Module 4
Scanning and Enumeration
A. Determining the Network Range
After the target has been analyzed and all relevant information organized, port
scanning can take place. The goal of performing port scanning is to identify open and
closed ports as well as the services running on a given system. Port scanning forms a
critical step in the attack process because the hacker needs to identify what services are
present and running on a target system prior to initiating an effective attack. Port
scanning also helps to determine the course of action in future steps because once the
nature of running services is identified, an attacker can select the best tools for the attack.
For example, a hacker may have a specific tool to target vulnerabilities found in the
Microsoft Internet Information Services (IIS) web server. However, if the victim is
running the Apache web server, the exploit tool will be incompatible. Once a port scan
has been thoroughly performed, the hacker can then move on to mapping the network and
looking for vulnerabilities that can be exploited.
The first step in port scanning is preparation— specifically, the gathering of
information about the range of Internet Protocol (IP) addresses in use by the target. With
this information, the port scanning process can become much more accurate and effective
because only the IP addresses on the intended victim will be scanned. Not having the
appropriate network range can result in an inaccurate or ineffective scan that may even
inadvertently set off detective measures.
Exploring the intricacies of obtaining information about network ranges unveils a
critical decision-making process for network administrators and cybersecurity
professionals. When embarking on this endeavor, individuals are presented with two
primary options: a manual registrar query or an automatic registrar query, each carrying
its own set of advantages and considerations. Furthermore, the importance of positively
identifying the network range cannot be overstated, setting the foundation for subsequent
actions. Additionally, delving into the realm of tools available for this task, such as Root
Zone and Whois, provides further insights into streamlining and enhancing the accuracy
of this critical phase in network management.
The manual registrar query approach involves directly navigating to registration
sites and conducting inquiries manually. This hands-on method provides a level of
control and precision, allowing individuals to interact directly with the registrar databases
to retrieve information about the network ranges. While it offers a personalized and
detailed approach, the manual method may be time-consuming, especially in the case of
large networks or complex configurations. Nevertheless, for those who prioritize
meticulousness and hands-on control, the manual registrar query remains a valuable
option.
On the other hand, the automatic registrar query method leverages web-based
tools to streamline the process of gathering information about network ranges. This
approach utilizes specialized tools that automate the querying process, potentially saving
time and effort. Web-based tools, such as those integrating Whois services, can
efficiently retrieve and present information about network ranges, making them
accessible and comprehensible for administrators. While the automatic method offers
efficiency, it is crucial to bear in mind that the accuracy of the results is contingent on the
reliability of the web-based tools and databases they access.
Regardless of the chosen method, the foundational step in this process is the
positive identification of the network range. Ensuring accuracy in identifying the range is
paramount before proceeding with any further actions. Inaccuracies at this stage can lead
to misguided decisions, potentially impacting network security, accessibility, and overall
management. To achieve this, network administrators often turn to specialized tools such
as Root Zone and Whois, which provide authoritative information about domain
registrations and IP addresses. These tools act as a safeguard, enhancing the reliability of
the identified network range.
Root Zone, as a fundamental component of the Domain Name System (DNS),
serves as a valuable resource for obtaining authoritative information about top-level
domains. Its structured hierarchy provides a comprehensive view of domain registrations,
aiding in the accurate identification of network ranges. Additionally, Whois services offer
a centralized repository of domain registration information, allowing administrators to
query and verify details about IP addresses, domain names, and registrants.
In conclusion, the process of obtaining information about network ranges involves
critical decision points and considerations. The choice between manual and automatic
registrar queries reflects a balance between control and efficiency. Positive identification
of the network range emerges as the linchpin, ensuring the accuracy and reliability of
subsequent actions. The integration of tools such as Root Zone and Whois adds a layer of
validation, fortifying the network administrator's ability to make informed decisions in
the dynamic landscape of network management and cybersecurity.
B. Identifying Active Machines
Once a valid network range has been determined, the next step is to identify
active machines on the network. There are several ways that this task can be
accomplished, including the following wardialing (legacy technique that is rarely used),
wardriving and related activities, pinging, port scanning. Each of these methods offers
different capabilities useful in detecting active systems and as such will need to be
explored individually. To use each of these techniques, the attacker must clearly
understand areas for which they are useful as well as those areas in which they are weak.
A technique used by many hackers in the first few decades of widespread
personal computer use is wardialing. Wardialing is a technique that was popular in the
1980s and 1990s as a footprinting tool, which explains why the process involves the use
of modems. Wardialing is very simple: It uses a modem to dial phone numbers to locate
modems. An attacker who picked a town at random and dialed up a range of phone
numbers in that town would likely turn up several computers with modems attached.
Wardialing using modems is a legacy technique with extremely limited utility value
today, but it does give rise to many similar techniques that essentially search for open
communication ports.
Wardriving is another technique for uncovering access points into a network.
Wardriving is the process of locating wireless access points and gaining information
about the configuration of each. This “sniffing” was initially performed with a laptop
computer, a car, and software designed to record the access points detected. Additionally,
a Global Positioning System (GPS) was optionally included to go to the next step of
mapping the physical location of the access points. It wasn’t long before mobile devices
became smaller, more functional, and better suited to finding wireless access points. The
ease of carrying around a small device with a wireless adapter, GPS receiver, and
software to collect information gave rise to warwalking, warjogging, warbiking, and even
warflying. If an attacker is able to locate even a single unsecured access point, the
dangers can be enormous because it can give that same attacker quick and easy access to
the internal network of a company. An attacker connecting to an unsecured access point
is more than likely bypassing protective measures, such as the corporate firewall.
So why is wardriving successful? One of the most common reasons is that in spite
of increasingly aggressive security measures, personnel sometimes install their own
access points on the company network without company permission (known as a rogue
access point). An individual who installs an access point in such a way will more than
likely have no knowledge of, or possibly not care about, good security practices and may
well leave the access point completely unsecured. Another reason is that sometimes when
an access point has been installed, those performing the installation have actively decided
not to configure any security features. Wardriving generally preys upon situations in
which security is not considered or is poorly planned. Make sure you stay out of
situations like that.
A technique that is useful at determining whether a system is present and active is
a ping sweep of an IP address range. By default, a computer will respond to a ping
request with a ping reply or echo. A ping is a network utility that sends an Internet
Control Message Protocol (ICMP) message. With the use of a ping, it is possible to
identify active machines and measure the speed at which packets are moved from one
host to another as well as obtain details, such as the time to live (TTL).
