Scribd
Upload
103 views47 pages

Ethical Hacking-1

The document provides an overview of ethical hacking, detailing various hacking techniques, phases, and methodologies. It covers topics such as session hijacking, web server vulnerabilities, and methods for information gathering like footprinting and scanning. Additionally, it distinguishes between different types of hackers, including white hat, black hat, and gray hat hackers, and emphasizes the importance of ethical hacking in cybersecurity.

Uploaded by

Atharva Pathak
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF or read online on Scribd
103 views47 pages

Ethical Hacking-1

The document provides an overview of ethical hacking, detailing various hacking techniques, phases, and methodologies. It covers topics such as session hijacking, web server vulnerabilities, and methods for information gathering like footprinting and scanning. Additionally, it distinguishes between different types of hackers, including white hat, black hat, and gray hat hackers, and emphasizes the importance of ethical hacking in cybersecurity.

Uploaded by

Atharva Pathak
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF or read online on Scribd
You are on page 1/ 47
ual Ethical Hacking 3 Table of Contents 12 73 7A Chapter 8: Session Hijacking 81 82 a3 84 7.12 Common DoS Attack Techniques.. BOTs/BOTNETs. 721 Bots. 722 Botnets... 7.2.3 Detection and Mitigation. “smurf” Attach 7.3.1 Countermeasures against Smurf Attacks, “SYN" Flooding. 74.1 SYN Flooding Attack Process. 74.2 Countermeasures against SYN Flooding... 7.43 DoS/DDoS Countermeasures. Spoofing vs. Hijacking... BLL SpoOfIMg nnn Ce Key Differences ‘Sequence Prediction Steps and Prevention. 8.3.1 Steps for Sequence Predictio Prevention Measures Chapter 9: Hacking Web Servers 94 92 93 94 Web Server Vulnerabilities... ‘Attacks against Web Servers.. Patch Management Techniques. Web Server Hardening Chapter 10: Web Application Vulnerabilities 10.1 102 103 Web Application Vulnerabilities nw Web Application Hacking... Google Hacking. 10.3.1 Countermeasures. Techknowledge ALL Web-based Password Caching Tesh gus mem 1 tenes Typ 65—_—_————— 113 Password Crackers Coantermeasres. 123 SQLServer Veboerabes Countermeasures. - ‘Ghapir19 Bute Overton 131 Boller Oversowe and Type ar 1 Introduction ax a | introduction : Terminology, Hacking Technology Types Ethical Hacking Phaces Macca, Macker Classes, Sls Required for an Ethical Hacer, Vurerbity Research Ways to Conduct Ethical Hacking. Invroduetion stand sogment of the scurty tla butt should not be overlooked, 1.2 __Hacking Technology Types knowledge, et 1.2.1. Types of Hacking is type of hacking aims to gain important let information, such as MasterCard deals and account ‘passwords. For example, hackers can rete a website clone that looks much ike the erginal and use to obtaln technique, he hacker fabrieatesa fake Interface, wich directs users toa unique website ‘when they elickwith the intention of sing epee website, Sess Introduction a _tntotction, ore login 410, Cracking Password lacers wil obtain your eedentals by ulna method called ey loggng, 1.2.2. Ethical Hacking Phases and government organi to secur. An ‘dosing your doors wil not be enough to safeguard sj Feasts Introduction "yoin information about te target without guningdiret websites and other public resoures, shodology isthe seanning phase, which Involves applying phase tothe target location in order to search for er accounts, credential, 1P addresses, and other deta, ‘Passive footprinting which involves tying ‘vulnerabilities, Hackers lok for information sucha ‘There ae three ferent ypes of sensing ; ‘Vulnerability scanning, which wes atomate tol like Netsparker, OpenVAS, and Nrap to identify § target’ weak pointsad vulnerabilities Port scanning: In ths sage, the targets scanned fr information such as open ports live systems, and ther services that are active onthe host. ves identjing the firewall of the company a wells addtional Galaing Access: The b ‘nile, Dos session hijacking. blr overflow, and more, The hacker guns acess tothe network, programs. and ‘ystemand then increases their access priveges to manage inked systems. 44. Malataning Acest: An ethical hacker esto hold onto acess tothe target until they have finished the tasks Ia hacker guns access, they choose to keop i for future explotation and organization's Rootkits and Trojans to cary out more network stacks, thei erdenc, sch a erasing or coruptng al logs, altering the values of logs orrestis, removing al ofthe folders they crete and unnstalingall of he applications. 1.3__Hacktivism 1.31 Hacker Classes ‘keen interest in the inner workings of any computer operating system characterizes a hacer, who is typically programmer who aqutres advanced understanding of programming languages and operating systems th order to ‘ind weaknesses in systems and the causes of those weaknesses 1 White Hat Hackers: White hat hackers also known as eer secur experts or ethlcl hacks, are authorized rations. They carry out penetration tests, ind protected (rom malicious eybererimes. Because they il hackers or eybersecuty expert, 2. Mat Hackers; Crackers. they are commonly own, are Black Hat Hackers who are able to access your system Ethical Hacking 15 Introduction ston * ‘without authorization and delete your important data Thy are identified by their malicious behavior, which ‘makes them easly recognzabl as eimlnas. They are attacked using common hacking techniques that they have is for personal gains assified as good intentions is classed as a gray hat hacer. Gray ‘an information technology (IT specialist with advanced cybersecurty knowledge to detec ud prevent unauthorized access to confidential information on acomputero databace, ‘Operating systems proficiency : A white bat hacker must be proficient ina variety of operating ystems. ‘ition to Windows and Mac, which are among the most widely used operating system, a hacker can use a Variety of high-level operating systems. Since hackers typically prefer to operate from untraceable networks, sing unique operating systems i one way they ean accomplish his. In addition to the more common operating systems, bing able oun more sophisticated operating systems like Linux, Ubuntu, and Red Hat i Rlpl dentitying and preventing security breaches. ‘Troubleshooting: In addition to offering proactive or preventive measures to stp security breaches, white at hackers ls offer reactive measures in case they happen When you create preventive plan, you alo need to have backup plan in case the pl Demonstrating problem saving counter-suateny in unavorable ‘Computer hardware knowledge: the mostimportant ables for an ethical hacker is having thorough uding how the motherboard, CPU, graphics card, and data storage ‘unetion. This fs because hackers often target diferent system components in onder to chain acess, and ‘owing how a machine operates isthe frst step in roubleshootngt when you have acces toa compromised machine ‘Know bow search engines operat, you can obtain almost any information by just ping keywords search engine. You an also quietly learn about hacking aces and gather impertant information about 1 Introduction Shout vmne of the newest hacking techniques. Finding en the pertinent information source. igo few ilerent programming languages is a must Writing codes how you ution, to 9 computer o detect criminal activity on a machine or software. C+e, Python ava © CCyplle writing : Computer experts then developed a way to send information that hackers cannot easy Interpret to prevent the unlawful decoding of private Information This method of sharing seretiormation is receive lr techniques. + Tofindwesknes + Tounderstand + Toknow how tore ‘could be exploited Following their evaluation of a company’s networks, ethical y weak Fonts, Including a decency in password encryption wnsecured hed software. The information gathered from these tests can be used by Yormed decisions regarding where and how to strengthen their security posture 10 2. Identifying and demonstrating methods of cybercriminals sualyCybereriminas’ how bad actors may break versed in the techniques Soersons, in these demonstrations, which ae intended to teach executives tworks and wreak havoc on their companies. Therefor, companies well ers employ to acess their systems are beter equipped to stop su Eehical Hacking 1 3. Assisting in eyber-attack preparation continuously evolving nature of online threats, which els them Roview Questions 0.2 Explumtrot pasos of eho! aching, 2.1 wratisnacing? 