Welcome back, everyone.
As of now, we have learned about one of the defining of the weaknesses to end maps, are we?
We do have other scanning mechanism as well, including open bars, even with where we have tried all
of those stuff earlier.
Right.
This is very interesting and widely adopted tool and very, very powerful tool as well.
This was earlier open.
So it's still, you know, freely available.
This is currently acquired by this is already being acquired, in fact, by Rapide seven.
And this is built on droopy language itself.
OK, so now let's let's dig deep into it and let's understand why it is not just a tool.
Why this framework?
The reason is there are a whole lot of stuff that is connected with it.
There are a whole lot of modules.
There are a whole lot of features and it provides several integrations of rest of the tools.
And that's why it does it does not really it's not really sufficient to call it as a tool.
That's why it becomes a framework where you have granularity of doing a whole lot of stuff by your own
way.
OK, so when we talk about the framework, it is it is it is very clear that it is a penetration tool
and penetration tool is basically making is basically exploit the weaknesses, exploit the vulnerabilities
that you have in the network and the and the importance of or the the the penetration tools come to
the picture once you have vulnerabilities which has been discovered.
And that's why it is important to understand a bit deep into how it really works.
So when it comes to Demitasse Point, it is open source penetration, penetration testing framework
that we already know about and many more.
A lot of organizations are making use of it.
There are many, you know, useful stuff that it provides free.
And we do have the provision as well, which is the commercial, you know, commercial options available.
Now, this provides a modular design.
That's why I call it a framework, because this has a lot of granularity where you get integrate and
you can have a lot of options where you can plug and play a lot of other stuff as well.
I will cover that.
Covered that in the later sections where it is built on the limbic center that is available on the colleague
already and there are more than seventeen hundred exploits available.
Now this brings us to a new question.
What exactly is most of us might be already aware, but just to give a recap, let's let's understand
what exactly these all fundamentals really looks like when it comes to the cyber security or ethical
hacking.
Oh, I'm not really talking about any wars or something, but let's understand what exactly happening.
We have a target somewhere over here.
OK, we have a target that is looks like this.
And just give me one second.
Yeah.
So we have a target over here.
And the first thing that we do is even though we have a target, what we do is we try to find out do
we have any weakness for this target?
I mean, if you talk about the real world, you you consider any war, you consider any target as well.
Whenever the war happens, the one country or the one one or the opponent or anybody, try to find out
a place where if we attack, there would be more significant impact to the target.
Right.
And that's why it is it is important to target at the right time, at the right place, but the right
method.
Right.
So sometimes it is it makes sense to attack in the nighttime or sometimes it does.
We know that satellite won't be really capturing those places.
So even if we attack, there won't be any detection mechanism.
Right.
So this happened in the in the real war.
Let's talk about in the in the article hacking as well.
And the ethical hacking to be before we jump in and target, we we try to launch any kind of malware
or, you know, scan or any sort of stuff.
It is important to understand.
Do we have an.
As for the target, and that's the first thing that that's what we have been doing with our vulnerability
scanners, now, once we have identified the vulnerabilities, once we have identified the vulnerabilities
of the target of the target, now we can launch our we can launch our attack.
But our penetration tool, testing tool, which is our greatest point.
All right.
Which is our method, spoke to made us proud framework and understand this.
If this is our attack, OK, this rocket and this is a missile.
Right.
So in the missile, you know, this there there's one part which is very limited, but which is being
that's where the actual detonation of whatever the payload exists.
That is where the actual payload really exists.
You know, this will really impact the entire impact that would be responsible for any nuclear or atomic
attack or actually secret ingredient recital there.
But the rest of the stuff is important for taking it to the target, and that's what we call it as exploit.
So understand if it is, you know, in terms of real world, you have a ballistic missile, intercontinental
and all the stuff, you know, which is responsible to take it to the another continent or maybe within
the continent or short range missile, long range missile, all the stuff.
Right.
This is the way exploiters responsible for an exploit is useful to understand what kind of what kind
of, you know, method we can take it to reach to the target.
And this all depends even with the vulnerability as well.
So when it comes to the ethical hacking, we can possibly use the multi handler scan single stage or,
you know, multi-stage exploit as well, exploit for windows, exploit for multiple of the softwares
and anything.
But the payload is something which is your malware, you know, but this is where your actual code may
be called on the Bauer show code, with the Python code, with any anything C, C++ or anything that
really sits there.
This is what really be responsible for executing the malicious action on the system or launching or
establish the connection with your with your command and control center.
OK, and this is what we have discussed as well.
So vulnerability in terms of ethical hacking, this is the weakness that allows the attacker to break
into the system itself.
And this weakness can exist in any any stuff.
You know, it can exist as we know it could exist into the time machine, you know, mobile devices,
web applications, network devices, protocol certificates, anything, digital certificate.
I mean, so this could be this could exist on anything.
Right.
And when we talk about the payload, payload is the actual code which which works, which is the which
is the malicious code that runs on the system and establish the connections with our command and control
center.
It runs on the system.
Once the exploitation is complete, that means once the it reaches to the system and it mostly used
to set up the as we have discussed is to set up the connection itself.
Right.
Is to set up the connection with our target system and that it's our choice.
What action we want to take it on the system.
Right.
And when we talk about the matter split and in a practical way, we have if I'm not wrong, we have
more than 700 or I'm not sure, maybe 500 plus payload at this moment is increasing in a way, but that's
the one come exploit.
So we understand already the exploit is the, again, a piece of code anyway, which is which is helpful
to helpful to take the payload to the target, which allows the attacker to take the advantage of the
vulnerability, one little bit system and compromised security in a variety of way and methods.
Plus it has more than I think around six hundred plus exploit that is being available.
All right.
So I hope you got the idea from all this stuff, because this is something which will which we will
keep using it throughout our journey.
Now, let's understand the architecture of it, so when we look at the architecture, there are multiple,
multiple components and that's the reason why we call it as more modular, because you see it, it's
the most of the components are integrated.
They are modular.
We can have plug and play kind of stuff.
We can use one or the one method or the other method and other stuff.
Right.
So it is built on the ruby.
So that's why we have here.
And that connects to the massive coalminer's point core.
That's the core function which is written on the ruby.
And so let's start from the bottom.
We have modules, modules, something that consists of, you know, all the small pieces of the codes.
So that's where we have our payloads know.
That's what we have discussed earlier.
That's where we have payloads.
We have encoders.
Now, encoders are the one which is responsible for encoding your payload sometime.
You know, maybe you are generating a payload.
You are generating maybe a malicious code for for a black hat.
It could be a malicious code for for ethical hacker.
We might be testing some time and we might be creating a malicious code as well to perform the exploit
on the system.
So in order to perform a kind of an detectable code, we'll have to make use of encoding, harshing
and multiple encryption mechanism as well.
So we do have a module called Auxillary as well.
Auxillary is pretty similar to what we make use as a scanning method or discovery method, which is
pretty much similar to the end map mechanism.
And it's pretty straightforward.
There are no features available as well.
Whenever we we want to make use of the feature of the MSF, we can do that as well.
Now there are multiple plug ins as well that directly talk to the MSF base and then we have interfaces.
Now, interfaces is something through which we connect to the MSF core.
We can connect to the MSF code either through the console and in order to connect to the console.
We just have to go to the and we have to dial the MSF console and we get get this key ally of the MSF.
That's pretty quick.
We can even have the Gwaii access through the Web console as well.
So that's the one way.
And as we have already discussed, what exactly the MSF Congress, which connects all the all these
stuff together.
So that's basically the architecture really looks like.
And let's let's get the idea while when we go into the event, we look look into the MSF estimates,
MSF interfaces.
All right, so let's go to the GARLEY, as we have discussed, in order to get the access to it, we
have to go via the interface.
So we have to method either we get to the console or to the G.I. Bill, majorly be making use of the
console because it's pretty straightforward, very, very pretty flexible, pretty agile.
And in order to get the access will have to type.
So will have to drive MSF console.
And it sometimes takes time to load, but it's pretty quick.
Now let's understand how all the features really looks like.
So I talked about a lot of exploit, lots of payloads.
So you see the current count.
So currently we have two thousand exploits.
All right.
And two thousand seventy one exploit and find ninety two payloads available.
So if you want to get to get to see all those, exploit what you need to do.
You can use a command to explore, use, exploit, do the dart and you can press enter straight away.
You get to see all the exploit that is being available.
OK, so this exploit could be for windows.
This these are all four windows that is being available.
You can you can see that and get the idea about it.
Or if you go Dawber, you even get to see the exploit which is there for multiple other purposes as
well.
So you see for SCDP, we have four FCP for Windows Adande and we do have.
Right.
So we do have exploit for browser based and many other purposes.
Well, in order to see the payloads, we can again do the use payload and hit enter you.
Now you see the payloads.
These are all women, but these are all used to generate payload.
I mean in a way malware.
OK, and you see these these are payload for reverse DCB, reverse SCDP.
These are all methods through which you can have your payloads or your malware to talk to your command
and control center, which we will be working on in the next session, or Moberly, the upcoming session.
Right.
So this is the way we you get to see all the exploit and all the payload.
Let's say you go and make use of any one of the exploit.
So let's say I'm making use of one exploit.
Molly.
And so this is the multi handler, which is which is basically opening a session whenever your malware
reaches to the target and somebody somebody runs that malware, your exploit will be open to start the
sessions, start the session on the on the to run the post exploitation activity.
All right.
So let's hit enter.
Now, once you have selected your exploit, now it's your task to select the payload.
So now you can make use of make use of any payload.
So let's say I.
I make use of a payload, which is.
Windows.
Interpretor.
Murray was.
OK, so Peter is pretty much kind of handler, which will help you to, once you get the access, will
be helpful for all the post exploitation activity.
And it will provide you kind of a persistent connection, even if something goes wrong, even if your
malware, even if the system restart, you'll still be be able to regain the access if it is a meta
Prechter kind of a payload.
So it is pretty much used for a kind of persistance connection for Windows Machine.
So let's say you press on once it is done, you selected the payload, your malware is selected.
Now let's understand what all you need.
If you need to know what all I need to do to this mix makes your job pretty easier.
If you want to know the information about this, you can type info.
This will give you an idea about what other platform it would really support on.
So you get the idea, OK, this provided by what what organization?
And, you know, what are the other information available?
What are the platform and what is the module or what is the architecture?
It will be supported.
Do we need any privileges?
All the stuff.
And now in order to complete your exploit or your weaponization, in a way, what other options do I
need to set?
Let's say you you can't really recall all the commands, although once you start working into it, it
would be all on your fingertips or so.
But in the beginning you might find a bit difficult.
So for that you can make use of options.
So this will help you to understand what all parameters you need to set.
So you see this, you need to set this mandatory information.
You need to have your localhost look at borders.
So this is something which is really a must in order to set the target itself.
So once you define that, then only you would be able to set the target and you will be able to launch
you will be able to launch the target to.
OK, so what happens is basically you haven't really created your payload in a way, you you basically
calling up the payload in order to create the payload, you might have to make use of massive venom,
which will be helpful to create the payload.
But this is what we are discussing, as is all about setting up the local host, setting up the remote
host and all those parameters to initiate or to perform the exploit to the remote target.
OK, so let's talk about it.
We can have a host to be defined so we can have a virtual host as our own system itself.
So this is already being set up, so we don't really need it.
So if we want to define the remote host, you can define the remote IP address itself.
So through which we can define maybe then got zeroed out one dot one, three, two, and then you define
your all the other parameter.
You can even set your local board as well if you want it by default.
It is four for four which is already there.
So you don't really, really need much more information in order to launch it.
You just have to type exploit.
Now remember this, your payload is your malware, but you haven't really created it as of now because
it is all it is all just selection of a payload you haven't really created or called any payload as
of now.
So in order to create it, we there are a massive Menom method which is being available.
So this is the method to perform the exploit.
So if you have, let's say, creative decision, create to launch these sessions and you want to see
what are the other activities you are doing so you can make use of Central Command and you can get to
see if you have any active sessions running or not.
You can even type jobs to understand if you have any active jobs related to maybe scanning or, you
know, maybe opening up any webcam on the remote coast or all this activity.
All right.
So this is all about this is all the basic stuff related to my test flight and what all activity you
could possibly do once you get the access to the motorsport.
All right.
So this is all about this lecture.
We'll get you in the next lecture where we'll be discussing about managing the data.
But they might exploit managing the, uh, managing the data to a structured database on the Postgres
good right to enjoy and keep learning.