It's time to get into a little bit more tunneling. And the reason for this is, is because we didn't cover nearly all the tools.
Now, there's not a whole lot more tools left. There's really just two and a half really.
And I wanted to cover those and kind of explain the configuration for them and what they mean for the actual Kali system and target system.
By us diving into a little bit more of the Wireshark itself. That's my dog down there.
So, with that being said, a couple of things that I want to go through real quick is that I remembered while getting everything prepped for this skill is that we covered Tor already.
Tor itself already goes through and performs proxy functions. It's just more along the side of the web browsing portion.
And that got me to thinking, where does all this sit in the OSI model?
And it's a great question. I'm glad you asked or thought about asking.
See, the ones that we're going to be looking at right now primarily operate layer five and above for this skill.
And the reason for this is, is because we're tunneling through protocols like HTTP and HTTPS and socks.
Now, why is that? Well, that's where those protocols sit in the OSI model stack.
And if we were to go a little bit lower inside the OSI model, it might be a bit easier for somebody on the blue team or the defense side to pick apart what's actually going on inside the packet itself.
Let me give you an example. So, I'm going to hop on over to our side system here real quick.
Now, I have Wireshark opened up inside of Kali. And all I'm doing here is, this is from the prep that I was doing for the skill.
And I just wanted to point this out real quick. So, I'm going to select a packet that's going from this workstation inside of Kali over to the actual host VM itself.
And if you remember, one of the things that we discussed about Wireshark early on is the fact that it goes through the OSI stack layers one through seven.
Basically, inside of each packet.
To demonstrate this, I want to show you, as I zoom in, you see where it says frame 16, packet 98 bytes on wire.
So, I'm going to highlight that for us real quick. And you see that's the overall packet itself on the right.
Well, if I go to the next one, you can see that that's Ethernet 2.
And this is where we're starting to get into that layer 2 of the OSI model because this is switching.
And then we go into the actual information cell for IPv4.
And you can see here that while the protocol is ICMP, if I scroll up and go deeper inside of Ethernet 2.
Down here, I'm going to maximize this for us to make it just a little bit easier to see.
Internet Protocol Version 4 IP Address. Now, yes, we are getting into Layer 3.
And then it moves up into Layer 4 by identifying the actual protocol that's going through and being performed.
Everything from there on out turns into Layer 5 and above.
And that's how I, from my thinking, and this may be different for you.
This is where it's like the connection is established and whatever service is being provided is provided.
So, like HTTP, HTTPS, FTP, Telnet, etc.
All that happens at Layer 5, 6, and 7, just at different points of it.
Now, does it all go all the way up into Layer 7?
Not always, but I mean, you get the idea.
So, everything that we're talking about here, ICMP, for this particular packet, is a Layer 4.
And it's basically, that's the end of it.
Now, we do get a little bit tied into Layer 5, 6, and 7 as far as showing the results to us.
But as far as going through the actual stack itself,
this is where all that root level stuff that red teams and blue teams always have a fight over.
So, blue teams will take a look at this and say,
what is the ARP address, because that's physical,
what is the IP address, what is the MAC address, all this other great stuff.
And that can tie it down to where we're coming from, going to,
and they can run, also, those IP addresses against databases like Whois and IANA
to figure out where in the world those IP addresses are actually going from and to.
Now, I bring all that up because one of the first tools that we're going to be taking a look at inside of this skill
is going to be taking advantage of HTTP, HTTPS, SOCKS, however we want to configure it.
Much like Tor.
Now, the difference between what we're doing in Tor and these other tunneling tools that we have here
is the fact that Tor was all about just the actual web browser
and using that web browser to traverse the interwebs
and be able to go to different sites using a series of different proxies or pivot points,
which is all well and good.
However, Tor is not really the greatest thing to use for pen testing
because you would have to set up a Tor site within the target network,
which is way more complicated than some of these reverse tools that we have.
Now, speaking of reverse tools that we have,
using directory traversal, file inclusion, and other attack methods
that we've already gone through, practiced, and discussed,
the tools that we use in this skill are going to be following along that same line
in terms of how we get that payload over to the actual target.
I'll be sending you a link throughout the skill below videos
to show you where you can get some of these Windows side tools at
because some of these are pretty easy to get to inside of Kali.
But I point this out because these tools, some of them aren't native to Kali,
some of them are definitely not native to Windows,
and you would definitely need a way to be able to get it to that system.
Now, you may download one of these files on your Kali system
and send it as a package to that Windows system.
But one of the things you also need to keep in mind is
that as this big storm is going on behind me, and we're under tornado watch,
that these tools will also be flagged on the IDS and IPS,
much like everything else that's already been developed.
And that's because it already has a known signature.
I was debating on getting into that known signature right away,
but I'm going to save that for our first tool because that's one of the hit points
where this actually came up at when I was doing the prep for this skill.
So, without further ado, let's do it to it!