

NTP Suite is used for NTP enumeration. This is important because in a network environment, you can find other primary servers that help the hosts to update their times and you can do it without authenticating the system.

Take a look at the following example.

ntpdate 192.168.1.100 01 Sept 12:50:49 ntpdate[627]: 
adjust time server 192.168.1.100 offset 0.005030 sec 

or 
ntpdc [-ilnps] [-c command] [hostname/IP_address] 
  
root@test]# ntpdc -c sysinfo 192.168.1.100 
***Warning changing to older implementation 
***Warning changing the request packet size from 160 to 48 
system peer: 192.168.1.101 

system peer mode: client
leap indicator: 00 
stratum: 5  

precision: -15 
root distance: 0.00107 s 
root dispersion: 0.02306 s 
reference ID: [192.168.1.101] 
reference time: f66s4f45.f633e130, Sept 01 2016 22:06:23.458 
system flags: monitor ntp stats calibrate 
jitter: 0.000000 s 
stability: 4.256 ppm 
broadcastdelay: 0.003875 s 
authdelay: 0.000107 s

enum4linux

enum4linux is used to enumerate Linux systems. Take a look at the following screenshot and observe how we have found the usernames present in a target host.

smtp-user-enum

smtp-user-enum tries to guess usernames by using SMTP service. Take a look at the following screenshot to understand how it does so.

Punch Line:

It is recommended to disable all services that you don’t use. It reduces the possibilities of OS enumeration of the services that your systems are running.

Exploitation

2018-02-23T15:52:00.000+05:30

Exploitation is a piece of programmed software or script which can allow hackers to take control over a system, exploiting its vulnerabilities. Hackers normally use vulnerability scanners like Nessus, Nexpose, OpenVAS, etc. to find these vulnerabilities.

Metasploit is a powerful tool to locate vulnerabilities in a system.

Based on the vulnerabilities, we find exploits. Here, we will discuss some of the best vulnerability search engines that you can use.

Exploit Database

www.exploit-db.com is the place where you can find all the exploits related to a vulnerability.

Common Vulnerabilities and Exposures

Common Vulnerabilities and Exposures (CVE) is the standard for information security vulnerability names. CVE is a dictionary of publicly known information security vulnerabilities and exposures. It’s free for public use. https://cve.mitre.org

National Vulnerability Database

National Vulnerability Database (NVD) is the U.S. government repository of standards based vulnerability management data. This data enables automation of vulnerability management, security measurement, and compliance. You can locate this database at − https://nvd.nist.gov

NVD includes databases of security checklists, security-related software flaws, misconfigurations, product names, and impact metrics.

In general, you will see that there are two types of exploits −

Remote Exploits − These are the type of exploits where you don’t have access to a remote system or network. Hackers use remote exploits to gain access to systems that are located at remote places.
Local Exploits − Local exploits are generally used by a system user having access to a local system, but who wants to overpass his rights.

Punch Line:

Vulnerabilities generally arise due to missing updates, so it is recommended that you update your system on a regular basis, for example, once a week.

In Windows environment, you can activate automatic updates by using the options available in the Control Panel → System and Security → Windows Updates.

In Linux Centos, you can use the following command to install automatic update package.

yum -y install yum-cron

DNS Poisoning

2018-02-23T15:50:00.003+05:30

DNS Poisoning is a technique that tricks a DNS server into believing that it has received authentic information when, in reality, it has not. It results in the substitution of false IP address at the DNS level where web addresses are converted into numeric IP addresses. It allows an attacker to replace IP address entries for a target site on a given DNS server with IP address of the server controls. An attacker can create fake DNS entries for the server which may contain malicious content with the same name.

For instance, a user types www.google.com, but the user is sent to another fraud site instead of being directed to Google’s servers. As we understand, DNS poisoning is used to redirect the users to fake pages which are managed by the attackers.

DNS Poisoning − Exercise

Let’s do an exercise on DNS poisoning using the same tool, Ettercap.

DNS Poisoning is quite similar to ARP Poisoning. To initiate DNS poisoning, you have to start with ARP poisoning, which we have already discussed in the previous chapter. We will use DNS spoof plugin which is already there in Ettercap.

Step 1 − Open up the terminal and type “nano etter.dns”. This file contains all entries for DNS addresses which is used by Ettercap to resolve the domain name addresses. In this file, we will add a fake entry of “Facebook”. If someone wants to open Facebook, he will be redirected to another website.

