Real Hacking: Learn The Cyber Kill Chain
ฝัง
- เผยแพร่เมื่อ 19 มิ.ย. 2024
- The cyber kill chain is a 7-step process to hack into targets. Examples of targets might include devices, networks, or organizations. Just as how computer networking has a conceptual model of layers, hacking has phases. The violent “kill” aspect of the term stems from its heritage in military operations. It all starts of with:
(1) Reconnaissance. There's never enough scouting and research to prep in advance before an engagement. Reconnaissance doesn't mean host and port scanning and service enumeration. It can also include methods OSINT, in-person scouting, and pattern-of-life analysis. The more diligence performed at the recon stage, the easier it is to hack later on in the cyber kill chain.
(2) Weaponization. This might be the most involved stage of the cyber kill chain. A better word might be "payload-ization." Cyber tools aren't kinetic weapons that create kinetic destruction. Rather they are more like spells to give the caster access and influence over a target. To hack, you need both an exploit and a payload. The exploit lets you take control over the thread of execution for a victim process. The payload is the code you want to run on top of the hijacked process. Often, for client-side attacks, you’ll have to hide both in a benign file or webpage to have a user start the hack.
(3) Delivery. There's a lot of ways to send data from Point A to Point B. Getting remote execution at the same time is the hard part. Sometimes this involves co-opting a user to help you. Other times you can fire off an exploit at a running service directly across the Internet. In some cases, you can have malware installed on a system en-route from the factory. Client-side, service-side, and supply-chain attacks are all forms of delivery methods.
(4) Exploitation. The point of code execution is where all the magic happens. This determines whether the hack actually succeeds. But exploitation isn't just a singular event. There's a ton of engineering time required to turn a proof-of-concept into a reliable tool. Bypassing memory protections or sandboxing methods are examples of feats needed for execution.
(5) Installation. Hacking is much more than remote access. It means maintaining persistence so you can access on-demand. Hand-in-hand with installation in the cyber kill chain is maintaining persistence. To survive a reboot or even re-format is important to make sure the previous steps don't go to waste. Persistence does increase the potential for detection though. Memory-only installation, rootkits, encrypted virtual file systems are some ways to maintain stealth.
(6) Command & Control. E.T. needs to phone home. If there's a network, the problem lies in keeping stealthy. If there's no network, then the problem lies phoning home without a phone. The C2 aspect of the cyber kill chain determines successful follow-on objectives. If you can’t communicate without detection, it'll be a short-lived hacking operation.
(7) Actions on the Objective. Real hacking always has a purpose to it. There’s little point in all the hard work of Steps 1-6 of the cyber kill chain if there’s no end-state to achieve. Depending on the threat actor, it can be for intel gathering, espionage, or financial gain. The actions on the objectives should support the end state. Tactically, this may be stealing data and expanding access to other devices.
---- RESOURCES ----
Intelligence-Driven Computer Network Defense, Lockheed Martin:
www.lockheedmartin.com/conten...
The Unified Kill Chain, Paul Pols:
www.csacademy.nl/images/scrip...
00:00 Different Levels of Warfare and Cyber Operations
00:46 The Cyber Kill Chain Framework
01:41 How Hacking Parallels Military Operations
02:42 Step 1: Reconnaissance
04:23 Step 2: Weaponization
05:53 Step 3: Delivery
08:18 Step 4: Exploitation
09:35 Step 5: installation
10:52 Step 6: Command-and-Control
12:55 Step 7: Actions on the Objective
13:21 Strategic Considerations of Hacking
#Hacking #KillChain #Cyberspatial - วิทยาศาสตร์และเทคโนโลยี
What do you think is the most important part of the cyber kill chain?
recon! I appreciate your videos they are very interesting. I'm working towards being a pen-tester and your content really sticks. Keep up the good work!
I also think that's recon, so, yeah, recon is in the first place
@@doloez6460 👍
@@jonmagee1778 Awesome to hear. Good luck on your journey :)
Nice content and very well explained..much appreciated 👍👍
Acc to me action on the objective and after recon.
Without any objective why anyone wants to do that?
I am loving your channel. Such high quality content!
