The Basics of Hacking and Penetration Testing

Ethical Hacking and Penetration Testing Made Easy

Patrick Engebretson

• Publisher: Syngress
• Year: 2011
• eBook ISBN: 9781597496568
• Topic: Ciencia de la computación
• Subtopic: Ciencias computacionales general

The Basics of Hacking and Penetration Testing serves as an introduction to the steps required to complete a penetration test or perform an ethical hack from beginning to end. This book makes ethical hacking and penetration testing easy – no prior hacking experience is required. It shows how to properly utilize and interpret the results of the modern-day hacking tools required to complete a penetration test. With a simple and clean explanation of how to effectively utilize these tools – as well as the introduction to a four-step methodology for conducting a penetration test or hack – the book provides students with the know-how required to jump start their careers and gain a better understanding of offensive security.The book is organized into 7 chapters that cover hacking tools such as Backtrack Linux, Google reconnaissance, MetaGooFil, dig, Nmap, Nessus, Metasploit, Fast Track Autopwn, Netcat, and Hacker Defender rootkit. Each chapter contains hands-on examples and exercises that are designed to teach learners how to interpret results and utilize those results in later phases. PowerPoint slides are available for use in class.This book is an ideal reference for security consultants, beginning InfoSec professionals, and students.- Named a 2011 Best Hacking and Pen Testing Book by InfoSec Reviews- Each chapter contains hands-on examples and exercises that are designed to teach you how to interpret the results and utilize those results in later phases.- Writen by an author who works in the field as a Penetration Tester and who teaches Offensive Security, Penetration Testing, and Ethical Hacking, and Exploitation classes at Dakota State University.- Utilizes the Backtrack Linus distribution and focuses on the seminal tools required to complete a penetration test.

Chapter 1. What Is Penetration Testing?

Information in This Chapter:

■ Introduction to Backtrack Linux: Tools. Lots of Tools

■ Working with Backtrack: Starting the Engine

■ The Use and Creation of a Hacking Lab

■ Phases of a Penetration Test

This chapter introduces the reader to the concept of penetration testing and ethical hacking. A formal methodology is introduced and explained. Information about Backtrack Linux is presented, which includes setting up a network connection and working with a terminal window. The use and creation of a penetration testing lab for completing and following along with the examples in this book is outlined. The chapter concludes with a summary and a look at the remaining chapters.

Keywords

Backtrack Linux, creating a hacking lab, penetration testing, penetration testing methodologies

Introduction

Penetration testing can be defined as a legal and authorized attempt to locate and successfully exploit computer systems for the purpose of making those systems more secure. The process includes probing for vulnerabilities as well as providing proof of concept (POC) attacks to demonstrate the vulnerabilities are real. Proper penetration testing always ends with specific recommendations for addressing and fixing the issues that were discovered during the test. On the whole, this process is used to help secure computers and networks against future attacks.

Penetration testing is also known as

■ Pen Testing

■ PT

■ Hacking

■ Ethical Hacking

■ White Hat Hacking

It is important to spend a few moments discussing the difference between penetration testing and vulnerability assessment. Many people (and vendors) in the security community incorrectly use these terms interchangeably. A vulnerability assessment is the process of reviewing services and systems for potential security issues, whereas a penetration test actually performs exploitation and POC attacks to prove that a security issue exists. Penetration tests go a step beyond vulnerability assessments by simulating hacker activity and delivering live payloads. In this book, we will cover the process of vulnerability assessment as one of the steps utilized to complete a penetration test.

Setting the Stage

Understanding all the various players and positions in the world of hacking and penetration testing is central to comprehending the big picture. Let us start by painting the picture with broad brush strokes. Please understand that the following is a gross oversimplification; however, it should help you see the differences between the various groups of people involved.

It may help to consider the Star Wars universe where there are two sides of the “force”: Jedis and Siths. Good vs. Evil. Both sides have access to an incredible power. One side uses its power to protect and serve, whereas the other side uses it for personal gain and exploitation.

Learning to hack is much like learning to use the force (or so I imagine!). The more you learn, the more power you have. Eventually, you will have to decide whether you will use your power for good or bad. There is a classic poster from the Star Wars Episode I movie that depicts Anakin as a young boy. If you look closely at Anakin’s shadow in the poster, you will see it is the outline of Darth Vader. Try searching the Internet for “Anakin Darth Vader shadow” to see it. Understanding why this poster has appeal is critical. As a boy, Anakin had no aspirations of becoming Darth Vader, but it happened nonetheless.

It is probably safe to assume that very few people get into hacking to become a super villain. The problem is that journey to the darkside is a slippery slope. However, if you want to be great, have the respect of your peers, and be gainfully employed in the security workforce, you need to commit yourself to using your powers to protect and serve. Having a felony on your record is a one-way ticket to another profession. It is true that there is currently a shortage of qualified security experts, but even so, not many employers today are willing to take a chance, especially if those crimes involve computers.

