Cherry.chetanpatel #Education/Technology

Difference Between a Penetration Test and Vulnerability Assessment - Part 2

2022-11-03T09:00:00.001+05:30

The Difference Between a Penetration Test and Vulnerability Assessment - Part 2

What is the Difference Between a Penetration Test and Vulnerability Assessment?

Part 2 of 2

Comparing Penetration Tests and Vulnerability Assessments

In part 1 of this post, we focused on the Vulnerability Scans, Vulnerability Assessments, and Vulnerability Management in order to differentiate the 3 prior to digging into Penetration Tests. Now, let’s introduce and define Penetration Tests, explain the test itself and goals, then go through the different types of Penetration Tests.

What is a Penetration Test?

A Penetration test, or pen test, is the process an ethical hacker conducts on a target and the IT environment to uncover vulnerabilities by exploiting them. The goal is to gain unauthorized access through exploitation which can be used to emulate the intent of a malicious hacker. Penetration test reports may also assess potential impacts on the organization and suggest countermeasures to reduce risk.

In layman terms, a pen tester or ethical hacker is trying to do what a hacker would try to do to breach a system, machine, server or break security controls in order to steal sensitive information or somehow damage the organization.

The National Cyber Security Center describes penetration testing as the following: “A method for gaining assurance in the security of an IT system by attempting to breach some or all of that system’s security, using the same tools and techniques as an adversary might.”

Phases of a Penetration Test

A Penetration Test is often broken down into the following phases:

Reconnaissance
Threat Modeling and Vulnerability Identification
Exploitation (gaining access)
Post-exploitation (maintaining access)
Covering tracks
Reporting
Resolution & Re-Testing

A pen test is often initiated by a variety of changes in an IT environment including application launches, major network/application changes or updates, compliance regulations or a breach/leak from a targeted attack. Again, the end goal of an ethical hacker is to gain unauthorized access to a system by means of exploiting vulnerabilities or gaps in security processes.

Penetration Test Reporting

The ultimate value of a pen test is the comprehensive report that is delivered by the ethical hacker. Pen test reports often follow a similar structure if they are of high quality and delivered by a reputable ethical hacker or organization.

Executive summary: This is a high-level summary of the report contents that uses non-technical language so that everyone from the CEO to the IT Security staff can understand. The process of the test, findings, and recommendations will be addressed to provide a clear understanding of the organization’s overall security status.
Summary findings and recommendations: This can be broken down into two sections – an overview of the findings and a review of the recommendations. The findings may include some of the higher risk vulnerabilities as well as a discussion of positive security controls practiced. The recommendations typically include the higher risk fixes including software vulnerabilities, poorly secured PII, or risky 3rd party access to name a few. Frankly, this section should list anything that that needs to be addressed to enhance overall security.
Detailed findings in order: This is the bulk of the report. Each finding will be written with a summary, technical details, reproduction steps, and detailed recommendations in order of significance.
Methodology: High-level pen testers will include a methodology section in the report to outline the process taken in their approach. The methodology can help your organization have a better understanding of how technical and deep the testing methodology was.
References: This section can include a list of used tools and applications for the assessment and any other relevant material.
Appendices: The last section is reserved for any material which required additional information relevant to the report but isn’t essential to the main body of the report.

When to Conduct a Penetration Test

Vulnerability Management Program: A good, mature vulnerability management program should include periodic penetration testing. Think about it this way, a vulnerability scan uncovers an unwieldy list of software vulnerabilities, a vulnerability assessment places the vulnerabilities in a prioritized list, a vulnerability management program handles fixing those vulnerabilities by priority and a penetration test will ultimately test those fixes.
Application Launches: A pen test is often conducted as part of the software development life cycle (SDLC) process to uncover existing vulnerabilities in the application. Software developers are notoriously poor at thinking about security in the development process so testing the applications is critical prior to launch.
Compliance regulations: A pen test is either required or recommended with certain compliance regulations including some of the most significant legislation including PCI-DSS, HIPAA, Sarbanes-Oxley, and others. Essentially penetration tests are a component of a full security audit. For example, the Payment Card Industry Data Security Standard (PCI-DSS) requires penetration testing annually or “upon significant changes.” The link above contains a PDF document.
Network or Application Changes: Pen tests are often scheduled in conjunction with any major changes in the network or application updates. Changes in the IT infrastructure often create security gaps. Think about simply adding a new system to an environment; that system requires security solutions like firewalls, content filtering, log monitoring, and depending on the data it contains, perhaps much more.
After a breach: This is the worst reason to conduct a pen test, but it has become fairly common. After having been breached and having confidential data exposed to the public, a company may immediately conduct a pen test to try and stop the bleeding so to speak. The objective here is to uncover any additionally existing vulnerabilities and holes an organization may have.

What are the Different Types of Penetration Testing?

Pen testing is often based on the level of knowledge and access given to the pen tester for very specific reasons. The range runs from black-box testing, where the tester is given minimal knowledge of the target system(s), to white-box testing, where the tester is granted a high level of knowledge and access. There are benefits to each type of testing which we will address.

Black-Box Testing
In a black-box scenario, the penetration tester is placed in the role of a true hacker, with no internal knowledge of the target system. Testers are not provided with any architecture diagrams or source code that is not publicly available. A black-box penetration test determines the vulnerabilities in a system that are exploitable from outside the network.

Black-box penetration testing relies on the skill of the ethical hacker and their analysis of currently running programs and systems within the target network. Black-box penetration testers are typically highly skilled must be familiar with automated scanning tools such as nmap and Metasploit and methodologies for manual penetration testing.

Gray-Box Testing
If a black-box tester is examining a system from an outsider’s perspective, a gray-box tester has the access and knowledge level of a high-level employee, often with elevated privileges on priority systems. Gray-box pen testers typically have some knowledge of a network’s internals, potentially including design and architecture documentation and an account internal to the network.

The purpose of Gray-box pen testing is to provide a more focused and efficient assessment of a network’s security than a black-box assessment. Leveraging the design document for the network a Gray-box pen tester can focus their attention on the systems with the greatest risk and value from the start, rather than spending time determining this information on their own. In addition, with legitimate access to systems testing of security inside the hardened perimeter simulates an attacker with longer-term access to the network.

White-Box Testing
White-box testing falls on the opposite end of the range from black-box testing; penetration testers are given full access to source code, architecture documentation and other information about the environment and systems. The main challenge with white-box testing is sifting through the massive amount of data available to identify potential points of weakness, making it the most time-consuming type of penetration testing.

Unlike black-box and gray-box testing, white-box penetration testers are able to perform static code analysis, making familiarity with source code analyzers, debuggers, and similar tools important for this type of testing.

White-box penetration testing provides a comprehensive assessment of both internal and external vulnerabilities, making it the best choice for calculation testing. One of the key benefits of this type of testing is to find coding errors in the early stages of software development.

Ethical Hacking, Red Teaming and Capture the Flag

We wrote a comprehensive blog post on Ethical Hacking, Red Teaming and Capture the Flag about a year ago which I encourage you to read for more information on the 3 exercises.

In this post, we’ll try and provide more concise information so we don’t simply repeat what was provided in the previous post or go too far in length with details about each.

Ethical Hacking

Ethical hacking is quite similar to penetration testing and often used interchangeably, however, there are several key differences. The term ethical hacking is a broader term for hacking techniques specifically used by ethical hackers. While a penetration tester might discover flaws and vulnerabilities and deliver a report, an ethical hacker will likely conduct a longer-term assessment, using a greater variety of attack types and more fully testing and exploring the environment.

While a penetration tester is usually focused on identifying vulnerabilities, an ethical hacker will usually pursue a full scope of hacking techniques in an attempt to find as many security flaws as possible. In most cases, it is less of a point-in-time assessment and more of a holistic security evaluation of a target environment. Ethical hackers also may provide more remediation assistance, commonly working with the organization to ensure the security of the target system.

Red Team Exercises

A red team assessment is another type of security testing tactic or exercise that is more defined and focused than penetration testing. The goal of a red team assessment is to test the target organization’s detection and response capabilities. The main difference is the comprehensive methods taken by the red team to simulate an actual attack.

Organizations are typically not informed of the test, and the red team proceeds to attempt to access critical and sensitive data leveraging a variety of attack methods; essentially simulating the tactics of an actual attacker. The assessments are usually a longer process and a more thorough investigation into security vulnerabilities and their corresponding impact. Methods may also be more extensive than a typical pen testing and include social engineering, wireless testing, and physical security testing.

Capture the Flag Penetration Test Exercises

Another penetration test-related exercise is a capture the flag (CTF) exercise. Testers are assigned a specific goal (capturing the flag), which might be exfiltrating a specific data file or accessing a specific system. CTF exercises are often set-up in a competition environment with teams competing to accomplish the goal first.

Contests with prizes and open competition are often used to recruit new employees, build security skills, and test systems. CTF exercises are different from a traditional penetration test in that they often use test environments or third-party environments, like the Michigan Cyber Range, as the event is more of an evaluation of the testers’ skills than production systems.

Bug Bounty Programs

Bug Bounty Programs have taken off recently because of the number of breaches, number of software vulnerabilities and the interest of large organizations to stay out of the news with a data breach. A bug bounty program is a deal or money offered by many websites, organizations and software developers by which individuals can receive recognition and compensation, in many cases thousands of dollars for reporting software bugs, especially those pertaining to exploits and vulnerabilities.

These programs allow the developers to discover and resolve bugs before the general public is aware of them, preventing incidents of hacking. Bug bounty programs have been implemented by a large number of organizations, including Mozilla, Facebook, Yahoo!, Google, Reddit, Square, and Microsoft.

Conclusion

We discussed Vulnerability Scanning, Vulnerability Assessments, Vulnerability Management and Penetration Testing. Hopefully, we were able to convey that scanning, assessments, and pen testing are all part of a quality vulnerability management program.

(1) Start with a scan to identify software vulnerabilities
(2) conduct an assessment to prioritize systems and patches, and once the assessment is complete with all tasks identified in the assessment handled
(3) conduct a pen test to test the security of the systems and security controls in the environment. Essentially, those are the nuts and bolts of a vulnerability management program.

To get started on the road to security program improvement start with a vulnerability assessment. This will provide a good launch point for your IT security team to understand where the organization lies on the security maturity continuum. You’ll have a list of vulnerabilities, systems, proprietary data or sensitive information and other details that will allow you to prioritize patching and other security tasks.

I hope this blog post provided the information you needed and please know that the team here at SecureOps is here to help. If you’ve run a Vulnerability Scan or Assessment and need assistance interpreting the results or taking the next step, please call us or e-mail us; we are happy to provide assistance.

Final Notes from SecureOps Management

SecureOps offer retesting to confirm that any vulnerability found has been fixed. We also provide a certificate that shows the Penetration Test has been completed. And of course, we use only skilled security professions who have deep industry specific certifications and have proven success.

Penetration Tests are excellent for companies to understand where their vulnerabilities resides as well as their strengths and weaknesses. It can also be a excellent training for developers to learn how to do secure coding and change their SDLC to an S-SDLC.

Difference Between a Penetration Test and Vulnerability Assessment - Part 1

2022-10-20T09:00:00.001+05:30

The Difference Between a Penetration Test and Vulnerability Assessment - Part 1

What is the Difference Between a Penetration Test and Vulnerability Assessment?

Part 1 of 2

Comparing Penetration Tests and Vulnerability Assessments

The staff here at SecureOps is consistently asked the purpose and the differences between vulnerability scans, vulnerability assessments and penetration tests – including all the variations of both such as red teaming, capture the flag exercises, bug bounty programs and more. Our goal in this blog post is to work from a high level and explain the general differences between identifying vulnerabilities to a more detailed level and ultimately walk through what the services are from an execution perspective and what benefits they offer an organization in terms of improving security.

Let’s start with answering the broad question first and dig deeper from the explanation that we use here at SecureOps. Vulnerability scans search systems for known vulnerabilities using a scanner like those manufactured by Nessus, GFI LANGuard, Rapid7, Retina, Qualys. A vulnerability assessment is the process of identifying, quantifying, and prioritizing the vulnerabilities in each system, then in the entire environment. The assessment should provide a prioritized list of patches and systems that need attention as well as when they need attention. Penetration testing is quite different; a quality pen test attempts to identify weaknesses that a threat actor could exploit including poor vulnerability management processes, unpatched software vulnerabilities, ineffective security settings on systems, gaps in the layer security solution and certainly much more.

Vulnerability Assessment vs Penetration Testing Snapshot Table

Vulnerability Assessment	Penetration Testing
This is the process of finding and measuring the vulnerability of a system Finds vulnerabilities and exploits them to break security controls and breach systems	Creates a list of vulnerabilities prioritized by its severity Helps in charting the path which will be taken by the attacker to take over the system(s)
Assessments start the process of identifying systems with security issues and their impact to the organization’s risk posture	Pen tests should be conducted after assessments and when the organization has an acceptable level of security practices and wants to identify additional vulnerabilities
Assessments uncover, define, identify and prioritize the vulnerabilities or security gaps in a system and organization in order to prioritize security issues.	Pen tests discover vulnerabilities with specific goals in mind. They want to know how a cybercriminal can exploit a vulnerability to breach a system or organization.

What is Vulnerability Management?

We discussed vulnerability scans and vulnerability assessments but before we move on, we figured we should explain vulnerability management briefly because it is the overriding program that contains vulnerability scans and assessment and we don’t want the term to add further confusion. The reality for many organizations is that running a vulnerability scanner that scans the majority of critical systems and produces a thousand-page report is considered fairly typical. The vulnerability scan report has allowed IT security teams to identify missing patches and insecure configurations, however these professionals were drowning and data and had no prioritized way to apply every patch in a timely manner.

For example, two years ago WannaCry and NotPetya created turmoil in even the largest corporations around the globe. Both attacks were fueled by the leaked exploit EternalBlue —a known vulnerability for which patches had been available for several months. Just after EternalBlue, Equifax suffered one of the most infamous breaches when attackers compromised a Struts vulnerability on a critical, public-facing web server—a vulnerability that had been identified several years earlier.

The real goal of any vulnerability management program should be to minimize risks to the organization introduced by vulnerabilities. Thus, vulnerability management is the process of addressing vulnerabilities, systems, data, and business goals by priority and handling the most critical patches or other issues by priority.

The first phase of the vulnerability management process is asset discovery. Organizations should know what machines or systems are deployed on their network, which has become increasingly difficult with IoT, BYOD, the digital transformation and the continuous collection of sensitive information. The next phase is the IT security teams response based on a risk-based approach to patching. The team should consider several factors including:

The type of data it contains – PII and other sensitive data – these systems should be prioritized
Where the system is on the network – is it exposed more than other systems to hackers?
What the system’s function is – is it a mail server, database, public-facing system, etc.
Whether or not the patch in question poses a threat

By considering the four variables above you can create a risk management program that will be cost-effective and aligned with the business goals. There’s an old adage in risk management: “When everything’s is a priority, nothing is a priority.” There were over 14,000 vulnerabilities or CVE’s distributed last year so obviously it is impossible to keep up in real-time with patching requirements for every system.

Download Our Comprehensive Threat and Vulnerability Management Program Infographic here: https://www.secureops.com/resources/

What Is A Vulnerability Assessment?

A vulnerability assessment, or VA, is the process of identifying threats and vulnerabilities on a target by using automated vulnerability scanners. This sometimes includes a range of manual testing with additional tools to further evaluate the security of applications or networks and to verify vulnerabilities discovered by the scanning applications.

To be clear, a vulnerability assessment is not a scan; it is a defined “point in time” assessment with a beginning and end, unlike vulnerability management which is a continuous and evolving process. Periodic assessments are part of an overall vulnerability management program.

Typically, an internal or external IT security consultant will review your corporate environment and identify a variety of potentially exploitable vulnerabilities that you are exposed to in a detailed report. The report will not only list the identified vulnerabilities but also provide actionable recommendations for remediation.

By performing periodic assessments within a Vulnerability Management program, IT security can identify possible security issues that may be present on the network, both from an internal and an external perspective. Early detection introduces the opportunity to address the problems before the attackers can exploit the weakness.

To be clear, a vulnerability assessment is cyclical and proactive in order to uncover vulnerabilities and to perform prioritized, risk-based patching as part of an ongoing vulnerability management program.

How to Perform a Vulnerability Assessment

Install a vulnerability scanner and schedule periodic scanning – many organizations scan once per month
Scan your company’s network to uncover potential vulnerabilities – This scan should include all devices with an IP address, such as desktops, laptops, printers, routers, switches, hubs, servers, wired and wireless networks, and firewalls.
Identify any changes, pending updates or missing software patches – Neglecting to update your software regularly can leave your system vulnerable.
Identify and prioritize risks – It is vital to assess your databases and identify which systems are priority – for example, those that hold PII or personal information like credit card numbers, social security numbers, and dates of birth.
Select strategic risk-based remediation – Any thorough scan is likely to surface some vulnerabilities. Implement remediation efforts and prioritize systems with your most high-risk data.
Plan your remediation tasks – Ensure minimal interruptions in your network’s service, and maximal convenience to your team and your clients.

This seems like a perfect place to take a quick breather before we jump into Penetration Testing and all variations and benefits. The second and final blog post on The Difference between Vulnerability Assessments and Penetration Testing will be posted shortly.

Is Web App Penetration Testing Worth the Price?

2022-10-06T09:00:00.001+05:30

Is Web App Penetration Testing Worth the Price?

The Fundamentals of Web App Penetration Testing

A couple of blog posts ago we went through the fundamentals of Web Application Penetration Testing.

We suggested that a web application penetration test is an assessment of the security of the code and the use of software and libraries on which the application runs. Pen testers are security professionals that will search for vulnerabilities in web apps such as:

Injection vulnerabilities
Broken authentication
Broken authorization
Incorrect error handling

In this blog post, we will discuss the pricing and overall economics of conducting web app penetration tests. First, as a note, from a broad perspective, a penetration test is an authorized simulated cyber-attack on a computer system or application performed to assess the strengths and weaknesses of the systems or application from that of a criminal, hacker, insider threat, and so on. One thing to remember is that a penetration test is a point-in-time test that is or should be conducted periodically as systems, applications and environments change frequently and thus, so does the security of those assets.

Penetration tests are critical to providing IT security an understanding of the overall security posture of the organization and the individual assets within the organization. It tests the security controls the organization has adopted for the sole purpose of strengthening existing controls and adding new controls to eliminate weaknesses.

Web Apps are the Most Targeted Asset by Hackers

In our previous blog post, we touch on some of this information so why the review? Because web apps are by far the most targeted asset cybercriminals use to access systems, escalated attacks, gain privileges to high priority systems and ultimately steal the sensitive data of the organization, its customers, and employees. As a matter of fact, according to SANS institute, web applications account for more than 60% of targets in cyber-attack attempts. In our opinion, this percentage is likely far higher over the past year or year and a half. Literally, tens of thousands of websites are targeted and hacked every day.

Vulnerability assessments, security posture assessments, and penetration tests are geared to evaluate the security strategy of an organization and they are critical. However, for the most part, they are not intended to specifically test the security of a web application like a pen test specifically designed to find flaws in the code that attackers can take advantage of to gain access to a system.

Determining the frequency of doing a web app pen test depends on a variety of factors including:

Is the application business-critical?
How often does the application’s code change?
What are other related systemic risks to the app?

In addition, because software developers or devops are constantly publishing new code, the need for pen-testing could be fairly often. Organizations conduct web app pen tests on an as-needed basis, which can be as often as quarterly or just once a year. Typically, the frequency of pen testing is aligned with the minimum requirements for compliance such as in ISO, PCI DSS, FISMA, HIPAA, Sarbanes-Oxley, and others.

The Real Cost of a Web App Pen Test

First, we recommend using pen testers who can clearly communicate what they are testing and discuss actionable remediation. A security testing mill which you’ll find via Google pretty easily is going to cost less, but you’re not going to get the advantage of talking to an expert human who will support your IT security team’s goals to use the information to prevent future hacks.

Second, a penetration test can cost anywhere from a few thousand dollars for a small, non-complex organization to more than $100,000 for a large, complex one. Penetration testing for a very “simple” single server/database web application with less than 10 pages, no publicly exposed APIs and 1-2 user roles will cost you approximately $5,000 US or thereabouts. If you are quoted an amount less than this you should ask the pen test provider serious questions about the robustness, relevance, and worth of the pen test that they are quoting you for because it might not be a quality test.