The next step to take after discovering active systems is to find out what services
are available on the systems. The most straightforward technique is to scan ports for
active services. Port scanning is designed to probe each port on a system in an effort to
determine which ports are open. It is effective for gaining information about a host
because the probes sent to a system have the capability to reveal more information than a
ping sweep can. A successful port scan will return results that will give a clear picture of
what services are running on a system. This is because ports are bound to services.
TCP is a protocol that was designed to enable reliable communication, fault
tolerance, and reliable delivery. All of these attributes allow for a better communication
mechanism, but at the same time, these features allow an attacker to craft TCP packets
designed to gain information about running applications or services. To better understand
these attacks, a quick overview of flags is needed. Flags are bits that are set in the header
of a packet, each describing a specific behavior as shown in TABLE 6-2. A penetration
tester or attacker with a good knowledge of these flags can use this knowledge to craft
packets and tune scans to get the best results every time.
TCP offers a tremendous capability and flexibility because of flags that can be set
as needed. However, UDP does not offer the same capabilities, largely because of the
mechanics of the protocol itself. UDP can be thought of as a fire-and-forget or best-effort
protocol and, as such, uses none of the flags and offers none of the feedback that is
provided with TCP. UDP is harder to use for port scans successfully. The reason UDP is
more difficult to use in port scanning is that as data is transmitted, there are no
mechanisms designed to return feedback to the sender. A failed delivery of a packet from
a client to a server offers only an ICMP message as an indicator of events that have
transpired. Port scanning is an effective tool for an ethical hacker or attacker, and proper
countermeasures should be deployed to limit results to authorized individuals. These
countermeasures include the range of techniques utilized by an organization’s IT security
group to detect and prevent port scanning from returning useful information.
C. Mapping Open Ports
Once an attacker completes the port scanning phase, it is time to move on to the
next step of mapping the network. An attack in this stage has moved to a more interactive
and aggressive approach. There are many tools available that can be used to map open
ports and identify services running on servers in a target network. Because every tool
cannot be covered here, it is necessary to limit the discussion to those tools that are
widely used and well known. No matter which tools are to be used, however, the activity
at this point can be boiled down to determining whether a target is online and then port
scanning the target.
Nmap (Network Mapper) is one of the most widely used security tools, and a firm
understanding of this utility is generally considered to be a basic requirement for security
professionals. At its core, Nmap is a port scanner that has the capability to perform a
number of different scan types. The scanner is freely available for several operating
systems, including Windows, Linux, MacOS, and others. By design, the software runs as
a command-line application, but to make usage easier, a graphical user interface (GUI) is
available through which the scan can be configured. The strength of Nmap is that it has
numerous command-line switches to tailor the scan to return the desired information.
SuperScan is a Windows-based port scanner developed by Foundstone. This port
scanner is designed to scan TCP and UDP ports, perform ping scans, run Whois queries,
and use Traceroute. SuperScan is a GUI-based tool that has a preconfigured list of ports
to scan or can be customized to scan a specific range. Scanrand is a scanning tool that is
designed to scan a single host up to large-scale networks quickly and then return results
about the network. Scanrand is unique among network scanners because although most
scanning tools scan one port at a time, Scanrand scans ports in parallel using what is
known as stateless scanning. By using stateless scanning, Scanrand can perform scans
much faster than other network scanners.
THC-Amap (The Hacker’s Choice–Another Mapper) is a scanner that offers a
different approach to scanning. When using traditional scanning programs, problems
arise when services that use encryption are scanned because these services might not
return a banner because certain services, such as the Secure Sockets Layer (SSL), expect
a handshake. Amap handles this by storing a collection of normal responses that can be
provided to ports to elicit a response. The tool also excels at allowing the security
professional to find services that have been redirected from standard ports.
D. OS Fingerprinting
Open ports that have been uncovered during the port scanning phase need to be
further investigated. The mere existence of an open port does not mean vulnerability
exists. Attackers must probe for more information to determine whether vulnerabilities
that exist can be exploited. The open ports that are discovered provide clues to what
operating system (OS) the target is running. Determining the OS that is running on a
specific target is the purpose of OS fingerprinting. Once an OS is identified, it is possible
to better focus the attacks that come later. To identify an OS, there are two different
methods that can be utilized: active fingerprinting or passive fingerprinting.
The process of active OS fingerprinting is accomplished by sending specially
crafted packets to the targeted system. In practice, multiple probes or triggers are sent
from the scanning system to the target. When the responses are received from a target
system, an educated guess can be made as to the OS that is present. Though it may appear
otherwise, OS identification is an accurate method of determining the system in place
because the tools have become much more accurate than in the past.
Xprobe2, a commonly used active fingerprinting tool, relies on a unique method
to identify an operating system known as fuzzy signature matching. This method consists
of performing a series of tests against a certain target and collecting the results. The
results are then analyzed to determine the probability that a system is running a specific
OS. Xprobe2 cannot say definitively which OS is running but instead uses the results to
infer what system is running.
The alternative to active fingerprinting is passive fingerprinting, which
approaches the process differently. Passive fingerprinting, by design, does not interact
with the target system itself. It is a passive tool that monitors or captures network traffic.
The traffic monitored is analyzed for patterns that would suggest which OSs are in use.
Passive OS fingerprinting tools simply sniff network traffic and then match that traffic to
specific OS signatures. The database of known patterns can be updated from time to time
as new OSs are released and updated. As an example, a tool may have a fingerprint for
Windows 7 but will need to be updated to include Windows 10.
One tool for performing passive OS fingerprinting is p0f, which can identify an
OS using passive techniques. That means p0f can identify the target without placing any
additional traffic on the network that can lead to detection. The tool makes attempts to
fingerprint the system based on the incoming connections that are attempted.
E. Mapping the Network
The next step in the process is to generate a picture of the network that is being
targeted. When the information has been collected and organized, a network diagram can
be produced that will show vulnerable or potentially vulnerable devices on the target
network. A number of network management tools can produce an accurate map of the
network based on information that has been gathered previously in addition to new
information. Some tools that can help in the process include SolarWinds, Auvik, Open-
AudIT, The Dude, Angry IP Scanner, Spiceworks Map IT, and Network Notepad. These
tools generally either scan your network and provide lists of discovered devices, allow
you to graphically depict devices on your network, or scan and automatically generate
visual network maps.
When it comes to managing and cataloging the various computers and devices
within a network, different approaches offer varying levels of efficiency and accuracy.
