A Seminar Report on
ETHICAL HACKING
Presented By T.RENUKA DEPARTMENT OF MASTER OF COMPUTER APPLICATIONS (MCA) G.PULLA REDDY ENGINEERING COLLEGE KURNOOL.
Ankit Fadia Certified Ethical Hacker (AFCEH)
INDIAN NO:1 ETHICAL HACKER
confidential
About Ankit..
21 years old, is an independent ethical hacker Specialization in
computer security and digital intelligence consultant . He has authored six internationally best-selling books on numerous topics related to Computer Security that have been widely over.
Appreciated by both professionals and industry leaders the world His books have sold a record 250,000 copies across the globe, have been translated into Japanese, Korean, Portuguese and Polish and are also being used as reference textbooks in some of the most prestigious academic institutions in Asia and North America.
MEET ANKIT PERSONALY IN
www.facebook.com/ankitfadiaofficialpage
confidential
Overview
Difference B/W hacker Vs cracker.
What is Ethical Hacking?
Why Ethical Hacking?
Who are ethical hackers?
What do Ethical Hackers do?
Ethical Hacking Process
Examples for ethical hacking
BASIC DIFFERENSES
Hackers
Access computer system or network without authorization Breaks the law; can go to prison
Crackers
Break into systems to steal or destroy data U.S. Department of Justice calls both hackers
Ethical hacker
Performs most of the same activities but with owners permission
Hands-On Ethical Hacking and Network Defense 5
HACKER
Having lots of knowledge & experience ( in positive manner)
CRACKER
Having lots of knowledge & experience ( in negative manner)
Hackers are good guys Hackers have strong ethics Hackers does not commit any crimes Hacker fights against criminals
crackers are bad guys Crackers have poor ethics Crackers commit crimes Cracker it self is a criminal
Conclusion:
Try to become hacker, not a
cracker.
What is Ethical Hacking
Also Called Attack & Penetration Testing, White-hat hacking, Red teaming Hacking Process of breaking into systems for: Personal or Commercial Gains Malicious Intent Causing sever damage to Information & Assets Ethical Conforming to accepted professional standards of conduct Black-hat Bad guys White-hat - Good Guys
Why Ethical Hacking
January - 2005
June 01, 2004 to Dec.31, 2004
Domains .com .gov.in .org .net .biz No of Defacements 922 24 53 39 12
.co.in
.ac.in .info .nic.in .edu other Total
48
13 3 2 2 13 1131
Defacement(damaging) Statistics for Indian Websites
Source: CERT-India
Why Ethical Hacking
Protection from possible External Attacks Social Engineering
Organizational Attacks
Automated Attacks
Restricted Data Accidental Breaches in Security
Viruses, Trojan Horses, and Worms
Denial of Service (DoS)
Who are Ethical Hackers?
One of the best ways to evaluate the intruder threat is to have an independent computer security professionals attempt to break their computer systems Successful ethical hackers possess a variety of skills. First and foremost, they must be completely trustworthy. Ethical hackers typically have very strong programming and computer networking skills. They are also adept at installing and maintaining systems that use the more popular operating systems (e.g., Linux or Windows 2000) used on target systems. These base skills are augmented with detailed knowledge of the hardware and software provided by the more popular computer and networking hardware vendors.
What do Ethical Hackers do?
An ethical hackers evaluation of a systems security seeks answers to these basic questions: What can an intruder see on the target systems? What can an intruder do with that information? Does anyone at the target notice the intruders at tempts or successes? What are you trying to protect? What are you trying to protect against? How much time, effort, and money are you willing to expend to obtain adequate protection?
Ethical Hacking - Process
1.
2.
3. 4. 5.
Preparation Footprinting Enumeration & Fingerprinting Identification of Vulnerabilities Attack Exploit the Vulnerabilities
Preparation
Identification of Targets company websites, mail servers, extranets, etc. Signing of Contract
Agreement on protection against any legal issues Contracts to clearly specifies the limits and dangers of the test Specifics on Denial of Service Tests, Social Engineering, etc. Time window for Attacks Total time for the testing Prior Knowledge of the systems Key people who are made aware of the testing
Footprinting
Collecting as much information about the target DNS Servers IP Ranges Administrative Contacts Problems revealed by administrators Information Sources Search engines Forums Databases whois, ripe, arin, apnic Tools PING, whois, Traceroute, DIG, nslookup, sam spade
Enumeration & Fingerprinting
Specific targets determined Identification of Services / open ports Operating System Enumeration
Methods Banner grabbing Responses to various protocol (ICMP &TCP) commands Port / Service Scans TCP Connect, TCP SYN, TCP FIN, etc. Tools Nmap, FScan, Hping, Firewalk, netcat, tcpdump, ssh, telnet, SNMP Scanner
Identification of Vulnerabilities
Vulnerabilities
Insecure Configuration Weak passwords Unpatched vulnerabilities in services, Operating systems, applications Possible Vulnerabilities in Services, Operating Systems Insecure programming Weak Access Control
Identification of Vulnerabilities(attacts)
Methods Unpatched / Possible Vulnerabilities Tools, Vulnerability information Websites Weak Passwords Default Passwords, Brute force, Social Engineering, Listening to Traffic Insecure Programming SQL Injection, Listening to Traffic Weak Access Control Using the Application Logic, SQL Injection
Identification of Vulnerabilities
Tools Vulnerability Scanners - Nessus, ISS, SARA, SAINT Listening to Traffic Ethercap, tcpdump Password Crackers John the ripper, LC4, Pwdump Intercepting Web Traffic Achilles, Whisker, Legion
Websites Common Vulnerabilities & Exposures http://cve.mitre.org Bugtraq www.securityfocus.com Other Vendor Websites
Attack Exploit the vulnerabilities
Obtain as much information (trophies) from the Target Asset Gaining Normal Access Escalation of privileges Obtaining access to other connected systems
Last Ditch Effort Denial of Service
Attack Exploit the vulnerabilities
Network Infrastructure Attacks Connecting to the network through modem Weaknesses in TCP / IP, NetBIOS Flooding the network to cause DOS Operating System Attacks Attacking Authentication Systems Exploiting Protocol Implementations Exploiting Insecure configuration Breaking File-System Security
Attack Exploit the vulnerabilities
Application Specific Attacks
Exploiting implementations of HTTP, SMTP protocols Gaining access to application Databases SQL Injection Spamming
Attack Exploit the vulnerabilities
Exploits Free exploits from Hacker Websites Customised free exploits Internally Developed Tools Nessus, Metasploit Framework,
Reporting
Methodology Exploited Conditions & Vulnerabilities that could not be exploited Proof for Exploits - Trophies Practical Security solutions
Ethical Hacking Commandments
Working Ethically
Trustworthiness Misuse for personal gain
Respecting Privacy Not Crashing the Systems
Examples for ethical hacking
Fake mail:
http://mailz.funmaza.co.uk/
One young lady cracked by an cracker in mumbai. A eleven years young boy changed the space ship direction in NASA from his home town russia sitting in his personal bed room. Bank robbery by changing IP (Internet Protocol) address.
Methods for changing IP address
www.spyping.com Using email tracker pro software. www.whatismyipaddress.com www.whatismyip.com http://trace.bharatiyamobile.com (to trace cell phones).