10.3 Wate ate way a conte eda eng? 2.4 _EiplanHuchorcussesin shor. Footprinting Definition information Gathering Methodology, Competitive Intligence, DNS Enumeration, Whois and ARIN Lookups, Types of DNS Records, Traceroute in Footpxntng E-Mail Tracking 2.1_Introduction / Definition ‘The method fr obtaining data on computer systems and the enies they area partofls called fingerprinting An attacker may employ a vorey of devices and method to obtain tis Information. When trying to break into an entire syston, a hacker en nd great wen this knowledge, 2.1 Methods of information Gathering ‘There are the fllowing three methods of information gathering: Footing Seanning Enumeration pee Footprinting ‘This method gathers s much data as possible about a target network system, or victim, There are several Ways to compromise an organization's sytem using Angerprintng. Tis approach also determines the target's posture. Boh ative and passive forms are possible, Passive footprinting involves gathering user dit without the user's knowledge. Active footprinting occurs when a user's private information is disclosed knowingly and pu Footprinting echiques are three types. These area follows ‘Opensource footprinting Network-based footprinting DNS interrogation 1)” Open source fotprinting ‘+ The safest footprinting method is open source. Restricting footprinting is aginst the law. Because it's ‘gana the law, hackers can freely engage In open soure footprinting, Open source footprinting includes things tke phone members, DOBS, age searches, ema address searches, employing automation tols IP ‘scans, and more, The majority of businesses post company-rlated information on ther own websites ‘Hackers wil explo them by using the companys provided information, a dre Exel Hacking 22 Footpenting oping, 1) Network-based Footprinting Information such as network services, shared data among users usernames and information names inside lroups canbe retrieved using network-based footpriting 1) DNS interrogation ‘After gathering al the required information on varius areas sng diferent techniques, the hacker uses the _re-existng tool to query the DNS. DNS Interrogation Is performed by many freeware online tools, Scanning ng patches thanks to ths technique. Consequenty, 5 the vulnerable discovered in an smetwork provided by ethical hackers and pen-testers, ‘There are three ype of sesnning Port scanning Networcecannng Valoerability scanning Portscanning “ToP (transmission contl protocol ports, he maps the organs tool performs port scanning i) Network scanning Prior to learing vulnerability scanning techniques, ‘conection. Aer hearing the packet, the server sends the len 8 syn/ac packet. Once more, the replies by giving the server the ack packat SYN (synchronization indaes thatthe server and lent have ‘established a connection. ACK indicates that a connection has been established between hosts ti) Vulnerability scanning Finding vulnerabilities on target network proactively is known as vulnerability scanning, Vulnerabilities and threats canbe Identifed withthe help of sme manual asstance as wll as some automatic scanning tools. An internet connections required forthe computer to perform vulnerabilty seaming, Footproning ihc Hacking a) 3. Enumeration names, network resources, shares, and je connection withthe system. By target information. The systema. For this reason, “The process of extracting data fromthe system, sucha machine and use serves, i elled enumeration. In enumeration, the Racker establishes 29 Crucuting direct queries, hackers can leverage tis connection to obtsin editions) ‘oumeracion phase’ esl i ery help tothe atacker if they wish to directly exploit the the enumeration phase of penetration testing regarded asrshy- “There are varius types of enumeration. These are as follows: 1) Nets Enumeration: Networc ase Input Output System is known a NetBIOS. HM is the company behind ts deropment Pte and fle server shouldbe enabled on Windows OS ifyou wish to count the number of etblOs devices Anattacker can launch a DOS attack on a distant computer by using NetOS. iy. SNM Enumeration : Simple Networc Management Protos known as SNMP. SNMP will bused to managea ‘enwork device that runs on nteruetProtoel (IP), such a¢ a route. The client-server architecture serves a its foundation. An stacker can obtain data about network resources, such as devices, shares, routers, ec, by using the SNMP enumeration By counting the SHMP entries on the remote device, an atacker can obtain trafic statisti ARP and routing tables and devicespeci data {uf SMTP Eoumeration:Siple Mail Transer Protocol is known as SMTP. Electronic malls transmitted through i ‘The dient server architecture serves ass foundation. ef compatible with TCP (Transmission contro protoce}) port 25. The MK server (ail exchange rerver) wil be used inorder to send mall via DNS. Competitive intelligence: +The method and proactive techniques used to generate nowledge about the competitive environment inorder to enhance organizational performance ae known as compete