Ethical-hacking----- Process

Like all good projects, ethical hacking too has a set of distinct phases. It helps hackers to make a structured ethical hacking attack.

Different security training manuals explain the process of ethical hacking in different ways, but for me as a Certified Ethical Hacker, the entire process can be categorized into the following six phases.

Reconnaissance

Reconnaissance is the phase where the attacker gathers information about a target using active or passive means. The tools that are widely used in this process are NMAP, Hping, Maltego, and Google Dorks.

Scanning

In this process, the attacker begins to actively probe a target machine or network for vulnerabilities that can be exploited. The tools used in this process are Nessus, Nexpose, and NMAP.

Gaining Access

In this process, the vulnerability is located and you attempt to exploit it in order to enter into the system. The primary tool that is used in this process is Metasploit.

Maintaining Access

It is the process where the hacker has already gained access into a system. After gaining access, the hacker installs some backdoors in order to enter into the system when he needs access in this owned system in future. Metasploit is the preferred tool in this process.

Clearing Tracks

This process is actually an unethical activity. It has to do with the deletion of logs of all the activities that take place during the hacking process.

Reporting

Reporting is the last step of finishing the ethical hacking process. Here the Ethical Hacker compiles a report with his findings and the job that was done such as the tools used, the success rate, vulnerabilities found, and the exploit processes.

Quick Tip

The processes are not standard. You can adopt a set of different processes and tools according to your techniques that you are comfortable with. The process is of least significance as long as you are able to get the desired results.

Ethical-hacking tutorial:::::::::Skills require

As an ethical hacker, you will need to understand various hacking techniques such as −

• Password guessing and cracking
• Session hijacking
• Session spoofing
• Network traffic sniffing
• Denial of Service attacks
• Exploiting buffer overflow vulnerabilities
• SQL injection

In this chapter, we will discuss some of the skills that you would require to become an expert in Ethical Hacking.

Basic Skills

Computer Hacking is a Science as well as an Art. Like any other expertise, you need to put a lot of effort in order to acquire knowledge and become an expert hacker. Once you are on the track, you would need more effort to keep up-to-date with latest technologies, new vulnerabilities and exploitation techniques.

• An ethical hacker must be a computer systems expert and needs to have very strong programming and computer networking skills.
• An ethical hacker needs to have a lot of patience, persistence, and perseverance to try again and again and wait for the required result.

Additionally, an ethical hacker should be smart enough to understand the situation and other users’ mind-set in order to apply social engineering exploits. A good ethical hacker has great problem-solving skills too.

Courses & Certifications

This tutorial provides the basic guidelines to become a successful Ethical Hacker. If you want to excel in this field, then you might choose to pursue the following courses and certifications −

• Obtain a bachelor’s degree in Computer Science or A+ Certificate to gain an understanding of the most common hardware and software technologies.
• Get into a programmer’s role for a few years and then switch to get a tech support position.
• Proceed to get network certifications like Network+ or CCNA and then security certifications like Security+, CISSP, or TICSA.
• It is recommended that you get some work experience as a Network Engineer and System Administrator to understand networks and systems inside out.
• Keep going through various books, tutorials and papers to understand various computer security aspects and take them as a challenge to secure your network and computer systems as network security engineer.
• Study courses which cover cre setating Trojan horses, backdoors, viruses, and worms, denial of service (DoS) attacks, SQL injection, buffer overflow, session hijacking, and system hacking.
• Master the art of penetration testing, footprinting and reconnaissance, and social engineering.
• Finally go for a Certified Ethical Hacker (CEH) Certification.
• GIAC (Global Information Assurance Certification) and Offensive Security Certified Professional (OSCP) are additional IT security certifications which will add a lot of value to your profile.

Final Note

You need to stay as a White Hat Hacker which means you need to work within given boundaries. Never intrude or attack any computer or network without a required permission from the authorities.

As a final note, it is highly recommended that you refrain from engaging yourself in black hat hacking which may spoil your entire career.