We added our pricing below which we discussed in our previous blog post and which you can always discuss with one of our experts.

Second, be careful concerning how much time a web app pen tester requires from your team including choosing a vendor, negotiating a contract, scoping the test, and finding an appropriate start date. Think about it, this can often be up to two weeks of effort you spend internally just to get a vendor to start a test. Make sure that vendor is easy to work with, can guide you based on your needs, and is 100% prepared to get started with the project on-time.

Third, when the penetration test is completed you should receive a comprehensive report that needs to include all the remediation issues that are found. These issues should be discussed and evaluated between the pentester and your team in order to prioritize fixes. In many cases, there will be several days if not a week or two of remediation that needs to be handled by your team. Remediation is of course a job on top of the jobs your team conducts on a daily basis so the easier the pen tester can spell out the issues, the faster your team can handle remediation.

Finally, verifying your team’s remediation of the vulnerabilities is generally not included in a web app pen test. Thus, you typically rely on other tools such as a Dynamic Application Security Test (DAST) scanner. However, scanners won’t learn your business logic and it won’t find that vulnerable plug-in that gives Admin access to your application.

Tests may even run a Buffer overflow or SQLi attack which will ultimately damage your web app. In addition, it will not deliver zero false positives, so there is a possibility it will increase pen test remediation activities.

Conclusion

Human Interaction is Key to a Successful Project
Pen testing as a service is becoming increasingly popular, however, the drawbacks to not having a real, live expert to discuss issues with are critical to eliminating vulnerabilities both now and in the future.

Access to Security Experts
Please make sure that human is a certified ethical hacker and an experienced expert in web app penetration testing. Further, make certain they come from an organization with a quality reputation and the ability to help you with other security needs.

Transparent Pricing is Critical
Find partners that can provide pricing in a clear, understandable manner. Lots of security services are custom and difficult to estimate, however, web app pen tests should be fairly straightforward when it comes to pricing.

Making Remediation a Priority
Detected vulnerabilities and risk-based remediation need to be available immediately after the test is complete and the report is delivered. The partnership between the pen tester, IT security, and devops should be a priority and should start as soon as possible

The Uber Breach 2022. What Happened in the Uber Breach?

2022-09-22T10:00:00.000+05:30

Uber recently notified authorities that they suffered a “cybersecurity incident.” Meanwhile, the hacker behind the incident has publicly shared some startling details with news outlets, and also let Uber employees know – using their own corporate Slack – of the attack.

Uber security and privacy woes started in 2011 with reports of parties treating guest to the Uber’s “God View”. Apparently there were two versions of the “God View”. The anonymized version, which as OK, and the “Creepy Stalker version”, showing whereabouts and movements of specific Uber users in real time. Entrepreneur Peter Sims was featured in the creepy version, found out, was upset about it, and wrote a Medium post (Can We Trust Uber?) which went viral. The news reports eventually gave way to regulatory investigations.

Then came the breaches.

Two breaches to be precise.

The first breach occurred in or about May 2014 when an intruder gained access to personal information about Uber drivers. Uber suffered a second, larger breach of drivers’ and riders’ data in October-November 2016. Uber failed to disclose the 2016 breach to consumers or regulators despite the fact that it took place while the company was under investigation for the first breach plus the “God View” incidents.

Surprisingly, regulators did not like that and Uber ended up paying out a record 148 Million penalty.

To top it all, on August 20, 2020, a criminal complaint was filed charging Joseph Sullivan, Uber’s former chief security officer, with obstruction of justice and misprision of a felony in connection with an alleged attempted cover-up of a 2016 data breach. The outcome of the criminal case will have serious implications for all companies, executives, and cybersecurity professionals.

Mr. Sullivan should be presumed innocent until proven otherwise but, if you are involved in decision making during security incidents, don’t wait to find-out the outcome of the case to start learning the lessons. The business’s duty to disclose a data breach is not always clear, and there are often a myriad of laws, regulatory practices and consumer expectations when navigating an incident response situation.

On Thursday, September 15th, Uber confirmed reports of an organization-wide cybersecurity breach. This is an evolving situation, but we will bring you here the latest information and commentary as we get it.

Update 9/20/22: Uber confirmed in a security update that the named attacker "Tea Pot" was affiliated with the Lapsus$ hacking group, famous for breaching NVIDIA, Samsung, and Microsoft earlier this year. According to their early investigations, it is likely that the attacker targeted an external contractor whose credentials were bought on the dark web.

What happened

Here’s what we know so far, pending investigation and confirmation from Uber’s security teams.

1. The attack started with a social engineering campaign on Uber employees, which yielded access to a VPN, in turn granting access to Uber's internal network *.corp.uber.com.

2. Once on the network, the attacker found some PowerShell scripts, one of which contained hardcoded credentials for a domain admin account for Thycotic, Uber’s Privileged Access Management (PAM) solution.

3. Using admin access, the attacker was able to log in and take over multiple services and internal tools used at Uber: AWS, GCP, Google Drive, Slack workspace, SentinelOne, HackerOne admin console, Uber’s internal employee dashboards, and a few code repositories.

Screenshot from a private message with the hacker on Telegram

The critical vulnerability that granted the attacker such high levels of access was hardcoded credentials in a PowerShell script. These credentials gave admin access to a Privileged Access Management (PAM) system: Thycotic. This tool carries huge amounts of privilege, making it a single point of failure; it stores both end-user credentials for employee access to internal services and third-party apps as well as DevOps secrets used in the context of software development. This is a worst-case scenario. The PAM system controls access to multiple systems, and having admin access means you can give yourself or extract secrets to all connected systems. This has appeared to give the attacker complete access to all of Uber's internal systems.

This isn't the first time we've seen an Uber data breach: in 2014 hackers gained access to an AWS S3 bucket after developers leaked secrets to a public git repository. Two years later, a similar incident happened when attackers exploited poor password hygiene by some developers to gain access to private repositories which contained multiple access credentials. Now we appear to have the final episode in the trilogy, and it appears to be the most serious situation yet.

How bad is it?

Critically, Uber’s Privileged Access Management (PAM) platform was compromised through the exposure of its admin credentials. Privileged access management (PAM) is the combination of tools and technology used to secure, control, and monitor employee access to an organization's critical information and resources. With that in mind, the attacker may have gained access to nearly all the internal systems of Uber. Let’s go through the ones we know of based on preliminary information and evidence to understand the severity of this incident.

Thycotic – Severity = Critical

The attacker gained admin access to the Thycotic PAM system. PAM systems can be a single full-featured software console or a collection of multiple tools; in the case of Thycotic, it is a single tool with many features. It can control access to different services and also has a secrets manager where credentials and passwords are stored. It appears the hacker was able to access secrets inside the secure storage, granting the worst possible scenario for Uber.

AWS instance – Severity = Critical

The AWS instance controls the cloud infrastructure of Uber's applications. Depending on configuration, privileges, and architecture, the attacker can potentially shut down services, abuse computing resources, access sensitive user data, delete or ransom data, change user access, and many more things.

VMware vSphere – Severity = Critical

VMware vSphere is a cloud computing virtualization platform. This is a critical platform as it interfaces with both cloud computing and on-premise servers which can give attack access to controlled on-premise servers as well as many administrative functions that would help an attacker move deeper into systems.

SentinelOne – Severity = High

SentinelOne is an XDR (eXtended Detection and Response) platform. Simply put, this platform connects to your mission-critical systems and lets you know if there are security issues. Any attacker that can obtain privileged access to this system can obfuscate their activity and prolong their attacks. XDRs can bake in "backdoors" for Incident Response (IR) teams, such as allowing IR teams to "shell into" employee machines and potentially widening the attacker's access.

Slack workspace – Severity = Medium

The internal messaging system of Slack can be used to great effect as an attacker to launch phishing campaigns. As the attacker has the instant trust of other users, they can send malicious links, try and get admins to elevate their privilege, and access sensitive information. As the attacker has made themselves known, this is likely a smaller threat.

GSuite Admin – Severity = Medium

GSuite is a tool used by many companies to manage their users, store data, and many other administrative tasks. With admin access, the attacker can create and delete accounts, but would also likely have access to employee data and other sensitive company data.

HackerOne – Severity = Medium

HackerOne is the platform used to pay and communicate with security researchers that find vulnerabilities within systems for rewards. Given the level of detail bounty hunters usually provide, anyone with access to the HackerOne tenant has detailed how-tos on how to exploit (likely unpatched) vulnerabilities in other areas of their IT systems. This means persistence is highly likely.

The hacking group apparently gained access to several internal Uber systems after stealing a third-party contractor's credentials and then convincing the contractor to approve a two-factor authentication request.

The security breach that hit Uber last week was the work of Lapsus$, Uber said in a blog post Monday. The South American hacking group has attacked a number of technology giants in the past year, including Microsoft, Samsung, and Okta.

While the attackers accessed several internal systems, Uber said it does not appear they infiltrated any public-facing systems, user accounts, or databases that store sensitive user information like credit card numbers. Additionally, Uber said it doesn't appear that the attackers accessed any customer or user data stored by its cloud providers.

Uber Breach 2022 Analysis

Based on news reports regarding the breach of Uber’s systems, the attacker manipulated one of the company’s employees into sharing their password, which allowed for the initial access of the target. The criminal hacker then proceeded with launching MFA fatigue attacks and compromising a worker’s Slack account to send out a message announcing to other employees that their company had suffered a data breach. In response, Uber has restricted access to Slack for internal communication. Among other compromised services are Google Cloud Platform, OneLogin, SentinelOne incident response portal, and AWS.

Several security researchers have already claimed the breach to be a “total security compromise” that might also result in the attacker posting the company’s source code online despite the tech giant’s representatives trying to “put out the fire” that started across media channels. The San Francisco-based ride-hailing company’s stance on the matter is different from the narrative voiced by non-Uber security analysts, mainly claiming that there is no evidence suggesting that the threat actor accessed sensitive data.

Prior to the incident, logs gathered from infostealers were put up for sale in the underground market. The infostealers that were used in these attacks against Uber employees were Raccoon and Vidar. The evidence suggests that the attacker used the acquired data to move laterally inside Uber’s network.

The motives of the threat actor are yet to be revealed, but his message shared in a channel on Uber’s Slack includes a demand for better pay for drivers. Uber representatives have not released any more updates publicly, claiming that the incident is currently under investigation.

Social engineering techniques are on the rise. This attack only mirrors the recent trend toward criminal hackers’ accumulating more sophisticated approaches to leveraging the human factor in their attacks. Drastic times call for drastic measures! Join forces with SOC Prime to enhance your threat detection capabilities and security posture with the power of a global community of cybersecurity experts. You can also enrich the collaborative expertise by contributing to SOC Prime’s crowdsourcing initiative. Develop and submit your Sigma and YARA rules, get them published to a platform, and receive recurring rewards for your input.

What is Log4j Vulnerability.

2022-02-22T09:30:00.000+05:30

The Log4j vulnerability allows malicious attackers to execute code remotely on any targeted computer.

What is Log4j : Log4j an open source software, a logging library for Java, is widely used by businesses and web portals. Earlier this month, this open source software was in the news for its vulnerabilities.Log4Shell, an internet vulnerability that affects millions of computers, involves an obscure but nearly ubiquitous piece of software, Log4j. The software is used to record all manner of activities that go on under the hood in a wide range of computer systems.

How the vulnerability can affect computers: This vulnerability is a challenge that will be faced by many companies and organisations that run software applications and websites, because Java is so widespread.

Log4j records events – errors and routine system operations – and communicates diagnostic messages about them to system administrators and users. It’s open-source software provided by the Apache Software Foundation.

A common example of Log4j at work is when you type in or click on a bad web link and get a 404 error message. The web server running the domain of the web link you tried to get to tells you that there’s no such webpage. It also records that event in a log for the server’s system administrators using Log4j.

How does Log4Shell work?

Log4Shell works by abusing a feature in Log4j that allows users to specify custom code for formatting a log message. This feature allows Log4j to, for example, log not only the username associated with each attempt to log in to the server but also the person’s real name, if a separate server holds a directory linking user names and real names. To do so, the Log4j server has to communicate with the server holding the real names.

Unfortunately, this kind of code can be used for more than just formatting log messages. Log4j allows third-party servers to submit software code that can perform all kinds of actions on the targeted computer. This opens the door for nefarious activities such as stealing sensitive information, taking control of the targeted system and slipping malicious content to other users communicating with the affected server.

Companies coming up with solutions: Crowdstrike, an American cybersecurity technology company, has launched a free targeted Log4j search tool that performs a targeted search by scanning a given set of directories, and then runs a deeper scan on those file types matching against a known set of checksums for Log4j libraries, it said in a blog.

Global cybersecurity company Kaspersky details in its blog the measures to be taken to safeguard against this vulnerability. One should follow the Apache guidelines in their website and install the most recent version of the library (i.e.2.15.0). Businesses should use a security solution that provides exploit prevention, vulnerability and patch management components. In addition, the company also recommended installing security solutions on the servers, this will allow one to detect the launch of malicious code and stop the attack’s development.

The damage that can be done :

Hackers are scanning through the internet to find vulnerable servers and setting up machines that can deliver malicious payloads. To carry out an attack, they query services (for example, web servers) and try to trigger a log message (for example, a 404 error). The query includes maliciously crafted text, which Log4j processes as instructions.

These instructions can create a reverse shell, which allows the attacking server to remotely control the targeted server, or they can make the target server part of a botnet. Botnets use multiple hijacked computers to carry out coordinated actions on behalf of the hackers.

A large number of hackers are already trying to abuse Log4Shell. These range from ransomware gangs locking down minecraft servers to hacker groups trying to mine bitcoin and hackers associated with China and North Korea trying to gain access to sensitive information from their geopolitical rivals. The Belgian ministry of defense reported that its computers were being attacked using Log4Shell.

Although the vulnerability first came to widespread attention on Dec. 10, 2021, people are still identifying new ways to cause harm through this mechanism.

Stopping the Vulnerability :

It is hard to know whether Log4j is being used in any given software system because it is often bundled as part of other software. This requires system administrators to inventory their software to identify its presence. If some people don’t even know they have a problem, it’s that much harder to eradicate the vulnerability.

Another consequence of Log4j’s diverse uses is there is no one-size-fits-all solution to patching it. Depending on how Log4j was incorporated in a given system, the fix will require different approaches. It could require a wholesale system update, as done for some Cisco routers, or updating to a new version of software, as done in Minecraft, or removing the vulnerable code manually for those who can’t update the software.

Is Loj4j still vulnerable?

More than 40 - 50% of the user's continue to download the vulnerable version of the Apache Log4j, despite the efforts to upgrade the software - according to the Sonatype, which own's the Maven Central repository, which is considered to be the most significant repository of Java.

Crypto after budget 2022 : How it will impact investors.

2022-02-12T09:30:00.000+05:30

Crypto industry celebrates breakthrough moment, but 30% tax a concern.

In a breakthrough moment for the crypto industry in India, Finance Minister Nirmala Sitharaman said in her budget speech on Tuesday that income from crypto trading would be taxed at 30%. Though her announcement doesn’t make crypto legal, it does give official recognition to these digital assets, bringing much-needed legitimacy to the sector.
For years, there have been reports of an imminent ban on private cryptocurrencies in India but today’s announcement closed that chapter, crypto industry stakeholders, including founders, venture capitalists and policy experts, told. To be sure, several lawyers said the industry remains in a legal grey area, and that only a full-fledged cryptocurrency bill would give these assets full legal status.

What is a virtual asset?

"Virtual assets" means any information or code or number or token (not being Indian currency or any foreign currency) generated through cryptographic means or otherwise, by whatever name called, providing a digital representation of value which is exchanged with or without consideration, with the promise or representation of having inherent value, or functions as a store of value or a unit of account and includes its use in any financial transaction or investment, but not limited to, investment schemes and can be transferred, stored or traded electronically. It also includes Non-Fungible tokens (NFTs) and any other tokens of similar nature.

Is crypto now legal?

“Though the government has recognised that crypto transactions are increasing in number and there is a need to tax the gains from crypto trading, it does not imply that cryptocurrencies are now legal. The Supreme Court in various verdicts has upheld that income from even unlawful or illegal sources must be taxed.” Experts say that while gains from cryptocurrencies will be taxed, the details on its legalities, classification of various cryptos and regulation will only be disclosed in the impending crypto bill.

The long-pending crypto bill was to offer much-needed clarity on cryptocurrency’s legal status in India. “The recognition that is accorded to crypto today, by means of a proposed amendment to the Income Tax Act should actually not be used to infer anything further.” However, a proper definition of cryptocurrencies and amendments to the Income Tax Act further reaffirm that the government would regulate cryptocurrencies, experts said.

“It does suggest that the government will not ban cryptocurrencies but a 30 percent tax and TDS on top of that may mean that the government will probably bring in stringent regulations.”

How will taxation work?

In the Budget memorandum, the government has detailed that a 30 percent flat tax will be applicable to income from virtual digital assets. Unlike gains from equities held for a certain period, gains from crypto trades will not attract different tax slabs based on how long they are held. This will be applicable starting April 1, 2023 and the taxes will be levied from the assessment year FY24.

The memorandum said gains from each asset would be separately taxable and even if in the same year there is a loss on the transfer of digital assets, it cannot be set off.

Why 1% TDS, and its impact

The Finance Minister said 1 percent TDS was being implemented to track crypto transactions so that the government won’t have to depend on crypto exchanges to collect data of each transaction and the volume. Despite the high tax, the industry sees this as a positive sign, drawing comfort from the fact that cryptocurrencies would not be banned and instead would be regulated.

"As of now, we don't see much panic but investors have a mixed response to the announcement. But going forward, maybe we will see an impact on trading volumes if people see more value in buying and holding for longer term. We may see people holding on to their investments rather than selling because selling will attract taxes."

Life after Covid-19 Pandemic.

2022-02-02T07:00:00.001+05:30

"How has the pandemic impacted your career plans and aspirations?"..."Have there been any unexpected positives?".

As a matter of fact, we don’t know how many waves are still out there waiting in a queue but as more and more people are getting vaccinated, one thing is for sure that sooner or later pandemic shall definitely come to an end & all thing’s will be back to the normal again, “Like meals can once again be enjoyed indoors at restaurants, families and friends are celebrating life moments in person, and some businesses are slowly bringing employees back to the office and many more”.

Life after Covid-19 will not only be stretched up to bringing home the beacon, it will embrace a whole new culture in which orthodox thinking will be thrown away, it will be equipped with a new challenges, like a majestic portal which welcomes us into a new world.

Digitalization and virtualization will be the new normal. Different work modes like remote working, hybrid working, and three model workings will be there. While outings along with the terms and conditions a new page describing a long list of precautions will be added. ‘Sustainable, recyclable, hygiene, sanitization’ will be new terms to attract a wide range of customers instead of using traditional terms like ‘discounts, sales’.

Healthy products will be on the shelf, shake hands will be replaced by Namaste, identity proof will be not enough for international tours a document indicating our health status will be mandatory, you may see autonomous machines such as a robot, drones at your services. Opportunities, and venues for sociability will become huge post-Covid.

From a financial and economic perspective, the market will bounce back. Sustainable startups and businesses will go green, green jobs will be created, people will more likely prefer safe investments, long term view.

For a post-Covid lifestyle, we have to be adjustable enough to strike a balance between optimism and pessimism. People are saying that it takes a long time to return to normal life, but there is a twist here. According to me, Life is proportional to the time, like there wasn’t and there will never be such a turn back, where the life you lived in the past will return. Our lifestyle defines our definition of life and circumstances define our lifestyle. Circumstances are never the same and so does life. So basically it’s our call to try on something which is not going to return or better prepare ourselves for the next unknown.

And the natural question that comes to mind is: “Now what?”

We talk about looking for the new normal. We assume things will eventually settle again, but into a new arrangement of reality. That is a reasonable assumption. But what will it look like?

Top 10 In-Demand programming languages to learn in 2022.

2022-01-26T08:00:00.020+05:30

This blog will focus on some of the most in-demand programming languages which will be dominant this year, 2022.

For almost every subject's like Web Development, Artificial Intelligence, Machine Learning, Data Science, or any other, the most important prerequisite is the ability to program in programming languages.