One common method involves the manual creation of a list, a straightforward yet error-
prone process that often leads to oversights. On the other end of the spectrum, utilizing
specialized software utilities for network scanning provides a more comprehensive
solution, although it is not without its limitations.
The manual creation of a list entails the laborious task of individually identifying
and documenting each computer and device on the network. While this method is
relatively easy to initiate, the inherent challenges lie in its susceptibility to human error.
The potential for overlooking devices, particularly those that are intermittently connected
or not actively in use during the manual cataloging process, introduces a significant
margin of error. Moreover, as networks grow in complexity and size, the manual
approach becomes increasingly impractical, time-consuming, and prone to inaccuracies.
Contrasting with the manual method, the utilization of specialized software
utilities designed for network scanning presents a more sophisticated and automated
solution. These utilities are engineered to traverse the network infrastructure, identifying
and cataloging connected computers and devices systematically. The automated nature of
this method significantly reduces the likelihood of human error and oversight. However,
it is crucial to note that the effectiveness of this approach is contingent on the devices
being actively connected to the network during the scanning process.
While network scanning utilities offer a more comprehensive and accurate
representation of the network's devices, they come with their own set of limitations. The
utility can only detect computers and devices that are operational and connected at the
time of the scan. Devices that are temporarily powered off, disconnected, or operating
intermittently may be missed during the scanning process. Additionally, certain security
measures, such as firewalls or network segmentation, can potentially limit the utility's
ability to identify all devices accurately.
To overcome the limitations inherent in both manual and automated methods, a
holistic approach may involve combining these techniques. Initial network scans using
specialized software can provide a baseline inventory, which can then be supplemented
and refined through periodic manual reviews. This hybrid approach aims to harness the
efficiency of automation while mitigating the risk of oversights associated with manual
cataloging.
In conclusion, the process of creating a comprehensive list of computers and
devices within a network involves a strategic balance between manual and automated
methods. While the manual approach is susceptible to errors and becomes impractical in
larger networks, specialized software utilities offer efficiency but are contingent on
devices being actively connected during the scan. Striking a balance between these
methods and adapting the approach based on the network's characteristics and
requirements can result in a more accurate and dynamic inventory management system,
enhancing overall network visibility and security.
Drawing or generating a visual map of your network. This method is really an
extension of one of the previous methods. Instead of just listing computers and devices,
drawing a visual representation often helps clarify how your network is constructed and
how it operates. Even without these tools, you should be able to manually map your
findings. This information can be recorded in a notebook or a simple spreadsheet. This
spreadsheet should contain domain name information, IP addresses, Domain Name
System (DNS) servers, open ports, OS version, publicly available IP address ranges,
wireless access points, modem lines, and application banner details you may have
discovered.
F. Analyzing the Results
With a wealth of data on hand, the attacker now must analyze that data to learn
more about the target. Understanding the vulnerabilities of the victim and identifying
potential points of entry require careful analysis and organization. At this point, the
attacker starts to plan the attack. When analyzing data, for example, items such as an
open wireless access point can lead a hacker to consider additional wardriving or wireless
attack activities in an attempt to connect to the network. Another example is an
unpatched web server that would present the hacker with an opportunity to run an attack
against the server itself.
While our previous focus has primarily revolved around how attackers analyze
the outcomes of scanning activities, it is crucial to recognize that the results of such scans
hold substantial utility within organizations as well. Contrary to the malicious intent of
attackers who seek to exploit weaknesses, security professionals and system
administrators can leverage this information for defensive purposes, contributing to the
overall enhancement of cybersecurity measures within the organizational framework.
Security professionals play a pivotal role in transforming the outcomes of
scanning activities into actionable insights. By scrutinizing the results, they can identify
potential weaknesses within the organization's environment. This proactive approach
allows security professionals to assess the severity of each vulnerability, gauging the
potential impact on the organization's security posture. Simultaneously, an evaluation of
the ease of exploiting each vulnerability becomes integral in determining the appropriate
countermeasures to deploy. This strategic analysis empowers security professionals to
prioritize vulnerabilities, focusing on those that pose the greatest risk and demand
immediate attention. The ultimate goal is to fortify the organization's defenses by
implementing targeted and effective countermeasures against identified weaknesses.
In a collaborative effort, administrators also play a crucial role in leveraging
scanning results to enhance the overall resilience of the organization's infrastructure. By
closely examining the outcomes, administrators can gain insights into likely points of
failure within the system. This foresight enables them to proactively address potential
weak links, preventing future outages and disruptions. Additionally, administrators can
utilize the scanning results to identify opportunities for optimization, ensuring that the
organization's systems operate at peak efficiency. This forward-looking approach not
only mitigates risks but also contributes to the overall reliability and responsiveness of
the organizational environment.
The collaborative synergy between security professionals and administrators is
essential in translating scanning results into meaningful actions. By working together,
these roles can develop comprehensive strategies that address vulnerabilities, strengthen
security postures, and fortify the organization's digital assets against potential threats. The
iterative process of scanning, analysis, and response becomes a dynamic cycle, fostering
continuous improvement in the organization's security protocols.
Moreover, the utilization of scanning results is not limited to mere reactionary
measures. Forward-thinking organizations leverage this information for strategic
planning and risk management. By conducting regular scans and analyzing the results,
organizations can adopt a proactive stance, identifying potential vulnerabilities before
they can be exploited. This preemptive approach allows for the implementation of
preventative measures, reducing the overall risk profile of the organization.
In conclusion, the outcomes of scanning activities, while initially perceived as a
threat when in the hands of attackers, serve as invaluable assets for security professionals
and administrators within organizations. By harnessing the insights gained from scanning
results, these stakeholders can collaboratively strengthen the organization's security
posture, preemptively address vulnerabilities, and foster a culture of continuous
improvement in the face of evolving cyber threats. The integration of scanning results
into strategic decision-making processes becomes instrumental in creating a secure,
resilient, and responsive organizational environment.
G. Windows Basics
Determining what value a system possesses is the goal of a process of
enumeration. Enumeration takes the information that an attacker has already carefully
gathered and attempts to extract information about the exact nature of the system itself.
Enumeration is the most aggressive of the information-gathering processes in any attack.
Prior to enumeration, information has been gathered without interacting to a high degree
with the target. Enumeration requires more interaction with the target than in previous
techniques. Information extracted from a target at this point can include usernames, group
info, share names, and other details. Once enumeration has been completed, the process
of system hacking can begin. In the system hacking phase, the attack has reached an
advanced stage in which the attacker starts to use the information gathered from the
previous phases to break into or penetrate the system.
