My DokuWiki

User Tools

Site Tools

Trace:
functionality_overview

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision 		Previous revision
functionality_overview [2023/01/28 14:14]
kaduuwikiadmin 		functionality_overview [2023/05/22 20:40] (current)
Line 1: Line 1:
-====== Functionality Overview ======+====== KADUU MAIN FEATURES OVERVIEW ====== 
 + 
 +In most areas, passive monitoring takes place. Thus, we do not actively scan for vulnerabilities or open ports. We use Kaduu to show what a hacker can learn about an organization. This includes leaked data, shadow IT, any sensitive information on hacker forums or the deep web, etc.  Thus, most searches are past-oriented and show the consequence of security incidents. However, there are also functions that serve to prevent security incidents. For example, domain monitoring helps to detect phishing and malware attacks in preparation.  
 + 
 + 
 +---- 
  
 ===== DOMAIN MONITORING ===== ===== DOMAIN MONITORING =====
Line 74: Line 80:
  
 ===== Hacker Forum Monitoring ===== ===== Hacker Forum Monitoring =====
 +
  
 **What is the threat?** **What is the threat?**
Line 104: Line 111:
  
 ===== Telegram Monitoring ===== ===== Telegram Monitoring =====
 +
  
 **Introduction** **Introduction**
Line 133: Line 141:
 ---- ----
  
-====== Bucket and Cloud Storage Monitoring ======+===== Bucket and Cloud Storage Monitoring ===== 
  
 **Introduction** **Introduction**
Line 161: Line 170:
 ---- ----
  
-====== Github Monitoring ======+===== Github Monitoring ===== 
  
 **Introduction** **Introduction**
Line 187: Line 197:
 ---- ----
  
-====== Google Dork Monitoring ======+===== Google Dork Monitoring ===== 
  
 **Introduction** **Introduction**
Line 216: Line 227:
  
 ===== Certificate Transparency Log Monitoring ===== ===== Certificate Transparency Log Monitoring =====
 +
  
 Many certificate services automatically issues domain-validated (DV) certificates to websites by checking the URL's phishing status against the Google Safe Browsing API. Once issued, the issuer does not monitor the certificates or take any action afterward. Even if Google later flags the domain as malicious, the issuer will not revoke certificates. As a result, many phishing websites are secured with SSL certificates, spoofing the legitimate clients name. By monitoring the certificate logs, you can detect if your organizations name gets spoofed on SSL certificates. The reason why this is possible is that the issuer submits all of the certificates into a certificate transparency log. This is a mechanism designed to increase public transparency into the activities of CAs. The logs can be accessed by Kaduu. Many certificate services automatically issues domain-validated (DV) certificates to websites by checking the URL's phishing status against the Google Safe Browsing API. Once issued, the issuer does not monitor the certificates or take any action afterward. Even if Google later flags the domain as malicious, the issuer will not revoke certificates. As a result, many phishing websites are secured with SSL certificates, spoofing the legitimate clients name. By monitoring the certificate logs, you can detect if your organizations name gets spoofed on SSL certificates. The reason why this is possible is that the issuer submits all of the certificates into a certificate transparency log. This is a mechanism designed to increase public transparency into the activities of CAs. The logs can be accessed by Kaduu.
Line 264: Line 276:
  
 ===== Paste Site Monitoring ===== ===== Paste Site Monitoring =====
 +
  
 Pastebin allows users to share text in the form of public posts called "pastes." Since the launch of Pastebin,many similar web applications called "paste sites" have developed. Pastebin sites are usually used for sharing code. However, any data in text form can also be uploaded and shared. The Pastebin search tool allows users to find relevant content based on keywords. Pastebin also relies on users to report abuse, which means non-compliant ones are rarely removed. This allows hackers to easily and anonymously penetrate data in an accessible location. Pastebin and similar websites are hosted on the Deep Web. This means that they can be viewed in a normal Internet browser, but the content is not indexed by Google and other traditional search engines. Users have to use the internal keyword search function to find specific content, or get paste links directly from other users. There are also paste sites on the dark web that offer increased anonymity via a Tor browser and are focused exclusively on illegal activities. For example, DeepPaste on the Dark Web is mainly used for advertising illegal goods or services. So, hackers use paste sites to prepare attacks or even to anonymously publish data from successful attacks. Therefore, it is important to monitor them. Pastebin allows users to share text in the form of public posts called "pastes." Since the launch of Pastebin,many similar web applications called "paste sites" have developed. Pastebin sites are usually used for sharing code. However, any data in text form can also be uploaded and shared. The Pastebin search tool allows users to find relevant content based on keywords. Pastebin also relies on users to report abuse, which means non-compliant ones are rarely removed. This allows hackers to easily and anonymously penetrate data in an accessible location. Pastebin and similar websites are hosted on the Deep Web. This means that they can be viewed in a normal Internet browser, but the content is not indexed by Google and other traditional search engines. Users have to use the internal keyword search function to find specific content, or get paste links directly from other users. There are also paste sites on the dark web that offer increased anonymity via a Tor browser and are focused exclusively on illegal activities. For example, DeepPaste on the Dark Web is mainly used for advertising illegal goods or services. So, hackers use paste sites to prepare attacks or even to anonymously publish data from successful attacks. Therefore, it is important to monitor them.
Line 343: Line 356:
 ---- ----
  
-====== Ransomware Site Monitoring ======+===== Ransomware Site Monitoring ===== 
  
 **Introduction** **Introduction**
Line 366: Line 380:
 Please click [[ransomware_site_monitoring|here]] for more information on the search syntax. Please click [[ransomware_site_monitoring|here]] for more information on the search syntax.
  
