Client-side attacks

In this section, we will learn about the Client-side attacks. It is better to gain access to a target computer using the server-side attacks, like trying to find exploits in the installed applications, or in the operating system. If we are not able to find the exploit, or if our target is hidden behind an IP or using the hidden network, in this case, we will use client-side attacks. Client-side attacks require the user to do something, like download an image, open a link, install an update that will then run the code in their machine. The client-side attacks require user interaction that?s why information gathering is very important. It gathers the information about an individual?s applications and who they are as a person. To do client-side attack successfully, we need to know the friends of that person, what network and website they use, and what website they trust. In client-side attack, when we gather information, our focus is the person, rather than their applications or operating system.

The target machine will be a Window machine, and the attacking machine will be Kali machine. To ensure they are on the same network, both the machine will use NAT networks. In our example, we will be using reserve connections, so separate IP address are not essential in this case.

In this section, we are going to learn how a tool called Veil can be used to generate an undetectable backdoor. After this, we will also discuss payloads. Once we have a brief idea about the payloads, we will generate a backdoor through which we will implement client-side attacks on our system, and enabling us to listen to the connections. Finally, we will learn at how to implement backdoor in real time, as well as techniques we can use to protect our system fromm such attacks.

In client-side attacks, we are going to cover the following topics: