Everand Logo

Welcome to Everand!

  • Discover millions of ebooks, audiobooks, and so much more with a free trial

    Only $11.99/month after trial. Cancel anytime.

    How to Hack Like a GOD: Hacking the Planet, #2
    How to Hack Like a GOD: Hacking the Planet, #2
    How to Hack Like a GOD: Hacking the Planet, #2
    Ebook243 pages1 hour

    How to Hack Like a GOD: Hacking the Planet, #2

    By sparc Flow

    5/5

    ()

    Read preview

    About this ebook

    Ever wondered how hackers breach big corporations? Wonder no more. We detail a step-by-step real life scenario to hack a luxury brand, steal credit card data and spy on board members.

    Art of exploitation
    We start by building a small hardware backdoor that we plant in a retail store owned by our target brand. You get to learn about the Wiegand protocol and how to bypass card readers found in all major shops and companies.

    Network security
    Using our backdoor as a pivot, we infiltrate the internal network and exploit NTLM vulnerabilities to connect to a random server. We bypass Applocker rules and elevate privileges to take control over the streaming screens in the shop. But, that's not enough for us now is it?

    We map the company's network architecture and bounce from server to server using "Pass-the-ticket"techniques and domain trusts in a Windows Forest. We land on HQ networks at the other end of the globe.

    Art of intrusion
    Once inside the main network, we hack a couple of servers (Golden ticket, Token impersonation, etc.) and manage to break into an IBM Z Mainframe, where credit card data is stored. We exfiltrate data from the Mainframe, then smuggle them off the network without triggering the DLP software.

    Finally, we explore how to execute code on the laptop of every board member and spy on their meetings.

    No metasploit and other old hacking tricks
    We go through each hacking trick step-by-step: from bypassing Citrix/Applocker to abusing Kerberos and hacking a Mainframe. The idea is to help you replicate these procedures during your engagements.

    All custom attack payloads are provided and explained thoroughly in the book.

    LanguageEnglish
    Publishersparc Flow
    Release dateSep 4, 2017
    ISBN9781521232682
    How to Hack Like a GOD: Hacking the Planet, #2

    Related to How to Hack Like a GOD

    Titles in the series (6)

    View More
    View More

    Related ebooks

    Security For You

    View More
    View More

    Related podcast episodes

    Related articles

    • Article

      Hacker’s Manual

      Mar 2, 2021

      Hacker’s Manual
      1 min read

    • Article

      Hacker’s Manual

      Nov 17, 2020

      Hacker’s Manual
      1 min read

    • Article

      “Someone Who Under Takes A Ransomware Attack Isn’t A Hacker, They’re An Attacker”

      Aug 12, 2021

      If you’ve ever attended an infosec or cybersecurity event, you will no doubt have noticed the preponderance of “Hacking is NOT a Crime” stickers. In 2018, some 500 such stickers were handed out at the DEF CON 26 event, the following year 5,000 were d

      7 min read

    • Article

      Social Engineering

      Oct 15, 2019

      Social Engineering
      5 min read

    • Article

      Hacker’s Manual

      Apr 19, 2021

      Hacker’s Manual
      1 min read

    • Article

      Cyber Insecurity

      Nov 17, 2020

      Each year we proclaim it’s time to learn how to hack. But why? Jonni always gets angry at the subversion of the term ‘hacking’ and I can understand why. Hacking is fun, as is finding out how systems work and how to get them to do things they were nev

      1 min read

    • Article

      Modern Hacking, Ethics And Statistics

      May 31, 2022

      Agerund and an infinitive walk in to the Linux kernel. They were hacking to learn. An awful adaptation of a (drinking to forget) joke, but a reasonable opener. An incredibly useful maxim from long ago hacker lore is “don’t learn to hack, hack to lear

