Hello everybody.
Welcome to master class.
November 10th, 2022.
I'm looking forward to hearing everybody and what you've got to
present. It looked like, you know, we have it listed. So it
looks like it's gonna be a great.
Press a bunch of presentations tonight. Definitely. Everybody's
ready and willing to listen.
It's going to be a lot of fun.
We have frank.
Uh Kianos, Jackson, Nunn and Lucian.
Olaru, I hope I said everybody's names correctly. I have a big
thing about that.
Because mines always said incorrectly. So I totally
understand OI try to do my best.
Let's start with uh, Frank. If Frank, Are you ready?
I am and you said my last name correctly.
All right.
Oh, great. Thank you.
Yeah.
So can everyone see my screen OK?
I see it.
OK.
OK, so let me minimize this quick, OK.
So welcome everyone. My name is Frank and for my master class
presentation, I decided to go over a tool that many bug bounty
hunters use as part of their hunt for bugs. By no means is
that my intention to become a bug bounty hunter, but I came
across this tool while I was strolling through my news feed,
trying to stay up to date with current events, tools in the
industry. This tool is widely used by red teamers as well to
test the the security.
Of an organization's systems.
So tonight's agenda will be mainly focused on the OWASP tool
known as Amas. We will touch.
Base briefly on what OWASP is and what they are known for.
And then we will dive into the contents of the tool and what it
is used for.
The tool, known as Amas, is a tool designed to perform network
mapping of attack surfaces and external asset discovery using
open source information gathering and active
reconnaissance techniques.
Emass can discover unknown attack services through DNS,
enumeration, and network mapping.
Uh, while conducting enumeration, one could use an IP
address, domain, domain name company, or a SN number as part
of the scope.
Which is pretty cool.
So before we dive further into what the tool is, we're gonna go
over what OWASP is.
A wasp is known as the open web application security project.
It is a nonprofit foundation that works to improve the
security of software from the website. It is a source for
developers and technologists to secure the web through tools,
resources, education and training.
Uh through community LED open source software projects. This
is the place where all of that happens.
Iowas provides free available articles, methodologies,
documentation, tools, and other technologies in the field of web
application security.
So.
Two of the resources that they provide for the community is the
OWASP top ten security risks and OWASP Web security testing
guide. This is something that all cybersecurity professionals
should be aware of.
The top ten security risk list is a report of all incidents
that happened in a given year across all industries, and is
ranked on ranked based on risks and any organization.
It is a standard awareness document for developers and web
application security.
So as you see here back from 2017, this is the list of the
top ten security risks that were identified and obviously
throughout the years the list has changed and going to 2021,
the list has changed a little bit. Some risks have climbed the
charts and there are some new ones as well.
Are the website security Testing Guide is a comprehensive?
Guide to testing the security of web applications and web
services.
So all of this is provided as part of Obama's mission to
improve the security of software.
So.
Now time for the bulk of the presentation. So amass has
mentioned previously is a tool that can discover unknown attack
services through DNS enumeration.
It is like the Swiss Army knife of.
Bug bounty hunting. So this tools made possible by Jeff
Foley and Anthony Rhodes. So as you see here amasses tool that
will run a collection of open source tools and run it as one
sort of like a Swiss army knife.
So there are different techniques that will pull from
different data sources, so some of them include API such as 360
passive DNS, Anubis DB buffer over.
Built with.
I also does certificate grabbing from census uh see Cert, SH,
Google ECT.
A DNS lookup via brute forcing reverse DNS sweeping zone
transfers.
And much, much more. So this is all the techniques that it can
provide and this is all the sources that they actually pull
from.
So.
It is ran. The tool itself is ran through the Terminal command
line. It can be downloaded through various ways, but for
time constraints we're not gonna dive into that.
So the amass dash help.
Command will list the different ways that the tool can be used.
So using the Intel subcommand, it will discover targets for
enumerations.
I won't. We use the ENUM command O perform enumerations and
network mapping.
If we run the VIZ Command, it will visualize the enumeration
results.
That's actually my favorite part of this tool.
The track will track the differences between enumerations
and DB, will manipulate the Amas graph database.
So if anyone was interested in learning more about the tool, it
actually provides documentation on GitHub.
See, these are great places to go to.
So the first command that we're gonna go over is the AMS Enum
dash list.
So what this does is that it's going to list all the resources
active that is currently configured with the tool.
