Ethical Hacking Concepts

What is ethical hacking?

Ethical hacking is to evaluate the security of and identify vulnerabilities in target systems, networks or system infrastructure. which means hacking with good intentions also called as "White hats". Ethical hackers are security experts perform these assessments. The proactive work helps to improve an organization's security posture.

Why should we lean Ethical Hacking?

• To find out the ways we can get hack
• Test other systems to find vulnerabilities and report to the developers.
• Help Organizations to fix loopholes

Explain different kinds of Hackers?

Hackers can be classified into different categories such as white hat, black hat, and grey hat, Script Kiddies, Green Hat Hackers, Blue Hat Hackers, Red Hat Hackers based on their intent of hacking a system.

White Hat Hackers:

These type of hackers are also known as Ethical Hackers who’re professionals with expertise in cybersecurity. They never intent to harm a system. They hack the system from the loopholes part of penetration testing and vulnerability assessments. A White Hat hacker is any individual who will help protect the company from raising cyber crimes.

Black Hat Hackers:

These are also known as crackers, are those who hack in order to gain unauthorized access to a system and harm its operations or steal sensitive information. Black Hat hacking is always illegal because of its bad intent which includes stealing corporate data, violating privacy, damaging the system, blocking network communication. Their motive is Financial gain.

Grey Hat hackers 

They have all the skills of a Black and a White Hat hacker. The difference is, they don’t care about stealing from people, nor do they particularly want to help people. Instead, they like to play with systems and enjoy the challenge of finding loopholes, breaking protections and generally just find hacking fun. Grey Hat hackers will rarely do anything harmful. If the intention is for personal gain then the hacker is considered to be a gray hat hacker.

Script Kiddies

It is a known fact that half knowledge is always dangerous. The Script Kiddies are amateurs types of hackers in the field of hacking. They try to hack the system with scripts from other fellow hackers. They try to hack the systems, networks, or websites. The intention behind the hacking is just to get attention from their peers. Their motives is Causing chaos and disruption to the service.

One standard Kiddie Script attack is a DoS (Denial of Service) or DDoS attack (Distributed Denial of Service). This simply means that an IP address is flooded with too many excessive traffic that it collapses. It creates confusion and prevents someone else uses the service.

Green Hat Hackers

Green hat hackers are types of hackers who’re learning the ropes of hacking. They are slightly different from the Script Kiddies due to their intention. The intent is to strive and learn to become full-fledged hackers. They are looking for opportunities to learn from experienced hackers.

Blue Hat Hackers

Blue Hat Hackers are types of hackers who’re similar to Script Kiddies. The intent to learn is missing. They use hacking as a weapon to gain popularity among their fellow beings. Blue Hat Hackers are dangerous due to the intent behind the hacking rather than their knowledge.

Red Hat Hackers

They are the types of hackers who’re similar to white hackers. The red hat hackers intend to stop the attack of black hat hackers.

What is CIA triad?

CIA stands for confidentiality, integrity, and availability, otherwise known as the CIA triad. This "triad" can help guide the development of security policies for organizations.

Confidentiality. Ensuring only the correct, authorized users can view, access, change, or otherwise use data. Confidentiality is when private data remains private and is not seen by unauthorized entities. Organizations will commonly use encryption to ensure only authorized entities with access to the data can see it.

Integrity. Ensuring that the system and information is accurate and correct. Integrity is when an organization knows the data has not been manipulated by accident or by malicious actors.

Availability.  Ensuring that systems, information, and services are available the vast majority of time. 

Best practices for implementing the CIA triad?

Putting Confidentiality into Practice:

• Categorize data and assets being handled based on their privacy requirements. 
• Require data encryption and two-factor authentication to be basic security hygiene.
• Ensure that access control lists, file permissions and white lists are monitored and updated regularly.

Scoping Integrity

• Review all data processing, transfer and storage mechanisms. 
• Version control, data logs, granular access control, and checksums can be useful to enforce integrity. Hash functions can further prevent data corruption.
• Invest in a dependable backup and recovery solution; one that assures business continuity and quick data recovery in the event of a security or data breach.

Ensuring Availability

• Build preventive measures such as redundancy, failover. Make security audits routine. Auto-update or stay abreast of system, network, and application updates.
• Utilize detection tools such as network/server monitoring software and anti-virus solutions.
• Develop a Data Recovery and Business Continuity plan with detailed corrective measures in the event of data loss, including timely communication with customers

What are some of the standard tools used by ethical hackers?

To facilitate some manual tasks and speed up the hacking process, hackers can use a set of tools such as:

• Metasploit
• Wireshark
• NMAP
• Burp Suite
• OWASP ZAP
• Nikto
• SQLmap

what is payload?

A payload is a piece of malicious codes that carry important information that can be used to hack any device.

what is vulnerability?

Vulnerability is a loophole within an organization's information systems, internal controls, or system processes that can be exploited by cyberattackers.

what are the phases of ethical hacking?

There are mainly 5 phases in hacking.

• Reconnaissance
• Scanning
• Gaining Access
• Maintaining Access 
• Clearing Track

What is Reconnaissance?

This is the first step of Hacking. It is also called as Foot-printing and information gathering  Phase. We usually collect information about three groups - Network, Host and People involved.

Reconnaissance efforts broken up into two types: passive and active.

Active: Directly interacting with the target to gather information about the target.

Tools used in Active Recon  scanning: Nmap, Nessus, OpenVAS, Nikto, Metasploit 

Passive:  Collect the information about the target without directly accessing the target. This involves collecting information from social media, public websites etc.

Tools used in Passive recon scanning: Wireshark, Google Dorking, FindSubDomains.com, VirusTotal, Shodan

 What is scanning and what are some examples of the types of scanning used?

Scanning may be referred to as a set of procedures for identifying hosts, ports and the services attached to a network. There are three types of scannings are involved: - Port Scanning, Vulnerability Scanning, Network Mapping.

Port scanning: This phase involves scanning the target for the information like open ports, Live systems, various services running on the host.

Vulnerability Scanning: Checking the target for weaknesses or vulnerabilities which can be exploited. Usually done with help of security tools.

Network Mapping: Finding the topology of network, routers, firewalls servers if any, and host information. This map serve as a valuable piece of information throughout the hacking process.

What happens in Gaining Access phase?

In this phase attacker enter into a system and try to gain administrative privileges so that he can install an application he needs or modify data or hide data.

What happens in Maintaining Access phase?

Hacker maintains the connection in the background without the knowledge of the user. This can be done using Trojans, Rootkits or other malicious files. The aim is to maintain the access to the target until hacker finishes the tasks he planned to accomplish in that target. 

What is Clearing Track phase?

No hacker wants to get caught. Hacker always clears all evidence by deleting the logs or modify the registry so that no one will find any traces leading to him.

What is Exploitation?

It is a piece of programmed software or script which can allow hackers to take control over a system, exploiting its vulnerabilities. Hackers normally use vulnerability scanners like Nessus, Nexpose, OpenVAS, etc. to find these vulnerabilities.

What is pentesting?

A pentest is an ethical cyber security assessment conducted to identify, safely exploit and help eliminate vulnerabilities that reside across an organisation’s IT environment.

What is footprinting? What are the techniques used for footprinting?

Footprinting refers to accumulating and uncovering information about the target network before attempting to gain access.

Hacking techniques include:

Open source footprinting: This technique will search for administrator contact information, which can be later used for guessing the correct password in social engineering.

Network enumeration: This is when the hacker attempts to identify the domain names and network blocks of the targeted

Scanning: Once the network is known, the second step is to pry on the active IP addresses on the network.

Stack fingerprinting: This technique should be the final footprinting step that takes place once the port and host are mapped.

What is mitigation?

Mitigation is the reduction of something harmful or reducing the risk.  

what is honeypot? how it protects from attack?

A honeypot is a system designed to lure hackers into revealing their origins and techniques, and they're used by security researchers.

What is network sniffing?

Network sniffing involves using sniffer tools that enable real-time monitoring and analysis of data packets flowing over computer networks. Sniffers can be used for different purposes, whether it’s to steal information or manage networks. Network sniffing is used for ethical as well as unethical purposes. 

What is SQL injection and its types?

A SQL injection occurs when the application does not sanitize the user input. Thus a malicious hacker would inject SQL query to gain unauthorized access and execute administration operations on the database. SQL injections can be classified as follows:

• Error-based SQL injection
• Blind SQL injection
• Time-based SQL injection

What is cross-site scripting and its different variations?

Cross-site scripting (XSS) attacks are a type of injection where malicious scripts are injected into otherwise benign and trusted websites. XSS takes place when an attacker inserts a malicious payload, usually in the form of JavaScript code in a web form. XSS vulnerabilities are categorized as follows:

• Reflected cross-site scripting
• Stored cross-site scripting
• DOM-based cross-site scripting

Explain what is Brute Force Hack?

Brute force hack is a technique for the hacking password and get access to the system and network resources.

What is Phishing?

Phishing technique involves sending of  false emails, chats or website to the impersonate real system with aim of stealing information from the original website.

What is A Distributed Denial of Service (DDoS) attack?

DOS attacks involve flooding servers, systems or networks with traffic to cause over-consumption of victim resources. This makes it difficult or impossible for legitimate users to access or use targeted sites. One computer and one Internet connection is used to flood a targeted resource with packets.

What is  Denial of Service (DoS) attack?

DDoS attack uses many computers and many Internet connections, often distributed globally in what is referred to as a botnet. A large scale volumetric DDoS attack can generate a traffic measured in tens of Gigabits (and even hundreds of Gigabits) per second.

.

What are Botnets?

Attackers build a network of hacked machines which are known as botnets, by spreading malicious piece of code through emails, websites, and social media. Once these computers are infected, they can be controlled remotely, without their owners' knowledge, and used like an army to launch an attack against any target.

What is an Intrusion detection system (IDS) 

IDS is a device or software application that monitors a network or systems for malicious activity or policy violations

what is Intrusion prevention system?

An Intrusion Prevention System (IPS) is a network security/threat prevention technology that examines network traffic flows to detect and prevent vulnerability exploits.

White box vs black box vs grey box pen testing.

The amount of information shared prior to an engagement can have a huge influence on its outcomes. Testing style is usually defined as either white box, black box or grey box penetration testing.

White box penetration testing

White box penetration testing, sometimes referred to as crystal or oblique box pen testing, involves sharing full network and system information with the tester, including network maps and credentials. This helps to save time and reduce the overall cost of an engagement. A white box penetration test is useful for simulating a targeted attack on a specific system utilizing as many attack vectors as possible.

Black box penetration testing

In a black box penetration test, no information is provided to the tester at all. The pen tester in this instance follows the approach of an unprivileged attacker, from initial access and execution through to exploitation. This scenario can be seen as the most authentic, demonstrating how an adversary with no inside knowledge would target and compromise an organization. However, this typically makes it the costliest option too.

Grey box penetration testing

In a grey box penetration test, also known as a translucent box test, only limited information is shared with the tester. Usually this takes the form of login credentials. Grey box testing is useful to help understand the level of access a privileged user could gain and the potential damage they could cause. Grey box tests strike a balance between depth and efficiency and can be used to simulate either an insider threat or an attack that has breached the network perimeter.

Grey box testing is often favored by customers as the best balance between efficiency and authenticity, stripping out potentially time-consuming reconnaissance.