      5 min read

    • Article

      Introducing Kali

      Mar 2, 2021

      Introducing Kali
      4 min read

    • Article

      Hacking Banks

      Dec 17, 2019

      Hacking Banks
      4 min read

    • Article

      Hack The Planet/Parrot

      May 31, 2022

      Hack The Planet/Parrot
      2 min read

    • Article

      Network Attacks

      Sep 21, 2020

      Though less common than malware and social engineering, network-based attacks are still a threat to every computer and mobile user, and everyone should have at least a basic understanding of what they are and how to avoid them. So this month let’s lo

      4 min read

    • Article

      Hack The System

      Dec 17, 2019

      If you followed our handy guide on the previous pages, then you’ll already have augmented your Kali Light installation with Nmap, a port-scanning utility par excellence and a vital part of any pen-tester’s arsenal. As mentioned on the DVD page (there

      4 min read

    • Article

      Hacker Distributions

      Nov 17, 2020

      Hacker Distributions
      1 min read

    • Article

      Hacking Power

      Jul 30, 2018

      Hacking Power
      4 min read

    • Article

      From Child Hacker To Bug Hunter

      Mar 19, 2020

      Why did you become a black hat hacker? At school I would finish my work in ten minutes and spend the rest of the lesson playing on the computer. I was 10 or 11 when I stumbled across a chatroom whose members taught me how to hack – I was just a bore

      1 min read

    • Article

      Data Recovery

      Mar 21, 2022

      Data Recovery
      12 min read

    • Article

      Discover The Secret IPhone Hack Codes

      Mar 26, 2020

      Did you know that your iPhone comes with its own set of manufacturer codes that are used to access detailed information about the device? Typing these codes into the Phone app’s keypad allows you to access hidden modes, troubleshoot any issues that y

      1 min read

    • Article

      Revisiting Tor

      Aug 24, 2020

      Revisiting Tor
      4 min read

    • Article

      Nmap Deep Dive

      May 31, 2022

      Nmap Deep Dive
      5 min read

    • Article

      Hack Your Bluetooth

      Jun 2, 2021

      Hack Your Bluetooth
      4 min read

    Related categories

    Reviews for How to Hack Like a GOD

    5/5

    1 rating0 reviews

    What did you think?

    Tap to rate

    Review must be at least 10 words

      Book preview

      How to Hack Like a GOD - sparc Flow

      Foreword

      Fashion brands tend to portray an elegant image of their products and designs. But what about the underlying machinery and computers that power their fancy fashion shows? How elegant is their IT infrastructure, and to what extent can a hacker wreak havoc?

      Follow me on a step-by-step journey where we pwn a high luxury (albeit fictitious) brand. From zero initial access to remotely recording board meetings, we will detail every custom script and technique used in this attack, drawn from real-life findings, to paint the most realistic picture possible.

      Whether you are a wannabe pentester dreaming about real-life hacking experiences or an experienced ethical hacker tired of countless Metasploit tutorials, you will find unique gems in this book for you to try.

      I have documented almost every tool and custom script used in this book. I strongly encourage you to test them out yourself and master their capabilities (and limitations) in an environment you own and control. Given the nature of this book, it is ludicrous to expect it to cover each and every hacking technique imaginable, though I will try my best to give as many examples as I can while staying true to the stated purpose of the book.

      I will fly over some concepts and systems like Kerberos, Citrix, and Mainframes by briefly explaining how they work and what they mean in the context of the hacking scenario. If you feel like you want to go deeper, I strongly advise you to follow the links I offer for each item and explore the dark, fun concepts behind each technique and tool.

      Note: Custom scripts and special commands documented in this book are publicly available at www.hacklikeapornstar.com.

      By the same author:

      Important disclaimer

      The examples in this book are entirely fictional. The tools and techniques presented are open-source, and thus available to everyone. Pentesters use them regularly in assignments, but so do attackers. If you recently suffered a breach and found a technique or tool illustrated in this book, this neither incriminates the author of this book in any way nor implies any connection between the author and the perpetrators.