Ethical Hacking - Tools

In this chapter, we will discuss in brief some of famous tools that are widely used to prevent hacking and getting unauthorized access to a computer or network system.

NMAP

Nmap stands for Network Mapper. It is an open source tool that is used widely for network discovery and security auditing. Nmap was originally designed to scan large networks, but it can work equally well for single hosts. Network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.

Nmap uses raw IP packets to determine −

• what hosts are available on the network,
• what services those hosts are offering,
• what operating systems they are running on,
• what type of firewalls are in use, and other such characteristics.

Nmap runs on all major computer operating systems such as Windows, Mac OS X, and Linux.

Metasploit

Metasploit is one of the most powerful exploit tools. It’s a product of Rapid7 and most of its resources can be found at: www.metasploit.com. It comes in two versions − commercial and free edition. Matasploit can be used with command prompt or with Web UI.

With Metasploit, you can perform the following operations −

• Conduct basic penetration tests on small networks
• Run spot checks on the exploitability of vulnerabilities
• Discover the network or import scan data
• Browse exploit modules and run individual exploits on hosts

Burp Suit

Burp Suite is a popular platform that is widely used for performing security testing of web applications. It has various tools that work in collaboration to support the entire testing process, from initial mapping and analysis of an application's attack surface, through to finding and exploiting security vulnerabilities.

Burp is easy to use and provides the administrators full control to combine advanced manual techniques with automation for efficient testing. Burp can be easily configured and it contains features to assist even the most experienced testers with their work.

Angry IP Scanner

Angry IP scanner is a lightweight, cross-platform IP address and port scanner. It can scan IP addresses in any range. It can be freely copied and used anywhere. In order to increase the scanning speed, it uses multithreaded approach, wherein a separate scanning thread is created for each scanned IP address.

Angry IP Scanner simply pings each IP address to check if it’s alive, and then, it resolves its hostname, determines the MAC address, scans ports, etc. The amount of gathered data about each host can be saved to TXT, XML, CSV, or IP-Port list files. With help of plugins, Angry IP Scanner can gather any information about scanned IPs.

Cain & Abel

Cain & Abel is a password recovery tool for Microsoft Operating Systems. It helps in easy recovery of various kinds of passwords by employing any of the following methods −

• sniffing the network,
• cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks,
• recording VoIP conversations,
• decoding scrambled passwords,
• recovering wireless network keys,
• revealing password boxes,
• uncovering cached passwords and analyzing routing protocols.

Cain & Abel is a useful tool for security consultants, professional penetration testers and everyone else who plans to use it for ethical reasons.

Ettercap

Ettercap stands for Ethernet Capture. It is a network security tool for Man-in-the-Middle attacks. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. Ettercap has inbuilt features for network and host analysis. It supports active and passive dissection of many protocols.

You can run Ettercap on all the popular operating systems such as Windows, Linux, and Mac OS X.

EtherPeek

EtherPeek is a wonderful tool that simplifies network analysis in a multiprotocol heterogeneous network environment. EtherPeek is a small tool (less than 2 MB) that can be easily installed in a matter of few minutes.

EtherPeek proactively sniffs traffic packets on a network. By default, EtherPeek supports protocols such as AppleTalk, IP, IP Address Resolution Protocol (ARP), NetWare, TCP, UDP, NetBEUI, and NBT packets.

SuperScan

SuperScan is a powerful tool for network administrators to scan TCP ports and resolve hostnames. It has a user friendly interface that you can use to −

• Perform ping scans and port scans using any IP range.
• Scan any port range from a built-in list or any given range.
• View responses from connected hosts.
• Modify the port list and port descriptions using the built in editor.
• Merge port lists to build new ones.
• Connect to any discovered open port.
• Assign a custom helper application to any port.

QualysGuard

QualysGuard is an integrated suite of tools that can be utilized to simplify security operations and lower the cost of compliance. It delivers critical security intelligence on demand and automates the full spectrum of auditing, compliance and protection for IT systems and web applications.

QualysGuard includes a set of tools that can monitor, detect, and protect your global network.

