Advance Hacking Methodologies SOW.pdf

USACyS, 170A WOAC Advanced Hacking Methodologies Training Requirement

1. General: The United States Army Cyber Center of Excellence (Cyber CoE) and Fort Gordon requires support to provide a four (4) week self-paced cyber technical training package for the Cyber School Warrant Officer Advanced Course (WOAC). The government anticipates at least three (3) iterations of the required four (4) week self-paced training in FY22. Each iteration will have a maximum number of twenty (20) students. This requirement shall provide the U.S. Army Cyber School with curriculum via online/virtual or other acceptable means of delivery on the below topic.

2. Curriculum:

Advanced Hacking Methodologies: Given a native OS and a training range, the student will employ hacking methodologies to successfully breach highly restricted / well defended networks.

• Introduction to Hacking Methodologies that covers cryptography/VPN, network security monitoring applications like Wireshark, Binary Arithmetic Basics – Hex, Decimal, and Bitwise Operations

• Networking Introduction that covers OSI layer protocols like TCP/UDP or DNS, IP addresses (IPv4 and IPv6), basic understanding of routing, link layer protocols, firewall types, IDS/IPSs, network security monitoring packet filtering with tools like Wireshark

• Web Application Introduction – HTTP protocol basics, cookies, and sessions, tool overviews of web applications like Burp Suite.

• Penetration Testing Lifecycle o Engagement o Information Gathering o Foot printing/Scanning o Vulnerability Assessment o Exploitation o Reporting

• Programming basics with overviews of penetration testing command line scripting with languages such as C++, Python, Bash, PowerShell, and Windows Command line.

o PowerShell Cmdlets used like Get-ChildItem, Get-WMIObject, Get-Process, Get- Service, Invoke-Obfuscation, and Invoke-CradleCrafter o PowerShell frameworks like PowerShell Empire, PowerSploit, Posh-SecMod, Nishang, Psgetsystem

• Information Gathering process – Open-Source Intelligence with tools like Whois, Shodan, DNSdumpster, DNSEnum, DNSrecon, The Harvester, DNSMap, Maltego, Netcraft, Google Hacking, or Crunchbase.

o Understand resources to get DNS, domain, IP blocks for organizations.

• Foot printing/Scanning process – Mapping and scanning with tools like Hping, and FPing with basic/advanced Nmap scans like TCP connect, SYN, UDP, Idle, Xmas, ACK, Null, and NSE scripts.

o Understand banner grabbing, active and passive OS fingerprinting.

o Performing firewall/IDS evasion techniques with source ports, fragmentation, or timing methods.

• Enumeration process o Enumeration of NetBIOS, SMB, SNMP with tools like Dumpsec, Enum4Linux, RPCClient, Winfo, smbclient, mount, snmpwalk, snmpset, and Nmap scripts.

• Sniffing with tools like Dsniff, Wireshark, TCPDump, WinDump.

• Man-in-the-middle (MiTM) attacks with tools like Ettercap, Cain & Abel, Macof, arpspoof, Bettercap, and SSLStrip.

• Vulnerability Assessment process – Using Vulnerability scanners like OpenVAS or Nessus.

o Identifying weak passwords with tools like Ncrack, Medusa, EyeWitness, Mentalist, CeWL, John the Ripper, or Hydra

• Exploitation process with exploits like Eternal Blue, Shellshock, Heartbleed, remote and client-side exploitation.

• Post-exploitation process with techniques for maintaining access with tools like Mimikatz or Mimipenguin, privilege escalation, lateral movement, building backdoors, maintaining persistence, data exfiltration with tools like Iodine, and performing clean-up after penetration exploitation.

• Web Application Attack process:

o Fingerprinting web applications using tools like Netcat, OpenSSL, Dirbuster, SQLmap, or Httprint.

o HTTP request examples like GET, POST, or HEAD o Cross-site-scripting (XSS) –

Understanding of XSS types like reflected, persistent, and DOM-based XSS attacks with tools like BeEF.

o Server query language (SQL) injections – Understanding of in-band, error-based, and blind SQL injections.