      Any actions and/or activities related to the material contained within this book is solely your responsibility. Misuse of the information in this book can result in criminal charges being brought against the persons in question. The author will not be held responsible in the event any criminal charges are brought against any individuals using the information in this book to break the law.

      This book does not promote hacking, software cracking, and/or piracy. All the information provided in this book is for educational purposes only. It will help companies secure their networks against the attacks presented, and it will help investigators assess the evidence collected during an incident.

      Performing any hack attempts or tests without written permission from the owner of the computer system is illegal.

      Prep and pep talk

      Luck is where opportunity meets preparation.

      Seneca

      Do you ever wonder while taking a stroll down Fifth Avenue in NYC – or any other fancy street – what lies behind the bright, shiny facades of big luxury shops? What feat of technology processes hundreds of sales daily? What information system run TV screens broadcasting fashion shows 24/7?

      As you are gifted with a curious mind, I am sure you are no stranger to these kinds of thoughts. Yet I would like to share with you a thought that will pique your curiosity: if banks, one of the most paranoid private corporations, struggle¹ to secure their systems, how are these luxury-shoe-making shops keeping their systems secure?

      In order to answer this question and to make this journey as realistic and enjoyable as possible, we will consider an imaginary luxury brand called GibsonBird. They have locations all over the world and are established in malls and on famous avenues alike. They pride themselves in being a high-tech, modern fashion brand.

      Let’s talk pwning strategy!

      Our goal as attackers is not to hack everything that has an IP address. Why go through 50,000 useless servers when only a few hold the data we are after?

      We will tailor our efforts to the complexity and size of GibsonBird – except for the occasional temptation here and there, of course. Who could resist a Windows 2003 SP2 server with an open SMB port²?!

      Ideally, we would like to:

      Steal financial records of every shop in the country: credit card data, number of sales, etc.

      Download personal data of every designer, manager, and executive board member

      Record board meetings discussing secret strategic plans

      That’s pretty ambitious and should keep us busy for a few more pages. So where do we start? How do we get from a random point on the internet map to a board meeting on the 90th floor of a skyscraper in NYC?

      In the scenario featured in How to Hack Like a Pornstar, we used two very common ways to penetrate a bank’s network:

      Hacking public websites hosted on the bank’s infrastructure

      Phishing employees and tricking them into executing malicious code that gave us remote access

      That is all good fun, but this time we would like to follow more esoteric paths. We will show how an attacker with physical access can do damage that quickly escalates to what the media would – incorrectly – call an Advanced Persistent Threat (APT).

      The broad idea is to plant a small piece of hardware in one of GibsonBird’s many stores. This hardware acts as a small computer that give us access to that shop’s local network, which we will then leverage to escalate to corporate, and pwn every other shop in the country.

      You would think that we need special hardware and engineering skills to achieve this Hollywood-esque move. We don’t. We will cover step-by-step how to build an effective little backdoor for around $30.

      Although most leisure time hackers would not choose to go down the road of planting hardware, this is the go-to path for intelligence and federal agencies in multiple countries.

      It does make sense. Why struggle to find (often unstable) zero-day vulnerabilities³ when you can intercept a shipment of newly ordered equipment, install a microchip, and access any traffic that flows through the equipment? Take the NSA, for instance; according to Snowden’s files⁴, that’s one of their favorite strategies.

      Figure 1 : Picture showing the NSA carefully opening an intercepted computer (router) package

      Before diving into the core subject, hacking GibsonBird, it is essential to agree on some fundamental hypothesis to fully grasp the purpose of each step we are about to take. We must take the time to ponder GibsonBird’s environmental constraints that will probably lead them to make predictable network choices. This preparation phase is very important as it can greatly help us develop and orient an optimal plan of attack, especially once inside the network.

      GibsonBird has over 100 stores. Each store

      Enjoying the preview?
      Page 1 of 1