Ethical Hacking Unit-3

Ethical hacking Unit - 3
Syllabus topic:-
Page No.
1) Ethical Hacking :
……………………………………………………………..
2) Enterprise Security:
………………………………………………………...
3) Phases :
…………………………………………………………………………..
4) Gaining and Maintaining Access :

……………………………………...
5) Systems hacking :
……………………………………………………………..
5.1) Windows and Linux - Metasploit and Kali Linux,
5.2) Keylogging,
5.3) Buffer Overflows
5.4) Privilege Escalation
5.5) Network hacking - ARP Poisoning,
5.6) Password Cracking,
5.7) WEP Vulnerabilities,
5.8) MAC Spoofing,
5.9) MAC Flooding,
5.10) IPSpoofing,
5.11) SYN Flooding,
5.12) Smurf attack,
6) Applications hacking :
……………………………………………………………
6.1) SMTP/Email-based attacks,VOIP vulnerabilities,
6.2) Directory traversal,
6.3) Input Manipulation,
6.4) Brute force attack,
6.5) Unsecured login mechanisms,
6.6) SQL injection,
6.7) XSS, Mobile apps security,
7) Malware analysis :
………………………………………………………………
7.1) Netcat Trojan,
7.2) wrapping definition,
7.3) reverse engineering
8) Phases :
……………………………………………………………………………
8.1) Covering your tracks :
8.1.1) Steganography,
8.1.2) Event Logs alteration
9) Additional Security Mechanisms :
………………………………………
9.1) IDS/IPS,
9.2) Honeypots and evasion techniques,
9.3) Secure Code Reviews (Fortify tool, OWASP Secure
Coding Guidelines)
3) Phases
Understanding the Different Phases Involved in Ethical Hacking and
Listing the Five Stages of Ethical Hacking
An ethical hacker follows processes similar to those of a malicious hacker. The steps to
gain
and maintain entry into a computer system are similar no matter what the hacker’s
intentions
are. Figure 1.1 illustrates the five phases that hackers generally follow in hacking a
system. The
following sections cover these five phases.
FIGURE 1.1 Phases of Hacking
Phase 1—Reconnaissance
Phase 2—Scanning
Phase 3—Gaining Access
Phase 4—Maintaining Access
Phase 5—Covering Tracks
Phase 1: Passive and Active Reconnaissance

Passive reconnaissance involves gathering information regarding a potential target
without the targeted individual’s or company’s knowledge. Passive reconnaissance
can be as simple as watching a building to identify what time employees enter the
building and when they leave. However, it’s usually done using Internet searches or
by Googling an individual or company to gain information. This process is generally
called information gathering. Social engineering and dumpster diving are also
considered passive information-gathering methods.
Sniffing the network is another means of passive reconnaissance and can yield
useful infor-mation such as IP address ranges, naming conventions, hidden servers or
networks, and other available services on the system or network. Sniffing network
traffic is similar to building monitoring: A hacker watches the flow of data to see
what time certain transactions take place and where the traffic is going.
Active reconnaissance involves probing the network to discover individual hosts,

IP addresses, and services on the network. This usually involves more risk of
detection than passive reconnais-sance and is sometimes called rattling the
doorknobs. Active reconnaissance can give a hacker an indication of security
measures in place (is the front door locked?), but the process also increases the
chance of being caught or at least raising suspicion.
Both passive and active reconnaissance can lead to the discovery of useful information
to use in an attack. For example, it’s usually easy to find the type of web server and the
operating system (OS) version number that a company is using. This information may
enable a hacker to find a vulnerability in that OS version and exploit the vulnerability to
gain more access.
Phase 2: Scanning
Scanning involves taking the information discovered during reconnaissance and using
it to examine the network. Tools that a hacker may employ during the scanning
phase can include dialers, port scanners, network mappers, sweepers, and
vulnerability scanners. Hackers are seeking any information that can help them
perpetrate attack such as computer names, IP addresses, and user accounts .
Phase 3: Gaining Access

This is the phase where the real hacking takes place. Vulnerabilities discovered during
the reconnaissance and scanning phase are now exploited to gain access. The method
of connec-tion the hacker uses for an exploit can be a local area network (LAN, either
wired or wireless), local access to a PC, the Internet, or offline. Examples include
stack-based buffer overflows, denial of service (DoS), and session hijacking. These
topics will be discussed in later chapters. Gaining access is known in the hacker world
as owning the system.
Phase 4: Maintaining Access

Once a hacker has gained access, they want to keep that access for future
exploitation and attacks. Sometimes, hackers harden the system from other hackers
or security personnel by securing their exclusive access with backdoors, rootkits,
and Trojans. Once the hacker owns the system, they can use it as a base to launch
additional attacks. In this case, the owned system is sometimes referred to as a
zombie system.
Phase 5: Covering Tracks

Once hackers have been able to gain and maintain access, they cover their tracks to
avoid detection by security personnel, to continue to use the owned system, to
remove evidence of hacking, or to avoid legal action. Hackers try to remove all traces
of the attack, such as log files or intrusion detection system (IDS) alarms. Examples of
activities during this phase of the attack include steganography, the use of tunneling
protocols, and altering log files. Stegano-graphy and use of tunneling for purposes of
hacking will be discussed in later chapters.
4) Gaining and Maintaining Access