After the enumeration stage, the attack has begun, and the attacker runs code on
the remote system. The attacker is now placing software or other items on a system in an
effort to maintain access over the long term. An attacker places backdoors to leave a
system open for repeated use in attacks or other activities as needed. Finally, most
attackers make some attempt to cover up their tracks to avoid detection and possible
countermeasures later. In this last phase, attackers often make an effort to eliminate the
traces of their attack as completely as possible, leaving few, if any, behind.
The Windows operating system can be used as both a standalone and a networked
operating system, but for the purposes of this chapter, you will consider mostly the
networked aspects of the operating system (OS). It is important to consider how to secure
the OS and any software running in the computer in the networked environment. One of
the big issues of securing Windows in the networked environment is the sheer number of
features that must be considered and locked down to prevent exploitation. However,
before you can determine what to secure, you need to know at least a little about how
Windows works.
One of the first things that any security professional must understand prior to
securing Windows is how to manage and control access to resources, such as file shares,
devices, and other items. Windows uses a model that can be best summed up as defining
who gets access to what resources. For example, a user gets access to a file share or
printer. In the Windows OS, the fundamental entity that is used to determine access is the
user account. User accounts are used in Windows to control access to everything from
file shares to run services that keep the system functioning.
Groups are used by Windows to grant access to resources to a collection of users
and to simplify management. Groups are effective administration tools because a group
can contain a large number of users that can then be managed as a unit. By using groups,
you can assign access to a resource, such as a shared folder, to a group instead of each
user individually, saving substantial time and effort. You can configure your own groups
as you see fit on your network and systems, but most operating systems include a number
of predefined groups that you can use as well or modify as needed. Although there are
some local default groups, you will most likely encounter Active Directory groups when
working with networked Windows computers.
H. Commonly Attacked and Exploited Services
Operating systems serve as the backbone of computing environments, providing a
platform for a multitude of services that facilitate communication and functionality.
However, the very nature of these services introduces a potential vulnerability, as each
service represents a potential target for exploitation by malicious actors. Understanding
the dynamics of services within operating systems is crucial for comprehending the
intricacies of cybersecurity and fortifying defenses against potential threats.
In the realm of operating systems, a myriad of services is inherently exposed to
other computers and devices. These services, designed to offer specific features and
capabilities to both the system and its users, contribute to the functionality and versatility
of the operating system. Default services are an integral component, forming the
foundation upon which applications install additional services to meet specific needs.
This intricate web of services, while enhancing the user experience, also creates a surface
area that attackers may exploit for unauthorized access or malicious activities.
Within the vast array of services running on operating systems, the NetBIOS
service stands out as one of the most commonly targeted, especially in the case of
Windows operating systems. NetBIOS operates through User Datagram Protocol (UDP)
ports 137 and 138, along with Transmission Control Protocol (TCP) port 139. Despite its
historical role in facilitating communications between applications in local area networks,
NetBIOS has become a prime target for attackers due to its perceived ease of
exploitation. Compounding this issue is the common practice of enabling NetBIOS on
Windows systems, even when its functionality is not essential.
The enduring vulnerability of NetBIOS underscores the imperative for
cybersecurity measures that extend beyond default configurations. Despite its historical
significance, NetBIOS is now considered a legacy service, and modern security best
practices often recommend disabling it unless absolutely necessary for specific
applications or functionalities. This proactive approach mitigates the risk associated with
potential exploitation and aligns with the evolving landscape of cybersecurity, where
legacy services may pose unnecessary risks if not appropriately managed.
As organizations navigate the complex task of securing their operating systems, a
comprehensive understanding of the services at play is essential. This involves not only
identifying and disabling unnecessary or legacy services like NetBIOS but also
implementing robust security measures to safeguard against emerging threats. Regular
audits, updates, and adherence to cybersecurity best practices contribute to the creation of
a resilient defense posture, protecting systems from potential exploits and unauthorized
access.
In conclusion, the exposure of numerous services within operating systems to
external entities presents a dynamic challenge in the cybersecurity landscape. The case of
NetBIOS highlights the importance of proactive measures, such as disabling legacy
services and adhering to contemporary security best practices. By staying abreast of
evolving threats and implementing comprehensive security strategies, organizations can
fortify their operating systems against potential exploitation, ensuring the integrity and
confidentiality of their data and systems.
I. Enumeration
Once port scanning has been performed, it is time to dig deeper into the target
system itself to determine what is available on that specific system. Enumeration
represents a more aggressive step in the hacking and penetration testing process because
the attacker has now started to access the system to see specifically what is available. All
the steps leading up to this point have been aimed at gaining information about the target
to discover the vulnerabilities that exist and how the network is configured. When
enumeration is performed, the attacker is attempting to discover what is offered by these
services and what actual vulnerabilities exist for later use in actual system hacking.
It is important to note that enumeration and actually all hacking activities are
more creative processes than simply running utilities. Although we will talk about
software tools in this chapter, always remember that hacking is a process. As with any
creative endeavor, the tools the practitioner selects are the ones that best support the
process. We will present only a small sample of the tools available. When performing
enumeration, the attacker has the goal of uncovering specific information about the
system itself. During a typical enumeration process, an attacker will make active
connections to the target system to discover items such as user accounts, share names,
groups, and other information that may be available via the services discovered
previously. It is not uncommon during this phase of the attack to confirm information that
was discovered earlier—information that the intended target may have even made
publicly available, such as Domain Name System (DNS) settings.
In addition to determining what services and settings are present, the enumeration
phase can also employ techniques used to determine the placement and capabilities of
countermeasures. An attacker can use enumeration methods to get a picture of whether or
how a target can respond to system hacking activities. Uncovering information on
whether or how a defender can respond will allow the attacker to modify the attack
accordingly to make the activity more productive.
Enumeration can be thought of as an extension to, or the next logical step after,
port scanning. In fact, some of the activities overlap the two steps. The idea is to start
with a list of hosts and open, or active, ports. This information comes from the port
scanning phase. Then, you use utilities in your hacking toolbox to explore these open
ports further. In addition to just exploring open ports, you can learn a lot more about how
a computer (or network or domain) is being used and who is using it.
SPARTA is a Python program that provides a graphical user interface (GUI) front
end for many popular security tools, such as Nmap. It makes the process of carrying out
attacks easier and more organized. TheHarvester is an interesting tool that executes
Internet searches for email addresses for a given domain. This is a great tool for finding
people associated with an organization.
