From c016f8124be25607e5fa373b1cee1523e387aea9 Mon Sep 17 00:00:00 2001 From: Tyler Perkins Date: Wed, 9 Mar 2022 12:45:01 -0500 Subject: [PATCH] Update for 09-03-22 12:45 --- tech/malware.wiki | 36 ++++++++++++++++++------------------ tech/security.wiki | 2 ++ 2 files changed, 20 insertions(+), 18 deletions(-) diff --git a/tech/malware.wiki b/tech/malware.wiki index 9462c5c..a6f0ab7 100644 --- a/tech/malware.wiki +++ b/tech/malware.wiki @@ -3,92 +3,92 @@ == Types == -== Advanced Persistent Threat == +=== Advanced Persistent Threat === Cybercrime directed at a business and political targets, using variety of intrusion techs and malware, applied persistently Often state sponsored. -== Adware == +=== Adware === Advertising that is integrated into software. Makes popup ads or redirection of a browser to commercial site -== Attack kit == +=== Attack kit === Set of tools for generating new malware automatically using a variety of supplied propagation and payload mechanisms (metasploit) -== Auto-rooter == +=== Auto-rooter === Malicous tools to break into new machines remotely -== Backdoor (trapdoor) == +=== Backdoor (trapdoor) === Any mechanism that bypasses a normal security check; it may allow unauthorized access to functionality in a program, or onto a compromised system. -== Downloaders == +=== Downloaders === Code that installs other items on a machine that is under attack. Included in malware code first inserted onto a compromised system to import a larger malware system. -== Drive by download == +=== Drive by download === Attack using code on a comprisimised website that exploits a browser vulnerability to attack a client system when the site is viewed. -== Exploits == +=== Exploits === Code sepcific to a single vulnerability -== Flooders == +=== Flooders === Generate a large volume of data to attack a networked computer system, carrying out some DOS attack -== Keyloggers == +=== Keyloggers === Capture keystrokes on a compromised system -== Logic Bomb == +=== Logic Bomb === Code inserted into malware by intruder. Lies dormant until a condition is met, then code triggers some payload. -== Macro virus == +=== Macro virus === Virus using macro scripting code, typically embedded in a document or document template, and triggered when the document is viewed/edited, to run and replicate into other documents. -== Mobile code == +=== Mobile code === Software that can be shipped unchanged to a htereogenous colelctions of platforms and execute with identical semantics. -== Rootkit == +=== Rootkit === Tools used after a system has been compromised to gain root level access -== Spyware == +=== Spyware === Software that monitors keystrokes, screen data, and/or network traffic, or scans files for sensitive information, and sends it back to some Controler server. -== Trojan horse == +=== Trojan horse === Appears to have useful function, but has hidden and malicous purpose and evades security machanisms, sometimes by exploiting legit authorizations of system entity that invoked it -== Virus == +=== Virus === Malware that when executed, attempts to replicate itself and propigate itself. -== Worm == +=== Worm === Malware that can run independently and can propagate a complete working version of itself onto other hosts on a network, by exploiting software vulns in the diff --git a/tech/security.wiki b/tech/security.wiki index 3983525..78dd386 100644 --- a/tech/security.wiki +++ b/tech/security.wiki @@ -50,6 +50,8 @@ Hiding information == [[malware|Malware]] == +See [[malware]] + == Common attack vectors == Try setting the HTTP `Host` header value to `internal-ip:80` where internal ip