Before choosing a programming language, beginners should carefully consider many factors, including popularity, demand, career opportunities, and applications.

JavaScript

JavaScript is one the most well-known programming languages, with strong demand and a strong following. JavaScript is used by many well-known IT companies such as Uber, Google, Microsoft, Uber, and Microsoft. Although the language is best known for its ability to add responsive elements to web pages, there are many other uses.

The language can be used for both front-end as well as back-end development. Developers find it attractive because of its interoperability with well-known frameworks like Vue, Node, and React.

It seems reasonable to expect JavaScript to continue to dominate the web in 2022, given the number of websites that heavily rely on JavaScript.

Python

Python is the preferred language for anyone who just started programming. It has a simple syntax that is easy for beginners to understand and use. It is used widely in web development, software programming, and many other areas.

The language includes rich library support, automatic garbage collection, improved interaction with other languages, and GUI programming support. Django and Flask and Pyramid are popular Python frameworks that make it easier and more convenient.

C/C++

C++ and C++ are both well-known in the IT industry. They rank at the top of many indices. C/C++ professionals are highly sought after by large IT companies like Adobe, Microsoft, Oracle, Microsoft, and Nvidia.

C is a general-purpose procedural language used for creating low-level systems like operating systems, kernel programming, and other applications. Many other programming languages can borrow from the characteristics of this language.

C++ is a programming language that emphasizes objects and was originally developed to extend C. It is widely used in many industries including competitive programming, GUI, desktop, and game development.

Java

The object-oriented programming languages implement Java’s well-known concept of write once, run everywhere. This allows Java programs to run on any system that supports Java, without the need for recompilation.

It is used in creating Android apps, web, desktop, and scientific applications. Top-tier companies like Flipkart and Amazon use Java, which offers attractive job opportunities for Java engineers.

R Language

Many big tech companies like Uber, Google, and Facebook use an R programming language to run their businesses. With the increasing demand for machine learning and data science, it is worth learning the R programming language.

It is an open-source programming platform that includes a wide range of libraries and frameworks. This language is widely used in data science, statistical analysis, and machine learning. GNU/Linux, as well as Microsoft Windows, are suitable for the language.

You can integrate it with many data processing platforms such as Hadoop or Spark. It is a popular language for developers due to its cross-platform compatibility and powerful graphical capabilities.

Kotlin

Kotlin is a general-purpose, statically typed programming language that supports both functional and object-oriented programming. It is compatible with Java and all Java libraries.

The language is easy to learn and can be used to develop Android and online applications. Javalin and KTor are the most widely used Kotlin frameworks. Companies like Netflix, Uber, and other companies have begun to hire Kotlin engineers.

C#

The general-purpose programming language was created by Microsoft primarily for its net framework. It is used extensively in game development as well as creating Windows programs and server-side software.

C# comes with a large library which makes it faster and more efficient to program in. Developers love C#’s structure language. It is also easy to update and scale can be used in component-oriented programming and integrates with the.NET library.

C# is used by Unity game engine developers, as well as organizations like Intellectsoft and Capgemini. This means that there are many opportunities for C# developers.

PHP

Many well-known websites use PHP, such as Facebook, Wikipedia, and WordPress. The open-source server-side scripting language PHP is used for website creation.

It has many characteristics, including cross-platform compatibility and object-oriented programming capabilities. It also allows easy interaction with HTML, CSS, and JavaScript. There’s also a large user community. This language is easy to learn for beginners. Laravel and Symfony are just a few of the popular PHP frameworks that you should consider.

Go

Companies such as Uber and Google use the Go programming language. Google’s Go programming language is statically typed and has a syntax similar to C. Multithreaded, the language can be used in distributed systems, cloud computing, as well as other applications.

The best thing about the language, however, is its ability to overcome many fundamental problems such as slow compilation and execution, a lack of a large standard library, and so forth.

Scala

Scala is used for various platforms and businesses by tech giants like Netflix, Linked In, and eBay. Scala is highly recommended for beginners because of its easy learning. Scala was designed to solve problems that Java developers had with Scala.

It has been a well-known language among developers for a long time. Scala is a general-purpose programming language, which can be used for object-oriented as well as functional programming.

Scala has many distinctive features, such as slow computing, string interpolation, and high scalability. Scala code can also be translated into bytecodes, and run on the Java virtual computer. The language is widely used in web development, data science, and machine learning.

World Blood Donor Day

2021-06-14T06:00:00.002+05:30

World Blood Donor Day (WBDD) is held on June 14 each year. The event was organised for the first time in 2005, by a joint initiative of the World Health Organization, the International Federation of Red Cross and Red Crescent Societies to raise awareness of the need for safe blood and blood products, and to thank blood donors for their voluntary, life-saving gifts of blood. World Blood Donor Day is one of 11 official global public health campaigns marked by the World Health Organization (WHO). On 14 June 2020 WHO and all countries will celebrate World Blood Donor Day.

World Blood Donor Day is celebrated every year by people around the world on June 14. It is celebrated on the birthday anniversary of Karl Landsteiner on June 14, 1868. Landsteiner was awarded the Nobel Prize for his discovery of the ABO blood group system.

Blood is a necessary resource for the planned treatments and the urgent interventions. It is helpful for patients who are suffering from life-threatening conditions for living longer and with a higher quality of life. It supports complex medical and surgical procedures.

The need for safe blood is universal. Safe blood is critical both for treatments and urgent interventions. It can help patients suffering from life-threatening conditions live longer and with a higher quality of life and supports complex medical and surgical procedures. Blood is also vital for treating the wounded during emergencies of all kinds (natural disasters, accidents, armed conflicts, etc.) and has an essential, life-saving role in maternal and neonatal care.

But access to safe blood is still a privilege of the few. Most low- and middle-income countries struggle to make safe blood available because donations are low and equipment to test blood is scarce. Globally, 42% of blood is collected in high-income countries, which are home to only 16% of the world’s population.

An adequate supply of safe blood can only be assured through regular donations by voluntary unpaid blood donors. This is why the World Health Assembly in 2005 designated a special day to thank blood donors and encourage more people to give blood freely. World Blood Donor Day takes place every year on 14 June. As well as thanking blood donors, it is a day to raise awareness about the global need for safe blood and how everyone can contribute.

Blood donations are needed all over the world to ensure individuals and communities have access to safe and quality-assured blood and blood products in both normal and emergency situations. Through the campaign, we call on more people all over the world to become life-savers by volunteering to donate blood regularly.

The day and the theme are also a call to action for governments, national health authorities and national blood transfusion services to provide adequate resources and put in place systems and infrastructures to increase the collection of blood from voluntary, non-remunerated blood donors; to provide quality donor care; to promote and implement appropriate clinical use of blood; and to set up systems for the oversight and surveillance on the whole chain of blood transfusion.

The objectives of this year’s campaign are to:

celebrate and thank individuals who donate blood and encourage more people to start donating;
raise wider awareness of the urgent need to increase the availability of safe blood for use wherever and whenever it is needed to save life;
demonstrate the need for universal access to safe blood transfusion and provide advocacy on its role in the provision of effective health care and in achieving universal health coverage;
mobilize support at national, regional and global levels among governments and development partners to invest in, strengthen and sustain national blood programmes.

Your involvement and support will help to ensure greater impact for World Blood Donor Day 2020, increasing recognition worldwide that giving blood is a life-saving act of solidarity and that services providing safe blood and blood products are an essential element of every health care system. Participation of interested partners is welcome at all levels to make World Blood Donor Day 2020 a success.

International organizations, including the World Health Organization, the International Federation of Red Cross and Red Crescent Societies, the International Federation of Blood Donor Organizations and the International Society of Blood Transfusion, among others, continue to work in close collaboration to provide guidance and support to their membership in this endeavour.

We urge you to join us to make access to safe blood a reality for everyone

What is Armitage and how is it used.

2021-05-16T11:01:00.007+05:30

What is Armitage?

Armitage is a graphical user interface for the Metasploit Framework. At first glance, it may seem that Armitage is just a pretty front-end on top of Metasploit. That’s not quite true. Armitage is a scriptable red team collaboration tool. It has a server component to allow a team of hackers to share their accesses to compromised hosts.

Starting Kali Linux

The best way to start playing with Armitage is to download Kali Linux and run it in a virtual machine. For this guide, you should set your virtual machine to NAT networking. This is necessary because in a moment, I will ask you to download a target virtual machine and set it up.

To login to Kali Linux, use the username root, password toor. To request an IP address via DHCP, type dhclient. To start X Windows, type startx.

Use Java 1.7

Kali Linux ships with Java 1.6 and Java 1.7. Java 1.6 is the default though and for some people–this version of Java makes their menus stick or draw slowly. For the best Armitage experience, you should use Java 1.7. Fortunately, it’s one command to change the default.

If you have 32-bit Kali Linux, open a terminal and type:

update-java-alternatives --jre -s java-1.7.0-openjdk-i386

If you have 64-bit Kali Linux, open a terminal and type:

update-java-alternatives --jre -s java-1.7.0-openjdk-amd64

Installing Armitage

Your version of Kali Linux may not include Armitage. To install it, type:

apt-get install armitage

Next, you need to start the Metasploit service. Armitage does not use the Metasploit service, but starting it once will setup a database.yml file for your system. This is a necessary step. You only need to do this once:

service metasploit start
service metasploit stop

Updating the Metasploit Framework

Use the msfupdate command to update the Metasploit Framework to the latest.

Starting Armitage

Before you can use Armitage, you must start the postgresql database. This does not happen on boot, so you must run this command each time you restart Kali:

service postgresql start

To start Armitage in Kali Linux, open a terminal and type:

armitage

Armitage will immediately pop up a dialog and ask where you would like to connect to. These parameters only matter if you want to connect to an Armitage team server. Since we’re getting started, we don’t care. Just press Connect.

Next, Armitage will try to connect to the Metasploit Framework. Big surprise, the Metasploit Framework is not running. Armitage will realize this and it will ask you if you would like it to start Metasploit for you. The correct answer is Yes. Press this button and wait.

You will see connection refused messages for up to a few minutes. If this is your first time starting the Metasploit Framework, this may take literally a few minutes. The Metasploit Framework is the largest Ruby codebase out there and it takes time to load all of its modules for the first time. Be patient.

If all went well, you will see a GUI that looks like this:

You’re now ready to use Armitage.

A Target

Every attacker needs a target. Since you’re just starting out, I recommend that you set up a target virtual machine made for learning the Metasploit Framework. If you need such a target virtual machine, look no further than Metasploitable 2.

Metasploitable 2 is a virtual machine maintained by the Metasploit project team. It’s an Ubuntu server with a lot of services and vulnerabilities.

You can download Metasploitable 2 at:

http://sourceforge.net/projects/metasploitable/files/Metasploitable2/

Set this virtual machine up. Make sure you set the networking for this virtual machine to NAT or host-only. You do not want to expose this virtual machine to the internet.

To learn its IP address, login as user msfadmin, password msfadmin when this virtual machine starts up. Type ifconfig to see the network configuration for this virtual machine. Once you have an IP address for this system, you’re now to ready to attack it.

Now, go RTFM

The Metasploit Framework has a lot of jargon and Armitage has a lot of conventions associated with it. Now that you’re up and running, I recommend that you take a few minutes and read the Armitage manual. You can skip the Getting Started portion if you like. Pay special attention to section 1.4 which details some of the vocabulary around the Metasploit Framework. I also recommend that you read the User Interface Tour, Exploitation, and Post Exploitation chapters.

The Armitage manual is not a tutorial, but it will help orient you around the tool. You want this orientation, because in the next part of this guide, you will attack the Metasploitable Virtual Machine that you setup a moment ago.

Armitage Labs:-

I spend a lot of time teaching folks how to use Armitage and its big brother Cobalt Strike. To start out right, I have my students go through several labs designed to help them experience the conventions in the Metasploit Framework first hand. Work through these labs and you will start to develop a mental model of what the Metasploit Framework can do and how it’s organized.

Scan

Go to Hosts -> Nmap Scan -> Intense Scan, all TCP ports
Type the IP address of the Metasploitable Virtual Machine
Wait for the scan to complete. It will take some time.
Right-click the Metasploitable host and select Services

Exploit

Go to Attacks -> Find Attacks
Wait for Attack Analysis complete dialog.
Right-click the Metasploitable host and try various items from the Attack menu until one works. Something is bound to work.Right-click the Metasploitable host and select Shell 1 -> Interact. If you have a Meterpreter 1 menu, then keep searching. Meterpreter is a great post-exploitation tool, but we’re not ready to talk about it yet. Find an exploit that yields a shell.
Type: whoami and press enter in the new Shell 1 tab.

Brute Force VNC

Select the Metasploitable host in the target area
Navigate to auxiliary -> scanner -> vnc -> vnc_login in the module browser. Double-click this module.
Press Launch
Open a Terminal and type: vncviewer metasploitable IP:5900. Use the password vnc_login helped you discover to connect.

Tomcat Manager Deploy Exploit

Select the Metasploitable host in the target area
Navigate to auxiliary-> scanner -> http -> tomcat_mgr_login in the module browser. Double-click this module.
Double-click the RPORT value and change it to the correct port. Take a look at the services on the system. Which port is running Apache Tomcat?
Press Launch
Navigate to exploit -> multi -> http -> tomcat_mgr_deploy in the module browser. Double-click this module
Change RPORT, USERNAME, and PASSWORD to their correct values. Step 4 should have yielded a valid username and password for you.
Press Launch

Brute Force

Metasploit modules ending with _login are usually able to brute force credentials. Try mapping one of the open services to its login module and follow these steps:

Type _login in the search box below the module browser
Launch the *_login module you’re interested in. Type _login in the box below the module browser to search for these modules
Find the USER_FILE option and double-click the black square. The black square indicates that there is a helper dialog to set this option
Double-click on the wordlists folder
Choose the unix_users.txt file
Set the PASSWORD option to something silly, such as password. Or, set PASS_FILE to a juicy looking file (but then expect this to take a long time)
Press Launch How many weak accounts did you find?

Postgres Ownership

Not all vulnerabilities will yield a shell. That’s OK. Sometimes there are other great opportunities:

Try to brute force credentials to the postgres database running on the system
Use the results of step 1 to read the contents of /etc/passwd through the postgres database. Hint: search for any postgres related modules. There may be one that can help you.

Before You Begin:-

Before you dive into Armitage, there’s a few things that you should know. While it’s possible to learn some basic tutorials in Armitage with little to no background in penetration testing, I’d highly recommend starting with Metasploit. If you’re not aware of Metasploit yet, understand that it is a console-driven application that requires working from the command line. Armitage does help alleviate some of this burden with graphical images, but you still need to know how to work from the command line to be a competent user.

Also, you need to be aware of how the Metsaploit framework is organized, particularly regarding its modules. After entering Metasploit, you can type help to view the modules included in the software. Every component of the software (and by extension, every component of Armitage) is divided up into modules – be it a scanning utility, malicious payload, or exploit.

Whenever you want to exploit a vulnerability on a given host, you first need to establish a connection with that host, which is called a session. Armitage is built to know how to handle sessions, and organizes sessions with graphics built on top of Meterpreter.

Meterpreter, however, is the portion of the code that allows you to run various operations on an exploited system.

Navigating User Interface:-

At first glance, the Armitage user interface can be pretty intimidating. But it really isn’t that complicated. There are basically three main areas of the user interface, which include the targets pane, the modules pane, and tabs on the bottom that provide access to the command line.

First off, let’s start with the modules pane on the left side. You’ll notice that it uses a tree structure much like a file system. It’s in this pain that you can find the module that allow you to execute a payload, exploit a system, and run various post-exploitation operations. Simply double click on the desired module to open a dialog, and Armitage will do the heavy lifting for you by configuring the module to target specified hosts.

Next, locate the main graphical window pane. Depending on the type of host (operating system, device type, etc.), Armitage will populate a different image. If you see an icon in red with electric tendrils, you are looking at a host in the graphical interface that has been successfully exploited. However, green lines between systems indicate a pivot, which just means you can use the exploited host to launch attacks on other systems. To select a host, simply left click on its icon. To select multiple systems, simply hold down the left mouse button and drag the mouse over all the systems you wish to select.

In addition, you can right click on a host to pull up a menu that will help you edit settings, login parameters, session options, and detailed information about the host in question. However, you won’t be able to see the login menu unless you have already used Metasploit to scan the host and identified open sockets on the remote system.

Also, depending on the type of computer you’re running Armitage on, you may want to select different hotkeys (or view them in the first place). To do so, simply click on the Armitage menu in the top left of the window, and then click on “Preferences.” You’ll then be able to see all of the currently configured hotkeys and their default values.

Setting Targets:-

Armitage’s strength (e.g. visualizing targets and hosts) is also its weakness. If you are trying to work with too many hosts, the GUI pane can become extremely cluttered, messy, and overwhelming. Fortunately, you can set target hosts via a table view. Simpy click on the Armitage menu in the top left, click on “Set Target View,” and then click on “Table View.” This will allow you to view and set target hosts with an interface that looks more like a clean spreadsheet.

Navigating the Bottom Pane: Tabs and Consoles

It’s also possible to open up multiple tabs in the bottom pane that will allow you to enter Metasploit commands and shell code. By right clicking on a tab, you can undock the tab into its own window for better management. In addition, you can move the sequence of tabs like you would in a web browser, and exit them by clicking on the “x.”

More interesting, however, is the fact that both Meterpreter and Metasploit occupy tabs in the interface. Those of you who have run Metasploit from the command line will feel at home in this pane, since each tab is essentially its own shell environment.

Importing Hosts:-

One of the great feature that makes Armitage so darn powerful is its ability to interface with other applications’ data – especially to important host data from other sources. It supports most of the popular scanners, so if you don’t want to run scans in Armitage, or just want to import data from a previous scan, you can load masses of data in a few quick seconds.

Some of the most popular scanners that it interfaces well with include Amap, NMAP, OpenVAS, and Nessus, though it also support IP360, Burp, NeXpose, Qualys, and several others. If you want to add a set of hosts from another scanner, simply click on the Hosts menu at the top and then click on the “Import Hosts” option.

Finding Exploits:-

Finding ways to exploit systems is no easy task. There are a number of countermeasures designed to mitigate the threat of exploitation, such as firewalls, code updates, and other similar tools. It’s almost more of an art than a science, and things are always changing. Some exploits are extremely temporal because antivirus and operating system developers are always trying to plug up the holes as quickly as possible.

And if you’re new to Metasploit or Armitage, it’s tough getting started if you aren’t aware of any existing exploits. The good news is that Armitage comes equipped with tools tools to help you find the latest and greatest system vulnerabilities. Basically, Armitage will create a session with a target host, and run some scanning and code-verification and checking utilities to gather information about the target. Then, it will list all known exploits, in much the same way as OpenVAS and Nessus scan for vulnerabilities.

To do a little bit of investigative work, click on a host’s icon, and then browse through the different protocols. For instance, one protocol listed for a host may be FTP. From the FTP menu, look for the very last option, labeled “Check exploits.” In the resulting output, simply check for exploits that are listed as “vulnerable.” You can use ctrl + f to easily find vulnerabilities and simplify the process.

Running an Exploit:-

You can also click on the Attacks menu and then click on “Find Attacks” to browse through the different attack modules residing in Armitage. If you have already checked to see that a system is vulnerable to a certain exploit, simply right click on a host’s icon, click on the “Attack” menu, and then select the exploit you wish to run.

It’s also worth noting that Armitage contains a ranking system for exploits, and by default, will only show exploits with a rank of “great.” You can click on the Armitage menu and then click on “Set Exploit Rank” so that the GUI interface populates exploits with a rank of “good.”

Why is May 1 celebrated as 'Maharashtra Day' and 'Gujarat Day'?

2021-05-01T06:00:00.002+05:30

The whole world celebrates May 1 as an International Labour day; however, very few people know that May 1 is also celebrated as 'Maharashtra Day' and 'Gujarat Day'. The first day of May is significant for both the states as it was on May 1 when both the existing states of Maharashtra and Gujarat were formed. Therefore, even if the whole world celebrates May 1 as Labour Day, the people of Maharashtra and Gujarat celebrate a much bigger event.

