VPN Transparency Project

Tag: hydra

  • Automated Reconnaissance in Hacking

    Introduction to Reconnaissance

    In the intricate and evolving world of ethical hacking and penetration testing, reconnaissance stands as the foundational phase – a critical starting point that sets the stage for all subsequent activities. This initial phase is centered around the systematic gathering of as much information as possible about a target system, network, or application.

    Reconnaissance, often likened to a form of digital scouting, is not just a preliminary step; it is a strategic phase that can significantly dictate the effectiveness of the entire ethical hacking process. The data collected during this stage informs the hacker about the target environment, revealing its structure, weaknesses, and potential entry points. This is akin to a chess player observing the board carefully before making a calculated move – the information gathered here is pivotal for planning the subsequent steps.

    Understanding the target’s environment through reconnaissance is more than just a cursory glance at its digital facade. It involves delving into the details, uncovering the technologies used, the network topology, the presence of firewalls, and even the kind of security practices in place. This comprehensive exploration helps in identifying potential vulnerabilities and the most effective attack vectors.

    Moreover, reconnaissance is not a one-size-fits-all approach. Each target presents its unique set of challenges and characteristics, requiring tailored tactics for information gathering. The insights gained during this phase enable ethical hackers to craft a more focused, efficient, and responsible approach to penetration testing. It ensures that their efforts are not akin to shooting arrows in the dark but are precise, informed, and strategically sound.

    The Challenge of Manual Reconnaissance

    Manual URL Exploration

    In the realm of ethical hacking, manual reconnaissance often involves the tedious task of URL exploration. This traditional method entails manually typing in and checking various URLs such as mysite.com/page/ or mysite.com/config/ in an attempt to uncover hidden directories, unlinked pages, or potential points of vulnerability. It’s akin to trying every door in a massive building to see which ones are unlocked. Hackers must rely on their intuition and experience to guess potential directory and file names, exploring every possible combination in the hope of finding something of interest.

    While this approach might seem straightforward, it is, in practice, incredibly time-consuming and often impractical, especially when dealing with sophisticated and complex websites or networks. The sheer number of possibilities can be overwhelming. A website may have thousands of possible URLs, and manually checking each one is not only laborious but also inefficient. Moreover, this process can be even more challenging if the website is large and regularly updated, as new pages and directories may be added frequently. In the fast-paced world of cybersecurity, where quick and efficient responses are crucial, such a time-intensive approach is far from ideal.

    Automation in Reconnaissance: Tools Overview

    To overcome the limitations of manual reconnaissance, the use of automated tools becomes indispensable. These tools are designed to systematically and swiftly scan through websites and networks, identifying potential entry points, vulnerabilities, and valuable information much more quickly than any human could. Automation in reconnaissance is not just a convenience; it’s a necessity in the modern digital landscape.

    Automated tools employ various techniques like brute-forcing directories and filenames, scanning for known vulnerabilities, and mapping out network structures. This not only saves a significant amount of time but also increases the breadth and depth of the reconnaissance phase. By automating tedious and repetitive tasks, ethical hackers can focus their attention on analyzing the collected data and planning their next steps more strategically.

    Gobuster

    Gobuster is a powerful tool widely used in the field of ethical hacking and cybersecurity. It is specifically designed to brute-force URIs (Uniform Resource Identifiers) on web servers. In simpler terms, Gobuster is adept at discovering directories and files hosted on a web server that might not be visible or linked from the main page. This tool is an essential element in the toolbox of ethical hackers and penetration testers for its efficiency and effectiveness in the reconnaissance phase.

    Gobuster operates by iterating through a predetermined list of filenames and directory names against a target web server. It methodically tries each entry from the list and checks the server’s response. If the server responds with an indication that the file or directory exists (typically a HTTP status code like 200 OK), Gobuster flags it and reports back to the user. This process automates the laborious task of manual URL guessing and checking, significantly speeding up the process of finding hidden or unlinked resources on the web server.

    The tool is highly customizable, allowing users to define various parameters such as the wordlist used for brute-forcing, the type of files or scripts to look for, and the handling of different response codes. This adaptability makes Gobuster not only a powerful tool but also a versatile one, suited to a wide range of reconnaissance scenarios.

