Learn Ethical Hacking Tools Free Hacking Tricks How To Hack Hacking Passwords & Email Hacking

Helps find additional IP addresses if authoritative DNS is known from whois.

MX record reveals the IP of the mail server.

Both Unix and Windows come with a Nslookup client.

Third party clients are also available - E.g. Sam Spade

Nslookup employs the domain name delegation method when used on the local domain. For instance, typing 'hr.targetcompany.com' will query for the particular name and if not found, will go one level up to find 'targetcompany.com'. To query a host name outside the domain, a fully qualified domain name (FQDN) must be typed.

The attacker can use dig and host command to obtain more information on UNIX systems.

Footprinting is one of the three pre-attack phases. The others are scanning and enumeration.

Footprinting results in a unique organization profile with respect to networks (Internet / Intranet / Extranet / Wireless) and systems involved.

There is no single methodology for footprinting, as a hacker can choose several routes to trace the information. Footprinting therefore, needs to be carried out precisely and in an organized manner. The information unveiled at various network levels can include details of domain name, network blocks, network services and applications, system architecture, intrusion detection systems, specific IP addresses, access control mechanisms and related lists, phone numbers, contact addresses, authentication mechanisms and system enumeration.

The information gathering activity can be broadly divided into seven phases: 

• The attacker would first unearth initial information (such as domain name), 
  

• locate the network range of the target system (using tools such as Nslookup, whois etc),
  

•  ascertain the active machines (for instance by pinging the machine), 
  

• discover open ports or access points (using tools such as port scanners), 
  

• detect operating systems (for instance querying with telnet), 
  

• uncover services on ports and 
  

• ultimately map the network.

Ethical hackers tries to answer:

• What can the intruder see on the target system? (Reconnaissance and Scanning phase of hacking)

• What can an intruder do with that information? (Gaining Access and Maintaining Access phases)

• Does anyone at the target notice the intruders attempts or success? (Reconnaissance and Covering Tracks phases)

If hired by any organization, an ethical hacker asks the organization what it is trying to protect, against whom and what resources it is willing to expend in order to gain protection.

Comprises of hackers with a social or political agenda

Aims at sending across a message through their hacking activity and gaining visibility for their cause and themselves.

Common targets include government agencies, MNCs, or any other entity perceived as 'bad' or 'wrong' by these groups / individuals.

It remains a fact however, that gaining unauthorized access is a crime, no matter what the intent.

Most hacktivists aim at sending across a message through their hacking activity and gaining visibility for their cause and themselves. Common targets include government agencies, MNCs, or any other entity perceived as 'bad' or 'wrong' by these groups / individuals. It remains a fact however, that gaining unauthorized access is a crime, no matter what the intent.

White Hats

• Individuals professing hacker skills and using them for defensive purposes. Also known as 'Security Analysts'.

Gray Hats

• Individuals who work both offensively and defensively at various times.

Ethical Hacker Classes

• Former Black Hats

  • Reformed crackers

  • First-hand experience

  • Lesser credibility perceived

• White Hats

  • Independent security consultants (maybe groups as well)

  • Claims to be knowledgeable about black hat activities

• Consulting Firms

  • Part of ICT firms

  • Good credentials

Reasons include need for prolonged stay, continued use of resources, removing evidence of hacking, avoiding legal action etc.

Examples include Steganography, tunneling, altering log files etc.

Hackers can remain undetected for long periods or use this phase to start a fresh reconnaissance to a related target system.

The hacker has exploited a vulnerability and can tamper and compromise the system.

Sometimes, hackers harden the system from other hackers as well (to own the system) by securing their exclusive access with Backdoors, RootKits, Trojans and Trojan horse Backdoors.

Hackers can upload, download or manipulate data / applications / configurations on the 'owned' system.

The exploit can occur over a LAN, locally, Internet, offline, as a deception or theft. Examples include stack-based buffer overflows, denial of service, session hijacking, password filtering etc.

Influencing factors include architecture and configuration of target system, skill level of the perpetrator and initial level of access obtained.

Business Risk - 'Highest' - The hacker can gain access at operating system level, application level or network level.

Business Risk - 'High' - Hackers have to get a single point of entry to launch an attack and could be point of exploit when vulnerability of the system is detected.

Scanning can include use of dialers, port scanners, network mapping, sweeping, vulnerability scanners etc.

Business Risk - To see if someone is watching and responding. Could be future point of return when noted for ease of entry for an attack when more is known on a broad scale about the target.

Passive reconnaissance involves monitoring network data for patterns and clues.

• Examples include sniffing, information gathering etc.

Active reconnaissance involves probing the network to detect

• accessible hosts

• open ports

• location of routers

• details of operating systems and services

Vulnerability - Existence of a weakness, design, or implementation error that can lead to an unexpected, undesirable event compromising the security of the system.

Target of Evaluation - An IT system, product, or component that is identified/subjected as requiring security evaluation.

Attack - An assault on system security that derives from an intelligent threat. An attack is any action that attempts to or violates security.

Exploit - A defined way to breach the security of an IT system through vulnerability.

---

Amarjit Singh

The verb 'hacking' describes the rapid development of new programs or the reverse engineering of already existing software to make the code better, and efficient.

The term 'cracker' refers to a person who uses his hacking skills for offensive purposes.

The term 'ethical hacker' refers to security professionals who apply their hacking skills for defensive purposes.

Now its all upon you, how you wanna to take it.

---

Amarjit Singh