lv6lv / dmzexploitation Goto Github PK

# DMZ Exploitation This week, you will apply the techniques you learned in class to pivot across subnets and attack a DMZ. ## Background on DMZs Most commonly, machines on a LAN send requests to the public Internet through a router, which forwards requests to the web after performing NAT, and forwards responses back to the requesting host on the LAN. This router typically has a firewall that only allows connections to/from certain ports, such as 80 and 443 (HTTP and HTTPS) . Network engineers can add an additional layer of protection to the network by installing a **DMZ (demilitarized zone)**, which acts as an additional layer of protection in front of an existing network. Only a _single_ machine separates the LAN pictured above from the public Internet: the `pfSense` router. In a DMZ, a whole _network sits in between. Recall that when machines on a LAN communicate on the Internet, they _all_ forward packets straight through the **default gateway**. When data comes back from the Internet, the gateway filters and forward it to the proper host on the LAN. Data passes through two gateways on its way through a DMZ. First, it passes through a router from the Internet into a network called the DMZ. This router typically runs a firewall that filters out all traffic that the organization doesn't expect—e.g., it may only allow connections to HTTP/HTTPS, email, and SSH ports into the DMZ.  **Note**: This is Creative Commons: https://commons.wikimedia.org/wiki/File:DMZ_network_diagram_2_firewall.svg From there, machines on the DMZ can forward requests to machines on the internal network. Sensitive data is typically stored only in the internal network, _not_ on machines in the DMZ. Clients on the public Internet interact with that data by sending requests to the machines Interaction with that data is done _through_ machines in the DMZ, which act as proxies. This means that attackers who compromise a machine in the DMZ do _not_ immediately own the machines in the internal network, and because it gives network administrators fine control over _exactly_ how services from the internal network are exposed to the outside world. One well-motivated use case for a DMZ is that of public web servers in a DMZ communicating with databases in an internal network.