The entire globe celebrates the 1st of May as International Labour Day every year. However, many are unaware that the 1st of May is also celebrated as 'Maharashtra Day' and Gujarat Day'. The day is significant for both the states, that is Maharashtra as well as Gujarat as on the first of May, both the states were formed. Read on to know more details about Maharashtra Day and Gujarat Day:

Formation of Maharashtra Day and Gujarat Day

The reason why people celebrate the first of May is celebrated as Maharashtra Day and Gujarat Day is the date of the formation of the states. On the first of May, the existing state of Maharashtra was formed. Before the establishment of the state, then known as Bombay, people from this region communicated in several languages like Marathi, Kutchi, Gujarati, and Konkani. However, later, The Sanyukt Maharashtra Andolan put forth their demand of forming a separate state.

There were various protests held with aims to fulfil their demand. The protest continued till the year 1960 and finally, in the same year, that is 1960, an act was passed by the Parliament of India. The act was called the Bombay Reorganization Act and it was passed with aims to divide the multilingual state of existing Mumbai, then known as Bombay, into two states Gujarat and Maharashtra. The act was passed and legislation became effective on the first of May, 1960.

History's roll in making of Gujarat and Maharashtra:

The reason why May 1 is celebrated as Maharashtra Day and Gujarat Day in both the respective states is that on this day, 57 years ago, the existing state of Maharashtra was formed. The then Bombay had people speaking various languages like Marathi, Gujarati, Kutchi, and Konkani, however, it did not work out. And, the Sanyukt Maharashtra Andolan began demanding a separate state.

The protest continued till 1960 and in the same year, the Bombay Reorganization Act was passed by India's Parliament to divide the multilingual state of Bombay into Gujarat and Maharashtra. The legislation came into effect on May 1, 1960.

Here's how Maharashtra and Gujarat Day is celebrated:

Maharashtra Day is celebrated with a parade at Shivaji Park, Dadar. The state governor, state reserve police force, Mumbai police, etc are all a part of the parade. Various cultural events also take place across Maharashtra. The day is also seen as a public holiday and all the schools, bank, government offices remain closed. Many notable personalities with the academic background, police officials, sportsmen, and doctors are awarded for their notable contribution.

In Gujarat, the day is celebrated across the state with parades and other government events. The parade takes place on the Sabarmati Waterfall in Ahmadabad.

May 1 is celebrated as Maharashtra Day and Gujarat Day. In 1960, the Bombay Reorganization Act was passed by India’s Parliament to divide the multilingual state of Bombay into Gujarat and Maharashtra. The legislation came into effect on May 1, 1960. The state of Bombay formerly comprised of speakers of different languages such as Marathi, Gujarati, Konkani, and Kutchi. During the mid-1950s, a movement known as the Samyukta Maharashtra Samiti started demanding a separate Marathi-speaking state while Mahagujarat Movement aimed at the formation of a state for Gujarati-speaking people. The movements ended with the creation of the Bombay Reorganization Act. The States Reorganisation Act, 1956 defined boundaries for the states within India on the basis of languages. The was at the forefront of the movement to divide the Bombay State into two states; one composed of areas where people primarily spoke Gujarati and Kutchhi and the other where people primarily spoke Marathi and Konkani. The state of Maharashtra and Gujarat were formed as a result of the Sanyukta Maharashtra Samiti movement according to the Bombay Reorganisation Act, 1960 enacted by the Parliament of India on 25 April 1960. The act came into effect on 1 May 1960, hence the reason of annual celebration. Maharashtra: Chief Minister: Devendra Fadnavis Governor: CH Vidyasagar Rao Capital: Mumbai Gujarat: Chief Minister: Vijay Rupani Governor: Om Prakash Kohli Capital: Gandhinagar

The Importance Of POSITIVITY.

2021-04-26T09:30:00.001+05:30

Life Lesson:

"Life is really simple, but we insist on making it complicated."

Positive thinking doesn't mean that you keep your head in the sand and ignore life's less pleasant situations. Positive thinking just means that you approach unpleasantness in a more positive and productive way. You think the best is going to happen, not the worst.

Positive thinking often starts with self-talk. Self-talk is the endless stream of unspoken thoughts that run through your head. These automatic thoughts can be positive or negative. Some of your self-talk comes from logic and reason. Other self-talk may arise from misconceptions that you create because of lack of information.

If the thoughts that run through your head are mostly negative, your outlook on life is more likely pessimistic. If your thoughts are mostly positive, you're likely an optimist someone who practices positive thinking.

The health benefits of positive thinking:-

Researchers continue to explore the effects of positive thinking and optimism on health. Health benefits that positive thinking may provide include:

Increased life span
Lower rates of depression
Lower levels of distress
Greater resistance to the common cold
Better psychological and physical well-being
Better cardiovascular health and reduced risk of death from cardiovascular disease
Better coping skills during hardships and times of stress

It's unclear why people who engage in positive thinking experience these health benefits. One theory is that having a positive outlook enables you to cope better with stressful situations, which reduces the harmful health effects of stress on your body.

It's also thought that positive and optimistic people tend to live healthier lifestyles — they get more physical activity, follow a healthier diet, and don't smoke or drink alcohol in excess.

A positive attitude is not just about sporting that smile on your face every time, it is more than that. It is about maintaining that optimistic mindset and attitude even when things are in utter chaos. It is often said that what good or bad diet does to your body, positive and negative thoughts do the same to your mind! Feed your mind with positive thoughts and you will see amazing changes around you.

When you start thinking optimistically, your mind becomes clear of any negative thoughts and you will see the world in a new light. You will stop blaming yourself or others. You will be in total control of your emotions and try to seek a valuable lesson in every setback you experience.

Identifying negative thinking:-

Not sure if your self-talk is positive or negative? Some common forms of negative self-talk include:

Filtering. You magnify the negative aspects of a situation and filter out all of the positive ones. For example, you had a great day at work. You completed your tasks ahead of time and were complimented for doing a speedy and thorough job. That evening, you focus only on your plan to do even more tasks and forget about the compliments you received.
Personalizing. When something bad occurs, you automatically blame yourself. For example, you hear that an evening out with friends is canceled, and you assume that the change in plans is because no one wanted to be around you.
Catastrophizing. You automatically anticipate the worst. The drive-through coffee shop gets your order wrong and you automatically think that the rest of your day will be a disaster.
Polarizing. You see things only as either good or bad. There is no middle ground. You feel that you have to be perfect or you're a total failure.

Focusing on positive thinking:-

You can learn to turn negative thinking into positive thinking. The process is simple, but it does take time and practice — you're creating a new habit, after all. Here are some ways to think and behave in a more positive and optimistic way:

Identify areas to change. If you want to become more optimistic and engage in more positive thinking, first identify areas of your life that you usually think negatively about, whether it's work, your daily commute or a relationship. You can start small by focusing on one area to approach in a more positive way.
Check yourself. Periodically during the day, stop and evaluate what you're thinking. If you find that your thoughts are mainly negative, try to find a way to put a positive spin on them.
Be open to humor. Give yourself permission to smile or laugh, especially during difficult times. Seek humor in everyday happenings. When you can laugh at life, you feel less stressed.
Follow a healthy lifestyle. Aim to exercise for about 30 minutes on most days of the week. You can also break it up into 10-minute chunks of time during the day. Exercise can positively affect mood and reduce stress. Follow a healthy diet to fuel your mind and body. And learn techniques to manage stress.
Surround yourself with positive people. Make sure those in your life are positive, supportive people you can depend on to give helpful advice and feedback. Negative people may increase your stress level and make you doubt your ability to manage stress in healthy ways.
Practice positive self-talk. Start by following one simple rule: Don't say anything to yourself that you wouldn't say to anyone else. Be gentle and encouraging with yourself. If a negative thought enters your mind, evaluate it rationally and respond with affirmations of what is good about you. Think about things you're thankful for in your life.

Practicing positive thinking every day:-

If you tend to have a negative outlook, don't expect to become an optimist overnight. But with practice, eventually your self-talk will contain less self-criticism and more self-acceptance. You may also become less critical of the world around you.

When your state of mind is generally optimistic, you're better able to handle everyday stress in a more constructive way. That ability may contribute to the widely observed health benefits of positive thinking.

What is Wireshark & how is it used.

2021-04-13T09:30:00.088+05:30

Wireshark is the world's leading network traffic analyzer, and an essential tool for any security professional or systems administrator. This free software lets you analyze network traffic in real time, and is often the best tool for troubleshooting issues on your network.

Common problems that Wireshark can help troubleshoot include dropped packets, latency issues, and malicious activity on your network. It lets you put your network traffic under a microscope, and provides tools to filter and drill down into that traffic, zooming in on the root cause of the problem. Administrators use it to identify faulty network appliances that are dropping packets, latency issues caused by machines routing traffic halfway around the world, and data exfiltration or even hacking attempts against your organization.

Wireshark is a powerful tool that requires sound knowledge of networking basics. For most modern enterprises, that means understanding the TCP/IP stack, how to read and interpret packet headers, and how routing, port forwarding, and DHCP work, for example.

What does Wireshark do?

Wireshark intercepts traffic and converts that binary traffic into human-readable format. This makes it easy to identify what traffic is crossing your network, how much of it, how frequently, how much latency there is between certain hops, and so forth.

While Wireshark supports more than two thousand network protocols, many of them esoteric, uncommon, or old, the modern security professional will find analyzing IP packets to be of most immediate usefulness. The majority of the packets on your network are likely to be TCP, UDP, and ICMP.

Given the large volume of traffic that crosses a typical business network, Wireshark's tools to help you filter that traffic are what make it especially useful. Capture filters will collect only the types of traffic you're interested in, and display filters will help you zoom in on the traffic you want to inspect. The network protocol analyzer provides search tools, including regular expressions and colored highlighting, to make it easy to find what you're looking for.

Sometimes the best way to find anomalous traffic is to capture everything and establish a baseline.

History of Wireshark

Wireshark has been around since 1998, when it was invented by Gerald Combs and called Ethereal. Over the years it has received gargantuan amounts of community support and patches, and is widely accepted as the de facto network protocol analyzer available today.

Wireshark runs on all the major and most minor operating systems, including the usual Linux distros, Windows, OS X, FreeBSD, NetBSD, and OpenBSD. The program is free software, licensed GPL, and is thus free to use, share, and modify.

Wireshark as a learning tool

There are so many hands-on uses for Wireshark that it's easy to overlook what an effective learning tool it can be. Lifting up the hood of a car is the best way to understand how an internal combustion engine works, and likewise lifting the lid on network traffic and watching packets fly by — even drilling down to the byte level, and examining TCP headers — is a powerful way to learn, and teach others how the internet works.

Demystifying the motor that runs our information economy can only lead to better-informed business decisions and better government policy, not to mention a better-qualified workforce. Wireshark is already a staple of classroom curricula in many training settings, but the docs are complete enough at this point that an eager learner can easily download the network protocol analyzer, sniff their local wifi access point, and start examining traffic.

What Is Wireshark?

Wireshark is a network protocol analyzer, or an application that captures packets from a network connection, such as from your computer to your home office or the internet. Packet is the name given to a discrete unit of data in a typical Ethernet network.

Wireshark is the most often-used packet sniffer in the world. Like any other packet sniffer, Wireshark does three things:

Packet Capture: Wireshark listens to a network connection in real time and then grabs entire streams of traffic – quite possibly tens of thousands of packets at a time.
Filtering: Wireshark is capable of slicing and dicing all of this random live data using filters. By applying a filter, you can obtain just the information you need to see.
Visualization: Wireshark, like any good packet sniffer, allows you to dive right into the very middle of a network packet. It also allows you to visualize entire conversations and network streams.

Viewing a packet capture in Wireshark

Packet sniffing can be compared to spelunking – going inside a cave and hiking around. Folks who use Wireshark on a network are kind of like those who use flashlights to see what cool things they can find. After all, when using Wireshark on a network connection (or a flashlight in a cave), you’re effectively using a tool to hunt around tunnels and tubes to see what you can see.

What Is Wireshark Used For?

Wireshark has many uses, including troubleshooting networks that have performance issues. Cybersecurity professionals often use Wireshark to trace connections, view the contents of suspect network transactions and identify bursts of network traffic. It’s a major part of any IT pro’s toolkit – and hopefully, the IT pro has the knowledge to use it.

When Should Wireshark Be Used?

Wireshark is a safe tool used by government agencies, educational institutions, corporations, small businesses and nonprofits alike to troubleshoot network issues. Additionally, Wireshark can be used as a learning tool.

Those new to information security can use Wireshark as a tool to understand network traffic analysis, how communication takes place when particular protocols are involved and where it goes wrong when certain issues occur.

Of course, Wireshark can’t do everything.

First of all, it can’t help a user who has little understanding of network protocols. No tool, no matter how cool, replaces knowledge very well. In other words, to properly use Wireshark, you need to learn exactly how a network operates. That means, you need to understand things such as the three-way TCP handshake and various protocols, including TCP, UDP, DHCP and ICMP.

Second, Wireshark can’t grab traffic from all of the other systems on the network under normal circumstances. On modern networks that use devices called switches, Wireshark (or any other standard packet-capturing tool) can only sniff traffic between your local computer and the remote system it is talking to.

Third, while Wireshark can show malformed packets and apply color coding, it doesn’t have actual alerts; Wireshark isn’t an intrusion detection system (IDS).

Fourth, Wireshark can’t help with decryption with regards to encrypted traffic.

And finally, it is quite easy to spoof IPv4 packets. Wireshark can’t really tell you if a particular IP address it finds in a captured packet is a real one or not. That requires a bit more know-how on the part of an IT pro, as well as additional software.

Common Wireshark Use Cases

Here’s a common example of how a Wireshark capture can assist in identifying a problem. The figure below shows an issue on a home network, where the internet connection was very slow.

As the figure shows, the router thought a common destination was unreachable. This was discovered by drilling down into the IPv6 Internet Message Control Protocol (ICMP) traffic, which is marked in black. In Wireshark, any packet marked in black is considered to reflect some sort of issue.

Drilling down into a packet to identify a network problem using Wireshark

In this case, Wireshark helped determine that the router wasn’t working properly and couldn’t find YouTube very easily. The problem was resolved by restarting the cable modem. Of course, while this particular problem didn’t necessitate using Wireshark, it’s kind of cool to authoritatively finalize the issue.

When you take another look at the bottom of Figure , you can see that a specific packet is highlighted. This shows the innards of a TCP packet that is part of a transport layer security (TLS) conversation. This is a great example of how you can drill down into the captured packet.

Using Wireshark doesn’t allow you to read the encrypted contents of the packet, but you can identify the version of TLS the browser and YouTube are using to encrypt things. Interestingly enough, the encryption shifted to TLS version 1.2 during the listening.

Wireshark is often used to identify more complex network issues. For example, if a network experiences too many retransmissions, congestion can occur. By using Wireshark, you can identify specific retransmission issues, as shown below in Figure.

Viewing packet flow statistics using Wireshark to identify retransmissions

By confirming this type of issue, you can then reconfigure the router or switch to speed up traffic.

How to Use Wireshark

You can download Wireshark for free at www.wireshark.org. It’s also freely available, as an open source application under the GNU General Public License version 2.

How to Install Wireshark on Windows

If you’re a Windows operating system user, download the version appropriate for your particular version. If you use Windows 10, for example, you’d grab the 64-bit Windows installer and follow the wizard to install. To install, you’ll need administrator permissions.

How to Install Wireshark on Linux

If you have a Linux system, you’d install Wireshark using the following sequence (notice that you’ll need to have root permissions):

$ sudo apt-get install wireshark

$ sudo dpkg-reconfigure wireshark-common

$ sudo usermod -a -G wireshark $USER

$ newgrp wireshark

Once you have completed the above steps, you then log out and log back in, and then start Wireshark:

$ wireshark &

How to Capture Packets Using Wireshark

Once you’ve installed Wireshark, you can start grabbing network traffic. But remember: To capture any packets, you need to have proper permissions on your computer to put Wireshark into promiscuous mode.

In a Windows system, this usually means you have administrator access.
In a Linux system, it usually means that you have root access.

As long as you have the right permissions, you have several options to actually start the capture. Perhaps the best is to select Capture >> Options from the main window. This will bring up the Capture Interfaces window, as shown below in Figure.

The Capture Interfaces dialog in Wireshark

This window will list all available interfaces. In this case, Wireshark provides several to choose from.

For this example, we’ll select the Ethernet 3 interface, which is the most active interface. Wireshark visualizes the traffic by showing a moving line, which represents the packets on the network.

Once the network interface is selected, you simply click the Start button to begin your capture. As the capture begins, it’s possible to view the packets that appear on the screen, as shown in Figure, below.

Wireshark capturing packets

Once you have captured all the packets that you want, simply click the red, square button at the top. Now you have a static packet capture to investigate.

What the Color Coding Means in Wireshark

Now that you have some packets, it’s time to figure out what they mean. Wireshark tries to help you identify packet types by applying common-sense color coding. The table below describes the default colors given to major packet types.

Color in Wireshark	Packet Type
Light purple	TCP
Light blue	UDP
Black	Packets with errors
Light green	HTTP traffic
Light yellow	Windows-specific traffic, including Server Message Blocks (SMB) and NetBIOS
Dark yellow	Routing
Dark gray	TCP SYN, FIN and ACK traffic

The default coloring scheme is shown below in Figure. You can view this by going to View >> Coloring Rules.

Default coloring rules

You can even change the defaults or apply a custom rule. If you don’t want any coloring at all, go to View, then click Colorize Packet List. It’s a toggle, so if you want the coloring back, simply go back and click Colorize Packet List again. It’s possible, even, to colorize specific conversations between computers.

In Figure below, you can see standard UDP (light blue), TCP (light purple), TCP handshake (dark gray) and routing traffic (yellow).

Viewing colorized packets in Wireshark

However, you’re not limited to just interpreting by color. It’s possible to view the input/output (I/O) statistics of an entire packet capture.

In Wireshark, just go to Statistics >> I/O Graph, and you’ll see a graph similar to the one shown in Figure.

Viewing the input/output traffic graph in Wireshark

This particular graph is showing typical traffic generated by a home office. The spikes in the graph are bursts of traffic that were caused by generating a Distributed Denial of Service (DDoS) attack using a few Linux systems.

In this case, three major traffic bursts were generated. Many times, cybersecurity pros use Wireshark as a quick and dirty way to identify traffic bursts during attacks.

It’s also possible to capture the amount of traffic generated between one system and another. If you go to Statistics and then select Conversations, you will see a summary of conversations between end points, as shown below in Figure.

Viewing endpoint conversations in Wireshark

In the above case, Wireshark was used to see if an old piece of equipment from MCI communications that was running on a client’s network could be traced.

It turned out that the client didn’t know this device was even on the network. Thus, it was removed, helping to make the network a bit more secure. Notice, also, that this network connection is experiencing a lot of traffic to Amazon (administering a server in AWS at the time) and Box.com (using Box for system backup at the time).

In some cases, it is even possible to use Wireshark to identify the geographic location of source and destination traffic. If you click on the Map button at the bottom of the screen (shown in Figure above), Wireshark will show you a map (Figure ), providing its best guess of the location of the IP addresses you’ve identified.

Viewing geographic estimations in Wireshark

Because IPv4 addresses can be easily spoofed, you can’t rely completely on this geographical information. But it can be fairly accurate.

How to Filter and Inspect Packets in Wireshark

You can apply Wireshark filters in two ways:

In the Display Filter window, at the top of the screen
By highlighting a packet (or a portion of a packet) and right-clicking on the packet

Wireshark filters use key phrases, such as the following:

ip.addr	Specifies an IPv4 address
ipv6.addr	Specifies an IPv6 address
src	Source - where the packet came from
dst	Destination - where the packet is going

You can also use the following values:

&&	Means “and,” as in, “Choose the IP address of 192.168.2.1 and 192.168.2.2”
==	Means “equals,” as in “Choose only IP address 192.168.2.1”
!	Means “not,” as in, do not show a particular IP address or source port

Valid filter rules are always colored green. If you make a mistake on a filter rule, the box will turn a vivid pink.

Let’s start with a couple of basic rules. For example, let’s say you want to see packets that have only the IP address of 18.224.161.65 somewhere inside. You would create the following command line, and put it into the Filter window:

ip.addr == 18.224.161.65

Figure shows the results of adding that filter:

Applying a filter to a capture in Wireshark

Alternatively, you can highlight the IP address of a packet and then create a filter for it. Once you select the IP address, right-click, and then select the Apply As Filter option.