So additional resources can be utilized through the
configuration file.
So when you do a standard install of this tool, this is
what.
These are the resources that are available.
So on the left here you see that data sources in the middle it
lists the types of tools that it is and on the right it tells you
whether or not it's available. So this is just a screenshot of
what you see from actually running the command.
So for the presentation, we are going to use a target from a bug
bounding website known as bug crowd bug. Crowd is a
crowdsourced security platform. It gives bug bounty punters a
platform to find exploits and companies, products and assets
without any repercussions. So I went ahead and selected company
that everyone is familiar with and that happens to be Netflix.
So the image that you see on the right is a list of the assets
that are in scope for penetration tests.
We're not going to be conducting up integration test, but however
we will be.
Uh, using the tool with this target?
So the Intel subcommand.
Can help you discover additional root domain names associated
with the organization that we are currently investigating.
Uh, so we've run that with The Who is command? It will list all
the discovered domains that are run through the reverse. Who is?
The Dash V will output the status of the command line as it
is being executed.
So the image that you see here is what was executed. Continues
for a good bit, so I didn't get a chance to, you know, get a
giant picture and try to fit it all in one page, but it will
list all the.
Uh sources on the left because of the dash SRC, it would
actually list the domains that were discovered.
And I included the IP V4. So what that will do is that will
print out any IP addresses that were discovered as well.
Uh, the ENUM command is will perform DNS enumeration and
network mapping while populating the selected graph database.
So the enum dash, SRC, dash, IP V4, dash, brute dash target
which is D so it's going to print out the sources.
That.
We used. It's also going to print out the IP addresses for
the domains and it's actually going to the Brute will perform
a brute force sub domain enumeration.
Using a word list that is located inside the configuration
file.
So as you see here we have different sources available like
from Pulse Drive says that it's from FTL.
Netflix.com and it will actually print out. There's two IP
addresses associated with that particular.
Domain.
So.
The amass of this command will create a network graph, visual
visualizations that add structure to the information
that was gathered.
So the D3.
Is short for data-driven documents. The command uses a
JavaScript library to create a visualization of the data.
So as we see here, a red is the target domain or other domains
that were discovered using the brute method I mentioned
earlier.
The green dots represent the records that were discovered
from open source method methods. The orange indicates the IP
addresses that were discovered.
And pink are the net blocks. This is a range of consecutive
IP addresses. Didn't example an example of this would be like
196.25 dot 0.0 to 196.25 dot 255.255.
And all the pink dot pink dots that connect to the blue dots
indicate the ASN numbers that were also discovered.
And what makes?
This command.
Actually, what I love about it is that.
You can actually play along with the the file, so this right here
is just a recording of what a D3 force mat looks like in real
time.
Because everything just moves when you're.
You know, just dragging it along. I don't know if you guys
remember from.
Growing up playing Mario 60, uh Mario 64 on the Nintendo 64, you
play with this you.
Click and drag his nose and it like you pull in and next to you
know it's just flaps back into place, though it sort of reminds
me of this. So I thought this was rather cool to play with.
So the track Subcommand will show the differences between
enumerations that were included that included the same targets
for monitor monitoring a targets attack surface.
So what it will do is it will it's sort of like a history
command. So what it will do is it'll list all the domains that
were found, the IP addresses and it'll tell you at which time the
scans were actually.
Execute it.
So in conclusion, OAF amass has many uses for web application
penetration testing for bug bounty hunters and red teamers
alike.
It is great to use many open source tools all-in-one sort of
like the Swiss Army knife of open source tools. So I know we
touched base on OWASP and what kind of resources they provide
for the Community and the different ways amass can be
helpful.
The biggest take away from this tool is that it can discover
unknown attack surfaces through DNS and DNS enumeration, and
network mapping.
So I wanna thank you all for your time and have a good rest
of your night.
So questions? I'm pretty sure we're gonna save the questions
for later.
Is that right, Marjorie?
Correct.
OK. And then?
Thank you, Frank. That was awesome.
And references if anyone is interested.
It's great.
I gotta.
Hide everything and I'm just kidding. Run.
Alright.
Ask my everybody's loving it.
All right.
Well, thank you so much, Frank.
My pleasure.
Let's go to Jackson. Are you ready?
Yep, I am. Just let me get it signed up and then we'll be good
OK.
to go.
