EHPT

Introduction to Ethical Hacking

• EHPT stands for Ethical Hacking / Ethical Hacking Penetration Testing. The act is locating weaknesses (gaps) in Systems, Devices, and Apps by simulating the intent and actions of malicious actors.
• Conceptually, it’s like an ongoing Pen Test performed by a group of Ethical Hackers.
• It involves legally hacking or performing Vulnerability Assessment (VA) tests for security bugs.
• Involves various techniques like:
  • 1) Exploiting software bugs
  • 2) Social Engineering
  • 3) Phishing
  • 4) Brute Force Attack

Ethical Hacking: Key Concepts and Practice

• EHPT is the practice of testing Systems, Apps, and Networks for vulnerabilities.
• Techniques include:
  • Exploiting software bugs: Find and manipulate OS/App flaws. Analogy: a door that doesn’t lock properly; a bug lets a hacker open the door without a key. Software security bugs are errors in programs that can be exploited to gain unauthorized access. Hackers can discover bugs in Apps/Web browsers that allow them to execute malicious code simply by visiting a site.
  • Social Engineering: Manipulating people/systems to reveal sensitive information. Hackers impersonate trusted individuals or organizations to trick people into revealing information (e.g., posing as a bank employee in an email to obtain account details or OTPs).
  • Phishing: Tricking users into clicking malicious links, attachments, messages, or creating websites that mimic legitimate ones.
  • Types:
    • Spear Phishing: Highly targeted using personalized victim information.
    • Whaling: Targeting high-profile targets (executives).
    • Clone Phishing: Replicating legitimate communications to trick recipients.
    • Phishing Kits: Pre-built tools to automate campaigns.
  • Brute Force Attacks: Trying every possible combination of characters to guess a password until successful. Time-consuming but can succeed against weak passwords. Tools automate thousands of attempts.
    Demo references: bitwarden password strength, passwordmonster.

Ethical Hacking: Overview and Purpose

• Ethical Hacking is the use of hacking techniques for legitimate purposes to identify and fix security vulnerabilities in systems, OS, apps, processes, policies, networks, or staff.
• Key Characteristics:
  • Authorized: Conducted with explicit permission from the system owner.
  • Purpose: To identify and fix security vulnerabilities.
  • Ethical: Adheres to a code of conduct and legal boundaries.

Why Ethical Hacking? Practical Rationale

• Companies that need continuous security, need Ethical Hacking.
• Companies that want more security bugs found.
• Companies that require difficult security bugs found.
• Benefits: Protect reputation, brand, and money by fixing issues.

Vulnerability Assessment (VA) vs Penetration Testing (PT)

• Vulnerability Assessment (VA):
  • Process of identifying and evaluating weaknesses in a system or network that could be exploited by attackers.
  • Focus: Identify potential weaknesses.
  • Tools: Usually automated vulnerability scanning tools.
  • Scope: Covers a wide range of Systems, Apps, OS, Networks.
• Penetration Testing (PT / Pen Testing):
  • Authorized, simulated attack on Systems, OS, Apps, Network to validate and test security.
  • Focus: Identify weaknesses and resilience; goes beyond VA by attempting to exploit the system.
  • Authorized and approved by the owner.
  • Scope: Focused on specific systems or networks.
  • Approach: Hands-on, using automated and manual techniques and tools.
• Summary: Ethical hacking combines VA and PT to yield a comprehensive view of security posture and mitigation steps.

Unethical Hacking and Its Motivations

• Unethical Hacking is malicious hacking, illegal without owner consent.
• Consequences: If caught, FIR (First Information Report) filed; bail often not granted; potential jail time (~7 years) if convicted.
• Motivations include personal gain, cyberterrorism, or other reasons; goals include stealing data/funds, disrupting operations, blackmail, selling data, or using it against targets.
• Techniques used by malicious attackers:
  • Attack on Mandatory Access Control (MAC) footholds
  • Bypassing Firewalls, IDS/IPS, SIEM
  • Persistence: maintaining control of a machine
  • Privilege Escalation: becoming root/admin
  • Exfiltration: moving data to attacker servers
  • Data sales on the Dark Web; use of cryptocurrency for anonymity

Key Ethical Hacking Concepts in Practice

• #1 Cybersecurity: Protection of computer systems, networks, and data from unauthorized access, usage, disclosure, disruption, modification, or destruction. Examples: Firewalls, encryption, training; users install patches/antivirus.
• #2 Event: Any occurrence in an information system, app, or network (e.g., successful login, printing a PDF, Gmail server displaying emails after login).
• #3 Incident: Any event that violates security policy or threatens integrity; incidents are bad events (e.g., attempted unauthorized access).
• #4 Asset: Anything of value to an organization (e.g., computers, servers, databases with sensitive data).
• #5 Vulnerability: Weakness in protection or flaws in OS/apps/network devices that can be exploited.
• #6 Threat: Anything that could cause harm to system, network, data, or staff; probability/vision of an attack; can be intentional or unintentional.
• #6 Threat Examples:
  • Malware: Phishing leading to malware infection; theft of data, corruption, disruption.
  • Unauthorized access, DoS, Social engineering, Data breaches, Zero-day attacks.
• #7 Exploit: Techniques/tools to take advantage of a specific vulnerability.
• #8 Attack: Deliberate exploitation of a vulnerability to gain unauthorized access; e.g., DoS via overwhelming traffic; vulnerability scanning for targets (FTP, ports, apps) via Exploit Frameworks.
• #9 Breach: Successful unauthorized access or disclosure of confidential information.
• #10 Malware: Malicious software; examples include executables, scripts; used to gain information or control.
• #11 Levels of Internet: Surface Web, Deep Web, Dark Web, etc., including academic/government content, TOR-encrypted sites, and illegal content.
• #12 Bug: A defect in a product when it does not behave as designed.

