Real Hacking: Learn The Cyber Kill Chain
Вставка
- Опубліковано 1 чер 2024
- The cyber kill chain is a 7-step process to hack into targets. Examples of targets might include devices, networks, or organizations. Just as how computer networking has a conceptual model of layers, hacking has phases. The violent “kill” aspect of the term stems from its heritage in military operations. It all starts of with:
(1) Reconnaissance. There's never enough scouting and research to prep in advance before an engagement. Reconnaissance doesn't mean host and port scanning and service enumeration. It can also include methods OSINT, in-person scouting, and pattern-of-life analysis. The more diligence performed at the recon stage, the easier it is to hack later on in the cyber kill chain.
(2) Weaponization. This might be the most involved stage of the cyber kill chain. A better word might be "payload-ization." Cyber tools aren't kinetic weapons that create kinetic destruction. Rather they are more like spells to give the caster access and influence over a target. To hack, you need both an exploit and a payload. The exploit lets you take control over the thread of execution for a victim process. The payload is the code you want to run on top of the hijacked process. Often, for client-side attacks, you’ll have to hide both in a benign file or webpage to have a user start the hack.
(3) Delivery. There's a lot of ways to send data from Point A to Point B. Getting remote execution at the same time is the hard part. Sometimes this involves co-opting a user to help you. Other times you can fire off an exploit at a running service directly across the Internet. In some cases, you can have malware installed on a system en-route from the factory. Client-side, service-side, and supply-chain attacks are all forms of delivery methods.
(4) Exploitation. The point of code execution is where all the magic happens. This determines whether the hack actually succeeds. But exploitation isn't just a singular event. There's a ton of engineering time required to turn a proof-of-concept into a reliable tool. Bypassing memory protections or sandboxing methods are examples of feats needed for execution.
(5) Installation. Hacking is much more than remote access. It means maintaining persistence so you can access on-demand. Hand-in-hand with installation in the cyber kill chain is maintaining persistence. To survive a reboot or even re-format is important to make sure the previous steps don't go to waste. Persistence does increase the potential for detection though. Memory-only installation, rootkits, encrypted virtual file systems are some ways to maintain stealth.
(6) Command & Control. E.T. needs to phone home. If there's a network, the problem lies in keeping stealthy. If there's no network, then the problem lies phoning home without a phone. The C2 aspect of the cyber kill chain determines successful follow-on objectives. If you can’t communicate without detection, it'll be a short-lived hacking operation.
(7) Actions on the Objective. Real hacking always has a purpose to it. There’s little point in all the hard work of Steps 1-6 of the cyber kill chain if there’s no end-state to achieve. Depending on the threat actor, it can be for intel gathering, espionage, or financial gain. The actions on the objectives should support the end state. Tactically, this may be stealing data and expanding access to other devices.
---- RESOURCES ----
Intelligence-Driven Computer Network Defense, Lockheed Martin:
www.lockheedmartin.com/conten...
The Unified Kill Chain, Paul Pols:
www.csacademy.nl/images/scrip...
00:00 Different Levels of Warfare and Cyber Operations
00:46 The Cyber Kill Chain Framework
01:41 How Hacking Parallels Military Operations
02:42 Step 1: Reconnaissance
04:23 Step 2: Weaponization
05:53 Step 3: Delivery
08:18 Step 4: Exploitation
09:35 Step 5: installation
10:52 Step 6: Command-and-Control
12:55 Step 7: Actions on the Objective
13:21 Strategic Considerations of Hacking
#Hacking #KillChain #Cyberspatial - Наука та технологія
What do you think is the most important part of the cyber kill chain?
recon! I appreciate your videos they are very interesting. I'm working towards being a pen-tester and your content really sticks. Keep up the good work!
I also think that's recon, so, yeah, recon is in the first place
@@doloez6460 👍
@@jonmagee1778 Awesome to hear. Good luck on your journey :)
Nice content and very well explained..much appreciated 👍👍
Acc to me action on the objective and after recon.
Without any objective why anyone wants to do that?
I can clearly see the effort you put into your videos! I just discovered your channel, and I'm not exaggerating when I say that I fell in love with the way you structure your videos! So clear and linear! Wow! Keep it up!
Really grateful of this comment. Thanks so much :)
I am loving your channel. Such high quality content!
Appreciate it :)
Interesting... you've just summed up general ideas of the entire course of Information Security at my Uni in less than 15 mins. Lol. Thanks for the video!
which uni you go to?
Maybe your Uni should incorporate this into their curriculum!
@@Cyberspatial ikr
We are growing so fast. Keep it up, don't change your quality line please!
Thanks! Will try, it ain't easy!
@@Cyberspatial we'll support you : )
I appreciate your extremely clear presentation of the steps with good examples, without getting stuck in the weeds or showing off. The big picture. It would be nice if you developed a reading list for us to download, as well as your favorite videos, books, and manuals, in addition to your own videos. Lastly, maybe even suggest institutions and other places to learn cybersecurity or warfare, from the best to the worst. Loved the presentation. The videography and sound are good. Well spoken. Clear, interesting, good pacing.
This is probably the most comprehensive security channel on youtube
Thank you!
YOUR CHANNEL IS ABSOLUTELY MIND BLOWING.AM SURE THAT YOU ARE UNKNOWN FOR SOMEHOW.YOUR CHANNELS ARE PROVIDING VERY GOOD CONTENT BY PROVIDING EASY EXAMPLES AND VISUAL CONTENT.PLEASE DONT STOP YOUR CHANNEL CONTINUE WITH MORE AND MORE CONTENT.AM VERY INTERESTED IN CYBER SECURITY SO PLEASE DO MORE CYBER SECURITY VIDEOS.SUPPOERT FROM INDIA.
Thank you so much 😀
I love this channel, how did I just find it?! many people have the knowledge, but few can convey it so clearly and with such high production. Love the visuals and the explanation!
I am surprised by the quality of your content and the fewer views on it! I wonder why this channel is not that bigger than it should be. I am learning so much from you!! From the bottom of my heart, thank you. Keep up the good work.
Thanks so much for the kind words. Hoping to reach and help more people moving forward. :)
This's quality content! You actually referenced a "scientific" work, which could help understand more internally this kill chain! Also, the video is really impressive and engaging.
Thank You!
Following since you had around 400 views. Happy to see that you are blowing up : D
Happy to have you along the ride :)
You are doing a great job explaining these things. It’s not overly simplified, but it’s not overwhelming either. Thank you!
Glad it was helpful!
I LOVE YOUR WORK OF QUALITY AND PROPER EXPLANATION YOU'RE NOT LIKE MOST OF THESE GUYS ON UA-cam CLAIMING TO BE SECURITY PROFESSIONALS..🔥🔥🔥
Thanks! 😅
Damn such good production .. times are changing
Glad you appreciate it. Thank you!
Not to exaggerate but I love this channel.
Bravo to the creator of this video.
I just found out this channel and it's helping me well.
Thanks alot.
OMG... I missed your videos in last 10months bcas... I found your chennal just now..... You great .... bcas i love your face when you pronounce words..😍.. and your content tooo clear and easy to understand..🔥🔥
Thank you for the kind words. Glad to have you here :)
Great video . short, sharp and detailed - but not too much detail. Thanks
Fascinating topic. Clear and comprehensive explanation, thanks for the great job :)
Thanks! Glad you like it :)
Nice video man, clear and concise explanation! Thanks a lot!
Love your content and your style. Don't stop 🙏
Won't stop with supporters like you believing in what we do. Thanks! :)
Like it has been said before, great content and explained in an equally great manner. No confusion here for me.
Thank you for your disciplined approach to sharing this information. It's sharpening me and making me realize how much more serious I need to be about these next four years of learning. Starting with no experience but want that OSCP before summer's end.
OSCP is a great cert to have, don't give up, even if you fail!
@@Cyberspatial Thanks man. This field is just too cool to fail. I do a bit of OSINT for marketing purposes and have a .onion services background , always been curious. That OSCP I see an initiation, passing is just a matter of conditioning.
Whenever I get notified by ur video's I'm soon excited & motivated more & ....
Happy to hear :)
Love the direction and content of this channel. Thank you.