Alright, so good evening. Good evening everybody. I'm doing my
master class on troubleshooting. I feel like this is one of the
things I do the most often and I feel like it's really important.
The only other thing there is to do is really to bypass problems
and I see that a lot of people do that instead of just
troubleshooting and trying to find a solution. And, you know,
implementing that solution. So today I'm gonna kind of show you
my method.
And then present a couple of scenarios and hopefully you guys
will help me out with those scenarios and we can kind of
make this a team thing.
So just the overview, I think troubleshooting is a vital step
in the process of making something work, whether it's
initially or whether it was working correctly at first, and
then it stopped working correctly.
Umm, I feel like these techniques are versatile because
once you learn the basis of them, you can.
Use them on many different issues, right? If you have a
network issue, you can use them, or if you have an issue with
your car, you can use them. So just by knowing the basics you
can use them in different areas.
And then I just kind of wanted to use the word divergent. So I
did that one.
So I got this one off of CompTIA. This is kind of their
basic troubleshooting. You'd first identify the problem,
you'd establish a theory. You test that theory, you create a
plan of action and a solution. You verify that that solution
worked, and then you document it. But I think we can kinda
make it more simple, but at the same time bring it to the next
level.
So the first thing we have to do is identify the malfunction,
because if we're troubleshooting, it means
something's not working correctly. We need to get it
working correctly.
Without this step, you know we really can't do anything else.
The second step is to gather the data. The most important part
here is asking questions. You know how long has this been
going on? Was there a system update before this happened? Is
this the first time it's happened? Things like that is
gonna help you narrow down the problem and figure out a
solution.
So the next thing is, after you have all the data gathered, you
feel like it's pretty good. You're gonna start to look at
the data and also we can present the data. We can collaborate
with other people and talk about the data we gathered and see if
maybe they have information on it because maybe it's something
simple and they already have the fix for it. You know, we don't
have to troubleshoot alone. I see a lot of people. I think
they're kind of scared to ask questions. They don't wanna look
like they don't know things. So it stops them.
From asking questions and maybe fixing things quicker.
The next step would be to brainstorm and brainstorm and
implement a solution. Again, this can be, you know, with
other people or with yourself after you've already had their
input.
And I think one of the most important things here is to take
the easiest route first. Some people wanna always go to the
complicated, you know, solution or they wanna go right back to
the beginning and restart. But you don't always have to do
that. Sometimes there's.
You know, just a small problem you can fix to get everything up
and running again.
The next step would be to determine and document the
outcome. This is really important because this is how we
know the solution that we brainstormed up was.
Correct and it's working. And then it's important to document
the outcome because if it doesn't work and it causes more
problems or something like that, we have something to go back to
and something to look at and say, hey, this didn't work.
Let's go ahead and try this now and we can kind of go through
these steps at different times. You know, we could brainstorm
and it maybe our data was bad. So we have to go gather more
data about the problem so we can fix it. You know, that's OK.
So Next up is going to be the scenarios.
So I'm gonna read these and then if somebody wants to chime in,
just raise your hand, unmute yourself and.
Yeah.
So specialist Smith went to go start his Humvee on motor pool
Monday, but as he turned the ignition, he heard grinding, but
the vehicle never turned on. The most knowledgeable mechanic
determined it was the starter and agreed to replace it.
Once replaced the specialist Smith trying to start the
vehicle but still have no luck.
So if we know that our solution should have worked, but it
didn't, what's the next step we should take?
So kind of looking back at the process in different steps,
which one of these should we go through?
April, what do you think?
I would say a make sure that all of the components will properly
installed.
OK.
What? What is someone else think about that?
I.
I personally like they just go off the Cliff down.
Yep, that's always the solution. We wish we could do, but we
can't.
So I would say April, that's great a makes all the components
were properly installed. That's important, right? Because if
they weren't, it doesn't function properly. But what
about the easiest thing? What if we go to see check the visible
wires and see if they're connected correctly?
But can we check that first and then maybe we have to
disassemble a little bit to see if all the components were
properly installed?
And then we also have, yeah, Sean.
I go with.
He lack of information, is it still grinding or doing the same
thing it was doing before?
So what would we need to do?
Because after the part being installed, is it performing new?
Information you know we need more information at this point.
What's it doing now?
So.
So you're saying our data is not good and we should go gather
So.
more data.
Correct.
Awesome.
I let's move on to the next one.
So in associate, Jim, I Chrysler was installing an airbag to a
car and in the middle of the process, the tool lost
connection to the network. A supervisor came up and tried to
reset the tool, but it could still not get the tool to
respond. What's the next step he should take to get it up and
running again? We have tried to reset the tool again. Third
times the charm throw the tool away and grab another one. The
company can afford it. Check the wireless access points to make
sure that the tool is connected or replace the battery on the
tool.
Does anybody wanna take a shot at this one?
I would kind of guess replace the battery on this one.
Yeah, that's a great idea. If the IT doesn't have enough
juice, maybe that's what's making the connection difficult,
so it can't connect to the network because it just doesn't
have enough power to do so.
So this is interesting because this was actually a scenario I
ran into.
At Tesla and.
Beforehand, our tools are wireless and they work off
wireless access points and they were doing construction, so it
ended up actually being the wireless access points. But that
wasn't the first thing I checked because I didn't even expect
that I expected that if they were to do that, they would have
let us know and stuff like that. So I started with, you know, de,
I replaced the battery, tried to reset the tool again, but then
it ended up being I had to go further and look at the access
points and see if they were all still up and good.
So for scenario 3, Mark was on his computer. Casually scrolling
on YouTube looking for a video to watch. He noticed that his
Internet was slower than usual, which shouldn't have been the
case because he just got a new router. He finally found a video
to watch on the latest cybersecurity news when his
browser redirected to a site he had never seen before.
So it looks like it's computers compromised.
How should we start getting his computer back in all good
security posture?
Anybody wanna take a shot at this one or we sleeping out
there?
So if he just got the the router, maybe he didn't change
the broadcast ID and the password on the router and
that's how somebody got into it.
Marjorie.
So.
Is on YouTube. I would go on YouTube and find the answer.
That's what I tell my students. That's what I always do. So.
That's a good idea.
I mean reset his router and IP address and see if it's it's
happens again.
Perfect easy solution. You know he could just unplug it. The
Ethernet cable, reset it, get a new IP.
I always tell you to do it, plug it, unplug it, plug it back in.
Yeah.
Take the easiest thing first, because and even if you know the
broadcast ID wasn't changed, just changing it now is that
gonna correct the problem. Whoever has access to his
network, are they still gonna, you know, be able to access it?
And that's all I have for my presentation guys. Thank you.
That was awesome.
Definitely.
Thanks for describing the scientific method.
Right.
There's always a way, but there's a simpler way, and
that's the best way to do it right?
Now.
I love it that you just gave everybody that because I love
the technical thinking part of it. Everybody must find their
own solutions and what's the best way to do is start with the
simple solution first, right?
Keep it simple, stupid is what I heard a lot and growing up, so I
kind of live that way now and I think that was perfect
presentation to really.
Uh, show how that can be done.
Yes, I would agree.
Thank you very much. Yeah, thank you very much, Jackson.
And and you know the first example. It was a solenoid.
I think he knew what it was.
No.
That's great.
Yeah, see. And then there's always ask your friend who knows
about cars. They can figure it out. Let them listen to it.
Exactly. That's a good one.
Exactly. Yeah.
Awesome job. OK, next we have Lucian of that name.
Hello everyone. My name is Lucian. I'm just. Give me one
Hello.
Ah.
second to see if I can share my screen.
I'm French, so since I'm French, it's Lucian. Sorry.
Talian, it's Lucian.
No.
You guys hear me and see everything, OK?
Yes.
Umm.
So tonight I'm gonna talk about.
The.
Part of penetration testing the Red's teaming that uses the
physical penetration testing.
It's in my opinion, a part that sometimes it's overlooked.
And I'm gonna start by saying what the physical penetration
testing is. It's a.
The method that assesses all the physical security controls,
which include locks, fences, security guards.
Cameras or other security measures?
And the test the the goal of test of physical penetration
testing is to circumvent the safeguards to access networks,
locate sensitive data and physically enter off limit
locations.
Also, I wanna talk a little bit about why it's physical
penetration testing important.
It is important because it assesses the risk of an attacker
physically breaking into your organization.
And we know that usually.
Businesses do an excellent job of protecting their networks and
applications against virtual cyber attack, but unfortunately
many do not consider the risk of a.
Possibly physical attack on their locations.
So.
In researching.
I found a couple of companies who offer the services and.
This is what I discover like what? Mostly, uh, a pen tester
who does physical penetration has in their tool.
So.
They use lock picks, bypass tool, elevator Master keys,
command keys and bum keys. They have all kind of wireless
adapters, antennas, hardware, other tools, or miscellaneous
tools.
I'm not going to talk about the lock picking.
Long part I'm gonna talk about the hardware. Does the part that
I found more interesting.
And this is an example of what a toolkit of a pen tester physical
pen tester looks.
So he has all the keys that I mentioned before and.
All the hardware and antennas.
The first tool that I'm gonna talk about it, it's called a
proxmark 3.
Well, this is.
A very unusual tool.
Ohh it's able to read, write, clone, brute force and emulate
almost all the RFID protocols.
And according to the source that I found, that's the only one
capable of transmitting and receiving at the same time.
It is a small size device that fits usually in the hand or a
pocket. It can run independently from a PC powered.
Uh by or an optional battery which allows you to perform
advanced actions such as of on online sniffing, key cracking
and offline encryption.
It allows you to hack.
Hotel rooms, car keys, public transportation system, like
buses, trams or museum tickets. Ewallets loyalty cards.
And many more.
What I found it also interesting it's that it's a great little
device for physical pen testing which allows you to capture,
replay and close most of the error F ID tags.
This is an example. This is how this the Pro Max Pro Mark 3
looks.
It's not cheap. It's starts at $340 and this version that you
see here, it doesn't include the the Bluetooth connectivity and
the battery, which you can attach and it make it completely
wireless.
The next slide, it's a short video. I hope you can guys see
it. If not let me know. It's about four minutes is the
longest that I added. I'm I'm not trying to make you watch
videos, but I think this is really interesting. So you can
see what this tool is capable of.
Should there be sound cause I don't think we can hear
anything.
The correct everyone else.
There's no sound.
No. Did you share with sound when you shared the screen?
Ohm. That's a good question.
Yeah, go ahead. Stop sharing and and go up to the top where you
OK.
where you hit the share tray. There should be a toggle switch
OK.
that says share computer sound.
OK.
Back.
Yeah. And the drop down or in the?
I said include computer sound this one.
And then you.
Yep, Yep.
OK. OK. Thank you.
You're welcome.
I'm gonna jump over again.
Welcome back to Hacker Warehouse TV. In today's tradecraft
Now we can hear it.
tutorial, we will be using our PROXMARK 3 RDV 4 to decrypt and
emulate a MIFARE 1K card using the blue shark module and RFID
tools Android app.
The technique we will use to copy and emulate the target card
is normally only possible with a wired connection to the proxmark
client on your computer workstation, but thanks to RG,
this can now be done wirelessly and discreetly in the field
using just the PM 3 in your Android device. To get started
you will need access to the following materials 1 proxmark
3, RDV 4 with the blue Shark module and the firmware fork
supporting the RFID Tools App One Android device.
The.
Our GRFD tools app installed.
And one target MIFARE Classic 1K card, we will be using an old
hotel room key card first. We are going to connect the
Proxmark 3 with our Android smartphone by opening the RFID
Tools app.
Power on the PM three and turn the Bluetooth module on by
flipping the two dip switches on the right side of the blue shark
module.
Tap the proxmark 3 RDV 4 in the app and look for it. The list of
Bluetooth devices once connected open up the Red Team terminal to
access the Proxmark client.
Next, we will identify the target card by using the easy
button menu and selecting HF search.
Note the UID value of the card. For later use we will need to
identify at least one valid key from this card to decipher all
of the key data. So check if the card is using any default keys
by hitting the easy button starting with HFMD. Check to
test for these known default keys. In our Case No valid keys
were found. The default keys displayed are in sectors of the
memory not used in authentication of the card.
We will proceed by using the easy button to perform a dark
side attack.
This will attempt to exploit a vulnerability related to the
parity bits used in reader card communication, and if
successful, will decrypt a valid key for further decryption, copy
the valid key to your clipboard. Next you will hit the easy
button for performing a nested attack. This starts with HFM. If
nested, tap this button and then use your keyboard input to
delete the default values and then paste in your valid key
followed by a space in the letter T hit send to execute the
nested attack using the known key value.
Once the client prints out the entire set of memory blocks, you
no longer need to be in proximity of the target card.
The target card data will now be loaded to the PM 3 emulator
memory.