4.1) Gaining Access
This is the phase where the real hacking takes place. Vulnerabilities discovered during
the reconnaissance and scanning phase are now exploited to gain access. The method
of connec-tion the hacker uses for an exploit can be a local area network (LAN, either
wired or wireless), local access to a PC, the Internet, or offline. Examples include
stack-based buffer overflows, denial of service (DoS), and session hijacking. These
topics will be discussed in later chapters. Gaining access is known in the hacker world
as owning the system.
4.2) Maintaining Access

Once a hacker has gained access, they want to keep that access for future
exploitation and attacks. Sometimes, hackers harden the system from other hackers
or security personnel by securing their exclusive access with backdoors, rootkits,
and Trojans. Once the hacker owns the system, they can use it as a base to launch
additional attacks. In this case, the owned system is sometimes referred to as a
zombie system.
5) Systems hacking
System hacking is defined as the compromise of computer systems and
software to gain access to the target computer and steal or misuse their
sensitive information. Here the malicious hacker exploits the weaknesses in
a computer system or network to gain unauthorized access of its data or
take illegal advantage of it.
5.1) Windows and Linux - Metasploit and Kali Linux

5.1.1) Windows Hacking
The user password of Windows OS which appears after the Windows starts
logging in lets users to protect the computer from getting unauthorized
access. Choosing a strong password of more than eight digits is an excellent
practice. Henceforth you can protect your files and folders from the hands of
malicious users. There are several tricks and techniques to crack a windows
password. But, from the hacker's point of view, if you able to social engineer
your victim and finds a Windows computer open, you can easily modify the
existing password and give a new password which will be unaware of the
victim or the owner of the computer.
5.1.2) Linux System Hacking
Linux, as we all know is an Operating System (OS) assembled user the
model of open-source software development and distribution and is based on
Unix OS created by Linus Torvalds.
Now to hack a Linux based computer system and get access to a password
protected Linux system, we have to know the basic file structure of Linux. As
we know, Linux is considered to be the most secure OS to be hacked or
cracked, but in the world of Hacking, nothing is 100% secured.
Hackers usually use the following techniques to hack the Windows system.
 Hack Linux using SHADOW file.

 Another technique commonly used by hackers is to bypass the user
password option in Linux.
 In another technique, the hacker detects the bug on Linux distribution
and tries to take advantage of it.
5.2) KeyLogging
If all other attempts to gather passwords fail, then a keystroke logger is the tool of
choice for hackers. Keystroke loggers (keyloggers) can be implemented either using
hardware or soft-ware. Hardware keyloggers are small hardware devices that
connect the keyboard to the PC and save every keystroke into a file or in the
memory of the hardware device. In order to install a hardware keylogger, a hacker
must have physical access to the system.
Software keyloggers are pieces of stealth software that sit between the keyboard
hardware and the operating system, so that they can record every keystroke.
Software keyloggers can be deployed on a system by Trojans or viruses.
5.3) Buffer Overflow

Buffer overflows are hacking attempts that exploit a flaw in an application’s code.
Essen-tially, the buffer overflow attack sends too much information to a field
variable in an appli-cation, which can cause an application error. Most times, the
application doesn’t know what action to perform next because it’s been overwritten
with the overflow data; so it either executes the command in the overflow data or
drops out a command prompt to allow the user to enter the next command. The
command prompt or shell is the key for a hacker and can be used to execute other
applications.
5.4) Privilege Escalation
When you obtain a password and gain access to an account, there is still more
work to do:
privilege escalation. The reality is that the account you’re compromising may
end up being a lower-privileged and less-defended one. If this is the case, you
must perform privilege escalation prior to carrying out the next phase. The goal
should be to gain a level where fewer restrictions exist on the account and you
have greater access to the system.
Every operating system ships with a number of user accounts and groups
already present.
In Windows, preconfigured users include the administrator and guest accounts.
Because
it is easy for an attacker to find information about the accounts that are
included with an
operating system, you should take care to ensure that such accounts are secured
properly,
even if they will never be used. An attacker who knows that these accounts exist
on a
system is more than likely to try to obtain their passwords.
There are two defined types of privilege escalation; each approaches the
problem of
obtaining greater privileges from a different angle:
Horizontal Privilege Escalation An attacker attempts to take over the
rights and
privileges of another user who has the same privileges as the current account.
Vertical Privilege Escalation The attacker gains access to an account and
then tries to
elevate the privileges of the account. It is also possible to carry out a vertical
escalation by
compromising an account and then trying to gain access to a higher-privileged
account.
One way to escalate privileges is to identify an account that has the desired
access and
then change the password. Several tools that offer this ability including the
following:

Ethical Hacking Unit-3

Uploaded by

Copyright:

Available Formats

Ethical Hacking Unit-3

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Ethical Hacking Unit-3

Uploaded by

Copyright:

Available Formats

Ethical hacking Unit - 3

4) Gaining and Maintaining Access :

FIGURE 1.1 Phases of Hacking

Phase 4—Maintaining Access

Phase 5—Covering Tracks

Phase 1: Passive and Active Reconnaissance

Active reconnaissance involves probing the network to discover individual hosts,

Phase 3: Gaining Access

Phase 4: Maintaining Access

Phase 5: Covering Tracks

4) Gaining and Maintaining Access

4.2) Maintaining Access

5.1) Windows and Linux - Metasploit and Kali Linux

 Hack Linux using SHADOW file.

5.3) Buffer Overflow

5.4) Privilege Escalation

You might also like