    Gobuster can be effectively used in a variety of situations during reconnaissance:

    1. Discovering Hidden Directories and Files: It can uncover directories and files that are not directly linked from the website’s main page or sitemap. This includes administrative panels, hidden resources, backup files, and more, which could potentially expose vulnerabilities.
    2. Mapping Web Application Structure: By revealing the structure of directories and files, Gobuster helps in understanding the layout of a web application, crucial for planning further penetration testing strategies.
    3. Identifying Misconfigured Servers: Occasionally, web servers are misconfigured to expose sensitive directories or files. Gobuster can detect these misconfigurations, aiding in the assessment of server security.
    4. Testing Virtual Hosts and Aliases: With appropriate configurations, it can also be used to test for virtual hosts (subdomains) and aliases that might be configured on the server but not publicly known.

    Hydra

    Hydra, often referred to as “THC-Hydra,” is a renowned and powerful tool in the realm of network security. It is most commonly recognized as a fast and effective network logon cracker, supporting a wide array of services. Hydra’s primary function is to assist security analysts and ethical hackers in testing the strength of authentication protocols on network services. The tool’s versatility in handling various protocols and its efficiency in conducting logon attempts make it a staple in penetration testing toolkits.

    One of the key strengths of Hydra lies in its ability to perform rapid dictionary attacks across more than 50 protocols, including popular ones like FTP, HTTP, HTTPS, SMB, SMTP, SSH, and Telnet. A dictionary attack, in this context, involves systematically entering every word in a predefined list of common passwords, with the aim of eventually hitting the correct one.

    Hydra automates this process, methodically testing thousands of password combinations against a network service to check for weak passwords. This process is not just about brute force; it’s about efficiency and speed. Hydra’s ability to conduct multiple attempts concurrently and its support for various authentication types (like basic, digest, NTLM, and form-based) make it exceptionally effective.

    The tool’s functionality extends beyond mere password cracking. It can be used to test various forms of authentication mechanisms and configurations on different services, providing a comprehensive overview of the robustness of security implementations in network environments.

    Conclusion

    Reconnaissance is an indispensable phase in ethical hacking and cybersecurity, laying the groundwork for all subsequent penetration testing and security assessment activities. This critical process of information gathering sets the stage for identifying potential vulnerabilities and planning effective attack strategies. Tools like Gobuster and Hydra significantly enhance the efficiency of this phase. Gobuster streamlines the discovery of hidden or unlinked web pages and directories, automating what would otherwise be a laborious and time-consuming task. Hydra, on the other hand, serves as a robust tool for testing network security, particularly in verifying the strength of authentication mechanisms across a variety of protocols.

    The integration of these tools into the reconnaissance process not only saves time but also provides a more thorough and comprehensive understanding of the target’s security posture. They embody the shift from manual, tedious methods to automated, efficient, and sophisticated approaches in ethical hacking.

    As we discuss the utility and power of these tools, it is paramount to underscore the importance of their legal and ethical use. Gobuster and Hydra, like all tools in the realm of ethical hacking, should be employed strictly within authorized testing environments or for educational purposes. Unauthorized use of these tools to gain access to systems or networks without explicit permission is not only unethical but also illegal and can lead to severe legal repercussions. Ethical hacking, by its very nature, is about strengthening security, not exploiting it for unauthorized access or harm.

    Further Reading/Resources

    For those interested in delving deeper into the world of ethical hacking and the use of tools like Gobuster and Hydra, the following resources provide valuable information:

    • Gobuster Official GitHub Repository: Gobuster GitHub
    • Hydra Tool Documentation: THC-Hydra
    • OWASP Testing Guide: A comprehensive guide covering a wide range of testing techniques and tools, available at OWASP Testing Guide
    • Cybrary Courses on Ethical Hacking: Explore in-depth courses and learning paths in ethical hacking at Cybrary
    • Books and eBooks: Consider titles like “The Web Application Hacker’s Handbook” by Dafydd Stuttard and Marcus Pinto, and “Metasploit: The Penetration Tester’s Guide” by David Kennedy et al. for more detailed insights into ethical hacking techniques and tools.

    These resources provide a mix of theoretical knowledge and practical insights, essential for anyone aspiring to deepen their understanding and skills in ethical hacking and network security.

    See also:

  • Brave

    Brave

    Brave is a free and open-source browser that prioritizes security and speed by automatically eliminating advertisements and website trackers. Based on the Chromium web browser, this browser was designed by the Brave software developer to provide consumers with an excellent browsing experience.