Step 2 − Now insert the entries under the words “Redirect it to www.linux.org”. See the following example −

Step 3 − Now save this file and exit by saving the file. Use “ctrl+x” to save the file.

Step 4 − After this, the whole process is same to start ARP poisoning. After starting ARP poisoning, click on “plugins” in the menu bar and select “dns_spoof” plugin.

Step 5 − After activating the DNS_spoof, you will see in the results that facebook.com will start spoofed to Google IP whenever someone types it in his browser.

It means the user gets the Google page instead of facebook.com on their browser.

In this exercise, we saw how network traffic can be sniffed through different tools and methods. Here a company needs an ethical hacker to provide network security to stop all these attacks. Let’s see what an ethical hacker can do to prevent DNS Poisoning.

Defenses against DNS Poisoning

As an ethical hacker, your work could very likely put you in a position of prevention rather than pen testing. What you know as an attacker can help you prevent the very techniques you employ from the outside.

Here are defenses against the attacks we just covered from a pen tester’s perspective −

Use a hardware-switched network for the most sensitive portions of your network in an effort to isolate traffic to a single segment or collision domain.
Implement IP DHCP Snooping on switches to prevent ARP poisoning and spoofing attacks.
Implement policies to prevent promiscuous mode on network adapters.
Be careful when deploying wireless access points, knowing that all traffic on the wireless network is subject to sniffing.
Encrypt your sensitive traffic using an encrypting protocol such as SSH or IPsec.
Port security is used by switches that have the ability to be programmed to allow only specific MAC addresses to send and receive data on each port.
IPv6 has security benefits and options that IPv4 does not have.
Replacing protocols such as FTP and Telnet with SSH is an effective defense against sniffing. If SSH is not a viable solution, consider protecting older legacy protocols with IPsec.
Virtual Private Networks (VPNs) can provide an effective defense against sniffing due to their encryption aspect.
SSL is a great defense along with IPsec.

Punch Line:

we discussed how attackers can capture and analyze all the traffic by placing a packet sniffer in a network. With a real-time example, we saw how easy it is to get the credentials of a victim from a given network. Attackers use MAC attacks, ARP and DNS poisoning attacks to sniff the network traffic and get hold of sensitive information such as email conversations and passwords.

ARP Poisoning / ARP Spoofing.

2018-02-23T15:49:00.000+05:30

Address Resolution Protocol (ARP) is a stateless protocol used for resolving IP addresses to machine MAC addresses. All network devices that need to communicate on the network broadcast ARP queries in the system to find out other machines’ MAC addresses. ARP Poisoning is also known as ARP Spoofing.

Here is how ARP works −

When one machine needs to communicate with another, it looks up its ARP table.
If the MAC address is not found in the table, the ARP_request is broadcasted over the network.
All machines on the network will compare this IP address to MAC address.
If one of the machines in the network identifies this address, then it will respond to the ARP_request with its IP and MAC address.
The requesting computer will store the address pair in its ARP table and communication will take place.

What is ARP Spoofing?

ARP packets can be forged to send data to the attacker’s machine.

ARP spoofing constructs a large number of forged ARP request and reply packets to overload the switch.
The switch is set in forwarding mode and after the ARP table is flooded with spoofed ARP responses, the attackers can sniff all network packets.

Attackers flood a target computer ARP cache with forged entries, which is also known as poisoning. ARP poisoning uses Man-in-the-Middle access to poison the network.

What is MITM?

The Man-in-the-Middle attack (abbreviated MITM, MitM, MIM, MiM, MITMA) implies an active attack where the adversary impersonates the user by creating a connection between the victims and sends messages between them. In this case, the victims think that they are communicating with each other, but in reality, the malicious actor controls the communication.

A third person exists to control and monitor the traffic of communication between two parties. Some protocols such as SSL serve to prevent this type of attack.

ARP Poisoning − Exercise

In this exercise, we have used BetterCAP to perform ARP poisoning in LAN environment using VMware workstation in which we have installed Kali Linux and Ettercap tool to sniff the local traffic in LAN.

For this exercise, you would need the following tools −

VMware workstation
Kali Linux or Linux Operating system
Ettercap Tool
LAN connection

Note − This attack is possible in wired and wireless networks. You can perform this attack in local LAN.

Step 1 − Install the VMware workstation and install the Kali Linux operating system.

Step 2 − Login into the Kali Linux using username pass “root, toor”.

