Ethical Hacking Fundamentals

Ethical Hacking Fundamentals

1. Hacking

   • Hacking in the field of computer security refers to exploiting system vulnerabilities and compromising security controls to gain unauthorized or inappropriate access to system resources.
   • Network hacking techniques include creating viruses and worms, performing denial-of-service (DoS) attacks, establishing unauthorized remote access connections to a device using Trojans or backdoors, creating botnets, packet sniffing, phishing, and password cracking.
   • Hacking on computer networks is generally done using scripts or other network programming.
   • A hacker is a person who breaks into a system or network without authorization to destroy, steal sensitive data, or perform malicious attacks.
   • Hacker Classes
     • Black Hat: Black hats are individuals who use their extraordinary computing skills for illegal or malicious purposes. This category of hacker is often involved in criminal activities.
     • White Hats: White hats or penetration testers are individuals who use their hacking skills for defensive purposes
     • Gray Hats: Gray hats are the individuals who work both offensively and defensively at various times. Gray hats might help hackers to find various vulnerabilities in a system or network and, at the same time, help vendors to improve products (software or hardware) by checking limitations and making them more secure.
     • Suicide Hackers: Suicide hackers are individuals who aim to bring down critical infrastructure for a “cause” and are not worried about facing jail terms or any other kind of punishment.
     • Script Kiddies: Script kiddies are unskilled hackers who compromise systems by running scripts, tools, and software developed by real hackers.
     • Cyber Terrorists: : Cyber terrorists are individuals with a wide range of skills who are motivated by religious or political beliefs to create the fear of large-scale disruption of computer networks.
     • State-Sponsored Hackers: State-sponsored hackers are skilled individuals having expertise in hacking and are employed by the government to penetrate, gain top-secret information from, and damage the information systems of other government or military organizations
     • Hacktivist: : Hacktivism is a form of activism in which hackers break into government or corporate computer systems as an act of protest. Hacktivists use hacking to increase awareness of their social or political agendas, as well as to boost their own reputations in both online and offline arenas
     • Hacker Team: A hacker team is a consortium of skilled hackers having their own resources and funding. They work together in synergy for researching state-of-the-art technologies.
     • Industrial Spies: Industrial spies are individuals who perform corporate espionage by illegally spying on competitor organizations. They focus on stealing critical information such as blueprints, formulas, product designs, and trade secrets.
     • Insiders: : An insider is any employee (trusted person) who has access to critical assets of an organization. An insider threat involves the use of privileged access to violate rules or intentionally cause harm to the organization’s information or information systems.
     • Criminal Syndicates: Criminal syndicates are groups of individuals or communities that are involved in organized, planned, and prolonged criminal activities. They exploit victims from distinct jurisdictions on the Internet, making them difficult to locate.
     • Organized Hackers: Organized hackers are a group of hackers working together in criminal activities. Such groups are well organized in a hierarchical structure consisting of leaders and workers.

2. Cyber Kill Chain

   • an efficient and effective way of showing how an attacker can harm an organization
   • helps organizations understand the various possible threats at every stage of an attack and the necessary countermeasures to defend against such attacks.
   • aims to actively enhance intrusion detection and response.
   • Cyberattacks occur in 7 phases
     • Reconnaissance
       • Ethical Hacking Fundamentals
       • An attacker performs reconnaissance to collect information and find weak spots
       • Info could be collected from a network, visiting a site, or a public website
     • Delivery
       • The delivery stage included creating a weapon. Itspayload is transmitted to the intended victim(s) as an email attachment,via a malicious link on websites,orthrougha vulnerable web application or USB drive
       • key stage that measures the effectiveness of the defense strategies implemented by the target organization based on whether the intrusion attempt of the adversary is blocked or not.
       • EX: SENDING the phishing email or distributing USB's with viruses
     • Command and Control
       • The adversary creates a command and control channel, which establishes two-way communication between the victim’s system and adversary-controlled server to communicate and pass data back and forth.
       • Hides evidence of compromise and leverages channels
     • Actions on Objectives
       • The adversary controls the victim’s system from a remote location and finally accomplishes their intended goals
       • The adversary can now use this network as a launch point for other attacks.
     • Weaponization
       • The adversary analyzes the data collected in the previous stage to identify thevulnerabilities and techniques that canexploit and gain unauthorized access to thetarget organization
       • The attacker creates a weapon used to that can carry out an attack, like a virus, or a phishing email
     • Exploitation
       • exploitation triggers the adversary’s malicious code to exploit a vulnerability in the operating system, application, or server on a target system
       • At this stage, the organization may face threats such as authentication and authorization attacks, arbitrary code execution, physical security threats, and security misconfiguratio
     • Installation
       • The adversary downloads and installs more malicious software on the target system to maintain access to the target network. Creates a backdoor access.
       • This phase includes obtaining access, hiding access, and maintaining access

3. Tactics, Techniques, Procedures

   • Tactics
     • the guidelines that describe the way an attacker performs the attackfrom beginning to the end
     • consists of the various tactics used to gather information for theinitial exploitation, perform privilege escalation and lateral movement, and deploy measures for persistence access to the system
   • Techniques
     • the technical methods used by an attackerto achieve intermediate results during the attack
     • hese techniques include initial exploitation, setting up and maintaining command and control channels, accessing the target infrastructure, and covering thetracks of data exfiltration
   • Procedures
     • organizational approaches that threat actors followto launch an attack
     • involve a sequence of actions performed by the threat actors toexecutedifferent steps of an attack life cycle.
   • Adversary Behavioral Identification
     • involves the identification of the common methods or techniques followed by an adversary to launch attacks to penetrate an organization’s network.
     • gives security professionals insight into upcoming threats and exploits and elps them plan network security infrastructure and adapt a range of security procedures as prevention against various cyberattacks.
     • Types of Behaviors
       • Command and Control Server
         • Attackers use command and control servers to talk to a system remotely through encrypted sessions. Using this channel. they can steal data, delete data, and launch other attacks. This can be detected by finding the presence of a command and control server by tracking network traffic for anomalies.
       • Use of Web Shell
         • An attacker uses a web shell to manipulate the web server by creating a shell within a website.. It allows attackers to gain remote access to the functions of the server in order to extract data and upload files. This can be identified by analyzing server access, error logs, suspicious strings, and user agent strings.
       • HTTP User Agent
         • the server identifies the connected HTTP client using the user agent field. An adversary modifies the content of the HTTP user agent field to communicate with the compromised system and to carry further attacks. This can be stopped by checking the content of the user agent field.
       • Unspecified Proxy Activities
         • An adversary can create and configuremultiple domains pointing to the same host,thus, allowing an adversary to switch quickly between the domains to avoid detection. You can check the data feeds generated by domains to find malicious files and unsolicited communications.
       • Internal Reconnaissance
         • Once the adversary is inside the target network, they enumerate systems, hosts, processes and execute various commands to find out info about the target. You can monitor what hackers do in this process by checking for unusual commands executed.
       • Data Staging
         • AN attacker can use data staging techniques to collect as much data as possible. Security professional can detect thing by monitoring network traffic and monitoring file integrity,
       • Use of Command-Line Interface
         • Once an attacker has access to a target system, they can use the command line interface to interact with the system, browse through files, read file content, modify files, create accounts, and download malicious code. You can identify this behavior by checking the logs for process ID, processes having arbitrary letters and numbers, and looking for any malicious files.
       • Use of PowerShell
         • Can be used by an adversary as a tool for automating data exfiltration and launching further attacks. Security professionals can check PowerShell's transcript logs in order to identify any misuse. Can be used to find IP's of attackers.
       • Use of DNS Tunneling
         • Attckers use DNS tunneling to hide malicious traffic in the legitimate traffic carried by common protocols used in the network. Using DNS Tunneling, an attacker can also communicate with the command and control server, bypass security controls, and perform data exfiltration. This can be identified by analyzing malicious DNS requests, DNS payload, and destinations of DNS requests.

4. Indicators of Compromise

   • IoCs act as a good source of information about threats that serve as data points in the intelligence process
   • Cybersecurity professionals use various automated tools to monitor IoCs to detect and prevent various security breaches to the organization. Monitoring IoCs also helps security teams enhance the security controls and policies of the organization to detect and block suspicious traffic to thwart further attacks
   • Categories of Indicators of Compromise
     • Email Indicators
       • Used to send malicious data to the target organization or individual
       • Examples include the sender’s email address, email subject, and attachments or links
     • Network Indicators
       • seful for command and control, malware delivery, identifying the operating system, and other tasks
       • Examples include URLs, domain names, and IP addresses
     • Host-Based Indicators
       • Found by performing an analysis of the infected system within the organizational network
       • Examples include filenames, file hashes, registry keys, DLLs, and mutex
     • Behavioral Indicators
       • Used to identify specific behavior related to malicious activities
       • Examples include document executing PowerShell script, and remote command execution
     • Key Indicators
       • Unusual outbound network traffic
       • Unusual activity through a privileged user account
       • Illegitimate files and software
       • Geographical anomalies
       • Multiple login failures
       • Increased database read volume
       • Suspicious registry or system file changes
       • Unusualusage of ports and protocols
       • Mismatched port-application traffic
       • Multiple requests for the same file
       • Large HTML response size
       • Unusual DNS requests
       • Malicious Emails
       • Unexpected patching of systems
       • Signs of Distributed Denial-of-Service(DDoS)activity
       • Service interruption and the defacement
       • Bundles of data inthewrong places
       • Web traffic with superhuman behavior
       • A drastic increase in bandwidth usage
       • Malicious hardware

5. Hacking Cycle

   • It is important for such security professionals to gain knowledge on various hacking phases, which will help them in analyzing and strengthening the security posture of the organization from various cyber threats.
   • 5 phases of hacking
     • Reconnaisance
       • Reconnaissance refers to the preparatory phase in which an attacker gathers as much information as possible about the target prior to launching the attack. In this phase, the attacker draws on competitive intelligence to learn more about the target.
       • Part of this reconnaissance may involve social engineering. A social engineer is a person who convinces people to reveal information such as unlisted phone numbers, passwords, and other sensitive information
       • Another reconnaissance technique is dumpster diving. Dumpster diving is, simply enough, looking through an organization’s trash for any discarded sensitive information. Attackers can use the Internet to obtain information such as employees’ contact information, business partners, technologies currently in use, and other critical business knowledge.
       • Reconnaisance Types
         • Active reconnaissance techniques, on the other hand, involve direct interactions with the target system by using tools to detect open ports, accessible hosts, router locations, network mapping, details of operating systems, and applications. Attackers use active reconnaissance when there is a low probability of the detection of these activities.
         • When an attacker is using passive reconnaissance techniques, they do not interact with the target directly. Instead, the attacker relies on publicly available information, news releases, or other no-contact methods
     • Scanning
       • Scanning is the phase immediately preceding the attack. Here, the attacker uses the details gathered during reconnaissance to scan the network for specific information. Scanning is a logical extension of active reconnaissance, and in fact, some experts do not differentiate scanning from active reconnaissance
       • Port scanners detect listening ports to find information about the nature of services running on the target machine
       • The most commonly used tools are vulnerability scanners, which can search for thousands of known vulnerabilities on a target network. This gives the attacker an advantage because he or she only has to find a single means of entry, while the systems professional has to secure as much vulnerability as possible by applying patches.
     • Gaining Access
       • Attackers use vulnerabilities identified during the reconnaissance and scanning phases to gain access to the target system and network. Gaining access refers to the point where the attacker obtains access to the operating system or to applications on the computer or network.
       • Attackers gain access to the target system locally (offline), over a LAN, or the Internet. Examples include password cracking, stack-based buffer overflows, denial-of-service, and session hijacking.
       • A hacker’s chances of gaining access to a target system depend on several factors such as the architecture and configuration of the target system, the skill level of the perpetrator, and the initial level of access obtained
     • Maintaining Access
       • Maintaining access refers to the phase when the attacker tries to retain his or her ownership of the system. Once an attacker gains access to the target system with admin or root-level privileges (thus owning the system), they can use both the system and its resources at will.
       • Attackers who choose to remain undetected remove evidence of their entry and install a backdoor or a Trojan to gain repeat access.
       • Attackers can upload, download, or manipulate data, applications, and configurations on the owned system and can also use Trojans to transfer usernames, passwords, and any other information stored on the system
     • Clearing Tracks
       • Clearing tracks refers to the activities carried out by an attacker to hide malicious acts. The attacker’s intentions include continuing access to the victim’s system, remaining unnoticed and uncaught, and deleting evidence that might lead to their own prosecution
       • Other techniques include steganography and tunneling. Steganography is the process of hiding data in other data, for instance, in image and sound files
       • Tunneling takes advantage of the transmission protocol by carrying one protocol over another.

6. Ethical Hacking Concepts

   • Ethical hacking is the practice of employing computer and network skills in order to assist organizations in testing their network security for possible loopholes and vulnerabilities.
   • Nowadays, most organizations (such as private companies, universities, and government organizations) are hiring White Hats to assist them in enhancing their cybersecurity. They perform hacking in ethical ways, with the permission of the network or system owner and without the intention to cause harm.
   • Ethical hacking involves the use of hacking tools, tricks, and techniques typically used by an attacker to verify the existence of exploitable vulnerabilities in system security.
   • Ethical hacking is a structured and organized security assessment, usually as part of a penetration test or security audit, and is a crucial component of risk assessment, auditing, counter fraud, and information systems security best practices.
   • The ethical hacker must follow certain rules to fulfill their ethical and moral obligations. They must do the following:  Gain authorization from the client and have a signed contract giving the tester permission to perform the test.  Maintain confidentiality when performing the test and follow a Nondisclosure Agreement (NDA) with the client for the confidential information disclosed during the All Rights Reserved. Reproduction is Strictly Prohibited. Ethical Hacking Essentials Copyright © by EC-Council Ethical Hacking Essentials Exam 112-52 Ethical Hacking Fundamentals Module 02 Page 75 test. The information gathered might contain sensitive information, and the ethical hacker must not disclose any information about the test or the confidential company data to a third party.  Perform the test up to but not beyond the agreed-upon limits. For example, ethical hackers should perform DoS attacks only if they have previously agreed upon this with the client. Loss of revenue, goodwill, an

7. Ethical Hacking Tools

   • Google hacking refers to the use of advanced Google search operators for creating complex search queries to extract sensitive or hidden information.
   • Advanced Google hacking refers to the art of creating complex search engine queries. Queries can retrieve valuable data about a target company from Google search results. Through Google hacking, an attacker tries to find websites that are vulnerable to exploitation.
   • Google search operators
     • site: This operator restricts search results to the specified site or domain
     • allinurl: This operator restricts results to only the pages containing all the query terms specified in the URL.
     • inurl: This operator restricts the results to only the pages containing the specified word in the URL.
     • allintitle: This operator restricts results to only the pages containing all the query terms specified in the title.
     • intitle: This operator restricts results to only the pages containing the specified term in the title.
     • inanchor: This operator restricts results to only the pages containing the query terms specified in the anchor text on links to the page.
     • allinanchor: This operator restricts results to only the pages containing all query terms specified in the anchor text on links to the pages.
     • cache: This operator displays Google's cached version of a web page instead of the current version of the web page.
     • link: This operator searches websites or pages that contain links to the specified website or page.
     • Note: According to Google’s documentation, “you cannot combine a link: search with a regular keyword search.”
     • related: This operator displays websites that are similar or related to the URL specified
     • info: This operator finds information for the specified web page.
     • location: This operator finds information for a specific location.
     • Filetype: This operator allows you to search for results based on a file extension.
   • Reconnaissance Tools
     • Reconnaissance tools are used to collect basic information about target systems to exploit them. Information collected by the footprinting tools includes the target’s IP location information, routing information, business information, address, phone number and social security number, details about a source of an email and a file, DNS information, domain information, and so on.
     • Web Data Extractor
       • Web Data Extractor automatically extracts specific information from web pages. It extracts targeted contact data (email, phone, and fax) from the website, extracts the URL and meta tags (title, description, keyword) for website promotion, searches directory creation, performs web research, and so on.
     • Whois Lookup
       • Whois services such as https://whois.domaintools.com or https://www.tamos.com can help to perform Whois lookups
     • ICMP Traceroute
       • Follows path of pings
     • TCP Traceroute
       • Tracks website ping path
     • Nmap
       • A security scanner for network exploration and hacking
     • MegaPing
       • MegaPing security scanner provides the following information: NetBIOS names, Configuration info, open TCP and UDP ports, Transports, Shares, Users, Groups, Services, Drivers, Local Drives, Sessions, and Remote Time of Date, Printers.
     • Unicornscan
       • In Unicornscan, the OS of the target machine can be identified by observing the TTL values in the acquired scan result
     • Nbtstat
       • Nbtstat is a Windows utility that helps in troubleshooting NETBIOS name resolution problems. The nbtstat command removes and corrects preloaded entries using several case-sensitive switches
     • NetBIOS Enumerator
       • NetBIOS Enumerator is an enumeration tool that shows how to use remote network support and to deal with some other web protocols, such as SMB