Common Vulnerabilities & Exposures (CVE) and Related Scoring

• CVE: List of records with unique alphanumeric IDs describing specific vulnerabilities/exposures.
• Maintained by CVE Numbering Authorities (CNAs); primary CNA is MITRE; 149 CNAs across 25 countries.
• Total CVE Records (as of cited data): 240,830.
• CVE Records can be added by CNAs after independently fixed and verified fixes.
• Not all CVEs are published immediately; some are held until a fix is ready.
• CVSS: Common Vulnerability Scoring System; uses CVE data to produce a numerical severity score; helps prioritize vulnerabilities for remediation.

PCI-DSS and Personal Data Protection (PII)

• PCI-DSS: Payment Card Industry Data Security Standard; security standards to ensure that organizations handling card data maintain a secure environment.
• Focus: Insecure storage and logging of cardholder data; PCI DSS requires masking/logging practices that do not expose card data (e.g., do not log full card numbers, expiry dates, or CVV).
• Demo contexts show risks when logs store sensitive data and what updated scripts should do (masking, not storing CVV post-authorization).
• PCI-DSS updates emphasize masking and limiting access to card data.
• PII (Personally Identifiable Information): Any data that can identify an individual; can be direct (e.g., name, biometrics, SSN) or indirect (data that, when combined with other data, can identify a person).
  • Direct PII examples: Name, Biometrics, Credit/Debit Card numbers, Email, Mobile, Passport, Aadhaar.
  • Indirect PII examples: DoB, Postal Address, ZIP, etc.
  • Important: PII can identify an individual directly or when combined with other data.

Fuzzing in VA and PT

• Fuzzing: Automated security testing technique that feeds invalid/unexpected/random inputs to a program to discover vulnerabilities.
• In VA: Focus on large-scale testing with automated tools; produces a vulnerability report with impact and remediation.
• In PT: Used to exploit vulnerabilities to demonstrate impact (data breaches, app crashes).
• Examples:
  • Web app login form fuzzing using payloads like ' OR '1'='1; -- to test SQL injection; if not sanitized, vulnerability exposed.
  • Blog comments with unencoded inputs leading to XSS; fuzz with JavaScript payloads like to test output encoding.
• Best practices: start with known inputs, automate tests, target high-risk areas, test in isolated environments.

Threat Maps

• Real-time visual representations of cyber attacks showing origins and destinations.
• Purpose: Understand current attack activity, prevalence, and potential new attack vectors.
• Data types displayed: attack types, locations, sources; color-coding and icons indicate severity/frequency.
• Example threat map sources: LiveThreatMap, Check Point Threat Map, Kaspersky Cyber Threat Map, FortiGuard Threat Map, Imperva Threat Map, Bitdefender Threat Map.

Motives of Hacking

• Financial Gain: Credit card fraud, online banking theft, cryptocurrency theft; extortion via stolen data or access.
• Espionage: Industrial espionage (trade secrets, IP) and government espionage (intelligence gathering).
• Personal Vendetta: Revenge against individuals/organizations; disruption motives.
• Fame: Gaining notoriety by showcasing skills.
• Recognition (Hacktivism): Political or social causes; public acts to make statements.
• Curiosity: Learning and exploration; understanding system workings.

Types of Hackers

• White Hat Hackers (Ethical Hackers/Pen Testers): Authorized, plan with scope, test security; report findings to owners.
• Black Hat Hackers (Malicious Hackers/Crackers): Highly skilled; illegal activities; aim to cause harm or steal data.
• Grey Hat Hackers: Operate in a gray area; may exploit vulnerabilities without permission but may report them.
• Red Team Hackers: Full scope, multi-layered – people, resources, OS, apps, network; emulate real adversaries.
• Script Kiddies: Inexperienced; use pre-made tools/scripts; lack deep understanding.
• Nation-State Hackers: Driven by national interests (RAW, MOSAD, MI7, NSA); target governments, critical infrastructure; well-resourced; advanced tools and operations; examples include APT groups (e.g., APT41, APT10, Lazarus).
• Hacktivists: Political/social/ideological motives; use open-source tools; actions include defacement, data leaks, DoS, propaganda (examples: Anonymous, LulzSec, WikiLeaks).

