Ethical Hacking and Computer Securities For Beginners

Elaiya Iswera Lallan

• Publisher: Blue Micro Solutions
• Year: 2017
• eBook ISBN: 9789670765099
• Topic: Computer Science
• Subtopic: Cyber Security
• Index: Computer Science

This book is written based on practical usage and research on computer security and networks. Basically everyone has strong concern about computer security networks where by it can sabotage the business and operations. It will be worse if the entire business operations are running on the website or web hosting company. This book covers practical approach on software tools for ethical hacking. Some of the software tools covered are SQL Injection, Password Cracking, port scanning, packet sniffing and etc. Performing ethical hacking requires certain steps and procedures to be followed properly. A good ethical hacker will find information, identify weakness and finally perform some attacks on the target machine. Then the most crucial part would be to produce a good security audit report for the clients to understand their computer network conditions. This book also explains and demonstrates step by step most of the software security tools for any beginners in the computer security field. Some of the software tools have been selected and utilized in computer security trainings and workshops.

1.0 What is Ethical Hacking?

 

Ethical Hacking is an act of performing and testing security on IT infrastructure with proper authorization from a company or organization. A person performing ethical hacking is known as ethical hacker or computer security expert. An ethical hacker will use latest hacking tools and social engineering techniques to identify vulnerabilities on IT infrastructure.

 

Overall the ethical hacking provides risk assessment about the security of IT infrastructure for a company or organization information systems. These risk assessment information will provide the level of security that can be exploited by a hacker.

 

On the other hand, hacker is a person who breaks into IT infrastructure or computer networks without any authorization. Hackers mostly hack for profit or motivated by challenge. These exploitation can cause financial lost, legal impart and trust towards the organization.

 

 

1.1 Why IT Security is so Important?

 

Nowadays all the companies or organizations are using and depending on IT infrastructure, computer networks and computer systems to operate their core businesses. Most companies store their client informations in the server in database systems. A good hacker will easily break into customer database if weak passwords are utilized on the server.

 

Definitely this will cause heavy financial losses to the company. Mostly these hacked incidents will not be reported in the media in detail because it will spoil the company’s reputation.

 

Moreover shopping and bill payments are performed online these days. Therefore client’s credit card information must be protected at all cost. One of the most famous method to gain client’s credit card information is by performing spoofing. Objective of spoofing is to fool the user into thinking that they are connected to the trusted website.

 

Most attacks are implemented utilizing emails these days. A good example whould be the LoveLetter worm attacks performed during year 2000. Millions of computers have been attacked and made changes to the users’ system itself. The LoveLetter worms are received using email attachments.

 

IT security is crucial to the organization and individual computer users. Individual computer users must make sure they have installed the latest antivirus and antispyware in their computers. Whereas companies must ensure they have engaged a computer security expert or consultant to look into their computer network security issues.

 

 

1.2 Ethical Hacking Procedures and Strategies

 

The first step in performing ethical hacking is to understand a hacker’s process. There are basically 5 main steps and processes of hacking:

 

Step 1 : Gaining targeted information

Step 2 : Probing vulnerabilities for exploitation

Step 3 : Gaining access to the targeted system

Step 4 : Maintaining access on targeted system

Step 5 : Covering the tracks on targeted system.

 

The targeted system is mostly referring to the machine to be hacked. It can represent a server or computer or any electronic devices. The hacker will perform the 5 steps mentioned above to gain control or steal information or stop the machine services. Each steps above may take a few months to acheive the desired goal.

 

An ethical hacker will perform the same steps above to further understand the weaknesses of the targeted system. Once the weaknesses are identified, the ethical hacker will take steps for countermeasure to avoid further exploitation on the targeted system.

 

 

 

 

 

2.0 Finding Information

 

In this process, the hacker will gather as much information about the target system before launching an attack. This allows the hacker to learn and strategize his or her attacks on the system. Basically there are 2 ways of gaining information :

 

1. Passive Methods of gaining information on the targeted system
2. Active Methods of gaining information on the targeted system

 

Passive methods involve acquiring information without direct interaction with the targeted system. One of the few ways of passive methods are acquiring publicly available information, social engineering and dumpster diving.

 

Dumpster diving is a process of looking for information in an organization’s trash for discarded information. Social engineering is a another process by making friends or smooth talk with staffs in the organization to reveal server passwords, security codes and etc.

 

Whereas active methods are utilizing tools to detect open ports, types of operating systems installed on target system and purpose of applications and services available on the targeted system.

 

Social engineering is the most deadly and effective way of gaining information on targeted system. Most previous employees that dislike the company management are potential threat for social engineering.

 

 

 

 

 

2.1 Software Tools for Gaining Targeted Information

 

As mentioned previously, using software tools to gain targeted information is categorized as Active Method. The most common and popular tools used for gaining targeted informations are as below:

 

1. WHOIS
2. Nslookup
3. ARIN
4. Neo Trace
5. VisualRoute Trace
6. Email Tracker Pro

 

 

 

2.2 WHOIS

 

WHOIS is a query and response protocol for querying databases that store the registered users or assignees of an Internet resource. Information that can be acquired are domain name, IP address block, autonomous system, and etc. The WHOIS protocol stores and provides database content in a human readable format.

 

 

The websites and software tool providing WHOIS informations are :

 

1. http://internic.net/whois.html
2. http://www.whois.net
3. SAM SPADE 1.14

Access information ...

Table of contents

• Ethical Hacking and Computer Securities For Beginners
• Contents
• Foreword
• About the Author
• Chapter 1 : What is Ethical Hacking?
• Chapter 2 : Finding Informations
• 2.2 WHOIS
• Access information at www.internic.net/whois.html
• Access information at www.whois.net
• Installing and Accessing Information from SAM...
• 2.3 Nslookup
• 2.4 ARIN
• 2.5 Neo Trace
• 2.6 VisualRoute
• Chapter 3 : Identifying Weakness
• 3.2 NMAP
• 3.3 NetScan
• 3.4 Webcruiser
• 3.5 GFI LandGuard
• 3.6 What is Wireshark and Ethereal?
• Chapter 4 : Performing Attacks
• 4.2 Denial of Service
• 4.3 Password Cracking
• 4.4 Perform Phishing Attacks
• 4.7 Buffer Overflow
• Chapter 5 : Ethical Hackers Important Tasks
• 5.1 Incident Forms
• 5.2 Computer Security Reports