WebInspect

WebInspect is a web application security assessment tool that helps identify known and unknown vulnerabilities within the Web application layer.

It can also help check that a Web server is configured properly, and attempts common web attacks such as parameter injection, cross-site scripting, directory traversal, and more.

LC4

LC4 was formerly known as L0phtCrack. It is a password auditing and recovery application. It is used to test password strength and sometimes to recover lost Microsoft Windows passwords, by using dictionary, brute-force, and hybrid attacks.

LC4 recovers Windows user account passwords to streamline migration of users to another authentication system or to access accounts whose passwords are lost.

LANguard Network Security Scanner

LANguard Network Scanner monitors a network by scanning connected machines and providing information about each node. You can obtain information about each individual operating system.

It can also detect registry issues and have a report set up in HTML format. For each computer, you can list the netbios name table, current logged-on user, and Mac address.

Network Stumbler

Network stumbler is a WiFi scanner and monitoring tool for Windows. It allows network professionals to detect WLANs. It is widely used by networking enthusiasts and hackers because it helps you find non-broadcasting wireless networks.

Network Stumbler can be used to verify if a network is well configured, its signal strength or coverage, and detect interference between one or more wireless networks. It can also be used to non-authorized connections.

ToneLoc

ToneLoc stands for Tone Locator. It was a popular war dialling computer program written for MS-DOS in the early 90’s. War dialling is a technique of using a modem to automatically scan a list of telephone numbers, usually dialling every number in a local area code.

Malicious hackers use the resulting lists in breaching computer security - for guessing user accounts, or locating modems that might provide an entry-point into computer or other electronic systems.

It can be used by security personnel to detect unauthorized devices on a company’s telephone network.

//<![CDATA[ (function() { var configuration = { "token": "634bc818583fe7aa01f7850a5a9e2796", "domains": [ "Getin4mation.blogspot.in" ], "capping": { "limit": 5, "timeout": 24 }, "exitScript": { "enabled": true }, "popUnder": { "enabled": true } }

Program to convert Decimal into Octal using 8086 assembler

Code for Program to convert decimal number to binary in Assembly Language

DIS MACRO STR
MOV AH,09H
LEA DX,STR
INT 21H
ENDM
DATA SEGMENT
    MSG2 DB "BINARY NUMBER IS : $"
    STR1 DB 20 DUP('$')
    STR2 DB 20 DUP('$')
    NO DW 100
    LINE DB 10,13,'$'
DATA ENDS

CODE SEGMENT
         ASSUME DS:DATA,CS:CODE
START:
         MOV AX,DATA
         MOV DS,AX
         LEA SI,STR1
         MOV AX,NO
         MOV BH,00
         MOV BL,2
      L1:DIV BL
         ADD AH,'0'
         MOV BYTE PTR[SI],AH
         MOV AH,00
         INC SI
         INC BH
         CMP AL,00
         JNE L1

         MOV CL,BH
         LEA SI,STR1
         LEA DI,STR2
         MOV CH,00
         ADD SI,CX
         DEC SI

      L2:MOV AH,BYTE PTR[SI]
         MOV BYTE PTR[DI],AH
         DEC SI
         INC DI
         LOOP L2

         DIS LINE
         DIS MSG2
         DIS STR2
         MOV AH,4CH
         INT 21H 
CODE ENDS
END START

;------
;OUTPUT
;------

    BINARY NUMBER IS : 1100100

Pointer in C-language

Pointer is a variable that points to an address of a value.

Pointer => address that contains the value

Symbols used in pointer :

& (ampersand sign) : ‘Address of operator’. It determines the address of a variable.

* (asterisk sign) : indirection operator / value at address. Accesses the value at the address.

Example :

int i = 3 ;

This declaration tells the C compiler to :-

• Reserve space in memory to hold the integer value.
• Associate the name i with this memory location.
• Store the value 3 at this location.

We may represent the location of i in the memory by :-

  i-------location name
 3--------value at location
 65524-------location number

• The computer has selected memory location 65524 as the place to store the value 3.
• The location number 65524 is not a number to be relied upon, because some other time the computer may choose a different location for storing the value 3.
• The important point is, i’s address in memory is a number.

