WEBVTT 00:00.520 --> 00:01.120 All right. 00:01.120 --> 00:01.480 All right. 00:01.480 --> 00:07.660 I guess a better title would have been some other enumeration techniques, as you know, when we discuss 00:07.660 --> 00:08.510 things like this. 00:08.530 --> 00:11.290 I'm not trying to be comprehensive. 00:11.620 --> 00:16.150 I am going to go through enumerations that we definitely need to be aware of. 00:16.840 --> 00:26.770 The Lightweight Directory Access Protocol or El LDAP is a wonderful technology that is often used for 00:26.770 --> 00:31.750 the storage of user accounts groups, that type of information. 00:32.080 --> 00:35.930 It stores this in a standards based database format. 00:35.950 --> 00:37.300 There's schemas. 00:37.300 --> 00:41.410 There's all this standardization that companies love to take advantage of. 00:41.920 --> 00:48.160 But of course, this can be enumerated with tools like software as LDAP administrator, something that 00:48.160 --> 00:56.110 would be very useful in the hands of an actual admin, but very, very dangerous in the hands of a computer 00:56.110 --> 00:57.070 criminal, of course. 00:57.430 --> 01:04.390 So we need to be diligent about securing ELD app whenever possible. 01:04.420 --> 01:11.620 Of course, because we want to harden these systems so that this information cannot be reconnaissance 01:11.620 --> 01:13.120 and enumerated. 01:13.630 --> 01:21.670 Now, something that grew out of lightweight directory access protocol is Microsoft's Active Directory. 01:21.910 --> 01:25.000 So it is l dap compliant. 01:25.570 --> 01:33.400 It follows the standards of LDAP, but there is a ton of additional security mechanisms and additional 01:33.400 --> 01:39.130 proprietary Microsoft technologies bolted on to this LDAP shell, if you will. 01:39.520 --> 01:44.470 We know there's the concept of a domain controller that maintains this. 01:44.470 --> 01:52.510 Microsoft Active Directory and Kerberos is the security technology that is used to keep everything secure. 01:52.810 --> 01:54.010 Kerberos, I believe. 01:54.010 --> 01:59.950 Isn't that the three headed dog that guards Hades in mythology? 02:00.220 --> 02:00.500 Yeah. 02:00.520 --> 02:09.160 So the Kerberos security protocol is a big deal, keeping the security IDs or SSIDs safe and all that 02:09.160 --> 02:11.920 stuff that's going to be in the domain controller. 02:12.250 --> 02:18.970 Now, to really modernize this discussion, I don't see a lot of conversation yet about this in ethical 02:18.970 --> 02:20.980 hacking books, in courses. 02:21.310 --> 02:23.140 I want you to have the latest information. 02:23.560 --> 02:31.270 Understand that Microsoft's Active Directory, when we say NSA, we are talking about the classic tried 02:31.270 --> 02:37.240 and true domain controller based Active Directory for user accounts and groups and computer accounts 02:37.240 --> 02:39.070 and burner accounts and all that great stuff. 02:40.060 --> 02:48.880 We are not talking about Arms A D, which is Microsoft Azure Active Directory. 02:49.210 --> 02:56.450 One of the biggest misconceptions is that Azure Active Directory is Microsoft Active Directory. 02:56.680 --> 02:57.550 It is not. 02:57.820 --> 03:03.940 In fact, Azure Active Directory is not even ELD compliant. 03:04.480 --> 03:07.120 So it is very different technology. 03:07.420 --> 03:15.100 They named it Active Directory because it's doing what classic Active Directory does, but it's a complete 03:15.100 --> 03:17.110 cloud based implementation. 03:17.710 --> 03:24.520 Now if you have an Azure Active Directory and you want to suck in your normal Microsoft Active Directory 03:24.520 --> 03:31.180 accounts and users and all that, they have a Kinect tool that allows that to easily be accomplished. 03:31.930 --> 03:38.920 Suffice it to say that today you have a lot of options when it comes to your Microsoft Active Directory. 03:39.040 --> 03:45.250 You could go build a traditional one in the cloud, or you could say tech with that, and you could 03:45.250 --> 03:47.650 start with Azure Active Directory. 03:48.670 --> 03:56.410 Network time protocol is one of those protocols that it gets picked on here in the cybersecurity landscape. 03:56.830 --> 04:06.130 We love network time protocol because it's going to synchronize in an automated fashion the time on 04:06.130 --> 04:13.660 all of our network nodes, hopefully all of our network nodes and everyone will agree on the same accurate 04:13.660 --> 04:14.050 time. 04:14.230 --> 04:20.950 In fact, network time protocol can be fed from a atomic clock, a very accurate time source. 04:21.610 --> 04:23.200 So wait a minute here. 04:23.590 --> 04:28.330 Are attackers going to be enumerating us for the correct time? 04:28.510 --> 04:30.100 Well, they're not wearing a watch. 04:30.340 --> 04:32.200 No, that's not what they're going to do. 04:32.470 --> 04:39.220 You see, they leverage the network time protocol to enumerate host information. 04:39.520 --> 04:45.040 IP address information, system names, even operating systems. 04:45.430 --> 04:54.310 And this really points us to a powerful and disturbing trend in hacking, both ethical and unethical. 04:54.550 --> 05:03.700 And that is the fact that many times we can leverage a protocol like network time protocol to enumerate 05:03.700 --> 05:05.740 something that we wouldn't even think about. 05:06.040 --> 05:06.320 Right. 05:06.340 --> 05:10.000 Like, you know, you think about it and you're like, oh, it's just distributing time. 05:10.150 --> 05:11.860 I'm not going to worry about enumeration. 05:11.980 --> 05:13.000 Wait a minute. 05:13.270 --> 05:17.700 It can help enumerate all these items that you see on screen. 05:18.280 --> 05:19.960 We might not have thought of that. 05:19.960 --> 05:26.740 And we know the designers of A.P. certainly didn't think of the protocol being attacked in this way. 05:27.630 --> 05:37.350 Now in the Linux environment, there's no update, no trace, and TCP DC and DPD queue that's configuring 05:37.350 --> 05:39.670 or querying the network time protocol. 05:39.690 --> 05:47.400 Damon So these are all utilities that are sometimes built in to Linux distros or can easily be added 05:47.400 --> 05:51.870 to Linux distros for working with troubleshooting and twrp. 05:52.380 --> 05:57.990 Of course, the only problem is when they fall into the wrong hands, they become powerful enumeration 05:57.990 --> 05:58.500 tools. 05:59.700 --> 06:00.580 Oh, my goodness. 06:00.600 --> 06:09.000 You talk about enumerating like a treasure trove of information, like the ultimate enumeration location. 06:09.420 --> 06:11.280 Boy, it would be DNS, wouldn't it? 06:11.790 --> 06:15.960 DNS is going to have all of these great system names. 06:16.110 --> 06:18.210 Two IP address mappings. 06:18.480 --> 06:19.140 Yikes. 06:19.380 --> 06:25.230 This would be, again, a treasure trove of information for someone attempting to enumerate your network 06:25.710 --> 06:29.610 and think about zone transfers. 06:29.970 --> 06:31.530 Not transfers. 06:31.890 --> 06:33.470 Zone transfers. 06:33.480 --> 06:37.860 Once again, my optical character recognition software is struggling on TS and FS. 06:38.190 --> 06:47.220 Yeah, zone transfers are when we are having one DNS server update another with all of the DNS records 06:47.370 --> 06:49.470 or a partial list of them. 06:49.680 --> 06:52.500 We can do full or partial zone transfers. 06:53.070 --> 06:59.880 Well, imagine the DNS system transferring all the records to the attacker. 07:00.840 --> 07:05.760 This could be done if we didn't secure things and they knew how to use Digg or not. 07:05.790 --> 07:07.590 Look up common tools. 07:07.740 --> 07:10.350 Many times embedded into operating systems. 07:10.560 --> 07:14.620 For instance, Windows has NSA look up for sure. 07:14.640 --> 07:15.690 It may even have Digg. 07:16.170 --> 07:19.320 So we know Unix boxes will as well. 07:19.650 --> 07:27.840 DNS recon is another tool not built in, but it can be very valuable for the enumeration of zone transfer 07:27.840 --> 07:28.470 information. 07:29.540 --> 07:30.890 But that's not it. 07:30.890 --> 07:37.190 When it comes to DNS, it's such a powerful enumerator that you could have cache, snooping, taking 07:37.190 --> 07:37.640 place. 07:37.880 --> 07:43.940 So this is when they're not trying to get the whole zone, but they are trying to resolve names to IP 07:43.940 --> 07:48.770 addresses and they're looking in servers that are caching this DNS information. 07:49.430 --> 07:53.420 This attack can be done recursively or non recursively. 07:53.480 --> 07:54.230 What does that mean? 07:54.560 --> 08:03.740 Well, recursive means that we all go and ask the cache server for a name two IP address mapping and 08:03.740 --> 08:08.360 if it doesn't know it, it will go take action trying to fetch it. 08:08.720 --> 08:13.340 Or a non recursive where if it doesn't know it, it'll stop right there. 08:13.610 --> 08:19.700 Cache snooping can be carried out both recursively and non recursively by the attackers. 08:19.970 --> 08:23.300 Their style would depend on the DNS architecture. 08:23.300 --> 08:23.750 Really? 08:24.620 --> 08:30.710 Now, what about mitigating these frightening types of DNS enumerations? 08:30.740 --> 08:41.120 Well, yeah, we are going to harden DNS servers big time, and they're only going to trust other authorized 08:41.120 --> 08:43.070 DNS infrastructure components. 08:43.340 --> 08:46.190 So we're going to be using access control lists. 08:46.370 --> 08:51.050 We're going to be using firewalls, intrusion prevention systems here big time. 08:51.620 --> 08:55.460 Also, by the way, on the subject of zone transfers. 08:55.790 --> 09:03.500 There's technology now like DNS transaction signatures that are going to make this highly, highly secure. 09:03.770 --> 09:10.460 So sure enough, we need to stay on top of new technological advancements with DNS, and they almost 09:10.460 --> 09:12.680 always tend to be in the area of security. 09:13.460 --> 09:16.160 Hey, how about IP seq enumeration? 09:16.490 --> 09:19.880 Well, we'd probably be going after UDP port 500. 09:20.060 --> 09:28.610 And we might be using a tool like IHC scan in order to get the internet key exchange data as much information 09:28.610 --> 09:33.440 as we can about how the company is using IP SEQ to build VPNs. 09:34.010 --> 09:36.200 Voice over IP could be enumerated. 09:36.470 --> 09:43.030 There's the session initialization protocol or SIP that runs over TCP and UDP ports. 09:43.040 --> 09:46.310 2012 one 5050 and 5061. 09:46.750 --> 09:52.880 Well, how about a weird range of port numbers to memorize there, but these are the ports that would 09:52.880 --> 09:57.170 be enumerated when we're going after voice over IP traffic. 09:57.860 --> 10:00.470 How about Linux and Unix users? 10:00.470 --> 10:05.660 We talked about Active Directory or Azure Active Directory in Microsoft environments. 10:06.020 --> 10:11.840 Well, in Linux in Unix environments, there's our users finger and Yahoo! 10:11.870 --> 10:20.270 Utilities that again are very valuable in the hands of the bona fide administrator but are very dangerous 10:20.270 --> 10:23.060 in the hands of the computer criminal. 10:23.610 --> 10:29.870 So yeah, that's just a smattering of other powerful enumeration techniques that exist. 10:30.230 --> 10:34.490 And it sure makes us feel like we've got some job security, doesn't it? 10:34.670 --> 10:35.780 That's always a good thing.