Scribd
Upload
11 views

System Hacking and Sniffing

hacking to system

Uploaded by

ronakshef
Copyright
© © All Rights Reserved
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
11 views

System Hacking and Sniffing

hacking to system

Uploaded by

ronakshef
Copyright
© © All Rights Reserved
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 8

What is System Hacking

in Ethical Hacking?
System hacking is the process of exploiting vulnerabilities in
electronic systems for the purpose of gaining unauthorized access
to those systems. Hackers use a variety of techniques and methods
to access electronic systems, including phishing, social engineering,
and password guessing.

Purpose of System Hacking:


Generally, the motive of the hackers behind System Hacking is
gaining access to the personal data of an individual or sensitive
information belonging to an organization in order to misuse the
information and leak it which may cause a negative image of the
organization in the minds of people, Privilege Escalation, Executing
malicious applications to constantly monitor the system.

This type of hacking is generally done by a Hacker who has a lot of


information regarding the System security, network, software, and
how the system communicates with others in the network, often
called Footprinting and Reconnaissance. Then these hackers try
numerous ways to carry out the attack but the common ways are:

 By deploying Viruses, Worms, Malware, Trojans


 Using phishing techniques
 Social Engineering
 Identifying and exploiting Vulnerability

Steps:
1. Reconnaissance: The first step in this type of Hacking is collecting information
regarding the System’s infrastructure, working, system’s network. This step is
very important as after this step the Hacker knows what attack to perform and
how to gain access without leaving a trace.

2. Scanning: This step involves scanning the target System, which includes:

 Vulnerability Scanning: Checking vulnerabilities in the


targeted system that can be exploited to gain access.
 Mapping of Network: Finding the working of the network,
firewalls, routers, and systems connected to it.
 Port Scanning: Scanning the open ports, and services running
over the System/Server.

3. Gaining Access: This is the phase in which the hacker breaks into the system
and gains unauthorized access to the System/Network and then elevates his
privileges to that of Administrator or SuperUser so he can play with the System
files that a normal/Guest user is unable to access.
4. Maintaining the Access: After the Hacker enters the System he tries to
maintain the connection with it in the background until he accomplishes the goal
with which he entered it.

To know more about the phases of hacking please refer to the


article 5 Phases of Hacking.

Prevention from Hacking:


 Using Firewall.
 Installing Anti-Virus and Anti-Spyware packages.
 Keeping the system up-to-date as security patches updates
comes regularly.
 Be Aware of various phishing techniques.

SQL Injection
SQL injection is a technique used to extract user data by injecting
web page inputs as statements through SQL commands. Basically,
malicious users can use these instructions to manipulate the
application’s web server.

1. SQL injection is a code injection technique that can


compromise your database.
2. SQL injection is one of the most common web hacking
techniques.
3. SQL injection is the injection of malicious code into SQL
statements via web page input.
Web servers communicate with database servers anytime they need
to retrieve or store user data. SQL statements by the attacker are
designed so that they can be executed while the web server is
fetching content from the application server. It compromises the
security of a web application.

Sniffing
What Is Sniffing?

In its simplest form, sniffing is the act of intercepting and


monitoring traffic on a network. This can be done using software
that captures all data packets passing through a given network
interface or by using hardware devices explicitly designed for this
purpose.
Sniffing Attack:
A sniffing attack can also be used in an attempt to recover a
passphrase, such as when an SSH private key has been
compromised. The sniffer captures SSH packets containing
encrypted versions of the password being typed by the user at their
terminal, which can then be cracked offline using brute force
methods.

 The term “sniffing” is defined in RFC 2301 as: “Any act of


capturing network traffic and replaying it, usually for the
purpose of espionage or sabotage.”
 This definition is not accurate for UNIX-based systems, since
any traffic can be sniffed as long as either the attacker has
access to network interfaces (NIC) or modifies packets that
could not be altered in transit. Sniffing can be performed using
a special program like tcpdump, tcpflow, or LanMon that is
connected to a port over which the packets can be inspected
remotely.
 Another sniffing attack called ARP spoofing involves sending
forged Address Resolution Protocol (ARP) messages to the
Ethernet data link layer. These messages are used to associate
a victim machine’s IP address with a different MAC address,
leading the targeted machine to send all its traffic intended for
the victim through an attacker-controlled host.
 This is used to both hijack sessions and also cause flooding of
the network via a denial-of-service attack (see Smurf attack).
Every IP packet contains, in addition to its payload, two fields:
an IP header, and an Ethernet header encapsulating it.
 The combination of these two headers is often referred to as a
“packet” by those who work with internet communications. An
attacker can, therefore, view and modify an IP packet’s IP
header without having to see its payload.
 The Ethernet header contains information about the
destination MAC address (the hardware address of the
recipient machine) and the Ether Type field contains a value
indicating what type of service is requested (e.g., precedence
or flow control).
 The Ether type could be “0xFFFF”, indicating that no service
fields were included for the Ethernet frame. This was used in
Cisco’s implementation prior to version 8.0.
Session
Hijacking

What is Session Hijacking?


TCP session hijacking is a security attack on a user session over a
protected network. The most common method of session hijacking
is called IP spoofing, when an attacker uses source-routed IP
packets to insert commands into an active communication between
two nodes on a network and disguise itself as one of the
authenticated users. This type of attack is possible because
authentication typically is only done at the start of a TCP session.
Another type of session hijacking is known as a man-in-the-middle
attack, where the attacker, using a sniffer, can observe the
communication between devices and collect the data that is
transmitted.

Different ways of session hijacking :

Using Packet Sniffers

In the above figure, it can be seen that attack captures the victim’s
session ID to gain access to the server by using some packet
sniffers
Cross Site Scripting(XSS Attack)
Attacker can also capture victim’s Session ID using XSS attack by
using javascript. If an attacker sends a crafted link to the victim
with the malicious JavaScript, when the victim clicks on the link, the
JavaScript will run and complete the instructions made by the
attacker.

You might also like