You’ll then see a menu of additional options. One of those is called Selected. If you choose Selected, then Wireshark will create a filter that shows only packets with that IP address in it.

You can also decide to filter out a specific IP address using the following filter, also shown in Figure

!ip.addr==18.224.161.65

Filtering out a specific IP address in Wireshark

You’re not limited to just IPv4 addresses. For example, if you want to see if a particular computer is active and using an IPv6 address on your network, you can open up a copy of Wireshark and apply the following rule:

ipv6.dst == 2607:f8b0:400a:15::b

This same rule is shown in Figure.

Applying an IPv6 filter in Wireshark

Clearly, this system is alive and well, talking on the network. There are so many possibilities.

Additional filters include:

tcp.port==8080	Filters packets to show a port of your own choosing – in this case, port 8080
!(ip.src == 162.248.16.53)	Shows all packets except those originating from 162.248.16.53
!(ipv6.dst == 2607:f8b0:400a:15::b)	Shows all packets except those going to the IPv6 address of 2607:f8b0:400a:15::b
ip.addr == 192.168.4.1 && ip.addr == 192.168.4.2	Shows both 192.168.4.1 and 192.168.4.2
http.request	Shows only http requests – useful when troubleshooting or visualizing web traffic

Time is the Best Healer.

2021-04-04T09:30:00.002+05:30

"TIME HEALS EVERYTHING."

We get to listen this (‘time is a great healer’) very frequently in our lives. Every time, we face an emotional injury, people who have seen lives and been through such situations suggest us not to be bothered, further telling us that time will heal our pain.

There is nothing that time can’t heal thus time is the best healer. Time teaches us to forget and forgive and go beyond the damage that has happened to us. It is said that out of sight and out of mind. Time takes us for a journey from the space where the bitter incidents took place and leave us in a new space of happiness. It is because of the time and passing of the time we are able to come out of the most difficult days in our life and being able to lead a happy life once again.

When we have difficult days ahead we would be thinking we can’t handle it anymore, we can’t carry it further and we would be thinking to annul everything but the days of hope and happiness are not far away. What we need to do is that give time its space to work and thus we are assured with great miracles. Many a time what we feel is that we can’t come out of our bad time and it is the end of everything but still there remains hope and time to have wonders happening.

We all are travelling in a vehicle called time, time the vehicle won’t leave us anywhere and go, and definitely it would take us to some beautiful avenues. Give time its space to work; we shall not be in a hurry for fortunes to happen, however, in fullness of time everything would happen.

I believe time can heal. Most unhappy experiences that happened to me seemed terrible at the time, but as time went by, I realized that I not only no longer felt sad but also learned valuable lessons.

Time is like a stream of water that gently runs through the wound deep in my mind, kisses it and washes it away. And at the end, it leaves something valuable to remind me just as a scar does. Without encountering those depressing experiences, I wouldn't live the way I am today.

It's no doubt that everyone has his or her own sadness to grieve, such as having memories of being humiliated, injured or hurt emotionally. I remembered that when I received my college entrance examination result I was shocked at the moment because my score was much lower than my expectation. As a result, it's certain that I would not be able to attend my dream university. I was heartbroken that time and cried again and again. However, I no longer feel the same way today and I have put all the sadness behind me. Three years have passed by from that day, for now I do well in my present university and I realize that what matters most is my persistence to work hard and a good work ethic. Bumping into many walls in life allows me to grow up, reflect on myself, and learn to survive in this society.

I believe time is the best medicine for healing my mind. Although the process is painful, I can meditate my past and learn a lot from it. Life is tough, but only by extracting precious inspirations from the unfortunate experiences can I really grow up and shape my minds even tougher than life. Caterpillar must endure a process of struggle before it becomes a beautiful butterfly - and the process, it's about time.

Holi – India’s Festival of Colour

2021-03-28T18:30:00.002+05:30

Holi, Festival of Colours

Holi is a Hindu spring celebration celebrated in the Indian subcontinent, otherwise called the "celebration of hues" or the "celebration of affection". The celebration means the triumph of good finished underhandedness, the entry of spring, end of winter, and for some, a bubbly day to meet others, play and snicker, overlook and pardon, and repair broken connections. It is additionally celebrated as a thanksgiving for a decent reap. It goes on for a night and a day, beginning on the night of the Purnima (Full Moon day) falling in the month of Phalguna, which falls somewhere close to the finish of February and the center of March in the Gregorian date-book. The primary night is known as Holika Dahan or Chhoti Holi and the next day as Holi, Rangwali Holi, Dhuleti, Dhulandi, or Phagwah.

Holi is an essential spring celebration for Hindus, a national occasion in India, a provincial occasion in Nepal and different nations. To numerous Hindus and some non-Hindus, it is a perky social occasion and a reason to toss shaded water at companions or outsiders jokingly. It is along these lines watched extensively in the Indian subcontinent.

The celebration has numerous reasons, most noticeably, it commends the start of Spring. In seventeenth century writing, it was recognized as a celebration that praised agribusiness, remembered great spring harvests and the prolific land. Hindus trust it is a period of making the most of spring's bounteous hues and saying goodbye to winter. To numerous Hindus, Holi celebrations stamp the start of the new year and also an event to reset and recharge burst connections, end clashes and free themselves of gathered passionate polluting influences from the past.

Significance of bonfire for Holi and Story of Holika

Holi is spread out over two days. On the first day, bonfire is created and on the second day, holi is played with colors and water. In some places, it is played for five days, the fifth day is called Ranga Panchami. Holi bonfire is known as Holika Dahan also Kamudu pyre is celebrated by burning Holika, the devil. For many traditions in Hinduism, Holi celebrates the death of Holika in order to save Prahlad, and thus Holi gets its name. In olden days, people use to contribute a piece of wood or two for Holika bonfire.

Holika

Holika (होलिका) was a demoness in Hindu Vedic scriptures, who was burnt to death with help of God Vishnu. She was the sister of King Hiranyakashipu and aunt of Prahlad.
The story of Holika dahan (Holika’s death) signifies the triumph of good over evil. Holika is associated with the annual bonfire on the night before Holi, the Hindu festival of colors.

According to Bhagavat purana, there was a king named Hiranyakashipu who, like a lot of demons and Asuras, had the intense desire to be immortal. To fulfill this desire he performed the required Tapas (penance) until he was granted a boon by Brahma. Since the God’s do not usually grant the boon of immortality, he used his guile and cunning to get a boon which he thought made him immortal. The boon gave Hiranyakashyapu five special powers: he could be killed by neither a human being nor an animal, neither indoors nor outdoors, neither at day nor at night, neither by astra (weapons that are launched) nor by any shastra (weapons that are hand held), and neither on land nor in water or air. As this wish was granted, Hiranyakashyapu felt he was invincible, which made him arrogant. Hiranyakashyapu decreed that only he be worshiped as a God, punished and killed anyone who did not accept his orders. His son Prahlad disagreed with his father, and refused to worship his father as a god. He continued believing and worshipping Lord Vishnu.

Hiranyakashipu is said to be the brother of Hiranyaksha. Hiranyakashipu and Hiranyaksha are Vishnu’s gatekeepers Jaya and Vijaya, born on earth as the result of a curse from the Four KumarasThis made Hiranyakashipu very angry and he made various attempts to kill Prahlad. During a particular attempt on Prahlad’s life, King Hiranyakashyapu called upon his sister Holika for help. Holika had a special cloak garment that prevented her from being harmed by fire. Hiranyakashyapu asked her to sit on a bonfire with Prahlad, by tricking the boy to sit on her lap. However, as the fire roared, the garment flew from Holika and covered Prahlad. Holika burnt to death, Prahlad came out unharmed.

Hiranyaksha was killed by Lord Vishnu’s 3rd Incarnation which was Varaha. and Hiranyakashipu was later killed by Lord Vishnu’s 4th Incarnation which was Narasimha.

Tradition
The night before Holi pyres are burnt in North India, Nepal and parts of South India in keeping with this tradition. The youth playfully steal all sorts of things and put them in Holika pyre.

The festival has many purposes; most prominently, it celebrates the beginning of Spring. In 17th century literature, it was identified as a festival that celebrated agriculture, commemorated good spring harvests and the fertile land. Hindus believe it is a time of enjoying spring’s abundant colours and saying farewell to winter. Holi festivities mark the beginning of new year to many Hindus, as well as a justification to reset and renew ruptured relationships, end conflicts and accumulated emotional impurities from past.

Prepare Holika pyre for bonfire
Days before the festival people start gathering wood and combustible materials for the bonfire in parks, community centers, near temples and other open spaces. On top of the pyre is an effigy to signify Holika who tricked Prahalad into the fire. Inside homes, people stock up on color pigments, food, party drinks and festive seasonal foods such as gujiya, mathri, malpuas and other regional delicacies.

Holika dahan

On the eve of Holi, typically at or after sunset, the pyre is lit, signifying Holika Dahan. The ritual symbolises the victory of good over evil. People sing and dance around the fire.
The next day people play Holi, the popular festival of colors.

Reason for Holika burning
The burning of Holika is the most common mythological explanation for the celebration of Holi. In different parts of India varying reasons are given for Holika’s death. Among those are:

Vishnu stepped in and hence Holika burnt.
Holika was given the power by the Brahma on the understanding that it can never be used to bring harm to anyone.
Holika was a good person and it was the clothes that she wore that gave her the power and knowing that what was happening was wrong, she gave them to Prahlad and hence died herself.
Holika wore a shawl that would protect her from fire. So when she was asked to sit in the fire with Prahlad she put on the shawl and sat Prahlad down in her lap. When the fire was lit Prahlad began praying to Lord Vishnu. So Lord Vishnu summoned a gust of wind to blow the shawl off of Holika and on to Prahlad, saving him from the flames of the bonfire and burning Holika to her death

The next day is known as Color holi or Dhulheti where people play with colors and water spraying pichkaris.

Each Holi colour signifies a special emotion that transcends the brightly coloured faces of people to a sentiment of community, equality and oneness.

Red: Purity
Orange: Endurance
Purple: Magic
Blue: Calmness
Green: Vitality
Yellow: Happiness
Pink: Love

Traditional sources of colours

Orange and red

The blossoms of palash or tesu tree, additionally called the fire of the backwoods, are commonplace wellspring of brilliant red and profound orange hues. Powdered fragrant red shoe wood, dried hibiscus blooms, madder tree, radish and pomegranate are substitute sources and shades of red. Blending lime with turmeric powder makes a substitute wellspring of orange powder, as does bubbling saffron (kesar) in water.

Green

Mehendi and dried leaves of gulmohur tree offer a wellspring of green shading. In a few zones, the leaves of spring yields and herbs have been utilized as wellspring of green color.

Yellow

Haldi (turmeric) powder is the run of the mill wellspring of yellow shading. Once in a while this is blended with chickpeas, gram or other flour to get the correct shade. Bael organic product, amaltas, types of chrysanthemums, and types of marigold are exchange wellsprings of yellow.

Blue

Indigo plant, Indian berries, types of grapes, blue hibiscus and jacaranda blooms are conventional wellsprings of blue shading for Holi.

Magenta and purple

Beetroot is the customary wellspring of maroon and purple shading. Frequently these are straightforwardly bubbled in water to get ready shaded water.

Brown

Dried tea leaves offer a wellspring of dark colored shaded water. Certain muds are substitute wellspring of dark colored.

Black

Types of grapes, products of amla (gooseberry) and vegetable carbon (charcoal) offer dim to dark hues.

Holi powder

Synthetic colours

Common hues were utilized as a part of the past to observe Holi securely by applying turmeric, sandalwood glue, concentrates of blossoms and takes off. As the spring-blooming trees that once provided the hues used to observe Holi have turned out to be more uncommon, synthetically delivered mechanical colors have been utilized to have their spot in all of urban India. Because of the business accessibility of alluring shades, gradually the common hues are supplanted by manufactured hues. Thus, it has made gentle extreme side effects of skin disturbance and irritation. Absence of control over the quality and substance of these hues is an issue, as they are as often as possible sold by merchants who don't have the foggiest idea about their source.

What is Nmap & How to Use Nmap Commands.

2021-03-15T11:53:00.001+05:30

Nmap is one of the most commonly used tools by ethical hackers. Its ease of use and clean installation along with powerful scanning options, adds to its popularity. This nmap tutorial gives you a comprehensive understanding of the tool and teaches you how to perform advanced scans by yourself.

Below is the list of topics that I’ll be covering through the course of this nmap tutorial.

What is Nmap?
Nmap Scan Types
Nmap Command List

What is Nmap?

Nmap, short for Network Mapper, is a network discovery and security auditing tool. It is known for its simple and easy to remember flags that provide powerful scanning options. Nmap is widely used by network administrators to scan for:

Open ports and services
Discover services along with their versions
Guess the operating system running on a target machine
Get accurate packet routes till the target machine
Monitoring hosts

Nmap is a free and open source utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts.

What Does Nmap Do?

At a practical level, Nmap is used to provide detailed, real-time information on your networks, and on the devices connected to them.

The primary uses of Nmap can be broken into three core processes. First, the program gives you detailed information on every IP active on your networks, and each IP can then be scanned. This allows administrators to check whether an IP is being used by a legitimate service, or by an external attacker.

Secondly, Nmap provides information on your network as a whole. It can be used to provide a list of live hosts and open ports, as well as identifying the OS of every connected device. This makes it a valuable tool in ongoing system monitoring, as well as a critical part of pentesting. Nmap can be used alongside the Metasploit framework, for instance, to probe and then repair network vulnerabilities.

Thirdly, Nmap has also become a valuable tool for users looking to protect personal and business websites. Using Nmap to scan your own web server, particularly if you are hosting your website from home, is essentially simulating the process that a hacker would use to attack your site. “Attacking” your own site in this way is a powerful way of identifying security vulnerabilities.

How To Use Nmap

Nmap is straightforward to use, and most of the tools it provides are familiar to system admins from other programs. The advantage of Nmap is that it brings a wide range of these tools into one program, rather than forcing you to skip between separate and discrete network monitoring tools.

In order to use Nmap, you need to be familiar with command-line interfaces. Most advanced users are able to write scripts to automate common tasks, but this is not necessary for basic network monitoring.

How To Install Nmap

The process for installing Nmap is easy but varies according to your operating system. The Windows, Mac, and Linux versions of the program can be downloaded here.

For Windows, Nmap comes with a custom installer (namp<version>setup.exe). Download and run this installer, and it automatically configures Nmap on your system.
On Mac, Nmap also comes with a dedicated installer. Run the Nmap-<version>mpkg file to start this installer. On some recent versions of macOS, you might see a warning that Nmap is an “unidentified developer”, but you can ignore this warning.
Linux users can either compile Nmap from source or use their chosen package manager. To use apt, for instance, you can run Nmap –version to check if Nmap is installed, and sudo apt-get install Nmap to install it.

How To Run a Ping Scan

One of the most basic functions of Nmap is to identify active hosts on your network. Nmap does this by using a ping scan. This identifies all of the IP addresses that are currently online without sending any packers to these hosts.

To run a ping scan, run the following command:

# nmap -sp 192.100.1.1/24

This command then returns a list of hosts on your network and the total number of assigned IP addresses. If you spot any hosts or IP addresses on this list that you cannot account for, you can then run further commands (see below) to investigate them further.

How To Run A Host Scan

A more powerful way to scan your networks is to use Nmap to perform a host scan. Unlike a ping scan, a host scan actively sends ARP request packets to all the hosts connected to your network. Each host then responds to this packet with another ARP packet containing its status and MAC address.

To run a host scan, use the following command:

# nmap -sp <target IP range>

This returns information on every host, their latency, their MAC address, and also any description associated with this address. This can be a powerful way of spotting suspicious hosts connected to your network.

If you see anything unusual in this list, you can then run a DNS query on a specific host, by using:

# namp -sL <IP address>

This returns a list of names associated with the scanned IP. This description provides information on what the IP is actually for.

How To Use Nmap in Kali Linux

Using Nmap in Kali Linux can be done in an identical way to running the program on any other flavor of Linux.

That said, there are advantages to using Kali when running Nmap scans. Most modern distros of Kali now come with a fully-features Nmap suite, which includes an advanced GUI and results viewer (Zenmap), a flexible data transfer, redirection, and debugging tool (Ncat), a utility for comparing scan results (Ndiff), and a packet generation and response analysis tool (Nping).

Nmap Commands

Most of the common functions of Nmap can be executed using a single command, and the program also uses a number of ‘shortcut’ commands that can be used to automate common tasks.

Here is a quick run-down:

1. Ping Scanning

As mentioned above, a ping scan returns information on every active IP on your network. You can execute a ping scan using this command:

#

2. Port Scanning

There are several ways to execute port scanning using Nmap. The most commonly used are these:

# sS TCP SYN scan
# sT TCP connect scan
# sU UDP scans
# sY SCTP INIT scan
# sN TCP NULL

The major differences between these types of scans are whether they cover TCP or UDP ports and whether they execute a TCP connection. Here are the basic differences:

The most basic of these scans is the sS TCP SYN scan, and this gives most users all the information they need. It scans thousands of ports per second, and because it doesn’t complete a TCP connection it does not arouse suspicion.
The main alternative to this type of scan is the TCP Connect scan, which actively queries each host, and requests a response. This type of scan takes longer than a SYN scan, but can return more reliable information.
The UDP scan works in a similar way to the TCP connect scan but uses UDP packets to scan DNS, SNMP, and DHCP ports. These are the ports most frequently targeted by hackers, and so this type of scan is a useful tool for checking for vulnerabilities.
The SCTP INIT scan covers a different set of services: SS7 and SIGTRAN. This type of scan can also be used to avoid suspicion when scanning an external network because it doesn’t complete the full SCTP process.
The TOP NULL scan is also a very crafty scanning technique. It uses a loophole in the TCP system that can reveal the status of ports without directly querying them, which means that you can see their status even where they are protected by a firewall.

3. Host Scanning

Host scanning returns more detailed information on a particular host or a range of IP addresses. As mentioned above, you can perform a host scan using the following command:

# nmap -sp <target IP range>

4. OS Scanning

OS scanning is one of the most powerful features of Nmap. When using this type of scan, Nmap sends TCP and UDP packets to a particular port, and then analyze its response. It compares this response to a database of 2600 operating systems, and return information on the OS (and version) of a host.

To run an OS scan, use the following command:

nmap -O <target IP>

5. Scan The Most Popular Ports

If you are running Nmap on a home server, this command is very useful. It automatically scans a number of the most ‘popular’ ports for a host. You can run this command using:

nmap --top-ports 20 192.168.1.106

Replace the “20” with the number of ports to scan, and Nmap quickly scans that many ports. It returns a concise output that details the status of the most common ports, and this lets you quickly see whether you have any unnecessarily open ports.

6. Output to a File

If you want to output the results of your Nmap scans to a file, you can add an extension to your commands to do that. Simply add:

-oN output.txt

To your command to output the results to a text file, or:

-oX output.xml

To output to an XML.

7. Disable DNS Name Resolution

Finally, you can speed up your Nmap scans by using the -n parameter to disable reverse DNS resolution. This can be extremely useful if you want to scan a large network. For example, to turn off DNS resolution for the basic ping scan mentioned above, add -n:

# nmap -sp -n 192.100.1.1/24

Nmap Scan Types

A variety of scans can be performed using Nmap. Below are the types of scans:

TCP SCAN

A TCP scan is generally used to check and complete a three-way handshake between you and a chosen target system. A TCP scan is generally very noisy and can be detected with almost little to no effort. This is “noisy” because the services can log the sender IP address and might trigger Intrusion Detection Systems.

UDP SCAN

UDP scans are used to check whether there is any UDP port up and listening for incoming requests on the target machine. Unlike TCP, UDP has no mechanism to respond with a positive acknowledgment, so there is always a chance for a false positive in the scan results. However, UDP scans are used to reveal Trojan horses that might be running on UDP ports or even reveal hidden RPC services. This type of scan tends to be quite slow because machines, in general, tend to slow down their responses to this kind of traffic as a precautionary measure.

SYN SCAN

This is another form of TCP scan. The difference is unlike a normal TCP scan, nmap itself crafts a syn packet, which is the first packet that is sent to establish a TCP connection. What is important to note here is that the connection is never formed, rather the responses to these specially crafted packets are analyzed by Nmap to produce scan results.