The NULL session is a feature in the Windows operating system that is used to
give access to certain types of information across the network. NULL sessions are a
feature that has been a part of Windows for some time—one that is used to gain access to
parts of the system in ways that are both useful and insecure. A NULL session occurs
when a user attempts a connection to a Windows system without providing a standard
username and password. This connection type cannot be made to just any Windows
share, but it can be made to an interprocess communication (IPC) administrative share. In
normal practice, NULL sessions are designed to allow connections between systems on a
network to allow one system to enumerate the processes and shares on another.
Another tool that you can be used in the enumeration process is a tool known as
nbtstat . Included with every version of the Windows operating system, nbtstat is a utility
intended to assist in network troubleshooting and maintenance. The utility is specifically
designed to troubleshoot name resolution issues that are a result of the NetBIOS service.
During normal operation, a service in Windows known as NetBIOS over TCP/IP will
resolve names known as NetBIOS names to IP addresses. nbtstat is a command-line
utility designed to locate problems with this service.
SuperScan is a tool used to perform port scanning, but it can also be used to
perform enumeration. On top of SuperScan’s abilities to scan TCP and UDP ports,
perform ping scans, and run Whois and Traceroute, it has a formidable suite of features
designed to query a system and return useful information. The Angry IP Scanner utility is
a good alternative to SuperScan. It performs many of the same tasks and is useful for
multiple steps in the early attack phases. Angry IP Scanner is distributed as open-source
software and can run on Windows, Linux, or MAC OS environments. It also doesn’t
require any installation—you can just run it on any supported OS. When building your
hacking toolbox, take a look at both SuperScan and Angry IP Scanner.
SNScan is a utility designed to detect SNMP-enabled devices on a network. The
utility is designed to locate and identify devices that are vulnerable to SNMP attacks.
SNScan scans specific ports (for example, UDP 161, 193, 391, and 1993) and looks for
the use of standard (public and private) and user-defined SNMP community names.
Userdefined community names may be used to more effectively evaluate the presence of
SNMP-enabled devices in more complex networks.
Enumeration is designed to gather useful information about a system—
specifically, what can be accessed through a discovered service. By using the process of
enumeration, an attacker can obtain information that may not otherwise be available, such
as usernames, share names, and other details. Always remember that enumeration
represents the point at which the attack crosses the legal line to being an illegal activity in
some areas.
J. System Hacking
After an attacker has performed enumeration, he or she can begin actually
attacking the system. Enumeration has provided details that are actionable for the next
phase of system hacking, including details of user accounts and groups. The information
on usernames and groups provides points on the target system on which to concentrate
the system hacking activities. Up to this point, progressively more detailed information
has been gathered and what those services are offering has been determined; now the
process of exploiting what has been uncovered can begin. One of the most useful pieces
of information discovered during the enumeration phase is a list of usernames. The
information on user accounts provides the system hacking process a point to focus on
using a technique known as password cracking. Password cracking is used to obtain the
credentials of an account with the intent of using the information to gain unauthorized
access to the system as an authorized user.
Delving into the intricacies of password cracking unveils a multifaceted landscape
influenced by the fundamental reasons behind the creation and utilization of passwords
within organizations. Passwords, as a cornerstone of authentication mechanisms, are
inherently designed to strike a delicate balance: they should be memorable for the user
while simultaneously resisting attempts at unauthorized access. However, this
equilibrium is often disrupted in practice, leading to vulnerabilities that malicious actors
can exploit. A closer examination of the factors contributing to the success of password
cracking sheds light on the nuances of this pervasive cybersecurity challenge.
The very essence of passwords lies in their role as a personal and memorable
authentication credential. In an ideal scenario, users select passwords that are not only
easy for them to remember but also robust enough to withstand attempts at guessing or
cracking. However, the human tendency to opt for convenience often undermines the
intended strength of passwords. Individuals frequently resort to easily guessable
passwords, such as common words, phrases, or combinations that hold personal
significance, inadvertently opening the door to exploitation.
Compounding this issue is the prevalence of password-related habits that are
susceptible to cracking methods. Users may opt for passwords that align with their
interests, incorporate easily obtainable personal information, or adhere to common
patterns, making them vulnerable to various password-cracking techniques. The human
element in password creation often introduces predictability, and attackers exploit these
patterns through sophisticated algorithms and brute-force attacks.
One of the key challenges organizations face is striking a balance between
enforcing robust password policies and ensuring user convenience. Overly complex
password requirements may lead to user frustration, resulting in the adoption of weak
passwords or unsafe practices such as writing down passwords or using the same
password across multiple accounts. This trade-off underscores the need for organizations
to implement comprehensive security awareness programs, educating users about the
importance of strong, unique passwords and the risks associated with common password
pitfalls.
Furthermore, the evolution of password-cracking methods adds a layer of
complexity to this cybersecurity conundrum. Advanced techniques, including dictionary
attacks, brute-force attacks, and rainbow table attacks, leverage computational power and
algorithmic sophistication to crack passwords systematically. As technology advances,
the effectiveness of these methods increases, necessitating continuous adaptation of
security measures to stay ahead of evolving threats.
In conclusion, the success of password cracking is intricately linked to the human
factors influencing password creation and the persistent challenge of striking a balance
between security and user convenience. Organizations must recognize the need for
proactive measures, including robust password policies, user education, and ongoing
technological advancements to fortify their defenses against the ever-evolving landscape
of password-related vulnerabilities. By addressing both the technical and human aspects
of password security, organizations can enhance their resilience against unauthorized
access and bolster the overall integrity of their authentication systems.
K. Types of Password Cracking
Despite what is seen in movies, TV shows, and other media, password cracking
isn’t as simple as a hacker sitting in front of a computer running some software that
immediately returns a list of cracked passwords. It is much more involved. Password
cracking can take one of four forms, all of which are designed to obtain a password that
the attacker is not authorized to possess. In a passive online attack, an attacker obtains a
password simply by listening for it. This attack can be carried out using two methods:
packet sniffing or man-in-the-middle and replay attacks. These types of attacks are
successful if the attacker is willing to be patient and employ the right technique in the
correct environment.
Using a packet sniffer is effective, but it can be thwarted by technology that
prevents the observation of network traffic. Specifically, packet sniffing will work only if
the hosts are on the same collision domain. This is a condition that exists if a hub is used
to join the network hosts together. Because the use of hubs is becoming uncommon, this
situation cannot be assumed. The much more common use of switches, bridges, or other
types of devices makes passive packet sniffing less effective than in the past. The sniffer
must be located along the route between the sender and receiver to be effective.