Understanding statements like SELECT, UNION, or Boolean operators Understanding of advanced SQL exploitation with xp_cmdshell or database manipulation.

o Understanding of other web attacks like session hijacking, cross-site request forgery, directory traversal, and file inclusion vulnerabilities.

• System Attacks o Introduction into terms like Viruses, Trojans, backdoors, rootkits, botnets, adware/spyware, keyloggers, ransomware, and worms.

o Password Attack introduction with tools like John the Ripper, Hashcat, OphCrack, or Hydra to perform dictionary or rainbow table attacks of LM/NT hashes and SAM files.

o Buffer Overflow attacks with introduction of heap and stack operations.

• Network Attacks o Authentication attacks with tools like Hydra to perform brute force and dictionary attacks o Windows shares with NetBIOS protocols, Admin and misconfigured shares.

o Null sessions with tools like nbtstat, netview, nmblookup, enum4linux, winfo, and smbclient.

o ARP poisoning attacks with tools like dsniff, arpspoof, or Cain & Abel o Metasploit/Meterpreter modules used for configuring network attacks with exploits, payloads, and basic script configuration.

• Windows and Linux Architecture introduction which covers Assembly language, registers, process memory, and stack operations like POP, PUSH, and NOPs.

o Understanding of security implementations like ASLR (Address Space Layout Randomization), DEP (Data Execution Prevention), Stack Canaries, SafeSEH, and ROP chains.

o Assemblers, Debuggers, and Compilers like Microsoft Visual C ++ and debuggers like Immunity Debugger, IDA Pro, GDB, WinDBG, and OllyDBG.

• Buffer Overflows o Understanding of vulnerable functions like strcpy/strncpy o Understanding of fuzzing and static code review for finding buffer overflows o Building buffer overflows with understanding offsets and using tools like pattern create, pattern offset, and mona to overwrite stack pointers.

• Shellcode o Introduction to local and remote shellcode o Building basic and advanced shellcode with tools like msfvenom to avoid terminators, Nulls, and security implementations.

• Cryptography and Password cracking o Discussion of Public Key Infrastructure, PGP, and misconfigurations in implementation of cryptography systems.

• Malware o Malware techniques with process hiding, hooking, obfuscation, packing, polymorphism and metamorphism.

o Examination of malware types like key loggers, Trojans, viruses, or worms.

• Social Engineering process with tools like Social Engineering Toolkit (SET) to perform Phishing, Spear Phishing, and Whale Phishing.

• Wireless Attacks – Understanding of wireless standards like WEP, WPA, WPA2, WPS, and

WPA3

o Understanding of Wireless attacks like initialization vector flaws, birthday paradox, rogue access points, evil-twin attack, and war driving o Display knowledge in the operation of wireless tools like inSSIDer, Kismet, aircrack-ng, airodump-ng, oclHashCat, CloudCracker, Pyrit, and Eaphammer

• Ruby Fundamentals o Introduction to the data types, arrays, ranges and hashes, variables, declarations and how is it used as an interpreter.

o Understanding of Ruby methods, blocks, aliases, classes, modules and handling exceptions o Understanding of exploitation methodology with Ruby

• Understanding of maintaining in-depth notes and screenshots for penetration reports.

2.1 Curriculum Presentation: Provide three (3) class iterations of four (4) weeks self-paced training in accordance with the Government Training Schedule:

Class 22-002 Advanced Hacking Methodologies (25 JUL 22 – 19 AUG 22)

Class 22-003

Advanced Hacking Methodologies (17 OCT 22 – 11 NOV 22)

Class 23-001

Advanced Hacking Methodologies (13 MAR 23 – 07 APR 23)

• All curriculum presentations dates are tentative and subject to change based on the Government Training Schedule.

• Provide requisite licensing, user account, log in, etc. required to access all services, curriculum, and virtual environment provided by the contractor for approximately 60, 170A WOAC students per year.