intelligence cinvelves a wel-coordinated program in addon tthe methodical gathering and analyst of data from various sources 2.2 _DNS Enumeration + DNS means Domainname service. DNS is used to store the record using the DNS database. In DNS, the most ‘commonly used types af record areas fllows + Domain name lies address Nameservers Starafautoriy tars for reverse DNS lookups + Mallechange _DNS is compatible with both UDP (User Datagram Protos) and TCP (Transmission control protocol) $3 s the port number that uses. TCP ts used In DNS fr one transfer, wile UDP is used for query resolution By using [DNS zone transfer, the postion of the dtatase cam be replicated from the primary sever to the secondary server. When the zone transfer request the DNS primary server and impersonates cient, DNS enumeration Is feasible I provides the sensve domain record information in response tothe request. Ethical Hacking 2 2.2. Whois and ARIN Lookups Foorpriating provided by ARIN gives users multiple option to access data fom ARIN aswell as other rgistris, RRS, and uRs that comply with RDAP. 222 Types of DNS Records + Zone es also known as DNS records are files stored in authoritative DNS servers that contain instructions ‘bout «domain. They Include the IP adress linked t the domain and how to respond to requests for that ‘damaln. These reconde are made up of several text les writen in a format called DNS syntax. Simply put DNS syntax is se of charactrs that astrcts the DNS server what odo. The term “TTL” which stands for “ime lives appended ta every DNS record and describes how frequenty a DNS server will update that record collection of DNS record can be compared ta Yelp busines listing You can lear foto helpful deal about "Most common types of DNS record 1. Arecord. The record thatholds the IP address ofa domain Learn more about the A record. 12. AAAA record = The record tha contains the IPv6 address fora domain (38 opposed to A records, which isthe vt addcess). CCRAME record Forwards one domain or subdomain to another domain does NOT provide an IP adress, Mxrecord-Direcsmaltoanemallserver. fora DNS eotry. ‘SOA record - Stores admin information about a domain. ‘SRV record Specifies portfor specie services 23._Traceroute in Footprinting cert (traceroute), which suse to follow a path between 2 use and the target system on be usd to obtain Information. In this manner, ls made evident where snd through which le being routed. 23.1 E-Mail Tracking + One way to keep track of whether emails ae reaching thor intended recipient i through emai tracking. Email tracking ls keeping troleo eral clicks nd opens in order tofllow up with partners jb candidates, and leds. Pat dtfereny, email tracking eth practice of monitoring emalls that are sent and tiling the information Foorpinting ical Hacking eS is you send ls known as email ster plcbrmen re ngs ep an cen Fe eto «ail umesanped rs Weney Ge pec encour etorapn grin’ pena. mje of ena king wr information 2 ttropen seater en here 1 oto cpnd eel vee coats ovo wes for example, your email management system will receve 2 ena specific action an he email you sent Review Questions 2.1 What ar cteentatds of gate itomatn ? (0.2 Wie shar rate on ONS Enunraton 2.3 Explan mal acing Social Engineering ommen Types OF Attacks ] 3.1_ Introduction ‘+ A manipulation rechnique known as “socal engineering” takes advantage of human error to obtan valuables, private information, ra {nto diving personal restricted, Attacks can occur through other interaction, 4+ Social engneerng-based scams revolve around human behavior and thought pattems; Therefore, socal engineering atacs ae particulary effective at influencing user's behavior. An attacker can sucessfully tick ‘and control a weer ance they nove what drives their behavior, 3.1.1 Common Types of Attacks. Keystroke logging: Keystroke logging also known as keyloggine or keyboard capturing isthe process of loging) each key pressed ona keyboard so thatthe serfs unaware that thelr acts are on running the loging program can then acess the data. A keylogger may be secretly rece being watched, The hardware-based or software-based. Keyloggers are prinarly used to stel passwords and other private data, ‘even hough the programs themselves are awful and many ofthem are made tot employers monitor how thelr 2 Denlabotservce attack : A denlal-tservice (DoS) atack ea ype of eyberattak in which the perpetrator atuempts to make 2 machine or network resource unavailable tots intended users by disrupting the services of host connected tothe