Chapter 6: Techniques Used by Hackers - Comprehensive Study Guide
Introduction to Hacker Mentality and Methodology
A hacker is defined as an individual who seeks to understand a system, which is often accomplished by identifying and learning its inherent weaknesses. It is important to distinguish the intent behind these actions, as many hackers are not criminals. Professionals who are authorized to test their organization’s system security to identify vulnerabilities are specifically referred to as penetration testers. To validate the skills required for this field, several prestigious certifications exist, including those offered by Offensive Security, the SANS Institute, and the EC-Council’s Certified Ethical Hacker (CEH) program.
Basic Hacking Terminology and Classification
The hacking community and its activities are categorized into specific types based on intent and experience. White hat hackers are ethical hackers who use their skills for defensive and legal purposes. In contrast, black hat hackers, also known as crackers, operate with malicious intent. Gray hat hackers represent a middle ground, often described as former black hat hackers who have transitioned into white hat roles. There is also a group known as script kiddies, who are inexperienced hackers using pre-existing scripts and tools without a deep understanding of the underlying technology.
Beyond these classifications, the term phreaking refers to the specific practice of hacking into telephone systems. In the context of organized security testing, penetration testing involves two distinct groups: the red team, which emulates the actions of an adversary to test defenses, and the blue team, which serves as the defensive unit responsible for protecting the infrastructure.
The Reconnaissance Phase: Passive Scanning
The reconnaissance phase is the initial stage of a hacking attempt or penetration test, used to gather information about the target. Passive scanning techniques are utilized to collect data without directly interacting with the target's systems in a way that might be logged or detected. Common methods include checking the target organization’s official websites, scanning public bulletin boards, monitoring chat rooms, and participating in discussion groups where employees might inadvertently share sensitive information. Even viewing a company’s security-related job advertisements can reveal technical details about their infrastructure.
Specific external websites are also vital for passive intel. Netcraft.com is used to gather server-related information and view performance data for hosting companies. For example, Netcraft data from August lists companies like Rackspace, NYI, and Bigstep, providing metrics such as outage times (e.g., ), failed requests (), and DNS connection timing (). Another critical tool is Archive.org, specifically the Wayback Machine, which allows researchers to view archived older versions of websites to find information that may have been removed from the current live site.
The Reconnaissance Phase: Active Scanning and Enumeration
Active scanning techniques provide more reliable data than passive methods but carry a higher risk of being detected by the target system's security monitoring software. Port scanning is a primary active technique where a hacker attempts to contact each network port on a target system to determine which services are open. The most prominent tool for this task is Nmap, a free utility widely used by both the hacking and security communities. Common Nmap scan types include the Ping scan, Connect scan, SYN scan, and FIN scan. Additional specialized scans include the FIN probe, FTP bounce scan, and SNMP scan.
Vulnerability assessment follows scanning, involving the systematic checking of a system to determine if it is susceptible to specific known attacks. Parallel to this is the process of enumeration, which is the detailed effort to find out exactly what resources, users, and shares are present on the target system. Tools frequently used for enumeration include Cain and Abel, Sid2User, Cheops (for Linux), UserInfo, UserDump, DumpSec, Netcat, and NBTDump.
Advanced Reconnaissance Tools: Shodan
Shodan is a powerful search engine used by both attackers and penetration testers to find specific vulnerabilities across the internet. Unlike traditional search engines that index websites, Shodan indexes the metadata and banners returned by internet-connected devices. It offers advanced search options such as finding servers with default passwords, identifying specific Apache server versions, or locating unsecured webcams. It is an essential tool for searching a company’s domain during a penetration test to see what exposures are visible to the public.
Execution of Actual Attacks: SQL Injection and XSS
One of the most prevalent and dangerous web attacks is SQL Script Injection. This attack depends on the hacker's knowledge of Structured Query Language (SQL) and relational databases to manipulate backend data. It is highly versatile and capable of achieving significantly more damage than many administrators realize. The primary defense against SQL injection is input validation, which involves filtering all user input before it is processed by the database. Despite the availability of this defense, many websites remain vulnerable because they fail to properly filter user-supplied data.