Step 3 − Make sure you are connected to local LAN and check the IP address by typing the command ifconfig in the terminal.

Step 4 − Open up the terminal and type “Ettercap –G” to start the graphical version of Ettercap.

Step 5 − Now click the tab “sniff” in the menu bar and select “unified sniffing” and click OK to select the interface. We are going to use “eth0” which means Ethernet connection.

Step 6 − Now click the “hosts” tab in the menu bar and click “scan for hosts”. It will start scanning the whole network for the alive hosts.

Step 7 − Next, click the “hosts” tab and select “hosts list” to see the number of hosts available in the network. This list also includes the default gateway address. We have to be careful when we select the targets.

Step 8 − Now we have to choose the targets. In MITM, our target is the host machine, and the route will be the router address to forward the traffic. In an MITM attack, the attacker intercepts the network and sniffs the packets. So, we will add the victim as “target 1” and the router address as “target 2.”

In VMware environment, the default gateway will always end with “2” because “1” is assigned to the physical machine.

Step 9 − In this scenario, our target is “192.168.121.129” and the router is “192.168.121.2”. So we will add target 1 as victim IP and target 2 as router IP.

Step 10 − Now click on “MITM” and click “ARP poisoning”. Thereafter, check the option “Sniff remote connections” and click OK.

Step 11 − Click “start” and select “start sniffing”. This will start ARP poisoning in the network which means we have enabled our network card in “promiscuous mode” and now the local traffic can be sniffed.

Note − We have allowed only HTTP sniffing with Ettercap, so don’t expect HTTPS packets to be sniffed with this process.

Step 12 − Now it’s time to see the results; if our victim logged into some websites. You can see the results in the toolbar of Ettercap.

This is how sniffing works. You must have understood how easy it is to get the HTTP credentials just by enabling ARP poisoning.

ARP Poisoning has the potential to cause huge losses in company environments. This is the place where ethical hackers are appointed to secure the networks.

Like ARP poisoning, there are other attacks such as MAC flooding, MAC spoofing, DNS poisoning, ICMP poisoning, etc. that can cause significant loss to a network.

In the next chapter, we will discuss another type of attack known as DNS poisoning.

Sniffing tools

2018-02-23T15:37:00.001+05:30

There are so many tools available to perform sniffing over a network, and they all have their own features to help a hacker analyze traffic and dissect the information. Sniffing tools are extremely common applications. We have listed here some of the interesting ones −

BetterCAP − BetterCAP is a powerful, flexible and portable tool created to perform various types of MITM attacks against a network, manipulate HTTP, HTTPS and TCP traffic in real-time, sniff for credentials, and much more.
Ettercap − Ettercap is a comprehensive suite for man-in-the-middle attacks. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols and includes many features for network and host analysis.
Wireshark − It is one of the most widely known and used packet sniffers. It offers a tremendous number of features designed to assist in the dissection and analysis of traffic.
Tcpdump − It is a well-known command-line packet analyzer. It provides the ability to intercept and observe TCP/IP and other packets during transmission over the network. Available at www.tcpdump.org.
WinDump − A Windows port of the popular Linux packet sniffer tcpdump, which is a command-line tool that is perfect for displaying header information.
OmniPeek − Manufactured by WildPackets, OmniPeek is a commercial product that is the evolution of the product EtherPeek.
Dsniff − A suite of tools designed to perform sniffing with different protocols with the intent of intercepting and revealing passwords. Dsniff is designed for Unix and Linux platforms and does not have a full equivalent on the Windows platform.
EtherApe − It is a Linux/Unix tool designed to display graphically a system's incoming and outgoing connections.
MSN Sniffer − It is a sniffing utility specifically designed for sniffing traffic generated by the MSN Messenger application.
NetWitness NextGen − It includes a hardware-based sniffer, along with other features, designed to monitor and analyze all traffic on a network. This tool is used by the FBI and other law enforcement agencies.

A potential hacker can use any of these sniffing tools to analyze traffic on a network and dissect information.

Sniffing

2018-02-23T15:34:00.002+05:30

Sniffing is the process of monitoring and capturing all the packets passing through a given network using sniffing tools. It is a form of “tapping phone wires” and get to know about the conversation. It is also called wire tapping applied to the computer networks.

There is so much possibility that if a set of enterprise switch ports is open, then one of their employees can sniff the whole traffic of the network. Anyone in the same physical location can plug into the network using Ethernet cable or connect wirelesslly to that network and sniff the total traffic.

