Hackology - exhilarate way to hack

This slide originally created by Yahya F. Al Fatih in term to educate people about the fun way of hacking. This slide is specially for event InfoVest 2018, speaker did not responsible for any misuse technique or tools in this slide.

Transcript

1. Hackology Exhillarate way to //.hack This slide originally created by Yahya F. Al Fatih in term to educate people about the fun way of hacking. This slide is specially for event InfoVest 2018, speaker did not responsible for any misuse technique or tools in this slide. #
2. # Yahya F. Al Fatih CTO of Crowde an abnormal tech savy. love to penetrate your apps. no DOTA no LYFE. 15 years experience in IT security 10 years as web developer 4 years in startup Wawadukan community WWWID writer
3. # Who tf is hacker ? STEP 1 Learn the hacker mind STEP 2 your apps is suck! STEP 3 Find the way! STEP 4 Test who you are STEP 5 Untuk memahami seberapa fun nya hacking, lebih baik jika menggunakan beberapa langkah yang sudah ditulis, dimulai dari Who tf is hacker ?, Learn the hacker mind, your apps is suck!, dilanjut dengan membuat praktek dimana dikenalkan penggunaan tools dan untuk apa lalu di lanjut dengan hacking test. Do you know the way ?
4. dirsearch & OpenDoor cek folder yang terdaftar CainAbel & Wireshark Baca data Python 2.7 & 3.6 Basic Package Tolong install semua aplikasi berikut The artifact of the way! nmap & sublist3r Advance Footprinting SQLmap & havij Sqlmap Expert WAScan & AVS Automated Vulnerability Scanner #
5. 5 2017
6. 6 Who is hacker ? they are dangerous nerd!
9. 1001 alasan mereka melakukan hacking 9 - Sebuah tantangan - Forge Knowledge - Server Baru - Showoff (?) - Diputusin mantan - Kepo mantan - Dendam sama dosen - Pengen internet gratis - Greedy cryptocurrency - miner - Bitcoin - dsb
11. Hack JS - BeeF JS - Keylogger JS - Coinhive JS - Rowhammer JS - LOIC JS - XSS’OR JS 11
12. BeeF JS 12 Keylogger JS http://beefproject.com/ https://github.com/beefproject/beef https://www.rapid7.com/db/modules/auxiliary/server/capture/http_javascript_keylogger https://github.com/JohnHoder/Javascript-Keylogger
13. Coinhive JS 13 Rowhammer JS
14. LOIC JS 14 XSS’OR JS
15. 15 The hacker mind they have short life
16. 16 To Understand About Robbery, Let’s Think Like a Thief
18. 18 Target Alternate Target Fingerprint Vuln Scanning Injection Backdoor
19. 19 apps flaw that hackers love to abuse yes, your apps is suck!
20. “ OWASP Top 10 - 2017 20
21. “ OWASP Top 10 - 2017 21
22. 22 1. Vulnerable Packages
23. “ Most of your Apps Vulnerabilities Come from npm 23 > 375,000 packages > 70,000 publisher > ~14% of npm packages carry known vulnerabilities
24. “ 24
25. “ Do you have any solution ? :( 25 > Dependencies Vulnerability scanner > re-check for every new feature is pushed > Manually Check Exploit database > patch~ > update~
26. 26 2. Vulnerable Code
27. 27 A1 - Injection SQL Injection Injection Flaw, yang berasal pada umumnya di SQL, OS, LDAP muncul disaat data serangan yang dikirimkan adalah data yang valid sebagai command. Penyerang mampu mengeksekusi “tricky query/ command” yang dapat disalahgunakan oleh penyerang untuk mendapatkan data apapun tanpa perlu autorisasi.
28. Definisi > Spesifik fungsi dengan kebutuhan informasi/ data berasal dari input user, informasi/ data tersebut bersifat "tidak aman" secara default 28
29. 29 Attack
30. 30 A2 - Broken Authentication Terkadang fungsi aplikasi tidak terimplementasi dengan baik pada bagian otentikasi yang berisko terhadap identitas user digunakan oleh orang lain. Penyerang mampu melakukan fungsi pada user aktif tersebut dan melakukan manipulasi data atau melakukan “breach” data pada user tersebut.
31. 31 Attack
32. 32 Attack
33. “ Kapan Menggunakan HTTPS ? AKA Secure HTTP 33
34. “ ALWAYS! Every Site, Every Request 34
35. 35 A1 - Injection Cross-site Scripting Pengiriman data tanpa validasi yang dikirimkan ke web browser client, dimana penyerang mampu mengeksekusi custom scripting ke browser client.
36. 36 Attack
37. 37 Attack
38. 38 Attack
39. 39 Attack
40. 40 A3 - Sensitive Data Exposure Pengiriman data tanpa validasi yang dikirimkan ke web browser client, dimana penyerang mampu mengeksekusi custom scripting ke browser client.
41. 41 Attack
42. “ 42 What should I do with my code ? :( > Security Guide for Developer https://github.com/k1m0ch1/secguide
43. “ PASSWORD 43
44. 6 reason password rules are bullshit - can’t remember - Special F#C@ING char - Special word - Too long - Expired password - CAN’T REMEMBER 44
45. “ 45
46. - Do not set arbitary length limit (NIST standar is 256 character) - Never prohibit any special character - Allow paste and password manager - Always [salted] hash. Never store password using 2 way encryption - Offer two-factor authentication Handling Password 46
47. “ People cannot create strong, unique password accross all their service using only their brain to remember 47
48. - Jangan menggunakan password yang kadaluarsa - Jangan pake rule aneh aneh - Jangan pake password hint New NIST Recommendation 48
49. - haveibeenpwned.com Password DUMP 49
50. 50 2018(?)
51. 51 Find the way! they have short life
52. 52 Security Motte and Bailey
61. 61 Escaping Dark age Security
62. 62 What we need in cyber security is not a firewall, not a motte and palisade to keep our bailey inviolate, but an immune system
63. 63 Immune System =/= Secure System Immune System = Well Maintained System
64. “ Bagaimana dengan apps mu ? 64
66. 66 Test who you are! yet another dumb CTF
67. Rules of play Time 45 minutes Build party or solo no DDoS #f9ba48 #ffffff https://ctf.wawadukan.id
68. Now the world is yours. The Challenge is hacker is not only you, there is a 1001 type of hacker in the world, now go on young padawan, Explore the World and become the best of the best, always remember, Keep Trying and There is no 100% secure in the world # The World is yours
69. yahya.kimochi@gmail.com #ffffff template by slidesppt.com Q & A telegram : k1m0ch1 http://k1m0ch1.github.com