Question

Describe three tools used primarily by attackers (ethical or malicious), three tools used primarily by defenders, and one tool useful to both. Answer briefly in your words.

Answer 1

`Hey,

Note: Brother if you have any queries related the answer please do comment. I would be very happy to resolve all your queries.

three tools used primarily by attackers

1: JBiFrost RAT

RATs allow remote administrative control. They can be used to install backdoors and key loggers, take screen shots, and exfiltrate data.

While there are a wide range of RATs circulating, JBiFrost is increasingly being used in targeted attacks against critical national infrastructure owners and their supply chain operators.

2: China Chopper

Web shells are malicious scripts which are uploaded to a target host after an initial compromise. They can then be used to pivot to further hosts within a network. China Chopper, which is just 4kb in size, is a widely used web shell.

Once a machine is compromised, China Chopper can use the file-retrieval tool ‘wget’ to download files from the internet to the target, and edit, delete, copy, rename, and change the timestamp of existing files.

3:PowerShell Empire

The PowerShell Empire framework (Empire) was designed as a legitimate penetration testing tool.

It allows continued exploitation once an attacker has gained access to a system. The tool provides an attacker with the ability to escalate privileges, harvest credentials, exfiltrate information and move laterally across a network.

three tools used primarily by defenders

Nmap

Nmap (Network Mapper), an open source network exploration and security auditing tool, is the tool of choice for many network administrators who want to map and test their networks for vulnerabilities. Nmap boasts a wide range of port-scanning techniques designed to rapidly scan large and small networks. Nmap is also known for its unrivalled ability to fingerprint not only a machine's operating system and the services it is offering, but also the type of packet filters and firewalls in use on the network.

Nessus

The Nessus Project aimed to provide a remote security scanner that was free, powerful, up-to-date and easy to use. Today, Nessus is one of the top-rated security scanners and is endorsed by information security organizations, including the SANS Institute. Nessus has often been first in introducing new features, such as the ability to not only detect remote flaws, but also local flaws and missing patches on network hosts, regardless of whether they're running Windows, Mac OS X, or a Unix-like system. Incidentally, Nessus invokes Nmap at the beginning of each scan.

OpenSSH

I believe one of the best ways of allowing applications to securely authenticate themselves to other resources is by using Secure Shell (SSH). As long as the connection between the services uses TCP, they can use the SSH channel to authenticate to each other and increase security against different kinds of attacks. For example, SSH can encrypt passwords and network traffic between Web and database servers, thus preventing eavesdropping, IP spoofing, IP source routing, DNS spoofing and other network-level attacks.

Kindly revert for any queries

Thanks.