In other words, Sniffing allows you to see all sorts of traffic, both protected and unprotected. In the right conditions and with the right protocols in place, an attacking party may be able to gather information that can be used for further attacks or to cause other issues for the network or system owner.

What can be sniffed?

One can sniff the following sensitive information from a network −

Email traffic
FTP passwords
Web traffics
Telnet passwords
Router configuration
Chat sessions
DNS traffic

How it works

A sniffer normally turns the NIC of the system to the promiscuous mode so that it listens to all the data transmitted on its segment.

Promiscuous mode refers to the unique way of Ethernet hardware, in particular, network interface cards (NICs), that allows an NIC to receive all traffic on the network, even if it is not addressed to this NIC. By default, a NIC ignores all traffic that is not addressed to it, which is done by comparing the destination address of the Ethernet packet with the hardware address (a.k.a. MAC) of the device. While this makes perfect sense for networking, non-promiscuous mode makes it difficult to use network monitoring and analysis software for diagnosing connectivity issues or traffic accounting.

A sniffer can continuously monitor all the traffic to a computer through the NIC by decoding the information encapsulated in the data packets.

Types of Sniffing

Sniffing can be either Active or Passive in nature.

Passive Sniffing

In passive sniffing, the traffic is locked but it is not altered in any way. Passive sniffing allows listening only. It works with Hub devices. On a hub device, the traffic is sent to all the ports. In a network that uses hubs to connect systems, all hosts on the network can see the traffic. Therefore, an attacker can easily capture traffic going through.

The good news is that hubs are almost obsolete nowadays. Most modern networks use switches. Hence, passive sniffing is no more effective.

Active Sniffing

In active sniffing, the traffic is not only locked and monitored, but it may also be altered in some way as determined by the attack. Active sniffing is used to sniff a switch-based network. It involves injecting address resolution packets (ARP) into a target network to flood on the switch content addressable memory (CAM) table. CAM keeps track of which host is connected to which port.

Following are the Active Sniffing Techniques −

MAC Flooding
DHCP Attacks
DNS Poisoning
Spoofing Attacks
ARP Poisoning

Protocols which are affected

Protocols such as the tried and true TCP/IP were never designed with security in mind and therefore do not offer much resistance to potential intruders. Several rules lend themselves to easy sniffing −

HTTP − It is used to send information in the clear text without any encryption and thus a real target.
SMTP (Simple Mail Transfer Protocol) − SMTP is basically utilized in the transfer of emails. This protocol is efficient, but it does not include any protection against sniffing.
NNTP (Network News Transfer Protocol)− It is used for all types of communications, but its main drawback is that data and even passwords are sent over the network as clear text.
POP (Post Office Protocol) − POP is strictly used to receive emails from the servers. This protocol does not include protection against sniffing because it can be trapped.
FTP (File Transfer Protocol) − FTP is used to send and receive files, but it does not offer any security features. All the data is sent as clear text that can be easily sniffed.
IMAP (Internet Message Access Protocol) − IMAP is same as SMTP in its functions, but it is highly vulnerable to sniffing.
Telnet − Telnet sends everything (usernames, passwords, keystrokes) over the network as clear text and hence, it can be easily sniffed.

Sniffers are not the dumb utilities that allow you to view only live traffic. If you really want to analyze each packet, save the capture and review it whenever time allows.

Hardware Protocol Analyzers

Before we go into further details of sniffers, it is important that we discuss about hardware protocol analyzers. These devices plug into the network at the hardware level and can monitor traffic without manipulating it.

Hardware protocol analyzers are used to monitor and identify malicious network traffic generated by hacking software installed in the system.
They capture a data packet, decode it, and analyze its content according to certain rules.
Hardware protocol analyzers allow attackers to see individual data bytes of each packet passing through the cable.

These hardware devices are not readily available to most ethical hackers due to their enormous cost in many cases.

Lawful Interception

Lawful Interception (LI) is defined as legally sanctioned access to communications network data such as telephone calls or email messages. LI must always be in pursuance of a lawful authority for the purpose of analysis or evidence. Therefore, LI is a security process in which a network operator or service provider gives law enforcement officials permission to access private communications of individuals or organizations.

Almost all countries have drafted and enacted legislation to regulate lawful interception procedures; standardization groups are creating LI technology specifications. Usually, LI activities are taken for the purpose of infrastructure protection and cyber security. However, operators of private network infrastructures can maintain LI capabilities within their own networks as an inherent right, unless otherwise prohibited.

LI was formerly known as wiretapping and has existed since the inception of electronic communications.

Fingerprinting

2018-02-23T15:27:00.000+05:30

The term OS fingerprinting in Ethical Hacking refers to any method used to determine what operating system is running on a remote computer. This could be −

Active Fingerprinting − Active fingerprinting is accomplished by sending specially crafted packets to a target machine and then noting down its response and analyzing the gathered information to determine the target OS. In the following section, we have given an example to explain how you can use NMAP tool to detect the OS of a target domain.
Passive Fingerprinting − Passive fingerprinting is based on sniffer traces from the remote system. Based on the sniffer traces (such as Wireshark) of the packets, you can determine the operating system of the remote host.

We have the following four important elements that we will look at to determine the operating system −

TTL − What the operating system sets the Time-To-Live on the outbound packet.
Window Size − What the operating system sets the Window Size at.
DF − Does the operating system set the Don't Fragment bit.
TOS − Does the operating system set the Type of Service, and if so, at what.

By analyzing these factors of a packet, you may be able to determine the remote operating system. This system is not 100% accurate, and works better for some operating systems than others.

Basic Steps

Before attacking a system, it is required that you know what operating system is hosting a website. Once a target OS is known, then it becomes easy to determine which vulnerabilities might be present to exploit the target system.

Below is a simple nmap command which can be used to identify the operating system serving a website and all the opened ports associated with the domain name, i.e., the IP address.

$nmap -O -v google.com

It will show you the following sensitive information about the given domain name or IP address −

Starting Nmap 5.51 ( http://nmap.org ) at 2015-10-04 09:57 CDT 
Initiating Parallel DNS resolution of 1 host. at 09:57 
Completed Parallel DNS resolution of 1 host. at 09:57, 0.00s elapsed 
Initiating SYN Stealth Scan at 09:57
Scanning google.com (66.135.33.172) [1000 ports] 
Discovered open port 22/tcp on 66.135.33.172 
Discovered open port 3306/tcp on 66.135.33.172 
Discovered open port 80/tcp on 66.135.33.172 
Discovered open port 443/tcp on 66.135.33.172 
Completed SYN Stealth Scan at 09:57, 0.04s elapsed (1000 total ports) 
Initiating OS detection (try #1) against google.com (66.135.33.172) 
Retrying OS detection (try #2) against  google.com (66.135.33.172) 
Retrying OS detection (try #3) against  google.com (66.135.33.172) 
Retrying OS detection (try #4) against google.com (66.135.33.172) 
Retrying OS detection (try #5) against google.com (66.135.33.172) 
Nmap scan report for google.com (66.135.33.172) 
Host is up (0.000038s latency). 
Not shown: 996 closed ports 
PORT     STATE SERVICE 
22/tcp   open  ssh 
80/tcp   open  http 
443/tcp  open  https 
3306/tcp open  mysql  

TCP/IP fingerprint: 
OS:SCAN(V=5.51%D=10/4%OT=22%CT=1%CU=40379%PV=N%DS=0%DC=L%G=Y%TM=56113E6D%P= 
OS:x86_64-redhat-linux-gnu)SEQ(SP=106%GCD=1%ISR=109%TI=Z%CI=Z%II=I%TS=A)OPS 
OS:(O1=MFFD7ST11NW7%O2=MFFD7ST11NW7%O3=MFFD7NNT11NW7%O4=MFFD7ST11NW7%O5=MFF 
OS:D7ST11NW7%O6=MFFD7ST11)WIN(W1=FFCB%W2=FFCB%W3=FFCB%W4=FFCB%W5=FFCB%W6=FF 
OS:CB)ECN(R=Y%DF=Y%T=40%W=FFD7%O=MFFD7NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A 
OS:=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0% 
OS:Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S= 
OS:A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R= 
OS:Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N% 
OS:T=40%CD=S)

If you do not have nmap command installed on your Linux system, then you can install it using the following yum command −

$yum install nmap

You can go through nmap command in detail to check and understand the different features associated with a system and secure it against malicious attacks.

Punch Line:

You can hide your main system behind a secure proxy server or a VPN so that your complete identity is safe and ultimately your main system remains safe.

Port Scanning

We have just seen information given by nmap command. This command lists down all the open ports on a given server.

PORT       STATE   SERVICE 
22/tcp     open    ssh 
80/tcp     open    http 
443/tcp    open    https 
3306/tcp   open    mysql

You can also check if a particular port is opened or not using the following command −

$nmap -sT -p 443 google.com

It will produce the following result −

Starting Nmap 5.51 ( http://nmap.org ) at 2015-10-04 10:19 CDT 
Nmap scan report for google.com (66.135.33.172) 
Host is up (0.000067s latency). 
PORT    STATE SERVICE 
443/tcp open  https  

Nmap done: 1 IP address (1 host up) scanned in 0.04 seconds

Once a hacker knows about open ports, then he can plan different attack techniques through the open ports.

Punch Line:

It is always recommended to check and close all the unwanted ports to safeguard the system from malicious attacks.

Ping Sweep

A ping sweep is a network scanning technique that you can use to determine which IP address from a range of IP addresses map to live hosts. Ping Sweep is also known as ICMP sweep.

You can use fping command for ping sweep. This command is a ping-like program which uses the Internet Control Message Protocol (ICMP) echo request to determine if a host is up.

fping is different from ping in that you can specify any number of hosts on the command line, or specify a file containing the lists of hosts to ping. If a host does not respond within a certain time limit and/or retry limit, it will be considered unreachable.

Punch Line:

To disable ping sweeps on a network, you can block ICMP ECHO requests from outside sources. This can be done using the following command which will create a firewall rule in iptable.

$iptables -A OUTPUT -p icmp --icmp-type echo-request -j DROP

DNS Enumeration

Domain Name Server (DNS) is like a map or an address book. In fact, it is like a distributed database which is used to translate an IP address 192.111.1.120 to a name www.example.com and vice versa.

DNS enumeration is the process of locating all the DNS servers and their corresponding records for an organization. The idea is to gather as much interesting details as possible about your target before initiating an attack.

You can use nslookup command available on Linux to get DNS and host-related information. In addition, you can use the following DNSenum script to get detailed information about a domain −

DNSenum.pl

DNSenum script can perform the following important operations −

Get the host's addresses
Get the nameservers
Get the MX record
Perform axfr queries on nameservers
Get extra names and subdomains via Google scraping
Brute force subdomains from file can also perform recursion on subdomain that has NS records
Calculate C class domain network ranges and perform whois queries on them
Perform reverse lookups on netranges

Punch Line:

DNS Enumeration does not have a quick fix and it is really beyond the scope of this tutorial. Preventing DNS Enumeration is a big challenge.

If your DNS is not configured in a secure way, it is possible that lots of sensitive information about the network and organization can go outside and an untrusted Internet user can perform a DNS zone transfer.

Footprinting

2018-02-22T19:47:00.002+05:30

Footprinting is a part of reconnaissance process which is used for gathering possible information about a target computer system or network. Footprinting could be both passive and active. Reviewing a company’s website is an example of passive footprinting, whereas attempting to gain access to sensitive information through social engineering is an example of active information gathering.

Footprinting is basically the first step where hacker gathers as much information as possible to find ways to intrude into a target system or at least decide what type of attacks will be more suitable for the target.

During this phase, a hacker can collect the following information −

Domain name
IP Addresses
Namespaces
Employee information
Phone numbers
E-mails
Job Information

In the following section, we will discuss how to extract the basic and easily accessible information about any computer system or network that is linked to the Internet.

Domain Name Information

You can use http://www.whois.com/whois website to get detailed information about a domain name information including its owner, its registrar, date of registration, expiry, name server, owner's contact information, etc.

Here is a sample record of www.google.com extracted from WHOIS Lookup −

google.com

Updated 1 hour ago

DOMAIN INFORMATION

Domain:

google.com

Registrar:

MarkMonitor Inc.

Registration Date:

1997-09-15

Expiration Date:

2020-09-13

Updated Date:

2018-02-21

Status:

clientDeleteProhibited
clientTransferProhibited
clientUpdateProhibited
serverDeleteProhibited
serverTransferProhibited
serverUpdateProhibited

Name Servers:

ns1.google.com
ns2.google.com
ns3.google.com
ns4.google.com

REGISTRANT CONTACT

Name:

Domain Administrator

Organization:

Google LLC

Street:

1600 Amphitheatre Parkway,

City:

Mountain View

State:

Postal Code:

94043

Country:

Phone:

+1.6502530000

Fax:

+1.6502530001

Email:

@google.com

ADMINISTRATIVE CONTACT

Name:

Domain Administrator

Organization:

Google LLC

Street:

1600 Amphitheatre Parkway,

City:

Mountain View

State:

Postal Code:

94043

Country:

Phone:

+1.6502530000

Fax:

+1.6502530001

Email:

@google.com

TECHNICAL CONTACT

Name:

Domain Administrator

Organization:

Google LLC

Street:

1600 Amphitheatre Parkway,

City:

Mountain View

State:

Postal Code:

94043

Country:

Phone:

+1.6502530000

Fax:

+1.6502530001

Email:

@google.com

RAW WHOIS DATA

Domain Name: google.com
Registry Domain ID: 2138514_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.markmonitor.com
Registrar URL: http://www.markmonitor.com
Updated Date: 2018-02-21T10:45:07-0800
Creation Date: 1997-09-15T00:00:00-0700
Registrar Registration Expiration Date: 2020-09-13T21:00:00-0700
Registrar: MarkMonitor, Inc.
Registrar IANA ID: 292
Registrar Abuse Contact Email: @markmonitor.com
Registrar Abuse Contact Phone: +1.2083895740
Domain Status: clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)
Domain Status: clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)
Domain Status: clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)
Domain Status: serverUpdateProhibited (https://www.icann.org/epp#serverUpdateProhibited)
Domain Status: serverTransferProhibited (https://www.icann.org/epp#serverTransferProhibited)
Domain Status: serverDeleteProhibited (https://www.icann.org/epp#serverDeleteProhibited)
Registry Registrant ID: 
Registrant Name: Domain Administrator
Registrant Organization: Google LLC
Registrant Street: 1600 Amphitheatre Parkway, 
Registrant City: Mountain View
Registrant State/Province: CA
Registrant Postal Code: 94043
Registrant Country: US
Registrant Phone: +1.6502530000
Registrant Phone Ext: 
Registrant Fax: +1.6502530001
Registrant Fax Ext: 
Registrant Email: @google.com
Registry Admin ID: 
Admin Name: Domain Administrator
Admin Organization: Google LLC
Admin Street: 1600 Amphitheatre Parkway, 
Admin City: Mountain View
Admin State/Province: CA
Admin Postal Code: 94043
Admin Country: US
Admin Phone: +1.6502530000
Admin Phone Ext: 
Admin Fax: +1.6502530001
Admin Fax Ext: 
Admin Email: @google.com
Registry Tech ID: 
Tech Name: Domain Administrator
Tech Organization: Google LLC
Tech Street: 1600 Amphitheatre Parkway, 
Tech City: Mountain View
Tech State/Province: CA
Tech Postal Code: 94043
Tech Country: US
Tech Phone: +1.6502530000
Tech Phone Ext: 
Tech Fax: +1.6502530001
Tech Fax Ext: 
Tech Email: @google.com
Name Server: ns2.google.com
Name Server: ns1.google.com
Name Server: ns4.google.com
Name Server: ns3.google.com
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2018-02-22T04:25:14-0800 <<<

The Data in MarkMonitor.com's WHOIS database is provided by MarkMonitor.com for
information purposes, and to assist persons in obtaining information about or
related to a domain name registration record.  MarkMonitor.com does not guarantee
its accuracy.  By submitting a WHOIS query, you agree that you will use this Data
only for lawful purposes and that, under no circumstances will you use this Data to:
 (1) allow, enable, or otherwise support the transmission of mass unsolicited,
     commercial advertising or solicitations via e-mail (spam); or
 (2) enable high volume, automated, electronic processes that apply to
     MarkMonitor.com (or its systems).
MarkMonitor.com reserves the right to modify these terms at any time.
By submitting this query, you agree to abide by this policy.

MarkMonitor is the Global Leader in Online Brand Protection.

MarkMonitor Domain Management(TM)
MarkMonitor Brand Protection(TM)
MarkMonitor AntiPiracy(TM)
MarkMonitor AntiFraud(TM)
Professional and Managed Services

Visit MarkMonitor at http://www.markmonitor.com
Contact us at +1.8007459229
In Europe, at +44.02032062220

For more information on Whois status codes, please visit
 https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en
--

Punch Line:

Though there are some advantages of keeping your website in an archive database, but if you do not like anybody to see how your website progressed through different stages, then you can request archive.org to delete the history of your website.