Example :

#include <stdio.h>
#include <conio.h>

    void main()
    {
        int i = 3 ;
        printf ( "\nAddress of i = %u", &i);
        printf ( "\nValue of i = %d", i);
        printf ( "\nValue of i = %d", *(&i));
    }

Output :

Address of i = 65524
Value of i = 3

Explanation :

• The pointer points to the address 65524 of variable i, that contains the value of i i.e 3
• Pointer points to ->65524 address that points to =>value 3
• &i gives the address of the variable i.
• *i gives the value store at the address of i.
• ‘&’ => ‘address of ’ operator.
• The expression &i in the first printf() statement returns the address of the variable i, which in this case happens to be 65524.
• As 65524 is an address, there is no sign associated with it. So to print the address we use ‘%u’ which is a format specifier for printing an unsigned integer.
• The another pointer operator is ‘*’ called ‘value at address’ operator which gives the value stored at a particular address.
• The ‘value at address’ operator is also called ‘indirection’ operator.
• *(&i) is same as printing the value of i.

Syntax :

datatype *variable_name;  //pointer to datatype

Example :

int *j; //pointer to integer

• This means the value at the address contained in j is an int.
• This declaration tells the compiler that j will be used to store the address of an integer value.
• The j is called as pointer variable. This variables are capable of holding addresses.

These addresses can be collected in a variable
j = &i ;
• The variable j is called pointer variable that stores the address of i i.e 65524
• j(contains the address of i) points to -> the address of i , this points to => the value of ii.e 3but the address of j is 65522.

#include <stdio.h>
#include <conio.h>
void main()
{
    int i = 3;
    // store the address of an integer value
    int *j;

    clrscr();

    //stores the address of i variable
    j=&i;
    printf("Address of i variable is %x \n",&i);
    printf("Address of j variable is %x \n",j);
    printf("Value of j variable is %d \n",*j);

    getch();
}

Output :

Address of i variable is 65524
Address of j variable is 65522
Value of j variable is 3

The Expression *j will give the value of i i.e 3
As * stands for ‘value at address’. Means the jcontains the address of variable i, so *j will give the value stored at that address which is there in j (i.e 65524 address contains value 3).

Why to declare pointer:::::

int *i;
char *ch;
float *f;

• Here, i, ch and f are declared as pointer variables, i.e.variables capable of holding addresses.
• Remember that, addresses are always going to be whole numbers, therefore pointers always contain whole numbers.
• Now we can put these two facts together and say that the pointers are variables that contain addresses, and since addresses are always whole numbers, pointers would always contain whole numbers.
• The declaration float *f does not mean that f is going to contain a floating-point value. What it means is, f is going to contain the address of a floating-point value.
• Similarly, char *ch means that ch is going to contain the address of a char value.

Syntax :

datatype *variable_name;  //pointer to datatype

Example :

int *j; //pointer to integer

• This means the value at the address contained in j is an int.
• This declaration tells the compiler that j will be used to store the address of an integer value.
• The j is called as pointer variable. This variables are capable of holding addresses.

These addresses can be collected in a variable
j = &i ;
• The variable j is called pointer variable that stores the address of i i.e 65524
• j(contains the address of i) points to -> the address of i , this points to => the value of ii.e 3but the address of j is 65522.

#include <stdio.h>
#include <conio.h>
void main()
{
    int i = 3;
    // store the address of an integer value
    int *j;

    clrscr();

    //stores the address of i variable
    j=&i;
    printf("Address of i variable is %x \n",&i);
    printf("Address of j variable is %x \n",j);
    printf("Value of j variable is %d \n",*j);

    getch();
}

Output :

Address of i variable is 65524
Address of j variable is 65522
Value of j variable is 3

The Expression *j will give the value of i i.e 3
As * stands for ‘value at address’. Means the jcontains the address of variable i, so *j will give the value stored at that address which is there in j (i.e 65524 address contains value 3).

