Usage of Metasploit

Payloads – It is a pathway that a Metasploit uses to target the attack. The set payload command allows easy and quick access to switch payloads. That leads to changing the interpreter or shell-based access into a specially designed operation.

Encoders – Usually, systems are well equipped with anti-theft solutions, so, it’s possible for the hacker that their attack might get noticed by the security software installed in the system of the target user. Thus, to prevent the user from hackers, encoders help the user. The basic function of the encoders is to confuse the attacker and payload in a manner that doesn’t get noticed by the attackers on the system of the target user. 

Auxiliary – Any system that is not an exploit is called an auxiliary module. These modules are an enchanting feature of the framework that allows it to extend for various purposes instead exploitation. Auxiliary modules have hundreds of modules that perform various functions like sniffing, scanning, fuzzing, and other such functions. However, these modules will not give you a shell but are very useful during a penetration test.  

Exploits – An exploit conducts a series of commands to target a specific vulnerability found in an application or system to provide the hacker access to the system. It includes code injection, web application exploits, and buffer overflow. Exploits are of two types automated and manual exploits. The use of exploit type depends on the level of granular control you desire to have on exploits. 

Uploading a Backdoor 

A backdoor is a shortcut in a system installed by the designers and programmers that allows a user to skip security essentials like username/password to log in. It’s quite common for attackers to install a backdoor after compromising a system. Even if the system is patched, the attacker can still maintain access by installing a backdoor that will allow its future access.

There is a large variety of backdoors available for various applications, and an attacker who has good programming knowledge can easily create custom varieties of backdoors to get access.

Malware Delivery Methods

There are three most common malware attack delivery methods through which malicious hackers attack users, and these methods are mentioned here below:

Client-Side Injections – This method doesn’t let the user have an idea about the attack, but they can feel the effects happening on the websites they visit. 

Advertising Frames – This malware delivery method happens when the attacker uses an advertising frame to target the victim on a publisher’s website. Attackers are very good at using this as an avenue to execute code in nefarious ways.

Cloaking via Advertising Frames - Cloaking misuses dynamic creative features of advertising platforms to gain ads that are blocked by the end-users.

Rainbow Attack

You have surely observed while entering a password in any application or system that it encrypts passwords into hashes. So, a rainbow table attack is a procedure of cracking password hashes by using a special table in a system. This table has a value of hash for every text character used during the login process. When a hacker gains access to this list, it becomes easy for them to crack passwords with the help of a rainbow table.

Hackers generally gain access through leaked hashes to conduct rainbow attacks. This attack is possible if the database of the password is poorly secured, or through Active Directory. It is also possible through phishing. Apart from these methods, numerous leaked password hashes are easily accessible on the dark web that is widely used by hackers.

Stealing SAM Database

The Security Account Manager (SAM) is a database file in Windows operating systems that manages all the user accounts and their sensitive information. All the hash passwords are stored in SAM. It starts running in the background when the Windows boots up. There is a variety of tools that are used to retrieve the SAM file through in-memory techniques.