WEBVTT

00:00:01.340 --> 00:00:03.560
Hello there, and welcome to this course,

00:00:03.940 --> 00:00:07.260
which is titled Exfiltration with CloakifyFactory.

00:00:07.260 --> 00:00:11.860
This course is part of the red team tools course series,

00:00:12.340 --> 00:00:15.760
and I'm super excited to take you through this course.

00:00:16.740 --> 00:00:18.150
My name is Rishalin Pillay,

00:00:18.150 --> 00:00:22.910
and let's get started. CloakifyFactory enables you to

00:00:22.910 --> 00:00:26.060
make use of text‑based steganography.

00:00:26.940 --> 00:00:32.060
It is created by Joe Gervais, also known as TryCatchHCF.

00:00:32.540 --> 00:00:39.080
Ultimately, this is a toolset that enables data exfiltration and infiltration

00:00:39.200 --> 00:00:43.930
in plain sight. It transforms the data into a list of harmless‑looking

00:00:43.930 --> 00:00:47.750
strings, essentially letting you hide in plain sight.

00:00:48.340 --> 00:00:53.160
The beauty of CloakifyFactory is that it makes use of pre‑packed ciphers.

00:00:53.640 --> 00:00:58.350
These ciphers include, for example, a list of Belgian beers,

00:00:59.040 --> 00:01:01.650
desserts in English and various languages,

00:01:02.040 --> 00:01:06.550
emojis, world beaches, and a lot more.

00:01:06.940 --> 00:01:11.840
It also has some prepackaged scripts for adding noise and entropy to your

00:01:11.840 --> 00:01:17.480
cloaked payloads. And examples of this could be prepending randomized ID

00:01:17.480 --> 00:01:22.910
tags or latitude and longitude coordinates, and, of course, there is a lot

00:01:22.910 --> 00:01:27.670
more. But CloakifyFactory works at its best when you are using your own

00:01:27.780 --> 00:01:31.820
customized ciphers, and I will show you how you can create customized

00:01:31.830 --> 00:01:37.890
ciphers in the demonstrations later. This tool is available on GitHub, so

00:01:37.890 --> 00:01:43.460
you can leverage it on Linux or Windows by making use of Python to EXE.

00:01:44.540 --> 00:01:48.860
It is simple, clean, and portable. And when I say simple, clean,

00:01:48.860 --> 00:01:52.040
and portable, essentially, you can make use of either the

00:01:52.040 --> 00:01:56.790
framework, or you can make use of the individual scripts to

00:01:56.790 --> 00:01:59.440
either cloak or decloak the data.

00:01:59.670 --> 00:02:05.350
Considering the killchain CloakifyFactory works from the action phase onwards,

00:02:05.840 --> 00:02:09.870
essentially allowing you to take action on the target. When we

00:02:09.870 --> 00:02:13.770
look at the MITRE ATT&CK tactics, in this course, we will focus

00:02:13.770 --> 00:02:16.160
predominantly on exfiltration.

00:02:16.540 --> 00:02:20.240
We will begin by looking at exfiltration over a C2 channel,

00:02:20.400 --> 00:02:25.330
and this is covered by tactic 1041, and then we will move to

00:02:25.330 --> 00:02:32.260
tactic 1567 with a subtactic of 0, which is Exfiltration over a Web Service.

00:02:33.140 --> 00:02:33.850
Finally,

00:02:33.860 --> 00:02:39.940
we will look at tactic 1048 with a subtactic of 1, which is exfiltration

00:02:39.950 --> 00:02:44.240
over an alternative protocol such as SMB. As always,

00:02:44.330 --> 00:02:46.360
ensure that you stay legal.

00:02:47.140 --> 00:02:50.770
This course is designed and built as an education course.

00:02:51.240 --> 00:02:54.860
Please do not replicate any of these tasks on targets

00:02:55.170 --> 00:02:56.760
that you do not have permission on.

00:02:57.140 --> 00:03:04.930
I will be using Kali Linux, specifically Kali Linux 2021.2. And, of course,

00:03:04.940 --> 00:03:09.190
make sure that you run an up‑to‑date operating system to ensure that you

00:03:09.190 --> 00:03:13.730
have all of the latest updates and upgrades by making use of the apt‑get

00:03:13.740 --> 00:03:16.990
update and apt‑get upgrade commands.