IA - Ethical Hacking Flashcards
is a state of well-being of information and infrastructures in which the possibility of successful yet undetected theft, tampering, and disruption of information and services is kept low or tolerable
Security
identification and assurance of the origin of information.
Authenticity
refers to the trustworthiness of data or resources in terms of preventing improper and unauthorized changes
Integrity
the concealment of information or resources
Confidentiality
refers to the ability to use the information or resource desired
Availability
person who enjoys learning the details of computer systems and stretch their capabilities.
hacker
describes the rapid development of new programs or the reverse engineering of already existing software to make the code better, and efficient
hacking
refers to a person who uses his hacking skills for offensive purposes.
cracker
refers to security professionals who apply their hacking skills for defensive purposes
ethical hacker
- An action or event that might prejudice security
- potential violation of security
Threat
Existence of a weakness, design, or implementation error that can lead to an unexpected, undesirable event compromising the security of the system.
Vulnerability
An IT system, product, or component that is identified/subjected as requiring security evaluation.
Target of Evaluation
- An assault on system security that derives from an intelligent threat.
- any action that violates security.
Attack
A defined way to breach the security of an IT system through vulnerability.
Exploit
can be defined as a legal and authorized attempt to locate and successfully exploit computer systems for the purpose of making those systems more secure.
Penetration testing
- The process includes probing for vulnerabilities as well as providing proof of concept attacks to demonstrate the vulnerabilities are real.
- testing always ends with specific recommendations for addressing and fixing the issues that were discovered during the test.
- find security issues by using the same tools and techniques as an attacker. These findings can then be mitigated before a real hacker exploits them.
Penetration Testing
Penetration testing is also known as
- pen testing
- pt
- ethical hacking’
- hacking
- white hat hacking
- offensive security
- red teaming
The first and simplest way to differentiate between white hats and black hats is
authorization
The second way to differentiate between an ethical hacker and a malicious hacker is through examination of the attacker’s
motivation
to provide the organization a realistic attack simulation so that the company can improve its security through early discovery and mitigation of vulnerabilities, the attacker should be considered a white hat.
intent
Differentiate Ethical from Malicious Hacker?
- authorization
- motivation
- intent
What Does a Malicious Hacker Do
1.recoinnaissance
2.scanning
3. gaining access
4. maintaining access
5. covering tracks
refers to the preparatory phase where an attacker seeks to gather as much information as possible about a target of evaluation prior to launching an attack. It involves network scanning either external or internal without authorization
Reconnaissance
refers to pre-attack phase when the hacker scans the network with specific information gathered during reconnaissance.
scanning
- refers to the true attack phase.
- The hacker exploits the system.
gaining access
- refers to the phase when the hacker tries to retain his ‘ownership’ of the system.
- The hacker has exploited a vulnerability and can tamper and compromise the system.
maintaining access
- refers to the activities undertaken by the hacker to extend his misuse of the system without being detected.
- Reasons include need for prolonged stay, continued use of resources, removing evidence of hacking, avoiding legal action etc.
- Hackers can remain undetected for long periods or use this phase to start a fresh reconnaissance
Covering Tracks
- Individuals with extraordinary computing skills, resorting to malicious or destructive activities. Also known as ‘Crackers.’
- Reformed crackers
First-hand experience
Lesser credibility perceived
Black hats
- Individuals professing hacker skills and using them for defensive purposes. Also known as ‘Security Analysts’.
- Independent security consultants (maybe groups as well)
Claims to be knowledgeable about black hat activities
White Hats
- Individuals who work both offensively and defensively
- Part of ICT firms
Good credentials
gray hats
- hacking with / for a cause’.
- Comprises of hackers with a social or political agenda
- Aims at sending across a message through their hacking activity and gaining visibility for their cause and themselves.
hacktivism
Ethical hackers tries to answer
- What can the intruder see on the target system? (Reconnaissance and Scanning phase of hacking)
- What can an intruder do with that information? (Gaining Access and Maintaining Access phases)
- Does anyone at the target notice the intruders attempts or success? (Reconnaissance and Covering Tracks phases)
Skill Profile of an Ethical Hacker
- Computer expert adept at technical domains.
- In-depth knowledge about target platforms (such as windows, Unix, Linux).