Sources of Interest: Categories and Examples

• Internet: Data breaches and breach databases (Have I Been Pwned, Krebs on Security, DataBreaches.net) for breach information and analysis.
• Websites (SQL Injection focus):
  • SQL Injection techniques: attackers execute malicious SQL to control a DB behind a web app; bypass security; authenticate/authorize bypass; retrieve/modify data.
  • Demos and portals show Admin Panels, centers, and result management (illustrative only in learning contexts).
  • OWASP: Open Web Application Security Project; SQL injection guide, Top 10 security risks; cheat sheets for payloads.
  • PortSwigger Web Security Academy: Hands-on labs for SQL injection; payload cheat sheets; community.
  • Acunetix: Web vulnerability scanner for SQL injection and other threats; training resources.
• Email: Spam and phishing emails designed to trick recipients into clicking links or opening attachments.
• Online Forums and Communities: Platforms where malware links spread, cybercrime recruitment can occur, and cyberwar recruitment discussions occur (examples include various articles and analyses).
• User System Apps: Attacks on apps/software; gather user/system info, unauthorized access, data manipulation/theft; exfiltration to Dark Web; potential for business impacts.
• Domain Servers: Attack networks/infra; DoS, stopping services; bypassing security controls (firewalls, SIEM, IDS/IPS); malware installation on user systems.
• Mobile Apps: Malware infections from apps; data leakage; unnecessary permissions; SIM cloning; GPS tracking.
• Cloud: Data breaches in cloud storage, account hijacking, insider threats within cloud providers.
• Internet of Things (IoT): Vulnerabilities in smart devices; botnets controlled via C2 servers.
• ATM: Skimmers (card theft via keyloggers, camera capture of PINs); ATM jacking (physical tampering); logic bombs causing fraudulent transactions.

Cyber Crime and Criminal Technologies

• Cyberbullying, Identity Theft, Data Breach, Ransomware, Phishing, Child Exploitation, Cyberstalking (listed among cyber crimes).

National & International Laws: Frameworks and Examples

• Importance: Deterrence, protection, legal recourse for victims.
• Data protection: Digital Personal Data Protection Act (example).
• Cybersecurity standards: ISO 27001, NIST, CIS Controls.
• Intellectual Property: Copyright, Patent, Trade Secret protections; patent and copyright certificates.
• International: Convention on Cybercrime; UNODC; penalties, data protection, cybercrime investigation cells.
• National laws (examples): Computer Fraud and Abuse Act (US); Data Protection Act (Europe – GDPR); Information Technology Act (India).

India IT Act: Key Provisions and Challenges

• Section 43A: Compensation for data subjects in case of data breaches.
• Section 69A: Government interception/monitoring/decryption of data under certain circumstances.
• Cybercrime Investigation Cells: Specialized units within law enforcement.
• Challenges: Cyber is rapidly evolving; public awareness gaps; evidence collection difficulties; Internet has no global boundaries (VPNs can obscure location).
• Practical takeaway: Legal frameworks exist but require ongoing adaptation to evolving tech and crime methods.

Notes on Demos and Practical Tools Highlighted in the Material

• Demonstrations referenced include password strength tools (e.g., Bitwarden), generic password strength demos, and SQL injection/JavaScript payload examples to illustrate vulnerabilities and defense needs.
• Online resources cited for further practice and understanding include OWASP, PortSwigger, and Acunetix, as well as threat maps and breach databases.

Connections to Foundational Concepts and Real-World Relevance

• Ethical hacking relies on foundational IT and security principles: confidentiality, integrity, and availability (CIA triad).
• VA and PT together provide a comprehensive security posture: VA identifies weaknesses; PT demonstrates exploitability and impact.
• Real-world relevance includes defending financial data (PCI-DSS), protecting personal data (PII), and complying with international and national laws.
• Ethical, philosophical, and practical implications include balancing security testing with privacy, obtaining authorization, and adhering to legal frameworks while addressing evolving threat landscapes.

Quick Reference: Notable Terms and Concepts (recap)

• EHPT: Ethical Hacking / VA / Pen Testing concepts and techniques
• VA vs PT: Identify weaknesses vs exploit vulnerabilities with authorization
• Unethical Hacking: illegal access, penalties, and typical attacker goals
• Critical Terms: Cybersecurity, Event, Incident, Asset, Vulnerability, Threat, Exploit, Attack, Breach, Malware, Levels of Internet
• CVE and CVSS: Standardized vulnerability IDs and severity scoring
• PCI-DSS and PII: Privacy and payment data protection standards
• Fuzzing: Probing software with invalid inputs to uncover weaknesses
• Threat Maps: Real-time visualization of cyber threats
• Hacker Motives and Types: Financial, espionage, ideation; White/Black/Grey/Red/Nation-State/Hacktivists/etc.
• Sources of Interest: Internet data breaches, SQL Injection resources, phishing, forums, apps, cloud, IoT, ATM threats
• Legal Frameworks: International and national laws, with India IT Act as a case study
• Practical demos and tools referenced (OWL/PortSwigger/Acunetix, etc.)