To emulate the target card using your PM 3, all you need to do is
input the command HDMF SIM followed by the letter U in the
UID of the card.
Tap sent to execute this command in the Proxmark will now act as
if it were the target card. Anytime it interacts with an
RFID reader.
This powerful attack technique is typically restricted to the
lab thanks to the incredibly small form factor of the
proxmark 3 RDV 4. The battery and Bluetooth capabilities
provided by the Blue Shark Module, and the discrete
interface provided by the RFID Tools app. This set of attacks
can now be deployed in the field by a single red teamer.
Remember that the unauthorized copying of proximity card data
may be illegal in your jurisdiction, so please hack
responsibly and ethically. Check out our other great articles on
RFID and the PM three and look forward to more trade craft
tutorials demonstrating the power of this toolkit. Go to
hackerwarehouse.com to purchase your own PROXMARK 3RD V Four in
the Blue Shark module, as well as many of the other accessories
you will need to build your own RF ID lab. Thanks again for
watching and remember.
Keep it between the laws.
Really no lulls this time.
OK, I hope you guys saw it and hear it.
Ohh, the next tool that I'm gonna talk a little bit. It's
the Flipper 0 so this is.
This is the most wanted right now.
So this tool it's a portable multi tool for pen testers and
the article that I found describes it as.
For gigs in a toy like body.
I'll share the pictures in a little bit. It looks pretty much
like a Tamagotchi like earlier.
The toys from the earlier 2000s, so flip Flipper 0. It's a multi
tool that covers many of your hacking needs and it's very
importantly an open source. It can communicate.
To the to the sub one gigahertz devices. It can also communicate
bottom low and high frequency.
Ohm to NFC cards, infrared devices, and even Bluetooth.
Also Flipper 0 allows you to run bad USB attacks by connecting
the device to a computer via USB and running a role. A whole
array of docky scripts.
3 Flipper 0 has an app support from both iPhone and Android and
it also has a large online community community that offers
offers resources.
And.
They come up with creative ways of using the device all the
time.
So this is the Flipper 0. This is how it looks.
It looks like it's on my Gucci. You can even play songs on it.
There was a video of people being mischievous and using the
Flipper 0 to open and close the charging ports of Tesla. Someone
discovered there is a vulnerability.
They make they made.
Public the the code on GitHub. You can download it.
Run it on your flipper.
And then when you see your test light, you can try to open their
uh charging port.
The next tool then I'm gonna talk about it. This is my last
tool. It's the land turtle, which is a tool that provides
tout remote access. Network intelligence gathering. Met in
the middle surveillance and attack.
Some of the features that the lanterns have are you can use
them to for a persistent method method terpreter in Metasploit
you can scan the net or use again map. You can use them for
DNS spoofing exfiltrate data.
Ohm, you can use them to capture browser traffic. You can you
have access to the entire LAN LAN network and you can use a
VPN to communicate with the.
As a as an active gateway.
And it's it's it's a short video presenting what the length or
Dale is.
This is how it looks it looks like.
Like a device like.
They would.
Translate from, you know the USB to to land port, but it cost
about $70.00.
And this is the description that I found for it.
The land turtle is a covert tool for getting shells hidden inside
this normal looking USB Ethernet adapters, a chip that runs open
source turtle modules and these modules do everything from
maintaining remote access to performing man in the middle
attacks and scanning networks, setting up the land turtle is
simple, the graphical shell guides you through the whole
process and the land turtle is setting forget. So once you've
configured it to your liking, just drop it on a network and
it'll run those modules. Since it's a smart USB Ethernet
adapter, you can plug it in between a computer and an
Ethernet cable as usual.
And now, poised as a man in the middle, you can sniff up
interesting network traffic or poison DNS, redirecting websites
to the IP address of your choosing. And since it's USB
powered, it can be dropped on the LAN with any regular USB
charger or battery pack. Best of all, the land turtle is
completely customizable to your needs, using the free open
source turtle modules need a persistent reverse shell on a
network. Try auto SSH when it integrate with Metasploit and
pivot through the network will use meterpreter need to access
every node on the LAN from wherever you are.
Open VPN will act as a site to site gateway, so whatever the
land turtle can see, so can you from afar. The land turtle is
great for penetration testers, systems administrators and tech
enthusiasts, and if you're looking for more modules,
there's an entire download center to install, more for free
right from the land turtle. Learn more and get your land
turtle now at lanturtle.com.