ACK SCAN

ACK scans are used to determine whether a particular port is filtered or not. This proves to be extremely helpful when trying to probe for firewalls and their existing set of rules. Simple packet filtering will allow established connections (packets with the ACK bit set), whereas a more sophisticated stateful firewall might not.

FIN SCAN

Also a stealthy scan, like the SYN scan, but sends a TCP FIN packet instead. Most but not all computers will send an RST packet (reset packet) back if they get this input, so the FIN scan can show false positives and negatives, but it may get under the radar of some IDS programs and other countermeasures.

NULL SCAN

Null scans are extremely stealthy scan and what they do is as the name suggests — they set all the header fields to null. Generally, this is not a valid packet and a few targets will not know how to deal with such a packet. Such targets are generally some version of windows and scanning them with NULL packets may end up producing unreliable results. On the other hand, when a system is not running windows this can be used as an effective way to get through.

XMAS SCAN

Just like null scans, these are also stealthy in nature. Computers running windows will not respond to Xmas scans due to the way their TCP stack is implemented. The scan derives its name from the set of flags that are turned on within the packet that is sent out for scanning. XMAS scans are used to manipulate the PSH, URG and FIN flags that can be found in the TCP header.

RPC SCAN

RPC scans are used to discover machines that respond to Remote Procedure Call services (RPC). RPC allows commands to be run on a certain machine remotely, under a certain set of connections. RPC service can run on an array of different ports, hence, it becomes hard to infer from a normal scan whether RPC services are running or not. It is generally a good idea to run an RPC scan from time to time to find out where you have these services running.

IDLE SCAN

IDLE scan is the stealthiest of all scans discussed in this nmap tutorial, as the packets are bounced off an external host. Control over the host is generally not necessary, but the host needs to meet a specific set of conditions. It is one of the more controversial options in Nmap since it only has a use for malicious attacks.

Nmap Commands

In this section of Nmap Tutorial, I’ll be listing down the various commands you can use in Nmap along with their flag and usage description with an example on how to use it.

Scanning Techniques

Flag	Use	Example
-sS	TCP syn port scan	nmap -sS 192.168.1.1
-sT	TCP connect port scan	nmap -sT 192.168.1.1
–sU	UDP port scan	nmap –sU 192.168.1.1
–sA	TCP ack port scan	nmap –sA 192.168.1.1

Flag	Use	Example
-Pn	only port scan	nmap -Pn192.168.1.1
-sn	only host discover	nmap -sn192.168.1.1
-PR	arp discovery on a local network	nmap -PR192.168.1.1
-n	disable DNS resolution	nmap -n 192.168.1.1

Port Specification

Flag	Use	Example
-p	specify a port or port range	nmap -p 1-30 192.168.1.1
-p-	scan all ports	nmap -p- 192.168.1.1
-F	fast port scan	nmap -F 192.168.1.1

Service Version and OS Detection

Flag	Use	Example
-sV	detect the version of services running	nmap -sV 192.168.1.1
-A	aggressive scan	nmap -A 192.168.1.1
-O	detect operating system of the target	nmap -O 192.168.1.1

Timing and Performance

Flag	Use	Example
-T0	paranoid IDS evasion	nmap -T0 192.168.1.1
-T1	sneaky IDS evasion	nmap -T1 192.168.1.1
-T2	polite IDS evasion	nmap -T2 192.168.1.1
-T3	normal IDS evasion	nmap -T3 192.168.1.1
-T4	aggressive speed scan	nmap -T4 192.168.1.1
-T5	insane speed scan	nmap -T5 192.168.1.1

NSE Scripts

Flag	Use	Example
-sC	default script scan	nmap -sC 192.168.1.1
–script banner	banner grabbing	nmap –script banner 192.168.1.1

IDS Evasion

Flag	Use	Example
-f	use fragmented IP packets	nmap -f 192.168.1.1
-D	decoy scans	nmap -D 192.168.1.1
-g	use a given source port number	nmap -g 22 192.168.1.1

The Value Of TIME

2021-03-02T09:00:00.002+05:30

Life Lesson:

"Time really is precious, so be careful where you spend it."

Time is a very precious thing in our life. Time is something we should never waste in any way. We can spend a lot of time doing various works, but we can never get back the time we spent. That’s why most of the successful people consider time as more important and valuable than money.

We all should utilize our time in productive ways. If you master the technique of managing time to utilize your time efficiency, you can achieve anything in your life. Time helps you to attain more with lesser efforts.

It is always better to respect and follow the valuable time instead of regretting later as the time we have spent is never coming back. We all know about the proverb “Time and Tide wait for none,” It is apt for our life.

We all should think that the time we get is an opportunity to grab for a well-built future. We should teach our younger ones also about the value of time. Utilizing time for our loved ones also helps us and the society to grow towards a superior one.

The best and most effective ways of utilizing time are setting goals, making work lists, prioritizing tasks, having a good sleep, etc. We must set long and short term goals for the best utilization of time. These long and short term goals will help us to save time and be productive.

Goals and work lists help us as a driving force to keep us always motivated. When we start a new work, and then we start to do it regularly, firstly it will look a very uninteresting one. But, later, we will understand that this is increasing our productivity. Finally, these driving forces help us to achieve our goals. Prioritizing tasks for our daily routines is a very effective way to manage time because we get to understand the importance of various tasks and jobs in our lives. Moreover, if we do similar works unitedly then, it also increases our productivity.

But, we should remember one thing that being productive doesn’t mean that we have to be involved in multiple works every time. Taking a sufficient amount of sleep and exercising are also parts of being healthy as well as productive. Exercising and sleeping maintain the right balance between our bodies and minds, which is essential for success in life.

There are few things related to time which we should always keep in our minds. They are punctuality, the importance of time management, courtesy, unpredictable future, etc. To lead a better life, we all have to be punctual in every case in our daily life. People who treat time as an essential factor for a better life are always punctual and thus successful in life.

Another important factor for leading a successful life is the management of time. You have to be regularly involved in work to find a good result and complete without facing any problem. None of us can predict our future. That’s why we should work hard from now and complete all our tasks on time to make our future bright. If we finish our work on time, we won’t have many works left to do at a time.

The proverb “killing time is not murder; it’s a suicide’ is applicable for those who don’t understand the value of time and don’t respect it. There are people too who give excuses for not completing work like they don’t have time for that. It’s not like they don’t have time; they don’t know how to manage time.

What Is Cryptocurrency?

2021-02-22T09:34:00.002+05:30

What is cryptocurrency?

Cryptocurrency is a form of payment that can be exchanged online for goods and services. Many companies have issued their own currencies, often called tokens, and these can be traded specifically for the good or service that the company provides. Think of them as you would arcade tokens or casino chips. You’ll need to exchange real currency for the cryptocurrency to access the good or service.

Cryptocurrencies work using a technology called blockchain. Blockchain is a decentralized technology spread across many computers that manages and records transactions. Part of the appeal of this technology is its security.

Cryptocurrency is a kind of digital currency that is intended to act as a medium of exchange. Cryptocurrency has become popular in the last decade, in particular, with Bitcoin becoming the most widely tracked alternative currency. Typically, cryptocurrency is electronic-only and does not have a physical form – that graphic at the top of the page is just an artist’s vision of digital currency.

Cryptocurrency appeals to many people because of its ability to be managed without a central bank and therefore concerns around secrecy and subterfuge. It appeals because of its ability to hold value and not be inflated away by central banks that want to print money. It’s also very difficult to counterfeit due to the blockchain ledger system that manages the currency.

Here’s what cryptocurrency is, how it works and the significant drawbacks to its use.

How cryptocurrency works

Cryptocurrencies are produced, tracked and managed through what’s called a distributed ledger such as blockchain. In a distributed ledger, the currency’s movement is processed by computers in a decentralized network, to ensure the integrity of the financial data and ownership of the cryptocurrency. Think of it like a giant never-ending receipt of all the system’s transactions that is being constantly verified by everyone who can see the receipt.

This decentralized system is typical of many cryptocurrencies, which eschew a central authority. That’s part of the appeal of cryptocurrencies such as Bitcoin – it keeps governments and central banks out of the currency system, reducing their interference and political maneuvering.

To this end, in some cryptocurrencies, the number of units of currency is limited. In the case of Bitcoin, the system is organized so that no more than 21 million bitcoins can be issued.

But how exactly does cryptocurrency come to exist? The key way is through what’s called mining, to use a metaphor related to the old monetary system based on gold or silver. Powerful computers, often known as miners, perform calculations and process transactions on the ledger. By doing so, they earn a unit of the currency, or at least a part of a unit. It requires a lot of expensive processing power and often a lot of electricity to perform these calculations.

Owners of the currency may store it in a cryptocurrency wallet, a computer app that allows them to spend or receive the currency. To make a transaction, users need a “key,” which allows them to write in the public ledger, noting the transfer of the money. This key may be tied to a specific person, but that person’s name is not immediately tied to the transaction.

So part of the appeal of cryptocurrency for many is that it can be used somewhat anonymously.

There’s literally no limit to the number of cryptocurrencies that could be created. The range of them is astonishing, and literally thousands of currencies popped up in the last few years, especially as Bitcoin soared into mainstream popularity in 2017. Some of the most popular cryptos include Bitcoin, Litecoin, Ethereum, Ripple and Tether. Even Facebook has been trying to get in on the cryptocurrency game by establishing a consortium of industry partners.

How many cryptocurrencies are there? What are they worth?

More than 6,700 different cryptocurrencies are traded publicly, according to CoinMarketCap.com, a market research website. And cryptocurrencies continue to proliferate, raising money through initial coin offerings, or ICOs. The total value of all cryptocurrencies on Jan. 27, 2021, was more than $897.3 billion, according to CoinMarketCap, and the total value of all bitcoins, the most popular digital currency, was pegged at about $563.8 billion.

The drawbacks of cryptocurrency

While proponents have a good story to tell about digital currencies such as Bitcoin, these currencies are not without serious drawbacks, at least as currently configured. That doesn’t mean you can’t make money on it by selling it to someone else at a higher price than you paid. However, these drawbacks do make it virtually useless as a currency, a means of exchange.

Bitcoin and other cryptos have real detractors, including some of the world’s top investors, such as multi-billionaire Warren Buffett. Buffett has called Bitcoin “probably rat poison squared,” while his longtime business partner Charlie Munger has said cryptocurrency trading is “just dementia.”

Why are cryptocurrencies so popular?

Cryptocurrencies appeal to their supporters for a variety of reasons. Here are some of the most popular:

Supporters see cryptocurrencies such as Bitcoin as the currency of the future and are racing to buy them now, presumably before they become more valuable

Some supporters like the fact that cryptocurrency removes central banks from managing the money supply, since over time these banks tend to reduce the value of money via inflation

Other supporters like the technology behind cryptocurrencies, the blockchain, because it’s a decentralized processing and recording system and can be more secure than traditional payment systems

Some speculators like cryptocurrencies because they’re going up in value and have no interest in the currencies’ long-term acceptance as a way to move money

Mining the currency is expensive and polluting

One of the most significant negatives to cryptocurrency is that it is “mined” by computers. Mining isn’t free, of course, and requires substantial amounts of energy to create a coin. While miners consume and pay for energy to run their rigs, it also creates significant pollution and waste.

One 2019 study in technology journal Joule concluded that Bitcoin mining produced enough carbon emissions in 2018 to rank it between the countries of Jordan and Sri Lanka. Researchers from MIT and the Technical University of Munich concluded that Bitcoin mining alone accounted for 0.2 percent of global electricity consumption. Add in the effects from other cryptos and electricity usage more than doubled.

Are cryptocurrencies a good investment?

Cryptocurrencies may go up in value, but many investors see them as mere speculations, not real investments. The reason? Just like real currencies, cryptocurrencies generate no cash flow, so for you to profit, someone has to pay more for the currency than you did.

That’s what’s called “the greater fool” theory of investment. Contrast that to a well-managed business, which increases its value over time by growing the profitability and cash flow of the operation.

“
For those who see cryptocurrencies such as bitcoin as the currency of the future, it should be noted that a currency needs stability.”

As NerdWallet writers have noted, cryptocurrencies such as Bitcoin may not be that safe, and some notable voices in the investment community have advised would-be investors to steer clear of them. Of particular note, legendary investor Warren Buffett compared Bitcoin to paper checks: “It's a very effective way of transmitting money and you can do it anonymously and all that. A check is a way of transmitting money too. Are checks worth a whole lot of money? Just because they can transmit money?"

For those who see cryptocurrencies such as Bitcoin as the currency of the future, it should be noted that a currency needs stability so that merchants and consumers can determine what a fair price is for goods. Bitcoin and other cryptocurrencies have been anything but stable through much of their history. For example, while Bitcoin traded at close to $20,000 in December 2017, its value then dropped to as low as about $3,200 a year later. By December 2020, it was trading at record levels again.

Are cryptocurrencies legal?

There’s no question that they’re legal in the United States, though China has essentially banned their use, and ultimately whether they’re legal depends on each individual country. Also be sure to consider how to protect yourself from fraudsters who see cryptocurrencies as an opportunity to bilk investors. As always, buyer beware.

What is Blockchain & How It Works in Cryptocurrency?

2021-02-11T10:00:00.004+05:30

What is blockchain?

Simply put, blockchain is a shared, immutable ledger that lets you record the history of transactions. By establishing trust, accountability and transparency, it transforms the way we carry out transactions and can be adapted to virtually any contract, deed or payment. Blockchain can be used across businesses, industries and even the world.

High-technology creates worldwide flexibility and growth of online payment. There remains enough room for the study of the unreserved adoption, confidence, and anticipation of the digital currency, blockchain in cryptocurrency, that are the major drivers of the network’s spread.

Banks’ technologies underlying these cryptocurrencies should be closely regarded as a possible generic way to pass value ownership in the long run. Let us first recall the precepts of cryptocurrency before we explain how blockchain and cryptocurrency work together.

What is Blockchain Cryptocurrency?

In the concept of a digital commodity, cryptocurrency blockchain is intended to serve as an interchange media. In comparison to physical currencies, blockchain cryptocurrency runs on digital networks and is mostly used to protect online financial transactions. These cryptography or encryption layers can also be used to monitor the formation and transition of additional modules. A cryptocurrency blockchain may take several forms, such as Bitcoin, Litecoin, Ether, Ripple, etc.

With the implementation of blockchain currency, anything might be produced that cannot be duplicated and sent directly from person to person. These deals do not involve developing a trustworthy third person, corporation, or computer server in a circle that acts as a source of confidence.

Operations of their users, and increasingly nuanced protocols incorporated into governing standards, regulate the availability and value of cryptocurrencies. Miners–consumers who anchor advanced computer functions to log transactions and receive newly generated cryptocurrency units and transaction prices in return–play an essential role in ensuring that cryptocurrencies run stably and smoothly.

The most striking distinction between blockchain money and the physical currency is using a decentralized transactions management mechanism contrasted with centralized digital currencies and central banking structures. This decentralized functionality is focused on the distribution of ledger technologies, which generally functions as a blockchain database.

How blockchain is different from traditional databases

To start, it’s important to know that blockchain isn’t a database but a network. On this network, permissioned users are able to manage, adjust and restore new entries. To make sure that all transactions are valid, nodes (network members) confirm that all participants are in agreement. Once this consensus is reached, the records are recorded permanently, prohibiting users and system administrators from deleting records at any time. Inherently secure, a blockchain creates one unified version of the truth that can be easily shared with network members ultimately saving time and reducing extra work.

On the other hand, a traditional database uses a central server that allows users to alter items. Unlike a blockchain network, these edits make changes to the original version. This means that subsequent users will see an entirely updated version and won’t be able to see a history of the transactions. Another key difference between a blockchain network and a database is that with a database, administrators are the ones with full control. These forms of authority are responsible for delegating access and granting permissions to their users.

Building blocks of blockchain

Even when discussing blockchain in its most basic terms, understanding how it works can be tricky. Here are some key blockchain terms and their definitions to get you started.

Distributed ledgers

A distributed ledger enables each network member or node, to personally hold and edit its records. This is different from a traditional database where the administrator distributes to distinct nodes. In a distributed ledger, they are created and kept by each participant — nodes create consensus by looking into each transaction and drawing conclusions from the records.

Nodes

A node can be any device, including a computer or cellphone, that has internet access and its own IP address. A node autonomously keeps a copy of the blockchain and carries out user-defined transactions.

Smart contracts

Smart contracts include all of the original terms and conditions agreed upon by the stakeholders in an agreement, and all of the transaction information kept on a blockchain. This makes it easier to digitally exchange money, property and other valuable assets. Smart contracts eliminate the need for middlemen, reduce extra costs and streamline processes. Even without a middleman, they uphold complete trust and transparency between the relevant parties.

Public and private networks

There are clear differences between public and private blockchain networks. A public blockchain is entirely available to the masses, meaning anyone can get involved and collaborate on the network. Another sign that a network is public rather than private, is whether or not there is an incentive for people to participate. For example, Bitcoin is one of the most popular public blockchain networks. In a private network, users must be invited to join. Limits are put into place to define who can participate on the network and what transactions that individual can interact with. Ultimately, the members of the blockchain network who handle the participant on-boarding process, must reach a consensus of who is and isn’t allowed to join.

Decentralization

When a network is decentralized, it means there is no one main source of authority. Since the responsibility to carry out business isn’t tied to one person, a blockchain becomes more secure. This is because a decentralized network reaches consensus through a system of nodes. These nodes are used to verify exchanges, record the collected information and share truly correct data.

Immutability

In its simplest form, immutability in the context of blockchain means that once a block is created, it can’t be changed. Users can trust that information on a blockchain is authentic and unchanged.

How Cryptocurrency and Blockchain Work

Blockchain is an online transaction; the technology behind blockchain essentially means that blockchains power the entire cryptocurrency concept. Interestingly, the blockchain has been developed to handle cryptocurrency. On the distributed header, a blockchain simply stores data.

The cryptocurrency blockchain is the primary lead in which all previous purchases and operations are usually registered, and at any given time, validates the ownership of all currencies. The blockchain includes a ledger of a cryptocurrency’s entire transactional background.

It has a limited duration and a limited number of transactions that occur in due course, each node of the software network of cryptocurrency stores identical copies of the blockchain. The decentralized server farms’ network is operated by technical experts or groups of people called miners. Miners actively record cryptocurrency activities and authenticate them.

Crypto-monetary transactions demonstrate secrecy; the validity of their nature is disputed in some aspects. A technology that works effectively to render online cryptocurrency purchases safer and build an impregnable firewall through which hackers cannot infiltrate was essential to ease these frauds in recent days. Safety is the first stage and concern of the blockchain in cryptocurrency. In addition to offering a stable network, blockchains also guarantee openness as the cornerstone to all transactions in cryptocurrencies.

Anyone on the internet with blockchains can access the transactions that exist since they are initiated on a cryptocurrency device. This makes it easy for consumers to carry on with online purchases transparently. A ledger is also available on all machines worldwide to keep track of the transactions. This means that a hacker cannot handle transactional data from a single position.

Even if hackers are successful with an attack and access a blockchain, they cannot alter any previous transaction blocks. All these blocks are knitted together in perfect cryptographic order and in a sequence. Any bitcoin transaction that often occurs is blocked and grouped within 10 minutes of completion. Each block contains a hash code that links it to its former block, thereby rendering it tamper-proof in isolation and related to the entire blockchain system.

Retention of the Net and Nodes Blockchain

A peer-to-peer network supports the blockchain. The network consists of a series of interconnected nodes. Nodes are independent computers that accept inputs and carry out an output operation on them.

Blockchain utilizes a single form of the network called a peer-to-peer network, which distributes the entire workload between similarly privileged individuals and are called peers. Without a central server, many dispersed and decentralized peers are present with a blockchain in cryptocurrency.

Security of blockchain

Aside from the fact that a blockchain is decentralized and immutable, blockchain data is protected by cryptography. Cryptography is a unique set of private keys like a digital signature that’s attached to transactions. The signatures maintain security since, if someone tries to change an entry without peer approval, it will become invalidated. If something does go wrong, all members of the network will be notified. The inherent transparency of the blockchain stops immediate issues from becoming bigger problems.

