[Autogenerated] let's wake up a bit.
What are the types of attacks we are going to protect
against using Mandala as a sage.
These attacks are detailed in a miter attack framework.
Both of the attacks are going to be mitigated using the following miter
shield technique called decoy artifacts and systems.
This technique will leverage a decoy artifact in the form
of a server establishing a honey pot that will increase
the ambiguity for an attacker.
The first attack is going to be an active discovery attack.
Let me give you a summary of what we are going to do here.
Before we start to see this in action,
we are going to use and map in order to perform some discovery
techniques on our ssh server protected by And let SSH let's assume
that were in the shoes of an attacker that wants to retrieve
information about the necessary server.
In order to sketch a more detailed plan on how to get control of it.
We will first try to enumerate all the encryption and compression
algorithms used by the server as an attacker.
We use this in order to find a potentially exploitable algorithm,
we won't know the actual ports where our target ssh server is running on.
So we are going to assume that it is running on the
standard ssh port which is 22.
However,
our server runs on a totally different ports and on 22 we
got our endless Ssh instance which will trap the attacker
and will drop the attack.
All right now, let's hear them off this.
I am now on a virtual machine that I have started,
which hosts a necessary server.
I'm going to run unless this age here on Port 22 and will
print all of its logs in a separate file.
This is useful because the logs will display if anyone has
attempted to interact with our server,
I will also take the address of the system in order to use it in
the attacks from a different VM and going to perform the
following command to see if I can retrieve the list of
encryption and compression algorithms.
When we press enter,
we notice that we don't get any output back and this will
stay the same for hours and hours until the attacker will
stop the command manually.
This means that the script has been caught into the tar pit of endless
sage know that the command is not specifying any support because any map
will scan all the open ports of the target host.
When it gets to interact with endless message,
it will get trapped in the tar pit and the attack would be successful.
Let's go back to our VM where our S S A server is running by
looking at the logs we can see the iP address of the attacker
that tried to commemorate our algorithms.
This is useful because you can see the actual
IP address of a potential attacker.
We're also going to analyze the network information sent from under SSH in a
later video to see exactly how it traps those clients.
We can also try to execute some other end map commands,
for example,
to lose the authentication methods used by the server running this
command will display the exact same behavior as before.
We can see that there is no output and we can wait for hours
for something to be rendered in the console.
This one happened as the client is actually trapped in SSH tar pit Right now,
even if we try to brute force our way into the server by using
a file with common user name and passwords,
we will stumble upon the same behavior as you can see on the screen.
In the next video,
we are going to do something more aggressive by attempting to do
a denial of service attack on our Ssh server.