Introduction to Ethical Hacking pdf file

learning purpose

1. Introduction to Ethical Hacking
©Great Learning. All Rights Reserved. Unauthorized use or distribution prohibited

2. What is Hacking?
©Great Learning. All Rights Reserved. Unauthorized use or distribution prohibited

3. What is Hacking ?
Ethical Hackingisthe protection of inter-connectedsystems,
includinghardware, softwareanddata, fromcyberattacks.
White Hat HackerGrey Hat HackerBlack Hat Hacker

4. Computer Security Threats
•Computer Virus
•Computer Worm
•Scareware
•Key logger
•Adware
•Malware
•Backdoor
•Trojan
•Ransomware
•Spyware

5. Goals of ethical Hacking
•Protect the privacy of an Organization
•Transparently report all the identified bugs/weaknesses/vulnerabilities to
t
he organization.
•Inform the vendors about the security measures and patches.

6. Skills Required by Ethical Hackers
Operating
Systems
Programming
Languages
Networking

7. Tools Used by Ethical Hackers

8. Process of Ethical Hacking
Reconnaissance
Maintaining Access
Scanning
Gaining Access
Reporting
Clearing Tracks

9. Reconnaissance
Thisisthefirststepof hacking. Itisalso calledasFoot printingand
informationgathering phase.Thisisthepreparatoryphasewhere
wecollect asmuchas informationas possible about these the
target.Weusually collectinformationabout three groups:
•Network
•Host
•PeopleI

10. Scanning
Three typesofscanningareinvolved:
Portscanning: This phaseinvolvesscanning thetarget forthe
informationlikeopenports,livesystems,variousservices running
onthe host.
VulnerabilityScanning: Checking thetarget fortheweakness or
vulnerabilitieswhichcanbeexploited.Usuallydonewiththe helpof
automatedtools.
NetworkMapping: Finding thetopology of network, routers,
firewallsserversifany,and hostinformationand drawinganetwork
diagramwiththeavailable information.Thismap mayserveasa
valuablepiece ofinformation.Thismap mayserve asavaluable
pieceof informationthroughout the hackingprocess.

11. Clearing Tracks
Nothiefwantstoget caught.Anintelligenthacker always clearsall
the evidencesothatinlaterpointoftime,no onewillfind anytraces
leadingtohim.Thisinvolvesmodifying/corrupting/deleting the
values oflogs,modifyingregistryvaluesand uninstallingallthe
applications he used and deletingallfoldershecreated.

12. Demonstration
©Great Learning. All Rights Reserved. Unauthorized use or distribution prohibited

13. Ethical Hacking Across Domains
Atit’score,Ethical Hacking occupiesaprominentroleinvarious
verticalssuchas:
•WebA

•MobileA

•Andma
…

14. Web Application Domain
TwoMajorCategories:
•Clients

•Servers

Allattackscanbecategorizedintro3majorattacks:
•ParameterT
ampering
•Unvalidatedi
nputs
•DirectoryT
Attacks

15. Web Application Domain
ClientDatabaseServer Application Server
example.com
Attacker

16. Web Application Domain
login Name: <script>alert("You are hacked")</script> Login Password:
login Name: 'Union select * from users'
Login Password:
login Name: <iframe src="....org"></iframe>
Login Password:

17. Common Web Application attacks
•InjectionF eg.SQLinjection,HTMLinjection,etc.
•Crosss
Scriptingeg.Reflected,Stored,etc.
•WebS
Attackseg.DNSCachePoising,Fileuploadsetc.

18. Web Application Domain
login: <script>alert(document.cookie)</script>
password:
subscribe:
email: <script>code to mail him user information</script>

19. Hacking Methodology
•WebF –GatheringInformation
•Vulnerability S
canners– w3af,Acunetix
•Identify E
Points andAttacksurface

20. Example : SQL injections
Victim
Attacker
Server
Select * from users where user_id=‘admin’ and
password=‘shadow’
Select * from users where user_id=‘blah’ or 1= 1-- and password=‘anything’

21. Mobile Domain
TheMobile Devicehas becomeaninseparable part oflifetoday.
Theattackersareeasilyabletocompromisethemobilenetwork
becauseofvariousvulnerabilities,themajority oftheattacksare
because ofthe untrusted apps.Themainoperatingsystemsused
are:
•Android
•IOS
•Windows
•Blackberry

22. ©Great Learning. All Rights Reserved. Unauthorized use or distribution prohibited
Example: Android
Libraries
Applications
Application Framework
Linux Kernel
Android Runtime

23. Types of Android Attacks
•UntrustedAPKs
•SMS
•Email
•Spying
•App s

•Rooting

24. Example: Tap Jacking

25. Network Domain
Anetworkisanattempt togain unauthorised accesstoan
organisation’s network,withtheobjective ofstealing dataorperform
othermaliciousactivity.Therearetwomaintypesof networkattacks:
•Passive:A
gainaccesstoanetworkandcan monitor or
stealsensitiveinformation,but withoutmakingany changetodata,
leavingitintact.
•Active:A
not only gainunauthorisedaccessbutalsomodify
data,eitherdeleting, encryptingorotherwiseharmingit.

26. Types of Network Attacks
Endpointattacks–gainingunauthorisedaccesstouserdevices,
servers orotherendpoints,typicallycompromisingthem by infecting
themwithmalware.
Malwareattacks–infectingITresourceswithmalware,allowing
attackerstocompromisesystems,steal dataanddo damage.These
alsoincluderansomwareattacks.
Vulnerabilities, exploitsandattacks–exploiting vulnerabilitiesin
softwareusedintheorganization,togainunauthorisedaccess,
compromiseorsabotagesystems.
Advanced persistentthreats–Thesearecomplexmulti-layeredthreats,
whichincludenetworkattacksbutalsootherattacktypes.

27. Ransomware
The WannaCryransomwareattackwasaMay2017worldwide
cyberattackby the WannaCryransomware cyrptoworm,which
targetedcomputers running the Microsoft Windowsoperating
systemby encrypting data anddemanding ransompaymentsinthe
Bitcoincryptocurrency.

28. Example : DDOS attack

29. Other Domains
•CloudC
•IOT
•Blockc

•Edge C

30. Demonstration –SQL injection
©Great Learning. All Rights Reserved. Unauthorized use or distribution prohibited

31. ©Great Learning. All Rights Reserved. Unauthorized use or distribution prohibited