Welcome back, everyone.
This is news and you are watching the session on the financial resources Bush.
So we will be understanding both of the show, understand which one to use and which one really works,
what the other in a better way.
Let's get started.
Let's first understand the bombshell before we jump into the financial understand where exactly are
we going to use it?
At the moment, we select any payload when you either create a payload through or tools like NASA Venom
that will be docking in the next station or you are making use or you are ready to listen on the next
flight framework.
In both the situation, it is important to select the right payload.
OK, if you if you end up selecting the wrong payload, you might not establish the connection with
the target and you might you might not be able to perform your exploration as well.
So that's before you choose.
You have to be very cautious about it.
OK, and I'll tell you which one to go without thinking twice.
Let's get started.
Let's first understand the bandshell in the bandshell.
You have your Harker's you are sitting on the right side and you have your victim that you're targeting,
basically.
Now, what are you going to do?
What are you going to do is first thing is you would be delivering a malware that would be that would
be delivered to your target machine through many any medium.
Right.
So you have delivered a malware on your target machine through phishing email, through USB or maybe
animatics.
Your job is just to deliver a now in the financial method.
It's a job of a malware to open up a listen to open up a listening sessions on Ineradicable.
OK, so that's where the moment the malware get install, it started listening on a board, just like
a server.
So in case of MindShift, the victim itself becomes a server, OK, and it starts listing on a book.
So that means anybody can connect and so do hackers.
So what happened is the hackers start establishing or start to establish a connection with the victim
machine or on board ADT because it can become a client in that case.
Right.
So in that case, it sends that connection request and the connection get accepted by the victim machine
and then the hacker get the complete access to the machine and it becomes the objective accordingly.
But remember this, in case of bandshell method, the victim itself start listening on a certain point.
All right.
So that's what happened in the bunch.
Now, what's the downside of it?
The downside is this will never going to work or mostly will not work in a situation when the Target
and Wal-Mart is having a firewall because usually firewall by default deny all the incoming traffic.
All right.
So being a staple behavior, whenever the connection is already generated from outside and comes inside,
it's by default block.
So that's why you have never noticed, you know, applications like Facebook or Google come on your
proactively and asking, hey, you want to browse on my side or hey, you want to look at this and it's
always you who go out and then the response comes back.
So by default, because the purpose of states for behavioral firewall is the by default, the connection
from inside to outside allowed as per the policy and outside to inside is by default block.
And that's why it's kind of a method will not work in the kind of in the in the situation of Enterprise
Network, but it might work in a public network like Web applications, which is open to everyone.
Right.
But this will not work in a situation where it's an enterprise network.
It's the perimeter of the network is protected with the firewall.
All right.
Let's learn about the revolution.
So I hope you got the idea about where to use Bangsa Binzel.
You can use it for the Web applications, which is open for everyone, but it cannot be used for the
targets or windows machines or laptop door, which is inside the perimeter perimeter of the network.
Right.
So let's learn about the revolution and the revolution would have.
You, again, have a good hacker and the victim issue, again, in the same situation you install,
you deliver a malware to the machine.
OK, this is exactly what we have seen in the situation of Punshon.
But this one very interesting difference, in spite of them opening up a listening sessions on a sub
in both the hacker starts that OK, the hacker machine starts a listening session and that means the
hacker becomes a server in that situation and open up a board around the board usually could be added
because it's well known and normally normally get along.
So in that situation, the the malware or the victim machine sends the request to the hacker.
And you know what?
It's mostly going to work, because if you recall earlier what I told about firewall in situation of
firewall, firewall by default, allow a connection from inside to outside.
In our situation, the victim is sitting and do the outside network and the hackers hackers are in the
outside of the world.
Right.
So in this situation, the connection would be allowed to access to the outside world because I would
think, OK, it's a genuine user Internet, a trusted user trying to access any certain Web application,
which is by default allowed in in most of the situation.
If the there's a strict policy about some application like listing everything, it might be blocked
as well.
But in most of the situation, if the hacker is smart enough, you're making use of a good domain name
whitelist and all those all those of good techniques, it might work as well.
So that all depends on the kind of strategies or techniques used by the hacker.
And this mostly works.
So this is how the rewards should work.
In spite of the machine opening up the listening, listening session, the hacker open up the listening
station in spite of hackers and the connection request, deal with the machine, send the connection
request.
Right.
And that's why it works very well in a situation of enterprise network, which is pretty widely bounded
with the perimeter security.
So for compromising time machines like windows into the copper network or personal home users or maybe
any machines learning smackeroos, even mobile phones as well, mobile devices as well.
This idea works.
The reverse mechanism works with us and gets every worst decision can be of multiple times where we
can make use of different kind of Sishen.
So you see this kind of position is basically disquisitions, OK, where by default it's going to be
a disk position where the three way handshake happened with the client since the sync request message
and the server send some send and act message.
Finally Glenton.
Deach that's how these Sinak get a three way handshake complete and after that the actual packet moves
on.
Right.
So the first option is the making use of reverse, reverse disposition, which we can make use of the
problem as it is pretty much readable.
Anybody can inside if you have any inspection or any normal firewall as well, it can read what exactly
is going inside of the station.
And if we find any malicious traffic inside, it can detect.
Right.
Who was a as well as most of the organization are fine.
That should be as well known vote.
So you might pass through it.
Your traffic, your malicious traffic or whatever you're talking in the show will be going inside the
EU, keeping traffic.
So it might be might get might bypass some of the devices in between.
But in a situation of reverse DHBs, it is found to be as a tunnel based communication which make use
of SSL.
That's why it is pretty much secure enough so that only the victim and hacker know what exactly happening
in between.
So even if you have a firewall in between and even if there is a firewall in between, it will never
know what kind of conversation or what kind of traffic is going back and forth across this session.
OK, so most of the time, if most of the time the advance or the advanced threats make use of the reverse
suppositions in that situation.
All right.
So we'll be making use of reverse.
Toward the schools and we'll see how how effectively we can make use of it.
All right.
So I hope this was really helpful for you.
Will catch you in the next session.
Thank you.