So in terms of deep packet inspection evasion tactics for pen testers like us,
why is it useful? Well, there's a couple of reasons. One, we can get around
IDS and IPS systems for us to be able to go through and pivot throughout the network,
send files back and forth, and be able to expand on our learning and security testing measures
within an organization. Now, to further elaborate, we incorporate things like encryption
for us to be able to do things like command and control. Now, yes, we went through and saw the
encryption examples a while ago, and that would be a little bit difficult for your typical user
to be able to go through and do, and we're not asking them to do that. However, there are users
that do do that, so be advised that that does happen. For us pen testers, though, it's a way
for us to be able to do enumeration and send that data back to our C2 system, command and control.
So let's say our pen testing box is outside of the organization and geo-dislocated. We're inside
of one of the Active Directory controllers in the organization that we're pen testing.
We have enumerated all of the user's informations on the actual domain itself,
so first name, last name, all the account data, everything but like passwords and such,
and if we try to send that back to our command and control system outside of the organization,
we might trip an alarm or two. See, an organization could have something like tripwire as well, too,
if we grab a file and try to send it over. I'll touch on that here in a second, but if we encrypt
it and send it to wherever we need it to go, then deep packet inspection is brought to a screeching
halt because the keys for those files don't exist inside of the system that's doing the inspection.
Otherwise, there would be no point in encryption whatsoever. Now, just a second ago, I touched on
files going back and forth in programs like tripwire. Did I mention tripwire? I may not have.
Now, my time in the DoD, we used a program called tripwire to do our network and perimeter
security for file scanning, so to speak. What this is, is basically we load up a system
full of hash tables, hash tables comprising of hashes found from files that we want to stay
within the organization, and if that signature tries to go outside of the network or that
designated network area, then tripwire would look at it and say, I see that hash going from
point A to point B, and it's going to throw an alarm up saying so-and-so's trying to steal a
file or send data to where it doesn't belong to. Well, this ties into the fact that as pentesters,
what we need to do is find a way for us to be able to exfiltrate data from a system or organization
without running across things like tripwire and having it tip the security folks off that we're
even there. So that's where encryption comes into place at, and also finding different ways to do
like IP, maybe like IPSec tunnels or some sort of encapsulation for us to be able to send data
without deep packet inspection devices or software out there finding out what it is that we're
actually doing. Because remember, if we can see it in Wireshark, then it could definitely be seen
in tools and software dedicated for that very purpose. Now don't you worry, there's always going
to be a case for encrypted data on the actual network itself, so there's going to be a method
for us pentesters to be able to hide traffic like that. Think about it for a second. There's banking
information transferred back and forth between users and banks all the time across the internet
around the world. If we take away the ability to do encrypted traffic, then all that banking
information is going to be public knowledge, and accounts are going to be hacked, and people are
going to have their money stolen, and it's just bad news all around. So that's why we're always
going to have the ability for encrypted traffic to be on the actual networks themselves. So as
pentesters, we'll always have a way to be able to hide information from the defenses, IDSs, IPSs,
that are in place on the network. In addition to that, in previous skills, we've seen that when we
make files with MSF Venom, that it comes up as a known hash in the VirusTotal table. You can go to
sites like VirusTotal.com and take a hash from a file, run it through there, and see if it's in the
database of known exploits or files that have malicious code in them. Most everything that's
been done inside of MSF Venom or Metasploit overall has already been uploaded to VirusTotal.
Now if we encrypt that file, the MSF Venom file that we create, package it up, encrypt it, and
send it over to a targeted system, and then decrypt it on that system once it gets there, we have
evaded the packet inspection on the actual network itself. We still have the battle of
endpoint security, but now we've taken one of the hurdles out of the way and allows us to be able to
send targeted files back and forth without being caught, at least on the network side, through one method.