    The Brave browser functions on Android, iOS and desktop computers. People can also use Brave search on any browser and set Brave as the default search engine. This privacy browser is three times faster than Chrome and offers superior Google protection. Brave is a popular security browser with a user base of over 50 million people.

    But when you are using Brave VPN, who’s servers are you really using? Interestingly enough, Brave VPN is actually Guardian VPN rebranded. According to my research, Guardian / Brave VPN predominantly uses CDN77, OVH, and Hydra Communications servers.

    Network Analysis

    Guardian, as a smaller VPN provider, presents an interesting case when considering its diversity indices, comprising of the Shannon Diversity Index (SDI) for Autonomous System Numbers (ASNs), the Country Diversity Index (GDI), and the City Diversity Index (CDI).

    Guardian’s SDI value of 1.22 places it at the lower end of the spectrum compared to other VPNs. This low value implies a lower diversity of ASNs among its VPN servers, suggesting that Guardian’s network might be more susceptible to network failures or targeted attacks.

    Comparatively, the GDI for Guardian is 1.78, indicating a limited diversity in the country locations of their servers. This suggests that Guardian’s service might not provide as wide a geographic coverage or as many country-specific access points as other VPNs such as Cyberghost or ExpressVPN.

    Finally, the CDI for Guardian stands at 2.79, again indicating a lower city-level diversity compared to other providers. This could imply that users might have fewer options in terms of city-specific server locations, which might be a critical factor for those seeking to bypass geographic content restrictions or for those prioritizing local server access.

    Comparatively, smaller VPNs like Mullvad and Privado demonstrate higher diversity indices across all three dimensions. Therefore, while Guardian’s overall performance can’t solely be determined by these indices, these figures suggest that its network diversity – at both the ASN and geographic levels – may be limited relative to both larger providers and similar-sized competitors.

    As always, it’s important to remember that these indices only provide one perspective on network performance and resilience. Other factors such as the specific ISPs involved, the quality of server infrastructure, the network’s overall capacity, and how the VPN service is managed and maintained, are also crucial considerations when evaluating a VPN service.

  • Surfshark

    Surfshark

    Surfshark VPN is one of the most popular VPN services in 2022. Its competitive price and unlimited simultaneous connections make it a very attractive VPN option for all kinds of users. But does this VPN live up to give the actual value for money that it claims? Surfshark also offers thousands of servers worldwide, excellent connection speeds, and next-gen AES encryption. However, users have been questioning its jurisdiction and whether it’s as private as showcased.

    Surfshark offers some really useful features like SmartDNS, the fast WireGuard protocol, P2P-optimized servers, and provides a selection of easy-to-use intuitive apps and platforms.

    So, when you’re connected to Surfshark – who’s servers are you really using? After completing my testing I have concluded that Surfshark uses 20% their own servers, 17% CDNext, 17% M247, 14% CDN77, 13% Host Royale, and the remaining few are Host Universal, Clouvider, and Hydra Communications.

    Surfshark Network Overview

    M247
    CDNext
    CDN77
    Host Royale
  • NordVPN

    NordVPN

    NordVPN is a Virtual Private Network (VPN) service provider that was founded in 2012 by four childhood friends in Panama. The company is now headquartered in Cyprus, with offices in the United States, the United Kingdom, and Lithuania. NordVPN is one of the most well-known VPNs in the market, and this is due to their extensive advertising on various platforms, including YouTube. NordVPN’s ads feature catchy taglines and famous personalities, making them one of the most recognizable VPN brands in the market.

    But just because NordVPN is based in Panama, that doesn’t mean their servers are. After testing around 6,700 servers used by NordVPN, I concluded that NordVPN servers predominantly use Datacamp Limited, M247, Clouvider, and Hydra Communications. It is worth noting that NordVPN does own and operate about 10% of their servers which are operated under the business name Tefincom.

    NordVPN Privacy Policy

    The privacy policy and terms of service are one key way a VPN provider can put their money where their mouth is. Afterall, a service can make whatever claims they want, but the truth lies in their policies. NordVPN has one of the worst privacy policies and acceptable use policies I’ve ever seen. First, in their ToS they stipulate that you are not to use NordVPN for anything that that they as a company would find inappropriate or offensive.

