Clearing Tracks Phaase

It involves removing or deleting any evidence of the penetration test, including logs, files and other digital footprints to prevent detection by the system administrators or security team.

🔹Do not leave any trail that can lead back to you.

Methods

1. Clear cache, logs & cookies
2. Close open ports
3. Dump used equipments.
4. Laundering

Tools

Shred
Auditpol

Clear logs & Cache.

Common logs - Event logs - Firewall logs - Netflow logs - System logs

Tools
Microsoft system internals i.e SDelete, Process explorer, Autoruns
Clear logs i.e syslog - Microsoft Event viewer

• Return all modified systems back to their original state.
• Remove all Backdoors, daemons, services & rootkits.

Linux.

Disabling logging services like rsyslog and then deleting logs is the most effective way to cover tracks by clearing logs on a Linux system.

                                $cd /var/logs | ls 
                                $ls
                                $shred file.log
                            

The shred command securely overwrites files to prevent recovery, but using it on log files without first stopping the logging service is ineffective.

                        $echo $SHELL $nano ~/.bash_history or zsh_history $history -c
                        

Microsoft Windows.

clearev #clear apps, system & security logs

MSTSC PowerShell tool & RDP >mstsc /public >mstsc /public /v:192.168.1.10 - Prevents credentials caching. - Disables saving of user settings.

Using Rootkits.

• Deploying rootkits to hide the presence of malicious software or unauthorized access.

• Application Rootkits can obscure files, processes, and network connections, making it difficult for system administrators to detect the hacker’s activities.

Changing File Timestamps.

• Modifying the timestamps of files to make it appear as though they were not accessed or altered.

Tools

Metasploit framework
Touch command
timestamp
bulkFileChanger
PowerShell
Exiftool

Can be used to change the creation, modification, and access times of files to mislead forensic investigations.

Network Traffic Obfuscation.

• Using techniques to disguise or encrypt network traffic to prevent detection by intrusion detection systems (IDS).

• This can involve tunneling traffic through secure channels or using VPNs to mask the source of the traffic.

Using Anonymizing Tools.

This helps in masking the source of the attack and makes it harder to trace back to the ethical hacker.

Tools

Tor
Proxy servers
VPNs

Dumping used equipments.

Methods

• Burning used hardware i.e files, computer, Pictures
• Removing all confidential data
• Wipe device clean i.e DBAN, KillDisk
• Disconnect all network connections.
• Delete all users used
• Delete all files, exe, scripts, temp files (Media sanitization)

Tools

Fire - Paper shredder

Previous Page Top Next