Thank you!
Please make a video on IR life cycle . With both OFFENSIVE & Defensive perspectives. 🙏🙏
I feel 10x more confident in soft soft, thanks!
Just found your channel ,love the quality content.
Awesome! Glad to have you here :)
Keep it coming! Love it! Could you do a high level video like this but on the blue teaming side, with like incident response and so forth?
Thanks for the recommendation, getting there slowly. For now, you can check the interview with a SOC Lead who practices both offensive and defensive security. Check it here 👉 ua-cam.com/video/5oGQNu4CJL8/v-deo.html
Im really enjoying your video's!!! So interesting and professional. Just keep on going you'll get there!
Thanks! Glad you like it :)
Fantastic Content Quality. Kudos to you!
Thank you :)
iam new for your chennal sir when i saw your firest video. now i want to look every videos for you make thank you so much such a great information and your explanation
Love you sir
stay home ,stay safe sir
Protect your self from covide
Really appreciate the kind words. Thank you and stay well :)
Thank you sir for your replay you are so kind to your followers
Excellent video!
wow awesome talk very informative
Enjoyed your video you have excellent communication skills. Keep up the good work young man.
Thanks for the kind words :)
@@Cyberspatial Your welcome.
Thank you for this amazing video!
Love all of your videos
Very great stuff! I just recently subbed your channel and I’m loving your tracking methods. I’m currently in school for my bachelors degree in IT. Your channel helps me understand networking and the art of hacking. I look forward to growing as a hacker overtime. I’m expanding my knowledge as I want to get in the industry of hacking once I graduate.
Happy to help. Wish you well on your journey. Keep growing and don't give up! 👍
Such a nice channel and awesome content. Thank you
Thank you!
can you do a video on the OSI model?
Your content is very interesting and high quality
Appreciate it :)
great video!
AMAZING Video! Thank you very much.
Welcome :)
Great video
Superb video. Subscribed!!
Thanks! Welcome aboard :)
Such a great channel!
Thank you!
I am loving your channel and I am web developer and going to switch my career in cyber security but don't know where to start. There is to much information with different different perspective. Can you please help from where should I start. And thanks for this helpful content.
If you're interested in puzzle solving and breaking things web app vulnerability testing could be interesting. You also want to look into doing web development tooling. A lot of tools used in cybersecurity and processes are scripts. You'll need to baseline yourself with a strong networking/sysadmin skills. Then start to expand your reading into security-related areas.
I love the term "Dumpser diving" I think I'll stick with it :D
Amazing content 👌
Glad you liked it
Thanks for all the effort you are putting in this channel
You guys deserve it! Wish could pump out more!
Nicely explained
Thank you!
This is such a good comparison.
Glad you appreciate it :)
Flash drives people needs a computer or any other devices with USB ports to access it contents. But... Is it possible to do the same thing with SD Cards for people insert into their smartphones as external storage?
Most computers have some kind of I/O for external media. Best to close off with hotglue or enable blocking/logging on the OS.
Lovely video!
Thank you!
Keep up the good work!!
Will do!
How does this channel not have millions of followers? Someone explain it to me please
Dude epic work!
Thanks!
Hello again, I am impressed by the content on your channel. You deserve way more likes and subs than you earn. I love knowledge, your information presentation gets me excited to learn more and dive into deeper detail of coding and security. I hope we bump into eachother in the future, I would love to show you what I learned and learn techniques from you. Keep up the great work my friend.
Thanks so much for the kind words. Looking forward to seeing you in the future :)
Genius move!
Thank you In the setup
Excellent
Most topics presented here and other videos are covered in Networking+ and security+ book or and class.
Excellent, thank you!
Glad you enjoyed it!
You really deserve more than milion subs
In due time :)
I always share on my facebook when cyberspatial has a new post because I learned a lot here
#CyberspatialIsTheBest
Really appreciate it :)
great video
Thanks!
Sharing a thought :
_Interesting to see that this whole industry wouldn't exist if humans were good and didn't mean to harm/attack each other..._
A lot of industries won't exist if humans were good to each other
Police, guns, army, etc etc
@@vaishnav3735 that's right ! Evil creates jobs
Say goodbye to the entire defense industry too!