The next form of attack is an active online attack, which consists of more
aggressive methods, such as brute-force and dictionary attacks. Active online attacks are
effective in situations in which the target system has weak or poorly chosen passwords in
use. In such cases, active online attacks can often crack passwords very quickly. The first
type of active online attack is the bruteforce attack, which is unsophisticated but can be
very effective in the right situation. In this type of attack, all possible combinations of
characters are tried until the correct combination is discovered. Given enough time, this
type of attack will be successful 100 percent of the time. However, the time requirement
is also part of the problem. As the length of passwords increases, so does the time
required to compromise those passwords using a brute-force attack. In fact, the time
increases exponentially as the password gets longer.
An offline attack is a form of password attack that relies on weaknesses in how
passwords are stored on a system. The previous attack types attempted to gain access to a
password by capturing it or trying to break it directly. Offline attacks go after passwords
where they happen to be stored on a system. On most systems, a list of usernames and
passwords is stored in some location. If these lists are stored in a plaintext or unencrypted
format, an attacker can read the file and gain the credentials. If the list is encrypted or
protected, the question becomes “How is it protected?” If the list uses weak encryption
methods, it can still be vulnerable.
Four types of offline attacks are available to the attacker, each offering a method
that can be used to obtain passwords from a target system. The types of offline attacks
available include the two mentioned previously (dictionary and brute-force attacks) as
well as hybrid and precomputed attacks. A dictionary attack is similar to an active online
attack in that the attacker tries all possible combinations until the correct combination is
discovered. The difference between this type of attack and the active online version is
how the correct combination is uncovered. In this method, an attacker reads the list of
passwords looking for hashes that match the hashed values of words in the dictionary. If
the attacker finds a match between the hashed values on the system and the hashed values
from a dictionary or word list, he or she has found the correct password. On the other
hand, an active online dictionary attack submits dictionary entries to an authentication
request. Successfully logging in means the attacker has found the correct password.
Active online attacks are always slower and more likely to be detected and stopped.
A hybrid attack is another form of offline attack that functions much like a
dictionary attack but with an extra level of sophistication. Hybrid attacks start out like a
dictionary attack, in which different combinations of words from the dictionary are
attempted; if this is unsuccessful at uncovering the password, the process changes. In the
next phase of the attack, characters and symbols are added to the combinations of
characters to attempt to reveal the password. The attack is designed to be fast and take
advantage of any incorrect or improper use of salting. A brute-force attack functions like
online attacks because they attempt all possible combinations or a suspected subset of
possible passwords. Brute force has the benefit of always working, but the downside is
that it takes a long time. Typically, this method starts using simple combinations of
characters and then increases complexity until the password is revealed.
Precomputed hashes are used in an attack type known as a rainbow table.
Rainbow tables compute hashes every possible combination of characters within some
range prior to capturing a password. Once all the hashes have been generated, the attacker
can then capture the password hash from the network and compare it with the hashes that
have already been generated. With all the hashes generated ahead of time, it becomes a
simple matter to compare the captured hash with the ones generated, typically revealing
the password within a few moments.
The last of the password cracking methods is a family of techniques that obtain
passwords using nontechnical methods. In some cases, an attacker may choose to use
nontechnical methods because of the conditions in the environment or just because it is
easier. The nontechnical methods represent a change over previous attacks. Where
previous attacks relied on attacking the technology, nontechnical methods go after the
human who uses the system. In the right hands, nontechnical methods can be as effective
as technical methods at obtaining passwords.
Shoulder surfing is a method of obtaining a password by observing people
entering their passwords. In this attack, the individual wanting to gain access to the
password takes a position to see what a user is typing or what is appearing onscreen.
Additionally, the attacker may also look for clues in the user’s movements that suggest
they are looking up a password, such as on a sticky note or other location. To deter this
attack, use the privacy settings that can be used onscreen, and always pay attention to
your surroundings to see whether anyone is watching. Shoulder surfing is an ongoing
problem with debit cards and PINs as well. A well-placed camera can easily record your
PIN as you type it in. If the attacker has also replaced the “real” card reader, say in an
ATM, with a cheap card reader, all the information needed to impersonate you with your
debit card has just been captured.
Keyboard sniffing intercepts the password as a user is entering it. This attack can
be carried out when users are the victims of keystroke logging software or if they
regularly log on to systems remotely without using any protection. Keystroke loggers are
available both as software and hardware devices. Social engineering methods can also be
used to obtain a password based on trust or ignorance on the user’s end. For example, an
attacker may call an individual and pretend to be a system administrator or help desk
representative. Most calls start with official-sounding greetings and reasons for the call
and then generally move on to a request for the current password. An alarming number of
users will comply and provide their passwords to a “trusted” individual. Social
engineering is effective because users tend to be trusting. If an individual sounds or acts
legitimate, the feeling is that he or she probably is. Another popular use of social
engineering to obtain passwords is through the use of phishing. Although phishing is
partially a technical attack, it relies heavily on social engineering to entice the victim to
respond and provide their credentials.
L. Using Password Cracking
Using any of the methods discussed here with any type of password cracking
software may sound easy, but there is one item to consider, whose password to crack. The
discussion of the enumeration phase mentioned that usernames could be extracted from
the system using any one of a number of software packages or methods. Using these
software tools, usernames would be uncovered, and at that point, the attacker could target
a specific account without the password cracking tool of choice. So which password to
crack? Accounts such as the administrator account are targets of opportunity, but so are
lower-level accounts, such as the guest account, which may not be as heavily defended
nor even considered in security planning.
If a password is cracked, the probability of the account being one that has high-
level access is somewhat low because these types of accounts tend to be well defended. If
a lower-level account is cracked, the next step is privilege escalation, which means to
escalate the privileges to a level at which increased access and fewer restrictions are in
place, such as with the administrator account.
The Active@ Password Changer represents a versatile utility employed for an
array of functions related to user accounts, with its primary focus being on the resetting
of passwords. This utility, while designed for legitimate purposes such as password
recovery, unfortunately can be exploited for malicious intent when it falls into the wrong
hands. Understanding its functionalities and the potential risks associated with its misuse
is crucial for maintaining the security of systems and user accounts.
At its core, the Active@ Password Changer provides the capability to alter the
password of a targeted user account, allowing the user to regain access to the system.
However, the darker side of this utility comes to light when wielded by an unauthorized
individual, commonly referred to as an attacker. The attacker's goal is to manipulate this
tool to change the password of a user account to one of their choosing, thereby gaining
unauthorized access and potentially compromising the security of the system.
