Security's Labyrinth

In this blog, I've created some memes to add some humor whilst spreading cyber security awareness. While developers can try hard enough to produce a secure application, it is of no use if the end users are careless in their part. As users, we must protect our data and online accounts to the best of our ability.  Note that this blog is also meant to be suitable for audiences who do not have a technical background, that's why I've tried to keep it as simple as possible. However, you can read more about these topics if you wish to gain in-depth understanding. 1. Update, update, update! A vulnerability is a weakness in a software that can be exploited by attackers. When developers figure out these vulnerabilities, they patch them and release updates for you to install. As an end user, it is your responsibility to make sure that the services you use are up to date.  Turning on automatic system updates will make this task easier.            ...

There is a significant gender gap among the qualified cyber security professionals. According to the ISC2 Women in Cybersecurity survey, women working in cybersecurity currently account for about one quarter (24%) of the overall workforce. This is quite opposite to the cyber security leadership roles, where women are in higher percentages. This brings up a question: In today's world where technical professions are no more dominated by men, why do women still face hesitation when it comes to applying for technical roles in the cyber security industry? This might be because sometimes our perceptions of ourselves and our skill sets hold us back. You are female, single, married, a mother, an adventurer—who cares? These factors must not hold you back from grabbing amazing opportunities and being able to follow your passion. Mentoring A role model or a mentor can be essential for professional development and growth. The lack of females in this industry limits the opportun...

Hacking: The word which instantly creates a picture of a guy sitting in a dark room wearing a hoodie and doing something terrifically dangerous or something terribly wrong. Have we ever related hacking with security? Ever thought of it as something that is useful? There are plenty of stereotypes when it comes to the world of hacking. It is considered as a negative word and people are discouraged to take it up. Cracking vs Hacking By definition, the term 'cracking' means trying to get into computer systems in order to steal, corrupt, or illegitimately view data. Whereas, 'hacking' refers to the practice of modifying or altering computer software and hardware to accomplish a goal that is considered to be outside of the creator's original objective. Even though hacking is actually done with consent and is good in nature, people still tend to call it ‘Ethical hacking’ as if to say a 'good good task'. It's important to note that the terms...

With the rise of various technologies, security is needed more than ever. But before understanding today's complex security measures, let's take a look on how all of these evolved over time, and what challenges were faced. Cloud Security Earlier, organisations and companies used their own servers to run their application software. These servers were located and managed in-house.This setup was expensive and led to increased capital cost of computer hardware and labor cost of administrators. At the same time, it was observed that most in-house systems were idle, leading to a lot of wasted resources. These problems gave rise to Virtualization. It reduced the number of servers and helped save money. Now, there was no need to purchase different hardware configuration systems for different applications; instead a pool of general hardware resources was used to run virtualized applications. Virtualization further led to renting out of infrastructure by third parties (IaaS). It is t...

In this article, I will explain how to move inside a network using a meterpreter obtained in another network. [Pivoting] Machines used: Attacker: Kali Linux (2020.1) Victim 1: Windows 7 x64 SP1 Victim 2: Windows 10 Pro Build 10240 x64 Adding a virtual adapter in VMWare Workstation: Firstly, we need to create an internal network for Windows 7 and Windows 10 by adding a virtual adapter. Step 1: Open Virtual Network Editor Step 2: Click on Change Settings Step 3: Click on Add Network, change the subnet IP to 10.10.10.0 and apply the settings. Note: You can give any custom subnet IP here. Setting up the lab: The next step is to update the network adapter(s) in all 3 virtual machines. The updated adapter settings are: Kali Linux: NAT Windows 7: NAT, vmnet2 (Host only) Windows 10: vmnet2 (Host only) In my system, the IP’s are as follows: Kali Linux: 192.168.30.128 Windows 7: 192.168.30.136, 10.10.10.128 Windows 10: 10.10.10.129 Note that Kali and Windows...

A Web Application Firewall acts as a protecting layer between the web application and the Internet. It filters the traffic and monitors it to protect the web application from certain attacks such as XSS (Cross site scripting) , DDOS (Distributed Denial of Service) and SQL Injection.  Unlike traditional edge firewalls that work on network layer, a WAF works at the application layer. WAF was needed because traditional firewalls were unable to block HTTP traffic, since different web applications had the same port number (80 or 443).   Diagrammatic Representation (Example Scenario): Description: When the client tries to access the Web application (say www.test.com), his request is filtered through the WAF running on Ubuntu (which filters the traffic and also gives him the illusion that the Web Application he's trying to access is hosted on an Ubuntu server) . Hence , Web application server's IP Address is not revealed (Windows 7). We can say that the WAF acts as a prox...