In the pen testing world, it is not uncommon to hear the terms “white hat” and “black hat” to describe the Jedis and Siths. Throughout this book, the terms “white hat,” “ethical hacker,” or “penetration tester” will be used interchangeably to describe the Jedis. The Siths will be referred to as “black hats,” “crackers,” or “malicious attackers.”

It is important to note that ethical hackers complete many of the same activities with many of the same tools as malicious attackers. In nearly every situation, an ethical hacker should strive to act and think like a real black hat hacker. The closer the penetration test simulates a real-world attack, the more value it provides to the customer paying for the PT.

Please note how the previous paragraph says “in nearly every situation.” Even though white hats complete many of the same tasks with many of the same tools, there is a world of difference between the two sides. At its core, these differences can be boiled down to three key points: authorization, motivation, and intent. It should be stressed that these points are not all inclusive, but they can be useful in determining if an activity is ethical or not.

The first and simplest way to differentiate between white hats and black hats is authorization. Authorization is the process of obtaining approval before conducting any tests or attacks. Once authorization is obtained, both the penetration tester and the company being audited need to agree upon the scope of the test. The scope includes specific information about the resources and systems to be included in the test. The scope explicitly defines the authorized targets for the penetration tester. It is important that both sides fully understand the authorization and scope of the PT. White hats must always respect the authorization and remain within the scope of the test. Black hats will have no such constraints on the target list.

The second way to differentiate between an ethical hacker and a malicious hacker is through examination of the attacker’s motivation. If the attacker is motivated or driven by personal gain, including profit through extortion or other devious methods of collecting money from the victim, revenge, fame, or the like, he or she should be considered a black hat. However, if the attacker is preauthorized and his or her motivation is to help the organization and improve their security, he or she can be considered a white hat.

Finally, if the intent is to provide the organization a realistic attack simulation so that the company can improve its security through early discovery and mitigation of vulnerabilities, the attacker should be considered a white hat. It is also important to comprehend the critical nature of keeping PT findings confidential. Ethical hackers will never share sensitive information discovered during the process of a penetration testing with anyone other than the client. However, if the intent is to leverage information for personal profit or gain, the attacker should be considered a black hat.

Introduction to Backtrack Linux: Tools. Lots of Tools

A few years back, the open discussion or teaching of hacking techniques was considered a bit taboo. Fortunately, times have changed and people are beginning to understand the value of offensive security. Offensive security is now being embraced by organizations regardless of size or industries. Governments are also getting serious about offensive security. Many governments have gone on record stating they are actively building and developing offensive security capabilities.

Ultimately, penetration testing should play an important role in the overall security of your organization. Just as policies, risk assessments, business continuity planning, and disaster recovery have become integral components in keeping your organization safe and secure, penetration testing needs to be included in your overall security plan as well. Penetration testing allows you to view your organization through the eyes of the enemy. This process can lead to many surprising discoveries and give you the time needed to patch your systems before a real attacker can strike.

One of the great things about learning how to hack today is the plethora and availability of good tools to perform your craft. Not only are the tools readily available, but many of them are stable with several years of development behind them. Maybe even more important to many of you is the fact that most of these tools are available free of charge. For the purpose of this book, every tool covered will be free.

It is one thing to know a tool is free, it is another to find, compile, and install each of the tools required to complete even a basic penetration test. Although this process is quite simple on today’s modern Linux OS’s, it can still be a bit daunting for newcomers. Most people who start are usually more interested in learning how to use the tools than they are in searching the vast corners of the Internet locating and installing tools.

To be fair, you really should learn how to manually compile and install software on a Linux machine; or at the very least, you should become familiar with apt-get (or the like).

More Advanced

APT, short for Advanced Package Tool, is a package management system. APT allows you to quickly and easily install, update, and remove software from the command line. Aside from its simplicity, one of the best things about APT is the fact that it automatically resolves dependency issues for you. This means that if the package you are installing requires additional software, APT will automatically locate and install the additional software. This is a massive improvement over the old days of “dependency hell.”

Installing software with APT is very straightforward. For example, let us assume you want to install the classic network-mapping tool Cheops. Once you know the name of the package you want to install, from the command line you can run apt-get install followed by the name of the software you want to install. It is always a good idea to run apt-get update before installing software. This will ensure that you are getting the latest version available. To install Cheops, we would issue the following commands:

apt-get update

apt-get install cheops

Before the package is installed, you will be shown how much disk space will be used and you will be asked if you want to continue. To install your new software, you can type “Y” and hit the enter key.

If you prefer not to use the command line, there are several GUIs available for interacting with APT. The most popular graphical front end is currently Aptitude. Additional package managers are outside the scope of this book.

A bas...

Table of contents

• Cover image
• Table of Contents
• Front-matter
• Copyright
• Dedication
• Acknowledgments
• About the Author
• About the Technical Editor
• Introduction
• Chapter 1. What Is Penetration Testing?
• Chapter 2. Reconnaissance
• Chapter 3. Scanning
• Chapter 4. Exploitation
• Chapter 5. Web-Based Exploitation
• Chapter 6. Maintaining Access with Backdoors and Rootkits
• Chapter 7. Wrapping Up the Penetration Test
• Index