Good afternoon my Alices and their Kitties 🎀🐈‍⬛

Today I want to continue the series of sweats about attackers The first part (https://t.me/technical_private_cat/312) was about planning attacks

This one will be about the attacks themselves 🩸

First I will describe the common types of attackers and their targets, then I will give some examples and also provide an archive with materials about it and the attacks themselves and their methods.

To begin with, let me remind you what types of attackers there are (it is important for understanding the goals and therefore the attacks).

Let's break it down by level of professionalism🗝

Let's start with the lesser level of professionalism and the possible harm from their hacking: 

This includes script kiddies - these are people who do not know how to write their own code and do not really understand what they break and how to do it competently . Usually do not even have an even plan of attack, and work exclusively with other people's scripts, Brutforce or are busy dudos attacks.

The next level of professionalism are those who ddos sites or break into the databases of small organizations. They do it for the sake of distinction or with some vague purpose. They often use various web for example
sqli vulnerabilities, as well as bruteforce and other people's scripts.

Next for me are the owners of various botnets and different carders.
Often they are more at the level of script kiddies. But in order to properly organize a botnet (for surveillance and data collection) need at least some brains.

Then for me there are gray hats, and those who break for the sake of interest. 🔑
Yes ,they can be pros, use serous vulnerabilities, but their direct goal is not to do harm.

They mostly find new vulnerabilities and 0deas, write their own scripts and understand competent hacking. What they find, they usually give to hacked organizations. 

Next up for me are the black hats 🎩 

More often than not they are pros at what they do and go to make money . Usually they use malware, compromising employees, or any vulnerabilities in the system, they can use other people's scripts, but with their own modifications, or significantly rewritten for the purposes they need.
Just these attackers can well cover their tracks (but about this we will talk in part about forensics).
This category is divided into groups or individuals (but more often groups) of different orientation. But about this later.

After me go state organized hacks 🌎.


Most often they are needed for surveillance and obtaining the necessary data. This can use many of the advantages of the government, malware and advanced hacking techniques.

By the way, if anyone is interested in a practical hacker group manual, here is a repository with some of the leaked material used to train the group members

In the further parsing I want to talk about black hats and their attacks 🎩🧩

First let's talk about encryption attacks and then ransom demands

This is done by gaining access to the server . By using subheading steps (for example by compromising employees or infecting their pc with a virus) or by getting into the network and intercepting the password from the server with a fitting + local dos attack and packet sniffing.
To gain access they can also exploit various rce vulnerabilities, here is a thread on github with tools related to them
Then, after accessing a server they use some ransomware programs (example one simple one using python or here's a repository, that includes ransomware and many other cool stuff , also here's a simple example of ransomware, written in C ).
Also, ransomware often needs to escalate privileges, and they can do it with CVE-2020-147, here's a script for its exploitation (check it out). There is also a privilege escalation packet
#cve #exploit #linux #malware #pentest #attackers