    • communicate, transmit, store, make available, share anything that is illegal, abusive, harassing, or otherwise objectionable (objectionable means anything which interferes with the rights of Nord, its users, or other third parties, or causes conditions that are dangerous, hazardous, and detrimental to others, or anything that most users and/or Nord would find to be offensive or inappropriate);

    Further, it goes on to suggest that using their service to bypass georestrictions is also against their ToS:

    • attempt to circumvent any technological measure and/or arrangement implemented by Nord and/or its licensors, or by the owner of the resource or the source of the material that the technological measure protects;

    • violate general ethical or moral norms, good customs, and fair conduct norms;

    Their privacy policy isn’t much better. It states that they will retain your billing information for ten years, and even worse, will retain your data if they receive a court order or subpoena:

    (ii) Nord also may retain information associated with you (e.g., payments data) in order to fulfill its obligations as required by applicable laws, regulations, court orders, subpoenas, or other legal processes for archival purposes.

    Lack of transparency

    One of the most well-known players in the VPN industry, has faced its fair share of controversy over the past few years. While it maintains a significant user base and performs admirably in various audits, numerous concerns have emerged about the company’s privacy practices, integrity, and security.

    One of the most glaring concerns revolves around a data breach that occurred in 2019. An attacker managed to gain access to a server by exploiting an insecure remote management system left by the data center provider. This incident, which went undisclosed by NordVPN until highlighted by a third party, is a clear violation of trust, raising valid concerns over the VPN provider’s transparency.

    Moreover, NordVPN’s relationship with Tesonet, a data-mining, analytics, SEO, and targeted marketing company, has been under scrutiny. Despite vehement initial denials, NordVPN finally admitted to this association, only to downplay its relevance. This admission further exacerbates concerns over user privacy, considering Tesonet’s activities.

    Adding fuel to the fire, NordVPN has been discovered to be based out of Lithuania, a country with mandatory data retention laws. This revelation contradicts the company’s claim of being registered in Panama, a known privacy-friendly jurisdiction, thus eroding trust.

    NordVPN’s partnership with Hola VPN, which was involved in forming a data mining botnet, and its alleged theft of technology from Hola VPN further draws into question the company’s ethics. It’s important to note that Hola VPN has been widely criticized for its own practices, which makes its association with NordVPN disconcerting.

    Several troubling practices have also surfaced relating to NordVPN’s marketing and sales techniques. The company has been accused of engaging in price discrimination, making it difficult for users to cancel auto-renewal, and reducing features for those who cancel auto-renewal. There are also reports of NordVPN sharing data with Facebook and leaking sensitive customer data.

    Adding to these controversies, NordVPN has been accused of blackmailing competitor TorGuard and has faced criticism from a UK-based watchdog for misleading marketing. It also reportedly sent cease-and-desist copyright claims to Njalla, further tarnishing its reputation.

    NordVPN’s wide-ranging sponsorship deals, which include football teams and numerous YouTubers, have also been called into question. Many believe these partnerships are incentivised by high affiliate commissions, which may be influencing the integrity of VPN reviews and recommendations.

    Despite the series of security audits that NordVPN has undergone, these revelations and practices suggest that trust and transparency are far from guaranteed. It’s crucial for users to conduct their due diligence and weigh the potential risks before choosing a VPN provider. The issues surrounding NordVPN serve as a sobering reminder that not all VPNs deliver on their promises of privacy and security.

    NordVPN, Surfshark, Denial

    NordVPN’s credibility was further strained when it was discovered that the company had ties to Surfshark, another popular VPN service. This discovery was unexpected and raised concerns given Surfshark’s track record.

    Surfshark has its share of controversies, which include system-level changes that persisted even after uninstallation, exposing user IPs and making them vulnerable. The company’s TrustDNS app has been implicated in data collection for advertising and marketing purposes. There’s also the issue of weak security, including the installation of risky root certificates on user devices.

    The link between NordVPN and Surfshark was initially and extensively denied by both entities. However, they eventually acknowledged their relationship, adding another layer to NordVPN’s complicated narrative. The merger between these two was officially announced, which startled users who were relying on these services for anonymity and security.

    These revelations not only shed light on NordVPN and Surfshark’s questionable practices but also underscore the need for users to question the transparency of VPN services. It’s essential to keep in mind that the practices of these companies can directly impact user privacy and security. Therefore, users must stay informed about the operations of their chosen VPN services.

    In the end, the core of the VPN business relies on trust, and the denial and eventual admission of the connection between NordVPN and Surfshark is a blatant breach of that trust. It highlights the need for vigilance and constant scrutiny of companies that promise to protect our digital rights and freedom.

    Related Posts