I’m thinking of starting a Certification on Ethical Hacking.I read the requirements which said I have to be 18 and above. I have just turned 17,and have a basic overview of hands on hacking.Is it a big deal I am not 18?
Not a big deal. Silly why they have an age limit. You can start reading books and practicing now. If you want the cert, just read study guides for it.
man i love this channel
Love having you here!
I would like to see a free sites to learn the tools you need to hack, Linux, cli for beginners? Thanks for the great video!
linuxjourney.com/
heehe you areback love you:)
Sorry to keep you waiting!
thank you.
You're amazing.
Thank you!
So interesting.
Glad you think so :)
@@Cyberspatial I do. Cyber war fair is the only kind of war fair I find interesting. As most of the time it is just information gathering rather than attacks that out right kill people as in real war.
Though I have my concerns large governments will and have taken advantage of the computer literate in order to feather their own political nest.
MAN, I MISS YOUR VIDEOS DUDE
Been a bit slow, sorry! Been tuning the workflow and processes to get these out faster
@@Cyberspatial any comment on the solarwinds attack?
Hi am trying to learn how to hack should be competent with programming languages because I don't know where to start
Bash and Python are great starting points!
I think it would be easier to carry out cybersecurity to protect a company than to want to manage a part of the web. The latter is an almost impossible challenge because you risk much more.
The smaller the network, the easier to defend. Some companies have enormous attack surfaces!
I am just getting my feet wet. This is awesome! Thank You Kindly..
Awesome! Wish you well on your journey :)
This guy is amaziing
Thanks!
I need to know some information ..... how people know check my massenger ... that what im doing there .. which people and what i chat him .... and is it crime ....
Bro your in that elite category ain't u, take me under your wing lol
There are scores of true elites out there that are way beyond. Just a UA-camr here :)
You dont need to get into 100% reverse engineering to understand how buffer overflows work. its a lot easier than it sounds
Wow informational P1😂
❤❤❤❤
I will join college ,in a year, I think I am getting idea , which skills I want to learn
Awesome! Wish you well :)
Where do I start with cyber security please
To start off, you need to identify which field you want to get into. Then, you can choose a learning approach to help you master that field. :)
@@Cyberspatial ethical hacking or security administration.
Start here.
2:38 what is the name of this movie?
Baywatch
I see you got into cybersecurity because you are obsessed with espionage and security because so am I
Cyber espionage is one of the primary use cases of "hacking" or offensive security!
@@Cyberspatial sounds interesting
how was this free to watch
Bro are you korean??😁😘
I certainly look Korean!
do you know website that i can learn cyber security for free?
Resources are pretty scattered unfortunately. Start by reading books on security and networking.
@@Cyberspatial which book that beginner can understand easily?
@@dekajulian7296 Ed Skoudis' Counterhack Reloaded is pretty good
@@Cyberspatial ty
@@dekajulian7296 Welcome! :)
I really wish Neil would have used Debian & HARDWARE. Semper Fi Speaking of military. Could you & Neil go over Unified Kill Chains? I read a paper by Paul Pols on the subject & it is insightful. Here is the link www.csacademy.nl/en/csa-theses/february-2018/104-the-unified-kill-chain
Thank you for sharing! Unified Kill Chain is really similar, they just add a few extra stages for more context, focusing in the Actions on OBJ and Lateral Movement stages.
5 minutes in and tNice tutorials is 10 tis harder than garageband on my phone
Can You be my mentor?
At the moment, we don't do one-on-one mentorship. All the advice we give are the ones we post on the channel.
@@Cyberspatial Thank you for your feedback
@@wyttee Welcome :)
Dude....he is already mentoring with this channel.
The best soft cos when ur stoned
After so many years of being confused and intimidated by tNice tutorials software I finally understand how to use it. I never thought the day would
im just bored 😅so im learning random crap
nth comment
Thanks!
it scares me that people know how to do all this lol
Usually it takes a team.
@@Cyberspatial Agreed
now i’m going to hack roblox
thanks!
Let us know how that works out for you 😏