Scribd Logo
Upload

Welcome to Scribd!

  • 107 views

    EH-Basic Hacking Techniques

    Uploaded by

    زياد بوزيري
    This document discusses basic hacking techniques and the hacking process. It describes the different types of hackers and layers they may target, including the social, network, software, and physical layers. The document outlines the typical steps in the hacking process, including footprinting, enumeration, planning, and execution. It provides examples of attacks at each layer and discusses issues like man-in-the-middle attacks, DNS poisoning, and challenges with penetration testing.

    Copyright:

    © All Rights Reserved
    Download as PPT, PDF, TXT or read online from Scribd

    EH-Basic Hacking Techniques

    Uploaded by

    زياد بوزيري
    107 views18 pages
    This document discusses basic hacking techniques and the hacking process. It describes the different types of hackers and layers they may target, including the social, network, software, and physical layers. The document outlines the typical steps in the hacking process, including footprinting, enumeration, planning, and execution. It provides examples of attacks at each layer and discusses issues like man-in-the-middle attacks, DNS poisoning, and challenges with penetration testing.

    Original Description:

    EH-Basic Hacking Techniques

    Copyright

    © © All Rights Reserved

    Available Formats

    PPT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses basic hacking techniques and the hacking process. It describes the different types of hackers and layers they may target, including the social, network, software, and physical layers. The document outlines the typical steps in the hacking process, including footprinting, enumeration, planning, and execution. It provides examples of attacks at each layer and discusses issues like man-in-the-middle attacks, DNS poisoning, and challenges with penetration testing.

    Copyright:

    © All Rights Reserved
    Download as PPT, PDF, TXT or read online from Scribd
    Download as ppt, pdf, or txt
    107 views18 pages

    EH-Basic Hacking Techniques

    Uploaded by

    زياد بوزيري
    This document discusses basic hacking techniques and the hacking process. It describes the different types of hackers and layers they may target, including the social, network, software, and physical layers. The document outlines the typical steps in the hacking process, including footprinting, enumeration, planning, and execution. It provides examples of attacks at each layer and discusses issues like man-in-the-middle attacks, DNS poisoning, and challenges with penetration testing.

    Copyright:

    © All Rights Reserved
    Download as PPT, PDF, TXT or read online from Scribd
    Download as ppt, pdf, or txt
    of 18

    Basic Hacking Techniques

    Michael Jones

    Review
    All computer systems are under attack
    from inside and outside
    Security = countermeasures and
    mitigations
    White hat hackers are testing security
    with permission
    Grey hat hackers claim to test security
    for the common good
    Black hat hackers aim to reach security
    for profit or other gain
    Michael Jones

    Basic Hacking Techniques

    The Hacking Stack


    Social Layer
    Application Layer
    Application Software Layer
    Systems Software Layer
    Transport Layer
    Physical Layer

    Michael Jones

    Basic Hacking Techniques

    The Hacking Process


    Classic experimental method
    Steps
    Footprinting
    Mapping the landscape

    Enumeration
    Mapping in detail

    Planning
    Identifying the where, when, how, how long

    Execution
    Analysis & evaluation

    The importance of documentation


    Michael Jones

    Basic Hacking Techniques

    Layer Selection
    Footprinting and enumeration may
    occur at more than one level
    Selection of layer will depend on:
    Nature of targets security
    Skills available
    Time available
    Nature of attack

    Michael Jones

    Basic Hacking Techniques

    Physical Layer Attacks


    Examples:
    Keyloggers
    Dumpster diving
    Analysing shredded paper
    Cameras and listening devices
    Supplied equipment (e.g., laptops,
    picture frames)

    Limited attack surface width


    Michael Jones

    Basic Hacking Techniques

    Network Layer Attacks


    Classic hacker territory
    Alternatives
    Intrusion
    Denial of service
    Combination

    Disaster recovery vulnerabilities


    invasive enumeration

    Michael Jones

    Basic Hacking Techniques

    Systems Software Attacks


    Example targets:
    Operating systems
    Routers
    Hardware devices

    Attack mechanisms
    Viruses, trojans

    Michael Jones

    Basic Hacking Techniques

    Attacks on Applications
    Examples:
    Word macros
    VBA in general
    JavaScript in PDF etc.

    Exploiting the interface between


    applications and systems software

    Michael Jones

    Basic Hacking Techniques

    Social Layer

    Social engineering
    Short or long term (sleepers)
    Blackmail or grooming
    Grooming
    one sided develop trust between
    mark and attackers
    two sided also reduce trust between
    mark and his/her support network

    Michael Jones

    Basic Hacking Techniques

    10

    Targets: CIA, CAIN, and


    PANIC
    Hackers aim to disrupt or circumvent
    one or more of the main elements of
    security:
    C Confidentiality
    A Availability
    I Integrity
    N Non-repudiation
    P Privacy
    Michael Jones

    Basic Hacking Techniques

    11

    Non-repudiation
    Critical in electronic commerce
    Sender cannot deny (repudiate)
    sending a message
    Receiver cannot repudiate having
    received a message
    NOTE: potential for message to be
    sent multiple times

    Michael Jones

    Basic Hacking Techniques

    12

    Case study: Man-in-themiddle


    Attack compromises the
    communication channel between
    sender and receiver
    By exploiting the trust the parties
    have in the communication, the
    attacker can compromise any
    element of the CAIN elements
    Can be achieved at any of the layers
    Michael Jones

    Basic Hacking Techniques

    13

    Case study: DNS Poisoning


    Attacker compromises Domain Name
    Server to re-route requests to a
    malicious site
    By persuading the server that the target
    IP address has changed

    Could be a variation of man-in-themiddle


    If some communication with actual site
    is maintained
    Michael Jones

    Basic Hacking Techniques

    14

    Planning Pen(etration) Tests


    Methodologies
    Open Source Security Testing
    Methodology Manual (OSSTMM)
    National Institute of Standards and
    Technology (NIST): guideline on
    Information Security Testing and
    Assessment

    Issues
    Rules of engagement, handling reporting
    Michael Jones

    Basic Hacking Techniques

    15

    OSSTMM Categories
    Vulnerability
    Affects access

    Weakness
    Affects interactivity controls, e.g.,
    authentication

    Concern
    Affects one or more of PANIC principles

    Exposure
    Increase of visibility

    Anomaly
    Other
    Michael Jones

    Basic Hacking Techniques

    16

    Diagnostics
    Gathering data about the processes
    and procedures
    What worked and why
    What did not work and why
    Problems:
    Accuracy of documentation
    Completeness of documentation
    Time involved
    Motivation
    Michael Jones

    Basic Hacking Techniques

    17

    Summary
    Ethical hackers conduct pen(etration)
    tests
    Black hat hackers simply attack
    Issue: handling mitigations
    Compare with: fire drills
    How realistic can these be if they are
    planned?
    What if not planned and an irreversible
    change has taken place?
    Michael Jones

    Basic Hacking Techniques

    18

    You might also like