Attack Methodology

Integrated Attack Strategy

Integrated attack strategies involve combining hacking computer systems with attack vectors such as: espionage, blackmail, medical/health attacks, asymmetric “guerrilla-style” attacks, weapons of mass destruction, and conventional kinetic military attacks. The…

Meterpreter

Metasploit has a payload component called Meterpreter that is injected inside a running process and offers a command environment to the attacker. This avoids starting a new process and keeps…

Agents

It is also possible to launch relayed pivot attacks through “agents” installed by sophisticated penetration testing tools. Core Impact agents, once deployed on a target system can be set as…

Relays

One way to launch an attack from a compromised system is to transfer all the tools you need to perform the attack over to the compromised system. Another way to…

Pivot Recon

In order to launch a pivot attack against another system, the attacker needs standard recon information. This includes the IP address, ports that are open and services responding on the…

Password Cracking

Generally, password cracking takes place in the ENTRENCH phase of the attack, after an initial penetration has been successful and password hashes have been retrieved from the compromised system, but…

Exfiltrate Data

There are several reasons why an attacker might want to get data back out of a system or network: The process of getting the data out can be as simple…

Ensure Future Access

Once high privileges are established and an account for future use is established, the next need is to ensure there is a pathway for future access. Use a penetration agent/rootkit…

Add an Admin User

Once admin/root privileges have been established, an attacker will often create a new account with high privilege levels in order to allow future access without needing to take extraordinary action.…