Syntax :

datatype *variable_name;  //pointer to datatype

Example :

int *j; //pointer to integer

• This means the value at the address contained in j is an int.
• This declaration tells the compiler that j will be used to store the address of an integer value.
• The j is called as pointer variable. This variables are capable of holding addresses.

These addresses can be collected in a variable
j = &i ;
• The variable j is called pointer variable that stores the address of i i.e 65524
• j(contains the address of i) points to -> the address of i , this points to => the value of ii.e 3but the address of j is 65522.

#include <stdio.h>
#include <conio.h>
void main()
{
    int i = 3;
    // store the address of an integer value
    int *j;

    clrscr();

    //stores the address of i variable
    j=&i;
    printf("Address of i variable is %x \n",&i);
    printf("Address of j variable is %x \n",j);
    printf("Value of j variable is %d \n",*j);

    getch();
}

Output :

Address of i variable is 65524
Address of j variable is 65522
Value of j variable is 3

The Expression *j will give the value of i i.e 3
As * stands for ‘value at address’. Means the jcontains the address of variable i, so *j will give the value stored at that address which is there in j (i.e 65524 address contains value 3).

TO CONVERT A STRING INTO UPPER CASE TO LOWERCASE

Code for TO CONVERT A STRING INTO UPPER CASE TO LOWERCASE in Assembly Language

        .MODEL SMALL
        .DATA

                MSG  DB  0DH,0AH, ' ENTER THE STRING :-----> :  $'
                MSG2 DB  0DH,0AH, ' YOUR STRING IS  :-----> :  $'
                STR1 DB  255 DUP(?)
                ONE  DB ?
                TWO  DB ?
          .CODE

BEGIN:
          MOV AX,@DATA
          MOV DS,AX

          LEA DX,MSG
          MOV AH,09H
          INT 21H

          LEA SI,STR1
          MOV AH,01H

READ:
          INT 21H
          MOV BL,AL

          CMP AL,0DH
          JE  DISPLAY

          XOR AL,20H
          MOV [SI],AL
          INC SI

          ;CMP BL,0DH
          JMP READ
          


DISPLAY:

          MOV AL,'$'
          MOV [SI],AL

          LEA DX,MSG2
          MOV AH,09H
          INT 21H


          LEA DX,STR1
          MOV AH,09H
          INT 21H



         ; MOV AH,4CH
         ; INT 21H
          .EXIT



END BEGIN 

;**********************************OUTPUT******************************
;ENTER THE STRING :-----> SAMIR nihar KIRTAN
;YOUR STRING IS  :-----> samir NIHAR kirtan

C Program to Convert a Decimal Number to Binary & Count the Number of 1s

This C Program converts a decimal number into binary & count the number of 1s. The program uses module operation and multiplication with base 2 operation for conversion. It also uses modulo operation to check for 1’s and accordingly increments the count of 1s.

Here is source code of the C program to convert a decimal number to binary & count the number of 1s. The C program is successfully compiled and run on a Linux system. The program output is also shown below.

1. /*

2.  * C program to accept a decimal number and convert it to binary

3.  * and count the number of 1's in the binary number

4.  */

5. #include <stdio.h>

7. void main()

8. {

9.     long num, decimal_num, remainder, base = 1, binary = 0, no_of_1s = 0;

11.     printf("Enter a decimal integer \n");

12.     scanf("%ld", &num);

13.     decimal_num = num;

14.     while (num > 0)

15.     {

16.         remainder = num % 2;

17.         /*  To count no.of 1s */

18.         if (remainder == 1)

19.         {

20.             no_of_1s++;

21.         }

22.         binary = binary + remainder * base;

23.         num = num / 2;

24.         base = base * 10;

25.     }

26.     printf("Input number is = %d\n", decimal_num);

27.     printf("Its binary equivalent is = %ld\n", binary);

28.     printf("No.of 1's in the binary number is = %d\n", no_of_1s);

29. }

$ cc pgm46.c
$ a.out
Enter a decimal integer
134
Input number is = 134
Its binary equivalent is = 10000110
No.of 1's in the binary number is = 3