-====== Bot Monitoring ======+---- 
 + 
 + 
 +===== Bot Monitoring ===== 
  
-===== What is a bot or a botnet? =====+**What is a bot or a botnet?**
  
 Malware bots and Internet bots are a type of malware that can be programmed to hack into user accounts, search the Internet for contact information, send spam, or develop other malicious activities. To disguise the origin of such attacks, attackers can also distribute malicious bots through a botnet - that is, a bot network. A botnet consists of a number of devices connected to the Internet and running one or more bots without the knowledge of the respective device owner. Because each device has its own IP address, botnet traffic originates from a variety of IP addresses, making it harder to spot and block its point of origin. Botnets also self-propagate to more devices, which can then send out spam and in turn infect more machines. Malware bots and Internet bots are a type of malware that can be programmed to hack into user accounts, search the Internet for contact information, send spam, or develop other malicious activities. To disguise the origin of such attacks, attackers can also distribute malicious bots through a botnet - that is, a bot network. A botnet consists of a number of devices connected to the Internet and running one or more bots without the knowledge of the respective device owner. Because each device has its own IP address, botnet traffic originates from a variety of IP addresses, making it harder to spot and block its point of origin. Botnets also self-propagate to more devices, which can then send out spam and in turn infect more machines.
Line 374: Line 392:
 If an IP, host name oder username pops up in the Kaduu logs, it means it has been infected with a malicious bot. If an IP, host name oder username pops up in the Kaduu logs, it means it has been infected with a malicious bot.
  
-===== Where can you obtain botnet logs in the darknet? =====+**Where can you obtain botnet logs in the darknet?**
  
 Botnet logs can be obtained in various darknet marketplaces, forums, and websites. These marketplaces and forums are typically used by cybercriminals to buy and sell stolen data, malware, and other illegal goods and services. Some examples include: Botnet logs can be obtained in various darknet marketplaces, forums, and websites. These marketplaces and forums are typically used by cybercriminals to buy and sell stolen data, malware, and other illegal goods and services. Some examples include:
Line 387: Line 405:
  
  
-===== What type of devices are more likely to be infected with bots? =====+**What type of devices are more likely to be infected with bots?**
  
 Malicious bots, also known as malware bots or botnets, can infect a wide range of devices, including personal computers, servers, and mobile devices. However, certain types of devices and users are more likely to be targeted than others. It is much more unlikely that public servers are infected with bots opposite to private computers. Here are the most exposed device types: Malicious bots, also known as malware bots or botnets, can infect a wide range of devices, including personal computers, servers, and mobile devices. However, certain types of devices and users are more likely to be targeted than others. It is much more unlikely that public servers are infected with bots opposite to private computers. Here are the most exposed device types:
Line 461: Line 479:
  
  
 +----
 +
 +===== E-Mail Monitoring =====
 +
 +
 +**Introduction**
 +
 +A phishing attack against your employees is usually preceded by a short phase of reconnaissance of the targets. In targeted spear phishing attacks, fraudsters often take data from employees’ social media profiles. There are also email lists offered in hacker forums, and lastly, there are a number of hacking tools that search the Internet and Dark Web for information on the targets.
 +
 +Higher-ranking CEOs & C-suite executives are usually more exposed to the public (their profile can often be found on the organization’s website), making them easier targets. For all other departments and employee types, it is difficult to assess the steps an attacker has to take to gather the information they need to reach their target. Only if you venture to perform the same information gathering as the hacker, can you assess the risk of your employees getting exposed to phishing attacks. The greater an employee’s exposure on the Internet or Dark Web, the higher the likelihood of them becoming a victim of a social engineering attack, like phishing. Employees who register with their names and business email accounts on private websites put the whole organization at risk as this gives the hacker a bigger attack surface.
 +
 +**What is monitored?**
 +
 +In Kaduu, we measure each employee’s exposure on the Internet and note where indications of activities related to the specific email account can be found. We try to find the employee’s email address on the Internet, Deep Web or Dark Net and list the according email references from the websites where we found the account. We then try to investigate how often the email is referenced in different unique sources. The more sources, the bigger the exposure.
 +
 +**What is the benefit?**
 +
 +Everything that helps you reduce your attack surface can also limit future breaches. If you find any employee’s business email account on private websites, you will be able to create targeted user awareness training that helps them understand the consequences of such an exposure.
 +
 +**How does it work?**
 +
 +We have two type of searches:
 +
 +  * (1) Database search: Kaduu runs a crawler in the background collecting any email adress it finds. This crawler is not looking for any specific email domain, but collects everything. Therefore the data set might be very limited to a specific account.
 +  * (2) External Search: The external Search will connect to an external authenticated API that will query specificly the domain you entered. You will find more results using the external search.
 +
 +In both cases you need to enter the company domain with the syntax "domain.com". Please use the TLD used for your email accounts.
 +
 +----
 +
 +
 +===== Discord Monitoring =====
 +
 +
 +Discord is a popular communication platform designed for online communities and gamers. It offers a variety of features including text, voice and video chat, file sharing, and gaming integrations. Discord is available as a browser-based web app, a desktop app for Windows, MacOS, Linux and as mobile apps for iOS and Android. The platform allows users to create and join virtual servers (also called "Discord servers") to connect with others based on common interests.
 +
 +**How is Discord used by hackers?**
 +
 +Discord can be used by hackers in various ways, including:
 +
 +  * Sharing hacking tools and tutorials: Discord servers can be used as platforms to share hacking tools and tutorials with other individuals.
 +  * Coordinating attacks: Hackers can use Discord channels to coordinate and execute attacks on websites, networks, or other targets.
 +  * Phishing and scamming: Hackers may use Discord to phish personal information or scam users through fake giveaways or other deceitful means.
 +  * Spreading malware: Hackers can spread malware through links or files shared on Discord servers, infecting other users' devices.
 +
 +**How many channels exist?**
 +
 +It's not possible to determine the exact number of Discord channels that exist, as the platform allows for an unlimited number of servers and channels to be created. The number of Discord channels continues to grow as new servers are created and existing servers add new channels. Discord has over 150 million monthly active users, so there are likely a large number of channels across all the servers on the platform.
 +
 +**What channels do we monitor?**
 +
 +  * "Blackhats underground": https://discord.gg/k8Jxuu66gX- dumps
 +  * "PirateShips CCs Shop": https://discord.gg/kVv58B63g2 - credit cards
 +  * "DarkSec": https://discord.com/invite/wTQa64JhJY - Hacking group
 +  * "A9 Market": https://discord.gg/a9market - credit cards
 +  * "Rent 8 hacker": https://discord.gg/cUTadTRNh9 - Rent a hacker
 +  * "sPlug": https://discord.gg/pzYzqcJtzz - PII data
 +  * "DarkCat.exe": https://discord.gg/2aW8KBEKxt
 +  * "Anonymity": https://discord.gg/2trMf94kPB
 +  * "Evil Empire": https://discord.gg/QVQA4duZ9M - Phishing, stealer logs
 +  * "Alka Tim": https://discord.gg/PrnUNDgRAN -  Turkish hacking team
 +  * "Dark Matter Market": https://discord.gg/VTWxZhDEvG
 +  * "Trisoft vlan": https://discord.gg/ErDj63yY - ;Malware talks
 +  * "Anon Cyber Team": https://discord.gg/jac3w4sGXq
 +  * "Netcat hacking": https://discord.gg/2rU7t5bEY5
 +  * "Backward Development": https://discord.gg/8gRcfgvtVK
 +  * "Oversec": https://discord.gg/cwxvPWtdsj - another turkish hacking group
 +  * "Christian Hacking club": https://discord.gg/qJyzCTEAkC - mostly news from cybersec world
 +  * and many more
 +
 +
 +----
 +
 +===== Passive Vulerability Detection =====
 +
 +In Kaduu we use a passive vulnerability detection approach. Passive Vulnerability Detection and Active Vulnerability Detection are two methods used to identify security vulnerabilities in a network or system.
 +
 +  * Passive Vulnerability Detection is a method of identifying vulnerabilities without actively interacting with the system or network being tested. This is typically done by analyzing system logs, network traffic, or other passively generated data. In case of Kaduu we query databases in the deep web that may contain data on the target. The advantage of passive vulnerability detection is that it doesn't disrupt the normal operation of the system and can be done without the target's knowledge. However, passive detection may miss some vulnerabilities that can only be detected through active interaction with the system.
 +  * 
 +  * Active Vulnerability Detection, on the other hand, involves actively interacting with the system or network being tested to identify vulnerabilities. This typically involves running scans, probes, or penetration tests to identify potential security weaknesses. The advantage of active vulnerability detection is that it can provide a more comprehensive view of the system's vulnerabilities and can help confirm the findings from passive detection. However, active vulnerability detection can be disruptive to the system's normal operation and may require prior permission from the target.
 +
 +**How to use this feature?**
 +
 +For the infrastructure search we need the domain (example.com and not www.example.com) as input. You can't search for IP's or other elements, because based on the domain we first find out via databases, which subdomains all belong to the main domain. We get data from Dnsdumpster, Shodan but also Certificate transparency logs. We thus recreate the infrastructure as a hacker will see it, without performing active scans. For all elements found, we then search the deep web again to see if any information about open ports or vulnerabilities can be found. Again, no scans take place.
 +
 +
 +**How do we present the data?**
 +
 +For every host we find we do a reverse DNS lookup and query databases like Shodan in order to find information about open ports, used applications or vulnerabilities (CVE).
  
  
functionality_overview.1674911672.txt.gz · Last modified: 2023/05/22 20:40 (external edit)

Page Tools

Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki