Ethical Hacking: Offensive and Defensive Security

Explore the OSI model overview, introduced by ISO in 1984, detailing its seven layers—application, presentation, session, transport, network, data link, and physical—and how they govern data transmission between machines.

Explore how data becomes protocol data units across the OSI model, moving from application data to segments, packets, frames, and bits, including port numbers, IP and MAC addressing.

Explore the differences between TCP and UDP, highlighting TCP's connection-oriented, reliable delivery with sequencing and flow control versus UDP's fast streaming with no handshakes and possible packet loss.

Explains why port numbers exist in the transport layer to route data to the correct application, using TCP/UDP and examples like HTTP port 443, Chrome, Zoom, and MySQL.

Explore how the network layer adds source and destination IPs to each packet, distinguishes private and public IPs, and uses NAT and DHCP to enable internal and external communication.

Explore common networking protocols and port numbers, including http, https, ftp, smtp, dns, dhcp, ssh, and telnet, and learn how encryption distinguishes ssh from telnet for secure remote access.

Install VirtualBox and the extension pack to create a sandbox lab environment for red-teaming activities. Test malware and offensive tools inside the sandbox to protect the primary machine.

Complete the Kali Linux and VirtualBox setup, import a preconfigured Windows target VM, and practice offensive and defensive exercises using included exploits, software, and scripts.

Explore Metasploitable Linux as a safe test environment for penetration testing, vulnerability assessment, and security research, practicing attacks before real servers.

Explore how honeypots attract attackers by simulating vulnerable systems, logging indicators of compromise (IOCs) and incidents to improve detection, while VPNs provide encrypted, remote access that attackers may exploit.

Demonstrates how single and distributed denial of service attacks overwhelm a web server using Kali tools, testing server limits and monitoring with Wireshark.

Explains how a man-in-the-middle attack uses ARP poisoning to intercept traffic by mapping IPs to MACs and redirecting packets through an attacker, using Kali and Ettercap.

This lecture demonstrates ARP poisoning and a man-in-the-middle attack, using Wireshark to sniff packets and capture http traffic, revealing usernames and passwords, and shows VPN as defense.

Explore how botnets are networks of compromised devices controlled by a malicious actor to launch dos or ddos attacks. Detect botnets by monitoring unusual network traffic and suspicious background processes.

Perform a host discovery scan to identify live hosts in the 192.168.8.0/24 class C network, including the gateway and metasploitable hosts, and generate an active-host report.

Perform a basic network scan with automation tools to enumerate live hosts, reveal vulnerabilities across devices, highlight critical flaws, and offer patching and reporting options, including CVE references.

Conduct a web application scan to identify vulnerabilities, including critical remote code execution and CVEs, using Metasploitable as a test target, then review scan results.

Explore the cyber kill chain and MITRE frameworks as attacker path models, detailing reconnaissance, weaponization, delivery, exploitation, malware installation, and command-and-control to achieve objectives.

Explore MITRE ATT&CK, examining its 14 tactics and the tactics, techniques, and procedures (TTP) model, and compare it with the cyber kill chain to understand attacker workflows.

Understand how endpoint detection and response (edr) differs from antivirus, using behavioral analysis and AI to detect known and unknown threats, with live response and cloud-based data forensics.

Explore data loss prevention (DLP) and how it blocks data exfiltration by monitoring network traffic, evaluating packets and IP reputations, and sending alerts, integrating with EDR to protect data.

Explore how reverse shell programs establish remote connections from a Windows target to a Kali machine using socket and Winsock concepts, and examine malware development and threat actor techniques.

Demonstrate building and testing a reverse shell, compiling a C program to an executable, and establishing a command and control channel between a Kali Linux host and a Windows target.

Compare reverse shell and blind shell, detailing how a malware-installed exe on a Windows host creates a reverse connection to the Kali attacker, bypassing outbound firewall rules.

Explore how Windows loads a program as a portable executable, moving chrome.exe from disk to memory, and how a process contains DLLs and memory while a thread executes inside it.

Explore how dynamic link libraries power Windows applications, their import-export APIs, and how threat actors leverage dlls to load, allocate memory, and execute code within target processes.

Learn how Windows log collectors capture security, PowerShell, and application logs for forensics and threat analysis, and install Sysmon to log process creation and login events in Event Viewer.