Ethical Hacking Final

Introduction
to
Ethical Hacking
Peter Muia - KENET

What is Ethical Hacking?
 Ethical hacking – defined “methodology adopted by
ethical hackers to discover the vulnerabilities existing
in information systems’ operating environments.”
 With the growth of the Internet, computer security has
become a major concern for businesses and
governments.
 In their search for a way to approach the problem,
organizations came to realize that one of the best ways
to evaluate the intruder threat to their interests would
be to have independent computer security
professionals attempt to break into their computer
systems.
Working principle of
ethical hacker :
“TO CATCH A THIEF ,
THINK LIKE A
THIEF…….”
Ethical Hacking
 Independent computer security
Professionals breaking into the
computer systems.
 Neither damage the target
systems nor steal information.
 Evaluate target systems security
and report back to owners about
the vulnerabilities found.
HACKING VS CRACKING
HACKING WITH MALICIOUS
INTENTION IS CRACKING
 The basic difference is
hackers do not do
anything disastrous.
 Cracking yield more
devastating results.
 Cracking is crime.
 Cyber crime are the
results of cracking ,not
hacking
Who are Ethical Hackers?
 “One of the best ways to evaluate the intruder threat is to
have an independent computer security professionals
attempt to break computer systems”
 Successful ethical hackers possess a variety of skills. First
and foremost, they must be completely trustworthy.
 Ethical hackers typically have very strong programming
and computer networking skills.
 They are also adept at installing and maintaining systems
that use the more popular operating systems (e.g., Linux or
Windows 2000) used on target systems.
 These base skills are augmented with detailed knowledge
of the hardware and software provided by the more
popular computer and networking hardware vendors.
Required Skills of an Ethical
Hacker
 Routers: knowledge of routers, routing protocols, and
access control lists
 Microsoft: skills in operation, configuration and
management.
 Linux: knowledge of Linux/Unix; security setting,
configuration, and services.
 Firewalls: configurations, and operation of intrusion
detection systems.
 Servers
 Network Protocols: TCP/IP; how they function and can
be manipulated.
 Project Management: knowledge of leading, planning,
organizing, and controlling a penetration testing team.
Why Do We Need Ethical
Hacking
Social
Engineering
Automated
Organizational
Attacks
Attacks
Restricted
Data
Accidental
Breaches in
Viruses, Denial of
Security
Trojan Service
Horses, (DoS)
and Worms
What do Ethical Hackers do?
An ethical hacker’s evaluation of a system’s security seeks
answers to these basic questions:
 What can an intruder see on the target systems?
 What can an intruder do with that information?
 Does anyone at the target notice the intruder’s attempts or
successes?
– What are you trying to protect?
– What are you trying to protect against?
– How much time, effort, and money are you
willing to expend to obtain adequate protection?
Modes of Ethical Hacking
 Insider attack
 Outsider attack
 Stolen equipment attack
 Physical entry
 Bypassed authentication attack (wireless
access points)
 Social engineering attack
Hacker classes

White Hat Hackers: - specializes in penetration testing and in other
testing methodologies to ensure the security of an organization's
information systems.

Black Hat Hackers: - The villain or bad guy, especially in a western
movie in which such a character would stereotypically wear a black hat
in contrast to the hero's white hat.

Gray Hat Hackers: - A skilled hacker whose activities fall
somewhere between white and black hat hackers on a variety of spectra

Hactivism – hacking for social and political cause.

Ethical hackers – determine what attackers can gain
access to, what they will do with the information, and
can they be detected.
Why do people hack??
 To make security stronger ( Ethical Hacking )
 Just for fun, Show off
 Hack other systems secretly & Steal important
information, Financial Gain
 A large fraction of hacker attacks have been pranks
 Venting anger at a company or organization
 Terrorism
Modes of Hacker Attack
 Over the Internet
 Over LAN
 Locally
 Offline
 Theft
 Deception
Ethical Hacking - Process
1) Preparation
2) Foot Printing
3) Enumeration & Fingerprinting
4) Identification of Vulnerabilities
5) Attack – Exploit the Vulnerabilities
6) Gaining Access
7) Escalating Privilege
8) Covering Tracks
9) Creating Back Doors
1.Preparation

Identification of Targets – company websites, mail
servers, extranets, etc.

Signing of Contract

Agreement on protection against any legal issues

Contracts to clearly specifies the limits and dangers of
the test

Specifics on Denial of Service Tests, Social Engineering, etc.

Time window for Attacks

Total time for the testing

Prior Knowledge of the systems

Key people who are made aware of the testing
2.Footprinting
Collecting as much information about the target

DNS Servers

IP Ranges

Administrative Contacts

Problems revealed by administrators
Information Sources

Search engines

Forums

Databases – whois, ripe, arin, apnic

Tools – PING, whois, Traceroute, DIG, nslookup, sam
spade
Finding remote computer
 Lets say a Hacker decides to break
into the computer of one of his
facebook friends.
 Then his first step will be to find the
IP address of his friend computer.
 So lets discuss what are the possible
ways of finding the IP address of any
remote computer.
Finding Remote Computer’s
IP Address

Through Instant messaging software

Through IRC Chat
MSN , Yahoo , g-talk
 If you are chatting on other messengers like MSN, YAHOO etc. then the
following indirect connection exists between your system and your friend’s
system:
Your System------Chat Server---- Friend’s System
Friend’s System---------Chat Server------- Your System
 Thus in this case, you first have to establish a direct connection with your
friend’s computer by either sending him a file or by using the call feature.
Then, goto MSDOS or the command line and type:
netstat -n
This command will give you the IP Address of your friend’s computer.
Instant Messenger
Ask your friend to come online and chat with you.
Case I: If you are chatting on ICQ, then the following connection exists
between your system and your friend’s system:
Your System------DIRECT CONNECTION----  Friend’s System
Friend’s System---------DIRECT CONNECTION-------  Your System
Now, goto command line and type:
netstat -n
This command will give you the IP Address of your friend’s

Getting IP from Website
 One can easily log the IP Addresses
of all visitors to their website by
using simply JAVA applets or
JavaScript code.
 By using PHP scripts it is possible to
determine user’s O.S and Browser’s.
 Same can be used to determine the
exact geographical location of the
visitors.
3.Enumeration &
Fingerprinting

Specific targets determined

Identification of Services / open ports

Operating System Enumeration
Methods

Banner grabbing

Responses to various protocol (ICMP &TCP) commands

Port / Service Scans – TCP Connect, TCP SYN, TCP FIN,
etc.
Tools
Nmap, FScan, Hping, Firewalk, netcat, tcpdump, ssh,
telnet, SNMP Scanner
4. Identification of
Vulnerabilities

Insecure Configuration

Weak passwords

Unpatched vulnerabilities in services,
Operating systems, applications

Possible Vulnerabilities in Services, Operating
Systems

Insecure programming

Weak Access Control
4.Identification of
Vulnerabilities
Methods

Unpatched / Possible Vulnerabilities – Tools,
Vulnerability information Websites

Weak Passwords – Default Passwords, Brute
force, Social Engineering, Listening to Traffic

Insecure Programming – SQL Injection,
Listening to Traffic

Weak Access Control – Using the Application
Logic, SQL Injection
4.Identification of
Vulnerabilities
Tools
Vulnerability Scanners - Nessus, ISS, SARA, SAINT
Listening to Traffic – Ethercap, tcpdump
Password Crackers – John the ripper, LC4, Pwdump
Intercepting Web Traffic – Achilles, Whisker, Legion
Websites
Common Vulnerabilities & Exposures –
http://cve.mitre.org
Bugtraq – www.securityfocus.com
5.Attack – Exploit the
Vulnerabilities

Obtain as much information (trophies) from
the Target Asset

Gaining Normal Access

Escalation of privileges

Obtaining access to other connected systems
Last Ditch Effort – Denial of Service

Vulnerabilities
Network Infrastructure Attacks

Connecting to the network through modem

Weaknesses in TCP / IP, NetBIOS

Flooding the network to cause DOS
Operating System Attacks

Attacking Authentication Systems

Exploiting Protocol Implementations

Exploiting Insecure configuration

Breaking File-System Security
Vulnerabilities
Application Specific Attacks

Exploiting implementations of HTTP, SMTP
protocols

Gaining access to application Databases

SQL Injection

Spamming
Vulnerabilities
Exploits

Free exploits from Hacker
Websites

Customised free exploits

Internally Developed
Tools – Nessus, Metasploit

Framework
6. Gaining access:

Enough data has been gathered at this point to
make an informed attempt to access the target
Techniques

Password eavesdropping

File share brute forcing

Password file grab

Buffer overflows
7. Escalating Privileges
If only user-level access was obtained in
the last step, the attacker will now seek
to gain complete control of the system
Techniques
Password cracking
Known exploits
8. Covering Tracks

Once total ownership of the target is
secured, hiding this fact from system
administrators becomes paramount, lest
they quickly end the romp.
Techniques

Clear logs
9. Creating Back Doors

Trap doors will be laid in various parts of the system to
ensure that privileged access is easily regained at the
whim of the intruder
Techniques

Create rogue user accounts

Schedule batch jobs

Infect startup files

Plant remote control services

Install monitoring mechanisms

Replace apps with trojans
Final Report
 Collection of all discoveries made during
evaluation.
 Specific advice on how to close the
vulnerabilities.
 Testers techniques never revealed.
 Delivered directly to an officer of the client
organization in hard-copy form.
 Steps to be followed by clients in future.
Ethical Hacking - Commandments
 Working Ethically
 Trustworthiness
 Respecting Privacy
 Not Crashing the Systems
Suggestions?

Ethical Hacking Final

Uploaded by

Copyright:

Available Formats

Ethical Hacking Final

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Ethical Hacking Final

Uploaded by

Copyright:

Available Formats

Introduction

Peter Muia - KENET

Your System------Chat Server---- Friend’s System

Friend’s System---------Chat Server------- Your System

Your System------DIRECT CONNECTION----  Friend’s System

Friend’s System---------DIRECT CONNECTION-------  Your System

Now, goto command line and type:

This command will give you the IP Address of your friend’s

Last Ditch Effort – Denial of Service

Tools – Nessus, Metasploit

You might also like