In a cloud environment, testing for Server-Side Request Forgery (SSRF) vulnerabilities involves attempting to access metadata services.
Accessing Cloud Metadata Service:
URL: http://169.254.169.254/latest/meta-data/ is a well-known endpoint in cloud environments (e.g., AWS) to access instance metadata.
Purpose: By exploiting SSRF to access this URL, an attacker can retrieve sensitive information such as instance credentials and other metadata.

Port mirroring allows the tester to passively capture and analyze network traffic without interacting directly with production systems, making it suitable for assessing vulnerabilities in the network stack of sensitive environments like power plants.

Maintaining persistent access in a compromised system is a crucial goal for a penetration tester after achieving initial access. Here's an explanation of each option and why creating registry keys is the preferred method:
* Creating registry keys :
* Explanation: Modifying or adding specific registry keys can ensure that malicious code or backdoors are executed every time the system starts, thus maintaining persistence.
* Advantages: This method is stealthy and can be effective in maintaining access over long periods, especially on Windows systems.
* Example: Adding a new entry to the HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry key to execute a malicious script upon system boot.
* References: Persistence techniques involving registry keys are common in penetration tests and are highlighted in various cybersecurity resources as effective methods to maintain access.
* Installing a bind shell (Option B):
* Explanation: A bind shell listens on a specific port and waits for an incoming connection from the attacker.
* Drawbacks: This method is less stealthy and can be easily detected by network monitoring tools.
It also requires an open port, which might be closed or filtered by firewalls.
* Executing a process injection (Option C):
* Explanation: Process injection involves injecting malicious code into a running process to evade detection.
* Drawbacks: While effective for evading detection, it doesn't inherently provide persistence. The injected code will typically be lost when the process terminates or the system reboots.
* Setting up a reverse SSH connection (Option D):
* Explanation: A reverse SSH connection allows the attacker to connect back to their machine from the compromised system.
* Drawbacks: This method can be useful for maintaining a session but is less reliable for long-term persistence. It can be disrupted by network changes or monitoring tools.
Conclusion: Creating registry keys is the most effective method for maintaining persistent access in a compromised system, particularly in Windows environments, due to its stealthiness and reliability.

To bypass two-factor authentication (2FA) and gain access to the executives' accounts, the tester should use Evilginx with a typosquatting domain. Evilginx is a man-in-the-middle attack framework used to bypass 2FA by capturing session tokens.
Phishing with Evilginx:
Evilginx is designed to proxy legitimate login pages, capturing credentials and 2FA tokens in the process.
It uses "phishlets" which are configurations that simulate real login portals.
Typosquatting:
Typosquatting involves registering domains that are misspelled versions of legitimate domains (e.g., example.co instead of example.com).
This technique tricks users into visiting the malicious domain, thinking it's legitimate.
Steps:
Configure an External Domain: Register a typosquatting domain similar to the company's domain.
Set Up Evilginx: Install and configure Evilginx on a server. Use a phishlet that mimics the company's mail portal.
Send Phishing Emails: Craft phishing emails targeting the executives, directing them to the typosquatting domain.
Capture Credentials and 2FA Tokens: When executives log in, Evilginx captures their credentials and session tokens, effectively bypassing 2FA.
Pentest Reference:
Phishing: Social engineering technique to deceive users into providing sensitive information.
Two-Factor Authentication Bypass: Advanced phishing attacks like those using Evilginx can capture and reuse session tokens, bypassing 2FA mechanisms.
OSINT and Reconnaissance: Identifying key targets (executives) and crafting convincing phishing emails based on gathered information.
Using Evilginx with a typosquatting domain allows the tester to bypass 2FA and gain access to high-value accounts, demonstrating the effectiveness of advanced phishing techniques.

https://thepacketgeek.com/scapy/building-network-tools/part-09/