Internet for an extended period of time. Denial of service fe pel cartied out by Aooding the targeted machin in an attempt to overload systems and Prevent some fal egimate requests from beng fled, na distributed deniaof service (DDaS) attack, the Incoming waffle Noodng the victim comes fom a variety of sources. This effectively makes stopping the attack Impossible simply by bocknga single source iposst tac: A watering hole attack is typeof security exploit where the atacer targets webskes the target group ate known to visit in an atempr to compromise a partial end user group, reunity to attack thelr intended vc. In 2 watering hoe tac, che are welled by thelr intended pre, searching for penings 0 1s that wil render thei target susceptible ‘Brute-frce attack: na brute force attack a hacker submits mumerous passwords oF Past of eventually guessing the right one. ll potential paswords and passphrates are method attacker unl the ight one is covered. A an alternative the attacker can ty to gues the generated by 2 key detvtion futon from the password, Whe 7. Man-in-themiddle attack : An attack known as 2 “mandn-thesmidde™ (MIT) occurs when an attacker surreptitiously relays and potentially modifies communication between two partes that think they are speaking with each other dec. Active eavesdropping is type of MITM in which the attacker ext ‘connections with the vets and passes messages betwen ther to give the impression th worth powers involved Hackers wil stop at nothing to obtain sensitive and congenial data and take control of user account Review Questions 0.1. Wie shorten ays apeg .2.2_eatan iene cats nl Scanning and Enumeration 4.1 _ Scanning and Enumeration ‘Scanning and enumeration are ruc steps in the Red of cyber secusy and network security. They are part of the inlormationgnhering process to dently and understand the characteristics of a target system oF network Her'san overview of ech ‘Definition : Scanning involves actively probing a system or network to identify lve hosts, open port, and services runing on those pos. AL TeP Connect can nmap -sT target, + Definttlon : Enumeration isthe process of extracting mare detailed information about the Identified 2, SW/Steath Sean: nmap-sS target services and resources on atarget system, “Tools and Technig + _ SNMP Enumeration: Simple Network Management Protocol (SNMP) canbe queried wo gather information it Su Exune c 4.3 _ Network Scanning Se + LDAP Enumeration :Ligheweht Directory Access Protocol Information aboutusers and groupeina directory service. 4. Version Detection nmap sV target can be used to gather ‘thea Hacking 43 Scanning nd Enumeration ‘Types of Network Scans etermine which hosts ona network are alive by sending CMP Echo Request (ping) packets. perce to MAC adresses on aocal network 2. ARPScans:Use Add 3. TOP SYN Seans: Probe ‘TeP handshake 44. FuIITCP Connect Scans: Common Network Scanning Tools Resoltion Protocol (ARF to mapIPad open ports 0 TP connection with the target to checkfor open ports «Nmap (Network Mapper) : A versatile too that support 2 variety of network scanning techniques, including ping scans portscans, and service version detection Angry I Scanner: A sinple and lightweight IP address and por scanner that provides information about active hosts ona network, “+ Neteat (ne): uty for reading and wring data across network connections often used for port scanning. Network Discovery Techniques 4 -Aetive canning: Involves sending packets to target devices and analyzing the responses. 2. Passive Scanning: Involves monltoring network traf to dently devices and services without directly Iteracting with them. ‘3, Legal and Ethical Considerations + Always ensure you have proper authorization before conducting any network juthoraed seannng of networks that you donot own or have permission to testis both ‘unethical and eg Example Nmap Network Scan Commands: 1, Ping Scam: omap sn target 12, TEPSIN Scan nmap target 3. FUTCP Connect Scan:nmap «Target 44 Vulnerability Scanning ‘+ Definition : Vulnerability scanning lnvolves the use of automated tos to sean a network sytem, application forknown security vulnerables. ‘Common Vulnerability Scanning Tools ity Scanning too! that identifies vulnerabilities, misconfigurations and othe Assesment ye) opens wry ene hati desig umercial tools like Nessus, " hase ‘A vulnerability management solution that includes vulnerability seaming and risk asessmest satarge ystems by sending SYN packets without completing the fll | thical Hacking an Scanning and Enumeration How Vulnerability Scanning Works ? + The scanning tool sends requests to the target system to identify open ports, series, and potenti ound along with recommended actions to mitigate orremediat them, ‘Types of Vulnerability Seans 41. Authenticated Scans: Conducted with valid credentials to assess vulnerabilities from an insider's perspective, providing a more comprehensive view. 2, Unauthenticated Scans: Perfrined without valld credentials focusing on external vulnerabilities that could be exploited without authentication. 4.5 _CEH Scanning Methodology 4, Reconnaissance Objective: Gather information about the target system or network “Techniques 1. Passive Reconnaissance: Collect Information without directly interacting with the target such a using public information sure Active Reconnaissance : Directly interact with the target. for example, by conducting DNS queries or network canning Scanning » “Objective: deny lve hosts, open pars and service on the target ‘Techniques 4. Network Scanning: Use tools ike Nmap to discover ive hosts and open port. | Vulnerabitity Scanning: Identify potential vulnerabilities using tools like Nessus or OpenVAS. Gaining Access » ‘Objective: Exploit vulnerabilities to gain unauthorized acces. ‘Techniques “+ aploitaton : Use known vulnerabilities to gain acess, for example, by explating weak passwords sofoeae vulnerabilities, or misonfgurations Maintaining Acess Objective: Establish 4 persistent presence on the targetsystem. Scanning and Brumeration “Techniques |. Backdoors: Install backdoors o rootkits oma 1 Privilege Escalation: Elevate privileges to gin 5. Analysis Objective : Collet and analyze data from the compromise system, “Techniques 1. Packet Sifiag: Capture and analyze network trafic to extract sensitive information iL LogAnalyss Review system logs fr evidence of unauthorized acess. 6 Covering Tracks (Objective: Hide evidence of the tack avd detection, Techniques |, LogDeletion; Delete or modilylog esto erase traces ofthe attack. AL Anthforease Toots: Use tools to manipulate or erase forensic evidence 7. Reporting Dbjecave Document findings and provide recommendations for securing the system. ‘Techniques + Report Generation: Creates dealed report outlining vulnerabilities exploits used, and recommendations forremedistion. cess even after inal exploitation. eve acess 46 Ping Sweep Techniques A ping sweep isa network reconnaissance technique used to discover live hosts within a speci IP address range. It involves sending JCMP Echo Request (png) messages to multiple IP addresses and analyzing the responses, to determine which hosts are activ. Mere are some common ping sweep techniques 1 Basie Ping Sweep ‘+ Description This involves sendingICMP Echo Request mesrages toa range of P addresses. (Command (Windows) fr /L9%6in (11.258) do @plng-n 1-100 292.1684.961 ‘+ Explanation : These commands use a loop to senda single ping to each IP addres in the specified range. ‘The-nand-< opdons control the numberof png packets and the-Wand-W options se the timeout. 2. ARP ing Sweep ‘Description : Involves sending ARP (Address Resolution Protocol) requests to discover live hosts ona local network Command (Windows) :arp-a ‘Command (Linx): arpscan—lcanet Explanation : These comman adresses fo devies onthe lo lay the ARP cache, sho wing the mapping of IP adresses to MAC e pping of IP aad w 46 Scanning and Enumeration sang end tnurerstion, 3. Custom Ping Sweep Tools ‘+ Description Various tots ae designed specially for ping sweeping and network discovery. + Examples: ‘Angry IP Scanner: cross-platform network scanner that can perform ping sweeps and other types of ping A fastand Neibe ping ike program with addtional features for blk scanning NetscanTools Pro: A comprehensive network toolkit that include a plng sweep feature 4. Nmap Ping Sweep ‘+ Description: Nmap, a powerful networc scanning tool, canbe used to perform ping sweeps + Comisand nmap so 192:1681.0/24 ‘+ Explanation :The-so option instructs Nmap to perform a ping scan without port scanning The IP adress range can be adjusted based onthe network being scanned 5. Multicast Ping Sweep ‘+ Description: Uslzes multicast ICMP Echo Request messages to discover host that upport multicast + Command (Linx) =ping-c3-b2240.0.1 ‘+ Explanation: The» option use to send multicast pings tothe specified multicast address, 4.6.1 Nmap Command Switches "Nmap is a powerful open-source network seanning tool that provides a wide range of options for probing and

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy