ethical hacker notes

Chapter 1

5 Phases of ethical hacking



  1. Reconnaissance (footprinting) - Known as the preparatory phase. Where the hacker gathers information about a target before launching an attack. Completed in phases prior to exploiting system vulnerabilities. Can use social engineering techniques. 

  2. Scanning/Enumeration - hacker identifies a quick way to gain access to the network and look for information. Uses various tools to gather indepth information about the network, computer systems, live systems, open ports, and more. Extracting information such as usernames, computer names, network resources, shares, and services is called enumeration. 

  3. Gain access - to the system, applications, and network, and escalate their user privileges to take control of systems. Takes all information gathered earlier and exploits the vulnerabilities they found to gain access to a target.

  4. Maintaining Access - Where the hacker keeps accessing the organization's system to launch additional attacks on the network. Can also be done by installing rootkits, or trojan horses. Once the hacker has permanent access to the system they can use it to launch more attacks.

  5. Cover your tracks - after the hacker gains access, they cover their tracks to avoid being detected by security personnel. Including overwriting log files to hide the fact they were ever there.



Penetration testing is one practice of finding vulnerabilities and risks and mitigation them to secure a computer or network systems. 



Ethical hacking and penetration testing are interchangeable terms. Ethical hacking is an all embracing term that includes all legal hacking methods, so penetration testing is actually a part of ethical hacking. 



Red Team vs Blue Team.

An offensive security team is called a red team. 

A defensive team is called a blue team. 



The red team attempts to break into a system, and the blue team works to keep them out.



The penetration testing life cycle is almost identical to the ethical hacking process. Includes reconnaissance, scanning and enumeration, gaining access, maintaining access, and reporting.



Penetration Testing Frameworks. 

Open Web Application Security project, or OWASP, describes techniques for testing the most common web application and web service security issues. 



The Open Source Security Testing Methodology Manual, also known as the OSSTMM, attempts to create one accepted method for a very thorough security test



The national institute of standards and Technology Special Publication 800-115, also known as NIST SP 800-115, is also a guide to the basic technical aspects of conducting information security assessments.



Penetration Testing Types

Three types of penetration tests: black box white box, and grey box.

A black box test is when the ethical hacker has no information about the target or network. This test is the best for simulating an outside attack and ignores insider threats.

Takes more time and is much more expensive, mostly because a lot of time and resources have to go into the reconnaissance and scanning phases.



White box test is the opposite of a black box. The ethical hacker is given full knowledge of the network, computer systems, and infrastructure. 

Allows a full test of the environment, but its not very realistic, as an attacker almost never 



Grey box test simulates an insider threat. Given partial information about the network and computer systems. This can be IP configurations, email lists, computer names, or other information an insider would realistically have. Requires less recon and scanning but doesn't give all the information to the ethical hacker



Penetration Testing Life Cycle

  • Performing reconnaissance

  • Scanning and Enumeration

  • Establishing Access

  • Maintaining Access

  • Reporting



Penetration Testing Types

  • Unknown Environment - The ethical hacker has no information regarding the target or network. This type of test best simulates an outside attack and ignores the insider threats. 

  • Known Environment - The ethical hacker is given full knowledge of the target or network. This test allows for a comprehensive and thorough test, but is not very realistic. 

  • Partially-known Environment - The ethical hacker is given partial information of the target or network, such as IP configurations or emails lists. This test simulates an insider threat.