book

Python for Cybersecurity

by Howard E. Poston, III

March 2022

Intermediate to advanced

240 pages

5h 13m

English

Wiley

Read now

Unlock full access

How This Book Is OrganizedTools You Will NeedFrom Here
Active ScanningSearch Open Technical DatabasesSummarySuggested Exercises
Valid AccountsReplication Through Removable MediaSummarySuggested Exercises
Windows Management InstrumentationScheduled Task/JobSummarySuggested Exercises
Boot or Logon Autostart ExecutionHijack Execution FlowSummarySuggested Exercises
Boot or Logon Initialization ScriptsHijack Execution FlowSummarySuggested Exercises
Impair DefensesHide ArtifactsSummarySuggested Exercises
Credentials from Password StoresNetwork SniffingSummarySuggested Exercises

Account DiscoveryFile and Directory DiscoverySummarySuggested Exercises
Remote ServicesUse Alternative Authentication MaterialSummarySuggested Exercises
Clipboard DataEmail CollectionSummarySuggested Exercises
Encrypted ChannelProtocol TunnelingSummarySuggested Exercises
Alternative ProtocolsNon-Application Layer ProtocolsSummarySuggested Exercises
Data Encrypted for ImpactAccount Access RemovalSummarySuggested Exercises
Acknowledgments

Content preview from Python for Cybersecurity

CHAPTER 7Accessing Credentials

User credentials can be invaluable to an attacker. With a set of credentials, an attacker can expand and deepen their access to target systems, achieve persistence, and make their activities more difficult for a defender to detect.

The MITRE ATT&CK framework includes 15 techniques for Credential Access, as shown in Figure 7.1.

Snapshot of MITRE ATT&CK: Credential Access — Figure 7.1: MITRE ATT&CK: Credential Access

In this chapter, we'll look at two very different means of capturing user credentials. The first part of the chapter will explore how to dump login credentials for online accounts from web browsers, which is one of the sub-techniques under the Credentials from Password Stores technique. The rest of the chapter discusses the use of Python's scapy library to sniff credentials from unencrypted network traffic (called Network Sniffing in MITRE ATT&CK).

The code sample archive for this chapter can be found at https://www.wiley.com/go/pythonforcybersecurity and contains the following sample code files:

ChromeDump.py
DetectLocalStateAccess.py
NetworkCredentialSniffing.py
DecoyCredentials.py

Credentials from Password Stores

User credentials are cached in a variety of locations and a few different formats. Many applications will store password hashes for authentication purposes, and these hashes can potentially be cracked to learn the associated passwords.

However, applications may ...