The last one, and I wanna talk about it. It's. I remember one
of my colleagues in one of the previous presentations. We're
talking about the Raspberry pie. So.
In researching tools.
Umm, I discovered.
I tutorial made by a professional from the IT.
Pro TV on how you can create your own.
Lantern Dale using a Raspberry Pi 0, which is the level entry
from Raspberry Pi. It's this version. It's about $10.
So I'm just gonna list what you need and pretty much what step
you have to take. I didn't attach the video because the
video is about 15 minutes long, so I don't wanna go over.
But anyone who's interested, I can post this on the.
On our, on our chat and everyone can watch it so.
The the hard way needed. It's Raspberry pie. It's a micro
adapter for Linux and Raspberry Pi and the butter a battery.
This thing is gonna need need need some power. You can use it.
You can either hook it up at a computer and power it from
there, or it can just add a battery and there's a software.
What I found interesting, he uses an easy to instance from
WS.
Ohh which is gonna use for a C2 server and he installed collie a
MI.
Then he uses thermax or which is a terminal emulator for his
phone.
And then he uses a Kelly instance for his laptop or
computer.
And then.
On all the instances he uses ncat.
Or as a shell connections.
And this is basically the idea where you have the laptop, you
have the server, you have the smartphone, you use the
smartphone with a SSH to connect to the server and you use the.
The laptop.
With Ankit to connect to the server and the Raspberry Pi
connects to the C2 server.
And this is the things that he used right now, the Raspberry Pi
Zero. You cannot find it. It's currently unavailable, but this
set that you see in here was about 30 something dollars, 35
or $36.00 at the time.
Ohh all the tools put together.
There were a bit over 50, so it's a bit cheaper than the
buying a lentil. This is made you made it.
And the sort all my references that I use and thank you very
much for bearing with me.
Great job, great job.
Thank you.
I think those are all the presenters for tonight. So guys,
do you have any questions for any of our?
Experts.
Very quiet bunch tonight.
OK.
Well, if no one has any other questions, any concerns?
I did see some of our newbies in here so.
Yeah.
I'm. I'm glad they were able to make it and and see what it's
all about, because this will be you in a few or weeks or so.
Don't scare him.
It's it's.
Just a reminder, I know it was pretty awesome tonight, so kinda
hard to talk and each week but.
Right, right.
Is this is This is why you can come each week and you can get
ready yourself, but everybody thinks it's gonna be hard and
and and look how great everybody did tonight. So.
But thanks everyone who I thought it was interesting. I of
course I go for the simple stuff like the troubleshooting cause
that was like really resonated with me. I I help everybody get
their Azure account working, if if you've all been through that,
I'm sure you have.
He had to get Visio at some point in your career here at
Purdueglobal. It was probably challenging.
Yeah, that's right. All day.
Yeah, I I remember that.
And when I was a student and yeah, it was a challenge.
It's never, and no matter what it's and it changes all the time
and we write. We write the instructions all the time and
it's still a problem so.
Yeah.
It keeps us busy.
But it's it's it's interesting when it happens, just exactly
like what was being presented. It's like such an important
skill for all IT cyber anybody students to have. And you just
have to have patience and just go through the steps and try
that again and and you know, you can't get frustrated. I think
that's the moral of the stories you have to go back through the
steps. Try again.
Everybody gets in eventually.
That's what's cool about it.
So, but great job, guys, everybody. Everybody did a great
job.
Thank you.
I just wanna add that if anyone is interested, you can go on
YouTube and just.
Google search Flipper 0 because.
People are pretty mischievous and they're using it in all kind
of instances, so they turn off the the monitors which show at
the prices and McDonald's, or they can even change the gas
prices, but not at the pump like on the display, the huge display
so they.
Show you the gas prices using the Flipper 0. You can actually
go and change that. I don't know if it's legal or not, but people
That.
are doing it so.
Pretty sure it would be legal that that sounds terrifying.
That's why I say off YouTube. There's too much scary stuff.
Yeah, people open garage doors and all kind of stuff. Doorbells
Yes, yes, for sure.
and stuff like that.
That's scary.
Very cool.
All right, everyone. Well, everyone have a great night.
Thank you so much.
And of course, if you have any questions, please reach out and
chat. Reach out to your lead and that's what they that's what
we're all here for, alright?
Have a good night everyone.
Thank you all for coming.