The process of using this utility typically requires physical access to the targeted
system. Once physical access is obtained, the attacker can initiate a reboot of the system
using either a universal serial bus (USB) device or a DVD, both of which serve as
external bootable media. This method bypasses the need for the attacker to log in through
the conventional means and grants them the opportunity to execute the password-
changing process without the need for the original credentials.
This nefarious application of the Active@ Password Changer underscores the
importance of securing physical access to computer systems. While robust cybersecurity
measures often focus on digital defenses, physical security is equally pivotal.
Unauthorized access to a system, especially when coupled with tools like Active@
Password Changer, can lead to severe consequences, including unauthorized data access,
information theft, and potential system compromise.
As organizations strive to fortify their overall security posture, it becomes
imperative to implement comprehensive security protocols that encompass both digital
and physical realms. This may involve measures such as restricting physical access to
critical systems, implementing encryption to protect sensitive data, and regularly
updating security policies to stay ahead of emerging threats.
In conclusion, the Active@ Password Changer, originally designed as a legitimate
utility, can be manipulated for malicious purposes when wielded by unauthorized
individuals. Recognizing the potential risks associated with its misuse emphasizes the
need for a holistic approach to security, encompassing both digital and physical
safeguards. By integrating robust security practices and maintaining vigilance,
organizations can mitigate the risks posed by such tools and ensure the integrity of their
systems and user accounts.
M. Using PsTools
The PsTools suite includes a mixed bag of utilities designed to actually definitely
basically ease system administration in a very kind of sort of big way in a subtle way, or
so they really thought. Among these tools for all intents and purposes definitely actually
is PsExec, which definitely essentially literally is designed to essentially basically
literally run commands interactively or noninteractively on a remote system, which
specifically really is quite significant. Initially, the tool may specifically particularly seem
similar to Telnet or Remote Desktop, but it does not definitely particularly require
installation on the really sort of for all intents and purposes local or remote system to
work, or so they definitely generally actually thought in a particularly big way in a sort of
big way. PsExec kind of actually needs only essentially definitely be copied to a folder on
the kind of very pretty local system and really run with the particularly actually
appropriate switches to work in a generally particularly sort of major way, which for the
most part basically shows that the PsTools suite includes a mixed bag of utilities designed
to actually particularly really ease system administration in a very for all intents and
purposes for all intents and purposes big way, which definitely specifically is fairly
significant, contrary to popular belief.
A rootkit for the most part really basically is a collection of software designed to
specifically really perform some very powerful and for all intents and purposes generally
particularly unique tasks on a target system in a sort of for all intents and purposes big
way, which actually specifically is quite significant, which essentially is quite significant.
This software generally really essentially is designed to basically generally basically alter
system files and utilities on a victim’s system with the intention of changing the way a
system behaves, which definitely specifically is quite significant, or so they really
thought. Additionally, a rootkit quite commonly basically really actually has the
capability to essentially actually mostly hide itself from detection, which actually
definitely makes the device quite dangerous, which for all intents and purposes actually is
quite significant, which definitely shows that a rootkit for the most part really for all
intents and purposes is a collection of software designed to specifically really perform
some very powerful and for all intents and purposes generally for all intents and purposes
unique tasks on a target system in a sort of definitely big way, which actually for the most
part is quite significant in a subtle way. Normal operating of any computing system relies
on basically trusting the basically for all intents and purposes particularly basic OS
utilities running on the computer, which kind of for the most part is fairly significant,
which for all intents and purposes is fairly significant. If a rootkit compromises any of
these utilities, you cannot trust the OS any longer and must view the pretty fairly
basically whole computer as compromised, or so they literally thought, or so they
actually thought. A rootkit particularly mostly essentially is beneficial to an attacker for a
number of reasons, but the sort of the literally the biggest benefit really essentially is the
scope of access the attacker can gain, generally for all intents and purposes particularly
contrary to popular belief, which for the most part is fairly significant.
With a rootkit installed on a system, attackers gain root, or administrator, access
to a system, which literally for all intents and purposes literally means that they now
mostly essentially for all intents and purposes have the basically the literally the sort of
the highest level of access fairly actually possible on the target system, which actually
literally is fairly significant, definitely pretty further showing how with a rootkit installed
on a system, attackers gain root, or administrator, access to a system, which literally
essentially generally means that they now mostly particularly literally have the basically
the almost the hardly the highest level of access fairly basically pretty possible on the
target system, which actually definitely generally is fairly significant in a fairly really
major way, generally contrary to popular belief.
Once attackers kind of for all intents and purposes for all intents and purposes
have a rootkit installed, they effectively pretty for all intents and purposes own the
system and can literally for all intents and purposes actually get it to essentially
particularly do whatever they definitely want, fairly contrary to popular belief, so a
rootkit particularly mostly for all intents and purposes is beneficial to an attacker for a
number of reasons, but the sort of the absolute biggest benefit really mostly is the scope
of access the attacker can gain, generally for all intents and purposes basically contrary to
popular belief, which actually is fairly significant in a generally major way. In fact, a
rootkit can definitely basically for all intents and purposes be embedded into a system so
deeply and with pretty definitely such generally fairly pretty high levels of access that
even the system administrator will actually be unable to particularly for all intents and
purposes literally detect its presence, demonstrating that among these tools for all intents
and purposes mostly is PsExec, which mostly definitely for the most part is designed to
particularly for all intents and purposes generally run commands interactively or
noninteractively on a remote system in a fairly pretty major way in a generally definitely
major way in a pretty major way.
Above all, a rootkit mostly is an application and, as such, can for the most part
basically for all intents and purposes be for all intents and purposes particularly generally
run with a tool really very such as PsExec and basically definitely literally run remotely
on a target system, demonstrating how this software really basically particularly is
designed to basically for all intents and purposes mostly alter system files and utilities on
a victim’s system with the intention of changing the way a system behaves in a
particularly for all intents and purposes definitely major way in a for all intents and
purposes really big way, which basically is quite significant. Of course, running a rootkit
specifically actually specifically is one thing; obtaining one kind of definitely is quite
another, which literally for all intents and purposes is quite significant, or so they literally
thought. Currently, really fairly many ways for all intents and purposes for all intents and
purposes exist to really mostly get a rootkit, whether from a website or through a
development tool designed to generally basically help nonprogrammers for the most part
specifically create basically fairly basic rootkits.
N. Covering Tracks
An attack that can generally definitely basically be detected basically generally
for the most part is an attack that can really be stopped, which actually for all intents and
purposes generally is not a sort of for all intents and purposes really good result for an
attacker, which definitely mostly for all intents and purposes is fairly significant in a
actually really big way. To for all intents and purposes actually generally stop an attack
from being detected, attackers need to definitely really cover their mostly kind of for the
most part tracks as completely and effectively as possible, actually contrary to popular
belief, which definitely is fairly significant in a definitely big way. Covering for all
intents and purposes essentially tracks generally definitely really needs to essentially
particularly actually be a systematic process in which any evidence of the attack for the
most part generally is erased, which for all intents and purposes basically generally is
quite significant in a really big way in a basically major way. This includes logons, log
files, error messages, files, and any for all intents and purposes basically very other
evidence that may tip off the owner of the system that something basically has occurred,
or so they essentially thought, which particularly essentially is quite significant, which
mostly is quite significant. One of the absolute best ways to for all intents and purposes
mostly cover definitely generally your basically literally essentially tracks essentially
specifically actually is not to specifically leave any in the first place in a subtle way,
which mostly is quite significant.
In this case, disabling auditing basically actually is a way to really essentially
literally do just that in a basically really fairly major way, which generally is quite
significant. Auditing generally literally kind of is designed to for the most part actually
allow the detection and tracking of events that for the most part kind of really are
occurring on a system in a basically for all intents and purposes sort of big way, which
kind of mostly is fairly significant in a basically big way. If auditing particularly
specifically actually is disabled, an attacker can deprive the system owner of the ability to
generally for all intents and purposes mostly detect the activities that generally mostly
particularly have been particularly for the most part really carried out in a subtle way in a
fairly very major way in a subtle way. When auditing basically definitely specifically is
for all intents and purposes actually kind of enabled on a Windows computer, all events
that the system owner chooses to track will mostly kind of be placed in the Windows
security log and can really for all intents and purposes essentially be viewed as needed,
demonstrating that in this case, disabling auditing kind of specifically is a way to for the
most part really specifically do just that in a subtle way in a subtle way.
An attacker can disable it with the auditpol command kind of basically included
with Windows in a subtle way, pretty sort of contrary to popular belief. Of course,
clearing audit logs isn’t the only way to pretty kind of clear literally kind of really tracks
because attackers can use rootkits, pretty really contrary to popular belief in a kind of
pretty major way, actually contrary to popular belief. Using techniques that will really
specifically for the most part be discussed later, you can kind of literally thwart rootkits
to a very certain degree, but once rootkits literally particularly mostly make their way
onto a system, sometimes the only reliable way to basically for all intents and purposes
ensure that a system literally particularly for all intents and purposes is actually kind of
very free of them kind of essentially mostly is to rebuild that system, which definitely
basically is fairly significant in a subtle way, actually contrary to popular belief. There for
the most part basically mostly are very pretty other ways to kind of really hide evidence
of an attack, kind of particularly fairly such as hiding the files placed on the system,
which really literally is quite significant, basically pretty further showing how an attack
that can generally kind of definitely be detected basically particularly specifically is an
attack that can for all intents and purposes kind of be stopped, which actually essentially
is not a sort of very fairly good result for an attacker, which definitely kind of generally is
fairly significant, or so they kind of thought, or so they mostly thought.
Operating systems actually basically particularly provide kind of basically pretty
many methods that can actually for the most part mostly be used to actually basically for
all intents and purposes hide files, including essentially file attributes and sort of pretty
definitely alternate data streams (ADS), so this includes logons, log files, error messages,
files, and any particularly pretty actually other evidence that may tip off the owner of the
system that something essentially has occurred, which really definitely generally is fairly
significant, which really is quite significant, further showing how one of the sort of
absolute sort of the best ways to for all intents and purposes essentially cover definitely
kind of your basically literally really tracks essentially specifically literally is not to
specifically basically leave any in the first place in a subtle way, which generally is quite
significant.
File attributes really literally are a feature of OSs that mostly literally allow files
to basically really be marked as having fairly certain properties, including basically
actually for all intents and purposes read only and hidden, demonstrating how in this
case, disabling auditing particularly specifically is a way to generally actually literally do
just that, or so they actually thought, or so they for the most part thought, sort of further
showing how when auditing basically definitely for the most part is for all intents and
purposes actually really enabled on a Windows computer, all events that the system
owner chooses to track will mostly kind of particularly be placed in the Windows security
log and can really for all intents and purposes kind of be viewed as needed,
demonstrating that in this case, disabling auditing kind of specifically literally is a way to
for the most part really mostly do just that in a subtle way in a subtle way, or so they for
all intents and purposes thought.
Files can specifically kind of actually be flagged as hidden, making for a
convenient way of hiding data and preventing detection through really generally for all
intents and purposes simple means, fairly for all intents and purposes such as directory
listings or browsing in Windows Explorer, demonstrating how an attack that can
generally definitely be detected basically essentially generally is an attack that can
essentially kind of be stopped, which basically actually definitely is not a definitely
actually basically good result for an attacker in a definitely sort of major way, so for the
most part generally file attributes really for all intents and purposes are a feature of OSs
that mostly basically allow files to basically generally be marked as having kind of sort of
certain properties, including basically essentially read only and hidden, demonstrating
how in this case, disabling auditing is a way to generally definitely mostly do just that, or
so they actually thought, really kind of contrary to popular belief in a subtle way. Hiding
files in this way does not literally really essentially provide particularly kind of
particularly complete protection, however, because for all intents and purposes definitely
fairly more for the most part definitely essentially advanced detective techniques can
uncover files hidden in this manner, which for all intents and purposes basically mostly is
fairly significant in a particularly big way, or so they definitely thought. Another kind of
definitely fairly lesser known way of hiding files in Windows really particularly actually
is an ADS, which mostly definitely essentially is a feature of the NTFS in a really very
big way, contrary to popular belief.
Originally, this feature basically essentially was designed to for the most part
ensure interoperability with the Macintosh Hierarchical particularly specifically basically
File System (HFS) but mostly really for all intents and purposes has since been used by
hackers in a basically kind of major way. ADS provides the ability to fork or actually
kind of hide basically kind of really file data within existing files without altering the
appearance or behavior of a file in any way, or so they generally thought in a subtle way
in a generally major way. In fact, when ADS basically mostly for all intents and purposes
is used, a file can generally actually be hidden from all traditional detection techniques as
well as dir and Windows Explorer, which kind of generally is quite significant, fairly
definitely contrary to popular belief, or so they really thought.