- Exemplary knowledge in networking and related hardware / software.
- Knowledgeable about security areas and related issues – though not necessarily a security professional.
There are five e-Business certification tracks under EC-Council Accreditation body:
- Certified e-Business Associate
- Certified e-Business Professional
- Certified e-Business Consultant
- E++ Certified Technical Consultant
- Certified Ethical Hacker
Any security evaluation involves three components
- preparation
- conduct
- conclude
In this phase, the evaluation technical report is prepared based on testing potential vulnerabilities.
Conduct
In this phase, a formal contract is signed that contains a non-disclosure clause as well as a legal clause to protect the ethical hacker against any prosecution that he may attract during the conduct phase. The contract also outlines infrastructure perimeter, evaluation activities, time schedules and resources available to him.
Preparation
In this phase, the results of the evaluation is communicated to the organization / sponsors and corrective advise / action is taken if needed.
Conclusion
Modes of Ethical Hacking
- Remote network
- Remote dial-up network
- Local network
- Stolen equipment
- Social engineering
- Physical entry
This mode attempts to simulate an intruder launch an attack over the Internet.
Remote network
This mode attempts to simulate an intruder launching an attack against the client’s modem pools.
Remote dial-up network
This mode simulates an employee with
legal access gaining unauthorized access over the local network.
Local network
This mode simulates theft of a critical information resource such as a laptop owned by a strategist, (taken by the client unaware of its owner and given to the ethical hacker).
Stolen equipment
This aspect attempts to check the integrity of the organization’s employees
Social engineering
This mode attempts to physically compromise the organization of ICT infrastructure
Physical entry
Security testing can be conducted using one of two approaches
- black box
- white box
with no prior knowledge of the infrastructure to be tested
Black-box
with a complete knowledge of the network infrastructure
White-box
is also known as Gray-box testing and this examines the extent of access by insiders within the network
Internal Testing
Deliverables
- Ethical Hacking Report
- Details the results of the hacking activity
- Vulnerabilities are detailed and avoidance measures suggestedIssues to consider
- the blueprinting of the security profile of an organization, undertaken in a methodological manner.
- one of the three pre-attack phases. The others are scanning and enumeration.
- results in a unique organization profile with respect to networks
Footprinting
- is a program to query Internet domain name servers. Displays information that can be used to diagnose Domain Name System (DNS) infrastructure
- Helps find additional IP addresses if authoritative DNS is known from whois
- MX record reveals the IP of the mail server
Nslookup
- works by exploiting a feature of the Internet Protocol called TTL, or Time To Live
- reveals the path IP packets travel between two systems by sending out consecutive UDP packets with ever-increasing TTLs
Traceroute
Information Gathering Methodology
- Unearth initial information
- Locate the network range
- Ascertain active machines
- Discover open ports / access points
- Detect operating systems
- Uncover services on ports
- Map the Network
Unearthing Initial Information:
Commonly includes
- Domain name lookup
- Locations
- Contacts
Unearthing Initial Information:
Information Sources
Open source
Whois
Nslookup
Hacking Tool:
Sam Spade
Locate the Network Range
Commonly includes:
1. Finding the range of IP addresses
1. Discerning the subnet mask
Information Sources:
1. ARIN (American Registry of Internet Numbers)
1. Traceroute
Hacking Tool:
1. NeoTrace
1. Visual Route
- allows search on the who is database to locate information on networks autonomous system numbers (ASNs), network-related handles and other related point of contact (POC).
- whois allows querying the IP address to help find information on the strategy used for subnet addressing.
ARIN
- useful network information utility that allows you to find out all available information about an IP address, host name, or domain, including country, state or province, city, name of the network provider, administrator and technical support contact information
- can find the information about a computer located in any part of the world
SmartWhois
provides high level views as well as detailed and historical views that provide traffic information in real-time or on a historical basis.
VisualLookout
e-mail analysis tool that enables analysis of an e-mail and its headers automatically and provides graphical results
eMailTrackerPro
is a tracking service that allows the user to track when his mail was read, for how long and how many times
Mail Tracking
can reveal public information of a domain that can be leveraged further
Whois, ARIN
can be used to target specific IP and later for IP spoofing.
Traceroute and mail tracking
can reveal specific users and zone transfers can compromise DNS security
Nslookup