Industries poised for adoption and transformation

The beauty of blockchain is that it can be applied to almost any business, industry or application. Here are some examples of how traditional industries are using blockchain to challenge the way we interact, think and progress.

Banking and financial markets

Financial service industries are frequently faced with cases of fraud and crime. Blockchain can replace outdated processes to promote collaboration, transparency, efficiency and shared trust.

Insurance

The insurance industry can create transparency for all parties with blockchain. Using technology that backs all transactions with security and trust features, a blockchain network can quickly and accurately verify data exchanges, making the process a lot less tedious.

Healthcare

Healthcare professionals can use a blockchain network to improve the quality of care. A blockchain can make it easier to send patient data from one place to another. It can also empower patients to take ownership of their own medical history data securely, particularly in today’s IoT environment.

Media and entertainment

In the wake of a digital revolution, a blockchain can foster trust in the media and entertainment industry. It can improve how users and professionals create, share and consume digital content. Blockchain can touch industries from music, movies and television to use cases like advertising, loyalty points and more.

Why do People Use Peer-to-Peer Networks?

File storage, also called torrenting, is one of the principal implementations of a peer-to-peer network. Typically, when you are installing a client-server model, it entirely relies upon the server’s health.

Blockchain use cases

Since blockchain technology can be applied to virtually any industry, hundreds of companies are transforming their business. Some of the most interesting use cases to date are identity, food safety, cross-border payments and supply chain. Here’s how blockchain is changing business.

Identity

When it comes to identity management with sensitive government-issued documents like IDs and licenses, each document must have enough traceable information linked to it so that it can be verified. With blockchain-enabled technology, government agencies can spend less time adjusting inconsistent files. By shortening document authentication processes, it’ll also create a better experience for everyone.

Food safety

Growers, distributors and retailers can enhance food trust in traceability, visibility and accountability from farm to fork. The network allows workers from every stage in the food supply chain to quickly respond to recalls, publish tracking data and share inspection certifications, creating a secure network of food influencers and innovators.

Cross-border payments

Global payment settlements that once took days can now be cleared and settled in seconds with new advancements in blockchain universal payment processing. Solutions work with normal payment systems to increase transparency in an affordable way. By streamlining the payment process, lowering costs and increasing efficiency, blockchain is changing the financial services landscape in real time.

Supply chain

Security, speed and efficiency are critical in the world of logistics. A blockchain network can help a supply chain reduce fraud, delays and courier costs. This makes it easier to identify problems, manage inventory and establish consumer and partner trust. In addition, networks can be implemented at scale to improve businesses and trade relationships worldwide.

Even though blockchain is still relatively new, it has already left a mark on almost every aspect of our lives and revolutionized some of the most basic industries we do business with each day. In light of these milestones, there is no telling how large it will grow, who will adopt it and what industry it will touch next. The only thing that is for sure, is that blockchain is developing the next generation of transaction systems. So there’s no better time for you to get an answer to the question, “What is blockchain and how does it work?” than now!

Conclusion

We hope this article gave you an insight into the workings of Blockchain and Cryptocurrency; please visit our article on a website to know more. Blockchain helps your marketing benefit considerably. You can target whom you are willing to; there will be no wastage of money. Reading this article, you will surely understand How Blockchain Works in Cryptocurrency.

What is AngularJS? An introduction to AngularJS.

2021-02-02T17:00:00.001+05:30

What is AngularJS?

Angular is a structural framework for dynamic web applications, made in pure JavaScript.
What does it mean to be a structural framework?

The fact that Angular is a structural framework allows us to use HTML as a template language, and extend its syntax to express the components of the application in a cleaner and simpler way.

As an example, let’s see this case, where we obtain the value of an entry:

In JavaScript:-

HTML:<input id="”input-data”" type="”text”" />
Code: document.getElementById(“input-data”).value

In Angular:-

HTML : <input type="“text”" /> 
Code : $scope.inputData;

When should you use AngularJS?

While Angular has received a lot of attention, it’s still important to decide whether it makes sense to use it for your web application. As a result, it’s important to keep in mind the conditions of the application that we want to make.

It is convenient to use Angular when making an application that fits the following characteristics:

It is a large application
You need a good structure
You need robustness
It is complex

Structure:-

It uses MVC, where the model communicates with the database, and so the variables defined in the controller are modified and the view is updated.

What is a controller?

This is one of the tools that Angular provides in the defined context (scope) to work later.

When we define a controller, a new scope is created and can only access the variables we have chosen.

The driver is not used to:

Manipulate the DOM
Format the entries (forms are used for this purpose)
Filter an output (filters are used for this purpose)
Share code among components (services are used for this purpose)
Manage the life cycle of the components

AngularJS Features:-

Angular has the following key features which makes it one of the powerful frameworks in the market.

MVC – The framework is built on the famous concept of MVC (Model-View-Controller). This is a design pattern used in all modern day web applications. This pattern is based on splitting the business logic layer, the data layer, and presentation layer into separate sections. The division into different sections is done so that each one could be managed more easily.
Data Model Binding – You don't need to write special code to bind data to the HTML controls. This can be done by Angular by just adding a few snippets of code.
Writing less code – When carrying out DOM manipulation a lot of JavaScript was required to be written to design any application. But with Angular, you will be amazed with the lesser amount of code you need to write for DOM manipulation.
Unit Testing ready – The designers at Google not only developed Angular but also developed a testing framework called "Karma" which helps in designing unit tests for AngularJS applications.

AngularJS Architecture:-

Angular.js follows the MVC architecture, the diagram of the MVC framework as shown below.

Angularjs Architecture Diagram

The Controller represents the layer that has the business logic. User events trigger the functions which are stored inside your controller. The user events are part of the controller.
Views are used to represent the presentation layer which is provided to the end users
Models are used to represent your data. The data in your model can be as simple as just having primitive declarations. For example, if you are maintaining a student application, your data model could just have a student id and a name. Or it can also be complex by having a structured data model. If you are maintaining a car ownership application, you can have structures to define the vehicle itself in terms of its engine capacity, seating capacity, etc.

AngularJS Advantages:-

Since it's an open source framework, you can expect the number of errors or issues to be minimal.
Two-way binding – Angular.js keeps the data and presentation layer in sync. Now you don't need to write additional JavaScript code to keep the data in your HTML code and your data later in sync. Angular.js will automatically do this for you. You just need to specify which control is bound to which part of your model.

Routing – Angular can take care of routing which means moving from one view to another. This is the key fundamental of single page applications; wherein you can move to different functionalities in your web application based on user interaction but still stay on the same page.
Angular supports testing, both Unit Testing, and Integration Testing.
It extends HTML by providing its own elements called directives. At a high level, directives are markers on a DOM element (such as an attribute, element name, and comment or CSS class) that tell AngularJS's HTML compiler to attach a specified behavior to that DOM element. These directives help in extending the functionality of existing HTML elements to give more power to your web application.

What is a module?

A module is a container for controllers, services, filters, directives. It gives structure to your application, since it represents different parts of it.

A module can be used again and, in any order, since they can slow down the execution time. It is also excellent for unit tests because you have to refer to a single module.

What is the view?

It is what the user sees, it shows the functionality of our application.

What is a directive?

A directive transforms the DOM elements to add functionality. Angular has its own directives from the beginning.

What is a service?

It is a solution for communication to the database and the exchange of information among the different components of the application.

They are singleton, which means that instances are created only when necessary. When the URL changes in the browser, all the controllers associated with that URL disappear, but not a service, so the data remains.

India's 72nd Republic Day 2021: The importance of Republic Day and how is it celebrated.

2021-01-26T09:00:00.004+05:30

India is a land of colourful festivities, but national festivals are something, which binds the entire nation together, imparting a message of 'unity in diversity'.

Each year, 26th January is a day on which every Indian heart fills up with patriotic fervour and immense love for motherland. There are many significant memories as it was this day when the Indian Tricolour was first unfurled in January 1930 at Lahore, by Pt Jawaharlal Nehru and the declaration of an independent Indian National Congress was made.

26th January, 1950 was the day when the Indian republic and its constitution came into force. It was this day in history in 1965 when Hindi was declared as the official language of India.

The dream of becoming an independent republic turned into reality on 26th January 1950 for India 71 years ago. Today our nation celebrates the Republic day with pride and dignity paying respect to the soldiers on this day who have laid down their lives for our cherished citizens to breathe with peace on our soil.

Republic Day in India is celebrated on January 26th and is a gazetted holiday. The term ‘gazetted holiday’ is used in countries such as India, Singapore and Australia which were all formerly colonized by the British.
Republic Day came into effect for the first time on 26th January 1950 to honour the day the Constitution of India came into force.
It is one of three national holidays in India, the other two being Independence Day and Gandhi Jayanti. Independence Day celebrates India’s freedom from British rule and is not to be confused with Republic Day which celebrates the Constitution of India. Dr. Rajendra Prasad, who was the first President of the Republic of India, unfurled the Indian National Flag while a salute of 21 guns rang out the birth of the Indian Republic.

Republic Day is celebrated throughout India in all the state capitals. Many businesses and shops close for the day along with banks, post offices and schools. A large celebration is held in New Delhi where the prime minister lays a wreath at the Amar Jawan Jyoti at India Gate in memory of the soldiers who sacrificed their lives for their country. People participate in parades all over India and school children take part by dancing and performing traditional songs. The president takes the military salute and armed forces fly past over the parade area showering the people below with rose petals.
Republic Day is a day where acts of bravery are rewarded with medals both to the military and to civilians. The armed forces display motor cycle rides and gifts are given to children. The spirit of the day focuses on the independence of India and celebrations conclude with a ‘fly past’ by the Indian Air Force where planes leave trails of smoke in the colours of the Indian flag.

The Delhi Republic Day parade is the largest and most important of the parades marking the Republic Day celebrations in India. The parade takes place every year on 26 January at Rajpath, New Delhi. It is the main attraction of India's Republic Day celebrations, which last for 3 days.

The first parade was held in 1950, and it has been held every year since.

The parade marches from the Rashtrapati Bhawan along the Rajpath, until the India Gate. It opens with the unfurling of the national flag by the President of India. This is followed by marching from several regiments of the army, navy, and air force, along with their bands. Tableau from various states signifying their culture are displayed. A beating retreat ceremony signifies the end of the parade.

The importance of Republic Day

It was on this day 71 years ago, the Indian Constitution came into force and the country was declared the largest democracy in the world.

After 200 years of British rule, when India gained Independence from the United Kingdom on August 15, 1947, it did not have a permanent constitution of its own. It was felt that a written constitution would help to run the country more systematically and for that, a drafting committee was constituted, headed by Dr B.R. Ambedkar. It took almost 2 years, 11 months and 18 days for the committee to draft the constitution. After making all the necessary changes it was formally adopted on November 26, 1949, by the Constituent Assembly of India. However, it came into force on January 26, 1950, and since that day India started celebrating January 26 as Republic Day.

This date was specifically chosen as it marks the anniversary of Purna Swaraj Day, which was held on January 26, 1930. The Purna Swaraj resolution made on January 26, 1930, called for “complete freedom from the British rule”. The constitution gave India's citizens the power to govern themselves by choosing their government. The Indian constitution declares India a sovereign, socialist, secular, democratic republic, assuring justice, equality, liberty and promoting fraternity to all its citizens.

How R-day is celebrated every year

A lot of effort is put towards organising events and celebrating Republic Day across the country. But the centre of attraction is always the grand event organised at the Rajpath in the National Capital. The event starts with the prime minister laying a wreath at the Amar Jawan Jyoti at India Gate, to remember soldiers who sacrificed their lives for the country. The president of India then hoists the flag at Rajpath every year, which is followed by a colourful parade showcasing the diversity of the country and military power. India’s military power is presided over by the Indian president, who is the Supreme Commander of the Indian Armed Forces. Assorted tableaus representing the colourful culture of different states, PSUs and other ministries are also a major attraction of the parade. The President of India also confers the military persons, citizens and children with bravery awards. Apart from this, at state and district level cultural festivals are organised every year on this day. It is a custom to have a foreign head of nations as the Chief Guest for the R-Day Parade at the national capital.

Beating Retreat

The Beating Retreat function is held after formally meaning the finish of Republic Day merriments. It is led on the night of 29 January, the third after quite a while. It is performed by the groups of the three wings of the military, the Indian Army, Indian Navy and Indian Air Force. The setting is Raisina Hill and a neighboring square, Vijay Chowk, flanked by the North and South piece of the Rashtrapati Bhavan towards the finish of Rajpath.

The Chief Guest of the capacity is the President of India who arrives escorted by the, a mounted force unit. At the point when the President arrives, the PBG leader requests that the unit give the National Salute, which is trailed by the playing of the Indian National Anthem, Jana Gana Mana, by the Army. The Army builds up the service of show by the massed groups in which Military Bands, Pipe and Drum Bands, Buglers and Trumpeters from different Army Regiments other than groups from the Navy and Air Force partake which play well known tunes like Abide With Me, Mahatma Gandhi's most loved song, and Saare Jahan Se Achcha toward the end.

How to Become a Front-End Developer.

2021-01-15T10:00:00.002+05:30

What is a Front End Developer?

A front end developer, also known as a front end web developer, is a professional responsible for the design and implementation of the interface. The users require this interface so that they can access the application in question. A web designer is a professional who creates a website’s appearance and design. And the front end developer makes sure that the design works online by using coding languages such as CSS, HTML, and JavaScript.

We should pause for a moment to clarify the differences between a front end developer, back end developer, and full stack developer. Let’s put this in simple terms: a front end developer is responsible for the parts of an app or website that users see and interact with. A back end developer takes care of the “behind the scenes” matters such as infrastructure and databases. The full-stack developer is a mixture of both, a jack of all trades that can handle the whole design process from the beginning to the end.

Note that there’s a trend these days where the line between the front end and back end development has been blurring. Primarily since many of the tasks that fall in the domain of back end developers are being increasingly handled by the front end developers.

As a final aside, there are also full-stack engineers. They are full-stack developers who have project management experience, adept at disciplines in the configuring, managing, and maintaining computer networks and systems.

Front End Developer Roles and Responsibilities

If you're wondering what a front end developer does, he must:

Decide web page design and structure
Develop features to enhance the users’ experience
Striking a balance between functional and aesthetic design.
Make sure the web design is smartphone-capable
Build reusable code for future use
Make sure web pages are optimized for best speed and scalability
Employ a diverse selection of markup languages to design web pages
Keep the brand consist throughout the whole design

Skills Required to Become a Front End Developer

Since the front end developer is the rock star of website/app development, they need to have a well-stocked personal toolbox. So a front end developer skills include the need to:

Have a degree in Computer Science or similar field
Be proficient in coding languages such as HTML, CSS, JavaScript, and jQuery
Understand server-side CSS.
Be experienced with graphic design applications (e.g., Adobe Illustrator)
Understand the principles of SEO
Have excellent skills in problem-solving
Be proficient in communicating with team members, bosses, and clients
Have good interpersonal skills

How to Become a Front End Developer?

You can become a front end developer if you follow these simple steps.

Learn CSS, JavaScript and HTML
These coding languages are the essential building blocks for web and app development, so you need to learn them. Fortunately, it’s not a very difficult undertaking. There are lots of online resources available out there that can help further your education in the coding languages. For extra credit, familiarize yourself with jQuery and JavaScript Frameworks.
Get Informed
That means reading articles and books about front end development. By getting an understanding of how things work on a website, you can make better sense of the various coding languages. If you want to round out your learning experience, check out some videos on YouTube.
Practice
Here’s where the old saying “practice makes perfect” comes into play. Start small by using your newfound knowledge to build small parts of a user interface, then expand slowly. If you end up making mistakes, don’t worry. Sometimes we learn more from our errors than we do from a flawless performance.
Learn the Command Line
When pursuing a profession that has anything to do with web design, it’s a good idea to get at least a basic grasp of concepts like displaying files and filesystem navigation. On a related note, you should familiarize yourself with the properties of the Shell, which is the means of accessing operating system functions via a text interface.
Learn Version Control
One of the hazards of coding is having it break when you change one small thing. Even after you try to rectify the problem, things are never quite the same again. That’s why a good front end developer learns version control. There is an impressive selection of version control systems to choose from, but if you want to go with the most popular, go with Git.
Enhance Your Skills
Check out some tutorials, tools, and open-source projects. Resources such as freeCodeCamp, Codecademy, Bootstrap, Vue.js, CSS Layout, and Front-end Checklist exists to help you master the skills of front end development without having to lay out any money for the opportunity. These tools are easily accessible online and can be a much-needed boost to your front end development education.
Take a Course
Take a front end development course. There’s nothing like learning from experienced people in a structured environment. You could do this by physically attending classes (which can be a drain on your free time), or taking an online course. There are many appropriate courses out there, but later on, we’ll show you an excellent and well-tested option that would perfectly fit your needs!
Get an Internship
Become a junior front end developer. Sometimes, the best way to learn new skills is to work under more knowledgeable people, and that’s what a junior front end developer or an intern does. Of course, the pay is less, but you need fewer qualifications. Besides, you’ll be learning from more experienced people, and that’s always beneficial.

What Skills do Front End Web Developers Use?

Front end web developers use three primary coding languages to code the website and web app designs created by web designers:

HTML
CSS
JavaScript
The code they write runs inside the user’s browser (as opposed to a back end developer, whose code runs on the web server). Think of it a little like this: the back end developer is like the engineer who designs and creates the systems that make a city work (electricity, water and sewer, zoning, etc.), while the front end developer is the one who lays out the streets and makes sure everything is connected properly so people can live their lives (a simplified analogy, but you get the rough idea). A front end web developer is also in charge of making sure that there are no errors or bugs on the front end, as well as making sure that the design appears as it’s supposed to across various platforms and browsers.
I’ve combed through dozens of front end web developer job listings to see which skills are the most in-demand right now. These are the things that real employers are looking for in job applicants today (and will still be looking for in the near future). Master these things and you’re certain to land an awesome front end dev job!
Skillcrush’s Break Into Tech program is an online course where you’ll get a solid foundation en route to landing the developer job you’re after. If you enroll in the Front End Developer Fast Track, you’ll start with skills like HTML and CSS, then move on to more advanced skills, like responsive web development, Git, and JavaScript.
HTML & CSS:-
HTML (Hyper Text Markup Language) and CSS (Cascading Style Sheets) are the most basic building blocks of web coding. Without these two things, you can’t create a website design, and all you’ll end up with is unformatted plain text on the screen. You can’t even add images to a page without HTML!
Before you get started on any web development career path, you’ll have to master coding with HTML and CSS. The good news is that getting a solid working knowledge of either of these can be done in just a few weeks.
The best part: HTML and CSS knowledge alone will let you build basic websites.
JavaScript:-
JavaScript lets you add a ton more functionality to your websites, and you can create a lot of basic web applications using nothing more than HTML, CSS, and JavaScript (JS for short). On the most basic level, JS is used to create and control things like maps that update in real time, interactive films, and online games. Sites like Pinterest use JavaScript heavily to make their user interface easy to use (the fact that the page doesn’t reload whenever you pin something is thanks to JavaScript!).
It’s also the most popular programming language in the world, so regardless of your dev career plans, it’s a super valuable thing to learn.
jQuery:-
jQuery is a JavaScript library: a collection of plugins and extensions that makes developing with JavaScript faster and easier. Rather than having to code everything from scratch, jQuery lets a front end web developer add ready-made elements to projects, then customize as necessary (one reason why knowing JavaScript is so important). You can use jQuery for things like countdown timers, search form autocomplete, and even automatically-rearranging and resizing grid layouts.
JavaScript Frameworks:-
JS frameworks (including AngularJS, Backbone, Ember, and ReactJS) give a ready-made structure to your JavaScript code. There are different types of JavaScript frameworks for different needs, though the four mentioned are the most popular in actual job listings. These frameworks really speed up development by giving you a jumpstart, and can be used with libraries like jQuery to minimize how much from-scratch coding you have to do.
Front End Frameworks:-
CSS and front end frameworks (the most popular front end framework is Bootstrap) do for CSS what JS Frameworks do for JavaScript: they give you a jumping-off point for faster coding. Since so much CSS starts with exactly the same elements from project to project, a framework that defines all of these for you upfront is super valuable. Most front end developer job listings expect you to be familiar with how these frameworks work and how to use them.
Experience with CSS Preprocessors:-
Preprocessors are another element that a front end developer can use to speed up CSS coding. A CSS preprocessor adds extra functionality to CSS to keep our CSS scalable and easier to work with. It processes your code before you publish it to your website, and turns it into well-formatted and cross-browser friendly CSS. SASS and LESS are the two most in-demand preprocessors, according to real job listings.
Experience with RESTful Services and APIs:-
Without getting too technical on this one, REST stands for Representational State Transfer. In basic terms, it’s a lightweight architecture that simplifies network communication on the web, and RESTful services and APIs are those web services that adhere to REST architecture. Read more about REST and RESTful services here.
Let’s say you wanted to write an app that shows you all your social media friends in the order you became friends. You could make calls to Facebook’s RESTful API to read your friends list and return that data. The same thing with Twitter (which also uses RESTful APIs). The general process is the same for any service that uses RESTful APIs, just the data returned will be different.
While it all sounds really complicated and technical, it’s a simple set of guidelines and practices that set expectations so you know how to communicate with a web service. They also make a web service perform better, scale better, work more reliably, and be easier to modify or move.
Responsive and Mobile Design:-
In the US alone, more people access the internet from their mobile device than from a desktop computer, so it’s no wonder that responsive and mobile design skills are super important to employers. Responsive design means that the site’s layout (and sometimes functionality and content) change based on the screen size and device someone is using.
For example, when a website is visited from a desktop computer with a big monitor, a user would get multiple columns, big graphics, and interaction created specifically for mouse and keyboard users. On a mobile device, the same website would appear as a single column optimized for touch interaction, but using the same base files.
Mobile design can include responsive design, but also includes creating separate mobile-specific designs. Sometimes the experience you want a user to have when visiting your site on a desktop computer is entirely different than what you want them to see when visiting from their smartphone, and in those cases it makes sense for the mobile site to be completely different. A bank website with online banking, for example, would benefit from a separate mobile site that lets users view things like the closest bank location and a simplified account view (since mobile screens are smaller).
If you want to learn all about mobile design, check out the Secrets To Building Mobile Sites Users Love.
Cross-Browser Development:-
Modern browsers are getting pretty good at displaying websites consistently, but there are still differences in how they interpret code behind the scenes. Until all modern browsers work perfectly with web standards, knowing how to make each of them work the way you want them to is an important skill. That’s what cross-browser development is all about.
Read more about cross-browser compatibility here and here, or check out Daniel Herken’s Cross Browser Handbook for a deeper dive.
Content Management Systems and E-commerce Platforms:-
Almost every website out there is built on a content management system (CMS). (E-commerce platforms are a specific type of CMS.) The most popular CMS worldwide is WordPress, which is behind-the-scenes of millions of websites (including Skillcrush!)—almost 60% of websites that use a CMS use WordPress.
The other most popular CMSs include Joomla, Drupal, and Magento. While knowing these won’t put you in as much demand as being a WordPress expert, they can give you a niche that will be desirable among companies who use those systems (and there are plenty out there).
Skillcrush’s Freelance WordPress Developer Blueprint is a great place to learn what you need to know to get started!
Testing and Debugging:-
It’s a fact of life for a front end web developer: bugs happen. Being familiar with testing and debugging processes is vital.
Unit testing is the process of testing individual blocks of source code (the instructions that tell a website how it should work), and unit testing frameworks provide a specific method and structure for doing so (there are different ones for each programming language).
Another common type of testing is UI testing (also called acceptance testing, browser testing, or functional testing), where you check to make sure that the website behaves as it should when a user is actually taking actions on the site. You can write tests that will look for things like particular HTML on a page after an action is taken (like making sure that if a user forgets to fill out a required form field, that your form error box pops up).
Debugging is simply taking all the “bugs” (errors) those tests uncover (or your users uncover once your site is launched), putting on your detective hat to figure out why and how they’re happening, and fixing the problem. Different companies use slightly different processes for this, but if you’ve used one, you can adapt to others pretty easily.
Git and Version Control Systems:-
Version control systems let you keep track of changes that have been made to code over time. They also make it easy to revert back to an earlier version if you screw something up. So let’s say you add a customized jQuery plugin and suddenly half your other code breaks. Rather than having to scramble to manually undo it and fix all the errors, you can roll back to a previous version and then try again with a different solution.
Git is the most widely used of these version control management systems. Knowing how to use Git is going to be a requirement for virtually any development job. This is one of those vital job skills that developers need to have, but that few actually talk about.
Problem Solving Skills:-
If there’s one thing that all front end developers have to have, regardless of the job description or official title, it’s excellent problem solving skills. From figuring out how to best implement a design, to fixing bugs that crop up, to figuring out how to make your front end code work with the backend code being implemented, development is all about creative problem solving.
Let’s say you’ve created a perfectly-functioning website front end, and you hand it over to the back end developers for them to integrate it with the content management system. All of a sudden, half your awesome features stop working. A good front end developer will view this as a puzzle to be solved, rather than a disaster in the making. Of course, an excellent, senior-level front end developer will anticipate these problems and try to prevent them in the first place!
What’s the Future of Front End Developers?

Overall, the future looks bright for anyone who wants to become a front end developer. The latest studies predict that by 2021, there will be a deficit of approximately 1 million developers in the United States alone. The rest of the world will have it even worse, according to similar studies.

According to the United States Bureau of Labor Statistics, Web developer employment in the US is projected to grow 15% from 2016 to 2026. The rate is much faster than the average for all other occupations.

Although these numbers seem incredible, if you pause and consider the times, it’s not so surprising. Increased Internet usage, especially in the mobile field, means a greater need for user interfaces, which in turn means more front end developer jobs. Web development is a field whose potential is tied closely to the Internet’s popularity, and the latter is surging with no signs of letting up. If you want to go where the jobs are, then look no further.

The Web Developer RoadMap

2021-01-06T09:00:00.002+05:30

Hello Guys, I hope you are doing great. I am sure you all have already made your goals by now and thinking about how to achieve those goals. If one of your goals is to learn to code or to become a Web Developer then I have something great to share with you today, the Web Developer RoadMap.

It’s a collection of different paths to learning front-end, back-end, and all other things a Web developer should know. You will not just know about web development but about essential programming stuff which is important for all kind of programmers.

The RoadMap is also divided into 3 sections, the first section is about common skills which every web developer should know, while the second and third section is about front-end and back-end development, two main areas of web development.

You can either learn Front-end or Back-end or both, depending upon your choice. If you want to become a FullStack Web developer then you have to learn both front-end and back-end, there is no escaping there.

In Frontend also you can choose to learn the framework you want like React, Angular or Vue.js, you don’t need to learn them all but learn the one you like.

Anyway, Here’s where you’ll start. As I have said before, You can choose either the Front-end or Back-end path below, depending upon your interest. Regardless, there are eight recommendations in yellow that you must learn for either path, these are the common things every programmer should know.

How to become a Web Developer in 20

1. Git:-
One of the most popular version control system. It’s just not possible to live without Git anymore. You can check out The Git Complete Guide on Udemy to start with.

2. SSH:-
It allows you to remove login to another host, another popular networking concepts which every web developer should know.

3. HTTP / HTTPS:-
The HTTP protocol is the backbone of web and a good knowledge of both HTTP and HTTPS is mandatory for a web developer

4. Basic Terminal Usage Linux Command line Basics:-
Not just a web developer but for any programmer, the Linux command line is very very important and I strongly recommend you to spend some time to learn them. The Linux command line basics course on Udemy is a good place to start with and if you like free courses, you can use these free Linux courses to start learning Linux.

5. Data Structures and Algorithms:-
These are the building blocks of any program and better knowledge of Algorithms and Data Structure is key for your next job or doing well on your current job.

6. Character Encodings:-

If you are creating global applications which shows information in many different languages across the world then you should have a good knowledge of character encodings. It basically tells your browser how to show your data.

7. GitHub:-
There is no doubt that every programmer should know Git and Github as they are the standard in terms of version control and code repository. If you want to learn and master Git and Github, you can check these free Git course.

The Frontend Developer RoadMap:-

If you want to become a front-end developer then you should follow the below Front-end Developer RoadMap. You should focus on yellow boxes which highlight important things to learn and follow from there. Below the RoadMap, you will find additional resources like books and courses to aid your learning.

1. Web Development Basics:-

It’s pretty obvious that if you want to become a Web Developer then you should know the basics of internet, web applications, protocols like HTTP and web development in general. Thankfully there are a lot of courses where you can not only learn these but much more than that.

I recommend the following resources for all programmers who want to learn Web Development:

2. HTML and CSS:-

HTML and CSS are the backbones of any website. HTML provides the structure while CSS provides the style and help them to look better and more visually appealing. If you want to become a serious frontend developer then you must master these two and to start with, you can check these free HTML and CSS courses to learn online.

3. JavaScript:-

Just like four pillars of object-oriented programming, I mean Abstraction, Encapsulation, Polymorphism, and Inheritance, there are three main pillars of web development, namely — HTML, CSS, and JavaScript.

The first two provides structure and style but it’s the JavaScript which makes them alive by adding inter activeness. It’s extremely important for a modern Java developer to learn JavaScript and thankfully there are many courses which you can look to learn both beginner and advanced JavaScript, here are some recommendations:

4. TypeScript:-

Just like we have C and C++, TypeScript can be considered as JavaScript++ though it’s not as popular as C++.The good part of TypeScript is that it adds type-safety in JavaScript code which means you can catch nasty JavaScript type related errors in the development phase.It also makes developing object-oriented code easily for JavaScript. If you want to learn TypeScript, Understanding TypeScript is a great course to start with and if you need more choices or free alternatives, here is another list of some free TypeScript courses to start with.

5. Angular:-

Gone are the days when people build websites using plain HTML, CSS, and JavaScript. Nowadays most of the work is done by a framework like Angular, React JS or Vue.js.

They not only provide a structure for storing your code but also makes it easy to develop a web application in quick time.

Angular is backed by Google, hence learning Angular is a good choice for any modern Web Developer. If you want to learn Angular there is no better course than Max’s Angular 7 (formerly Angular 2) — The Complete Guide on Udemy.

6. React JS:-

Similar to Angular, React is also a popular library for developing web applications. It allows you to write reusable components which you can then use to create modern looking interactive web pages.Like Angular is backed by Google, React is backed by Facebook and hence quite popular. If you want to learn React then you either join Stephen Grider’s Modern React with Redux or Max’s React — The Complete Guide on Udemy. Both are excellent courses to learn to React online.

Here are the links:

7. Vue.js:-

The Vue or Vue JS has really picked up speed last year and more and more people are recommending and using Vue.js. I am still a beginner on Vue and probably take some time to learn and migrate into Vue based application. But, if you have already made a decision you can start with Vue.js Essentials course on Udemy.

The Backend Developer RoadMap:-

If you want to become a back-end developer, then you can follow this Back-end Developer RoadMap. Again, you can start with yellow boxes which highlight key technologies you need to learn and then grow from there. Below the RoadMap, you will find some supplementary material and links to courses and books to aid your learning.

1. Node.js:-

There are many choices to develop your web application’s backend e.g. you can use Java and Spring or maybe Python + Django but in recent year Node.js has come up as the preferred option.The best thing about NodeJS is that it allows you to develop a complete web application using just one programming language — JavaScript.If you want to go Node route, then The Complete Node.js Developer course by Rob Percival and Andrew Mead is best to start with.

2. Java:-

I am primarily a Java developer who have learned Web Development and other programming languages, hence when it comes to developing backend my preferred choice is Java. You can either use Core Java or Java + Spring Boot to write a cutting edge, high-performance backend. If you want to go Java and Spring route, here are a couple of courses you can join to get up-to-speed.

3. Python:-

Python is another awesome language, full of powerful framework and libraries. If you want to develop backend using Python then you can use Django, a full-stack web development framework for Python programmers. To start with here are a couple of courses to learn Python and Django:

4. Ruby:-

Ruby is another powerful language perfect for web development. It has got a great framework called Rails which makes creating Web applications really easy and fast. If you want to start with Ruby you can check out The Complete Ruby on Rails Developer Course on Udemy.

5. PHP and MySQL:-

Forget about whatever negative things people say about PHP. It is still the easiest way to write the server side code and many, almost 50% of the internet runs on PHP and MySQL stack.

If you are interested in learning PHP, you can check out PHP for Beginners course on Udemy. If you need more choices and free resources, you can also check my list of free PHP and MySQL courses to start with.

That’s all about how to become a Web Developer. This is an excellent resource to start with as it highlights several paths to become the Web developer you always wanted to be.

Though, if you stuck somewhere and if there is any confusion, you can always ask here and we’ll try to answer your queries as best as possible.

Top 10 In-Demand programming languages to learn in 2021.

2020-12-31T08:55:00.001+05:30

The top programming languages for new developers.

There are around 600 programming languages out there. The demand and popularity of programming languages fluctuate every year. Also, new programming languages are coming with attractive features.

So, which programming language should you learn? Learning a new programming language is always an investment of your time and brainpower. If you are a seasoned developer or if you already know several programming languages, then you can learn a niche, modern one.
But if you are starting your programming career in 2020 or if you want to learn your first or second programming language, then it is wise to learn one of the mainstream and established programming languages. Here I will list programming languages based on the following criteria:
Already mainstream and firmly established in the Software Development industry.
Top-ranked in the renowned programming languages ranking websites.
Popularity is increasing or stable and not sharply decreasing.
They have a large set of libraries, frameworks, tooling support, and have a large community.
They are demanding in the job market with a good salary.

1) Python:-

For people just starting out with computer science in 2021, and even for those with some experience with this language, Python is something every programmer should be comfortable with. This language offers an intuitive and easy-to-learn syntax that makes it a popular choice among beginners and professionals alike. The beauty of Python is that it is extremely versatile, as it can almost be used anywhere. Whether you want to work on some back-end application of a website or mobile application, or you want to on some data science-related work, Python is critical to these tasks and many more. Python is the preferred language in the areas of machine learning, deep learning, artificial intelligence, and other data science fields. Data science is the hottest topic these days, as businesses and companies are now extracting insights from data analysis and using that to further grow their markets. Libraries, such as TensorFlow, Keras, Scikit, etc., have made the computation required for running different models extremely cheap and fast to execute.

This versatility and availability of all kinds of libraries in Python have led to enormous growth in demand for this language. Python just keeps on growing without slowing down.

2) JavaScript:-

JavaScript is one of the most widely used languages, as it is considered the standard programming language of the web. It is used in almost every website you have seen on the Internet. JavaScript provides a syntax that allows it to be used in both the front-end and back-end sections of websites, showing the flexibility and power that it possesses. In addition to HTML and CSS, JavaScript offers a way that allows users to not only develop and design their websites but also make their websites more dynamic by adding functionalities to the elements present in the site. Moreover, Javascript is also the fundamental language used in web frameworks, such as React, Vue, and Node, making it the undisputed king in the web development department. Websites that you regularly visit, such as Google, YouTube, and Wikipedia, were all created using JavaScript.

Code:

Result:

3) Java:-

Java is another immensely popular programming language that, albeit being one of the oldest languages out there, is still highly in-demand. Java is often used in the work of large organizations. It is also widely used in Android development, which, considering the popularity that Android applications have garnered, makes Java a highly sought-after skill to have. Due to Java’s scalability, strong memory allocation, and high performance, companies like Amazon, Twitter, and Adobe are a few names that come under the list of users of this programming language, along with a million other repositories that can be found at GitHub.

4) C/C++ :-

C/C++ is among the fastest programming languages out there, providing a high level of functionality. This language is therefore used in the majority of low-level systems, such as operating systems, embedded systems, kernel development, etc. It is even used as a baseline in the development of other programming languages. Due to its large set of libraries and stable nature, C/C++ also plays a huge role in the areas of game development, computer graphics, virtual reality, and more. Companies like Nvidia, Google, Microsoft, and Apple are often on the lookout for C/C++ developers.

5) C# :-

C# is a programming language developed by Microsoft that has made quite a name for itself in the web and game development departments. C# is most regularly used in the Unity software, which is one of the most popular game engine software used for building 2D and 3D video games. C# also plays a huge role in building Windows applications and has therefore been used at the back-end side of websites such as Bing, Visual Studio, etc.

Code:

Script being used in Unity:

6) PHP:-

Despite the huge popularity that languages like Python and JavaScript have garnered in backend development, PHP is still going strong and continues to be used by large companies, including Facebook, Yahoo, and Wikipedia. There remains a huge demand for PHP developers in the market, as many websites (particularly WordPress) around the web are running using PHP as their baseline. Therefore, PHP is still a great choice as a language to learn in 2021.

Code:

Result:

7) Swift:-

Swift is a programming language developed by Apple for creating iOS applications. It is one of the most in-demand languages out there, as iOS applications are still extremely popular among users and Apple is still standing strong. Although Flutter (Dart) and React Native are also options for iOS development, Swift is still the more widely used and preferred option.

8) Kotlin:-

Kotlin is a language developed by JetBrains whose work revolves around the development of Android applications. This is precisely why Google decided to name Kotlin as the official language for Android development, putting it ahead of Java. And, as Android is the highest-selling mobile operating system, the fact that Kotlin is one of the languages to learn in 2021 comes as no surprise.

Vulnerabilities That Ethical Hacker Can Uncover.

2020-12-29T13:58:00.001+05:30

Protocols of ethical hacking:-

Staying legal is the foremost key to ethical hacking. The ethical hackers must take management’s approval before performing a security assessment.
Approval defines the scope of ethical hacking. The scope of security assessment should be restricted to the pre-defined legal boundaries.
By reporting vulnerabilities identified during the assessment, an ethical hacker suggests the remedies to resolve them.
Guided by the ethical motive, data security is again one of the crucial tasks of ethical hackers. They should agree to the organization’s non-disclosure policy.

Types of problems that ethical hacking can address:-

Ethical hacking duplicates the black hat hacking technique to assess security vulnerabilities. Initially, ethical hackers performed reconnaissance to collect as much information as possible. The information is collected by performing automated and manual testing on the permitted area to attack. Once the vulnerabilities are identified, ethical hackers use exploits against them to explain the consequences.

The most common vulnerabilities that ethical hacking can discover are –

1. Broken authentication:-

It allows the user to bypass the authentication process on a web application. The attacker can perform automated attacks such as credential surfing. It is part of ethical hacking to test for broken authentication.

2. Security misconfigurations:-

This vulnerability is listed among the top vulnerabilities on OWASP. It is about the misconception that an organization has with regard to its security posture. The organization will be in a false notion of having a secure environment in the company. Whereas ethical hacking helps locate the security gaps that could lead to serious threats when identified by black hats.

3. Injection attacks:-

It is a broad attack vector where an attacker injects untrusted input into the application. This code or query gets processed by an interpreter which alters the execution of the program. The ethical hacker on penetrating the application coding can locate the weak corner that allows the attacker to inject the code.

4. Components with known vulnerabilities:-

These are often ignored by developers, and hence, they are exploited by malicious attackers. Automated tools can be used to identify vulnerable components to some extent. Whereas, few vulnerabilities take deeper intrusions to be found and removed.

5. Sensitive data exposure:-

It is again listed among the top 10 vulnerabilities of OWASP as it can put critical data at risk. The data may include contact numbers, passwords, credit card details, private health data, and many more. These details, when exposed, may result in a potential data breach.

After performing the penetration testing, ethical hackers list their findings and prepare a detailed report. The document explains the traced vulnerabilities and the process to mitigate them.

What skills and certifications should an ethical hacker have?

Ethical hackers play an important role in the refining of the security posture of an organization. They are subject matter experts with a wide range of computer skills. Briefly, the skills that a typical ethical hacker should have are

Proficiency in networking and operating systems
Expertise in scripting languages
Knowledge of information security

The most recognized ethical hacking certification: Certified Ethical Hacker (C|EH)

C|EH is the most desired security certification that every information security professional seeks to have. It puts you in a hacker’s seat and enables you to think and act similar to that of a malicious attacker. By being in the shoes of an attacker, you could perform the test faster and defend the systems with efficacy. C|EH covers all the five phases of ethical hacking. They are – reconnaissance, gaining access, enumeration, maintaining access and covering your tracks. It is the world’s most advanced and comprehensive ethical hacking course. It has 20 of the most updated security domains and 340 latest methodologies