Appreciate it :)
I can clearly see the effort you put into your videos! I just discovered your channel, and I'm not exaggerating when I say that I fell in love with the way you structure your videos! So clear and linear! Wow! Keep it up!
Really grateful of this comment. Thanks so much :)
Interesting... you've just summed up general ideas of the entire course of Information Security at my Uni in less than 15 mins. Lol. Thanks for the video!
which uni you go to?
Maybe your Uni should incorporate this into their curriculum!
@@Cyberspatial ikr
We are growing so fast. Keep it up, don't change your quality line please!
Thanks! Will try, it ain't easy!
@@Cyberspatial we'll support you : )
I appreciate your extremely clear presentation of the steps with good examples, without getting stuck in the weeds or showing off. The big picture. It would be nice if you developed a reading list for us to download, as well as your favorite videos, books, and manuals, in addition to your own videos. Lastly, maybe even suggest institutions and other places to learn cybersecurity or warfare, from the best to the worst. Loved the presentation. The videography and sound are good. Well spoken. Clear, interesting, good pacing.
I love this channel, how did I just find it?! many people have the knowledge, but few can convey it so clearly and with such high production. Love the visuals and the explanation!
I am surprised by the quality of your content and the fewer views on it! I wonder why this channel is not that bigger than it should be. I am learning so much from you!! From the bottom of my heart, thank you. Keep up the good work.
Thanks so much for the kind words. Hoping to reach and help more people moving forward. :)
This's quality content! You actually referenced a "scientific" work, which could help understand more internally this kill chain! Also, the video is really impressive and engaging.
Thank You!
YOUR CHANNEL IS ABSOLUTELY MIND BLOWING.AM SURE THAT YOU ARE UNKNOWN FOR SOMEHOW.YOUR CHANNELS ARE PROVIDING VERY GOOD CONTENT BY PROVIDING EASY EXAMPLES AND VISUAL CONTENT.PLEASE DONT STOP YOUR CHANNEL CONTINUE WITH MORE AND MORE CONTENT.AM VERY INTERESTED IN CYBER SECURITY SO PLEASE DO MORE CYBER SECURITY VIDEOS.SUPPOERT FROM INDIA.
Thank you so much 😀
You are doing a great job explaining these things. It’s not overly simplified, but it’s not overwhelming either. Thank you!
Glad it was helpful!
Following since you had around 400 views. Happy to see that you are blowing up : D
Happy to have you along the ride :)
Damn such good production .. times are changing
Glad you appreciate it. Thank you!
I LOVE YOUR WORK OF QUALITY AND PROPER EXPLANATION YOU'RE NOT LIKE MOST OF THESE GUYS ON TH-cam CLAIMING TO BE SECURITY PROFESSIONALS..🔥🔥🔥
Thanks! 😅
Great video . short, sharp and detailed - but not too much detail. Thanks
Nice video man, clear and concise explanation! Thanks a lot!
Like it has been said before, great content and explained in an equally great manner. No confusion here for me.
This is probably the most comprehensive security channel on youtube
Thank you!
Not to exaggerate but I love this channel.
Bravo to the creator of this video.
I just found out this channel and it's helping me well.
Thanks alot.
Fascinating topic. Clear and comprehensive explanation, thanks for the great job :)
Thanks! Glad you like it :)
Love your content and your style. Don't stop 🙏
Won't stop with supporters like you believing in what we do. Thanks! :)
OMG... I missed your videos in last 10months bcas... I found your chennal just now..... You great .... bcas i love your face when you pronounce words..😍.. and your content tooo clear and easy to understand..🔥🔥
Thank you for the kind words. Glad to have you here :)
I feel 10x more confident in soft soft, thanks!
Love the direction and content of this channel. Thank you.
Thank you!
Whenever I get notified by ur video's I'm soon excited & motivated more & ....
Happy to hear :)
Thank you for your disciplined approach to sharing this information. It's sharpening me and making me realize how much more serious I need to be about these next four years of learning. Starting with no experience but want that OSCP before summer's end.
OSCP is a great cert to have, don't give up, even if you fail!
@@Cyberspatial Thanks man. This field is just too cool to fail. I do a bit of OSINT for marketing purposes and have a .onion services background , always been curious. That OSCP I see an initiation, passing is just a matter of conditioning.
Just found your channel ,love the quality content.
Awesome! Glad to have you here :)
Keep it coming! Love it! Could you do a high level video like this but on the blue teaming side, with like incident response and so forth?
Thanks for the recommendation, getting there slowly. For now, you can check the interview with a SOC Lead who practices both offensive and defensive security. Check it here 👉 th-cam.com/video/5oGQNu4CJL8/w-d-xo.html
Please make a video on IR life cycle . With both OFFENSIVE & Defensive perspectives. 🙏🙏
Im really enjoying your video's!!! So interesting and professional. Just keep on going you'll get there!
Thanks! Glad you like it :)
Excellent video!
Fantastic Content Quality. Kudos to you!
Thank you :)
Thank you for this amazing video!
Very great stuff! I just recently subbed your channel and I’m loving your tracking methods. I’m currently in school for my bachelors degree in IT. Your channel helps me understand networking and the art of hacking. I look forward to growing as a hacker overtime. I’m expanding my knowledge as I want to get in the industry of hacking once I graduate.
Happy to help. Wish you well on your journey. Keep growing and don't give up! 👍
I love the term "Dumpser diving" I think I'll stick with it :D
AMAZING Video! Thank you very much.
Welcome :)
Enjoyed your video you have excellent communication skills. Keep up the good work young man.
Thanks for the kind words :)
@@Cyberspatial Your welcome.
wow awesome talk very informative
Such a nice channel and awesome content. Thank you
Thank you!
great video!
Love all of your videos
iam new for your chennal sir when i saw your firest video. now i want to look every videos for you make thank you so much such a great information and your explanation
Love you sir
stay home ,stay safe sir
Protect your self from covide
Really appreciate the kind words. Thank you and stay well :)
Thank you sir for your replay you are so kind to your followers
Great video
Your content is very interesting and high quality
Appreciate it :)
can you do a video on the OSI model?
Thank you In the setup
Thanks for all the effort you are putting in this channel
You guys deserve it! Wish could pump out more!
Genius move!
Hello again, I am impressed by the content on your channel. You deserve way more likes and subs than you earn. I love knowledge, your information presentation gets me excited to learn more and dive into deeper detail of coding and security. I hope we bump into eachother in the future, I would love to show you what I learned and learn techniques from you. Keep up the great work my friend.
Thanks so much for the kind words. Looking forward to seeing you in the future :)
I am loving your channel and I am web developer and going to switch my career in cyber security but don't know where to start. There is to much information with different different perspective. Can you please help from where should I start. And thanks for this helpful content.
If you're interested in puzzle solving and breaking things web app vulnerability testing could be interesting. You also want to look into doing web development tooling. A lot of tools used in cybersecurity and processes are scripts. You'll need to baseline yourself with a strong networking/sysadmin skills. Then start to expand your reading into security-related areas.
Such a great channel!
Thank you!
Excellent
Amazing content 👌
Glad you liked it
This is such a good comparison.
Glad you appreciate it :)
Excellent, thank you!
Glad you enjoyed it!
Superb video. Subscribed!!
Thanks! Welcome aboard :)
Nicely explained
Thank you!
thank you.
Sharing a thought :
_Interesting to see that this whole industry wouldn't exist if humans were good and didn't mean to harm/attack each other..._
A lot of industries won't exist if humans were good to each other
Police, guns, army, etc etc
@@vaishnav3735 that's right ! Evil creates jobs
Say goodbye to the entire defense industry too!
Lovely video!
Thank you!
Dude epic work!
Thanks!
How does this channel not have millions of followers? Someone explain it to me please
Flash drives people needs a computer or any other devices with USB ports to access it contents. But... Is it possible to do the same thing with SD Cards for people insert into their smartphones as external storage?
Most computers have some kind of I/O for external media. Best to close off with hotglue or enable blocking/logging on the OS.
Keep up the good work!!
Will do!
I always share on my facebook when cyberspatial has a new post because I learned a lot here
#CyberspatialIsTheBest
Really appreciate it :)
I would like to see a free sites to learn the tools you need to hack, Linux, cli for beginners? Thanks for the great video!
linuxjourney.com/
man i love this channel
Love having you here!
Most topics presented here and other videos are covered in Networking+ and security+ book or and class.
great video
Thanks!
I’m thinking of starting a Certification on Ethical Hacking.I read the requirements which said I have to be 18 and above. I have just turned 17,and have a basic overview of hands on hacking.Is it a big deal I am not 18?
Not a big deal. Silly why they have an age limit. You can start reading books and practicing now. If you want the cert, just read study guides for it.
You really deserve more than milion subs
In due time :)
heehe you areback love you:)
Sorry to keep you waiting!
You're amazing.
Thank you!
I am just getting my feet wet. This is awesome! Thank You Kindly..
Awesome! Wish you well on your journey :)
I think it would be easier to carry out cybersecurity to protect a company than to want to manage a part of the web. The latter is an almost impossible challenge because you risk much more.
The smaller the network, the easier to defend. Some companies have enormous attack surfaces!
So interesting.
Glad you think so :)
@@Cyberspatial I do. Cyber war fair is the only kind of war fair I find interesting. As most of the time it is just information gathering rather than attacks that out right kill people as in real war.
Though I have my concerns large governments will and have taken advantage of the computer literate in order to feather their own political nest.
MAN, I MISS YOUR VIDEOS DUDE
Been a bit slow, sorry! Been tuning the workflow and processes to get these out faster
@@Cyberspatial any comment on the solarwinds attack?
This guy is amaziing
Thanks!
Hi am trying to learn how to hack should be competent with programming languages because I don't know where to start
Bash and Python are great starting points!
Bro your in that elite category ain't u, take me under your wing lol
There are scores of true elites out there that are way beyond. Just a TH-camr here :)
❤❤❤❤
2:38 what is the name of this movie?
Baywatch
You dont need to get into 100% reverse engineering to understand how buffer overflows work. its a lot easier than it sounds
I will join college ,in a year, I think I am getting idea , which skills I want to learn
Awesome! Wish you well :)
Wow informational P1😂
I need to know some information ..... how people know check my massenger ... that what im doing there .. which people and what i chat him .... and is it crime ....
I really wish Neil would have used Debian & HARDWARE. Semper Fi Speaking of military. Could you & Neil go over Unified Kill Chains? I read a paper by Paul Pols on the subject & it is insightful. Here is the link www.csacademy.nl/en/csa-theses/february-2018/104-the-unified-kill-chain
Thank you for sharing! Unified Kill Chain is really similar, they just add a few extra stages for more context, focusing in the Actions on OBJ and Lateral Movement stages.
I see you got into cybersecurity because you are obsessed with espionage and security because so am I
Cyber espionage is one of the primary use cases of "hacking" or offensive security!
@@Cyberspatial sounds interesting
5 minutes in and tNice tutorials is 10 tis harder than garageband on my phone
Where do I start with cyber security please
To start off, you need to identify which field you want to get into. Then, you can choose a learning approach to help you master that field. :)
@@Cyberspatial ethical hacking or security administration.
Start here.
how was this free to watch
Bro are you korean??😁😘
I certainly look Korean!
The best soft cos when ur stoned
do you know website that i can learn cyber security for free?
Resources are pretty scattered unfortunately. Start by reading books on security and networking.
@@Cyberspatial which book that beginner can understand easily?
@@dekajulian7296 Ed Skoudis' Counterhack Reloaded is pretty good
@@Cyberspatial ty
@@dekajulian7296 Welcome! :)
im just bored 😅so im learning random crap
Can You be my mentor?
At the moment, we don't do one-on-one mentorship. All the advice we give are the ones we post on the channel.
@@Cyberspatial Thank you for your feedback
@@wyttee Welcome :)
Dude....he is already mentoring with this channel.
After so many years of being confused and intimidated by tNice tutorials software I finally understand how to use it. I never thought the day would
nth comment
Thanks!
now i’m going to hack roblox
thanks!
Let us know how that works out for you 😏
it scares me that people know how to do all this lol
Usually it takes a team.
@@Cyberspatial Agreed