Cross-Site Scripting (XSS) is another common web attack where an attacker injects a client-side script into web pages viewed by other users. The attacker enters these scripts into areas of a site that other users interact with, such as comment sections or profiles. When a victim visits that part of the site, the attacker’s script executes in the victim's browser instead of the intended functionality. A related threat is cross-site request forgery (CSRF), which attacks a website by exploiting the trust the site has in a user’s browser.
Miscellaneous Cyber Attack Vectors
Several other specialized attack methods are employed by hackers to gain unauthorized access. Directory traversal allows an attacker to navigate outside of the web root folder to access restricted directories on the server. Cookie poisoning involves modifying unencrypted cookies to bypass authentication or misrepresent a user's identity. URL hijacking, or typosquatting, involves creating fake URLs that look similar to real ones to trick users into visiting malicious sites. Command injection is specifically designed to execute arbitrary system commands within a vulnerable application. Furthermore, mobile devices are targets for cell phone attacks such as bluesnarfing, bluejacking, bluebugging, and pod slurping.
Password Cracking Techniques and Tools
Password cracking remains a cornerstone of unauthorized access. Several methods are used depending on the strength of the target password. Dictionary attacks use lists of common words and known passwords. Hybrid attacks combine dictionary words with numbers or symbols. Rainbow tables utilize precomputed tables of password hashes to quickly reverse a hash into its plaintext form. Brute-force attacks involve trying every possible combination of characters until the correct one is found.
A popular tool specifically for cracking Windows passwords through rainbow tables is called ophcrack. Other widely recognized tools in the security community for password cracking include Brutus, John the Ripper, WebCracker, THC-Hydra, and Crack Station.
Malware Creation and Windows-Specific Hacking
The creation of malicious software is often facilitated by malware creation utilities that allow even inexperienced users to generate dangerous files. Examples of these utilities include the TeraBIT Virus Maker, Sam’s Virus Generator, Internet Worm Maker Thing, JPS Virus Maker, Deadlines Virus Maker, and Sonic Bat Virus Creator.
The TeraBIT Virus Maker provides a graphical interface for attackers to select various malicious behaviors, including disabling the Windows Firewall, Task Manager, Registry Editor (Regedit), and System Restore. It can also be configured to delete personal files, format hard drives, hide desktop icons, and add unauthorized user accounts. For Windows-specific environments, notable hacking techniques include Pass the Hash (moving laterally using hash credentials), executing Net User Scripts to manipulate accounts, and the "Login as System" technique to gain the highest possible local privileges.
Standards and Methodologies for Penetration Testing
Penetration testing is not a random process; it is a methodical probing of a target network to identify security weaknesses. To ensure consistency and thoroughness, several standards have been developed. These include NIST (Technical Guide to Information Security Testing and Assessment), the National Security Agency (NSA) Information Assessment Methodology (IAM), and the PCI Penetration Testing Standard, which is vital for organizations handling credit card data.
The Dark Web and Onion Routing
The Dark Web is a portion of the internet that cannot be accessed through standard browsers and is only reachable via the onion routing process. Onion routing functions by routing packets through multiple proxy servers worldwide. Each proxy server in the chain can only decrypt one layer of the packet to reveal the destination of the next proxy. If a packet is intercepted between two proxies, the interceptor can only identify the immediate previous and next hops, effectively hiding the actual origin and destination. It is important to note that surfing the Dark Web is inherently dangerous, as many sites are hosts for malware and other cyber threats.
Protective Measures and Further Study
Thwarting hackers requires a multi-layered security approach. The variety of scanning techniques used by attackers underscores the absolute necessity of blocking non-essential traffic at the firewall and maintaining an active Intrusion Detection System (IDS). For students and professionals looking to deepen their expertise, specialized resources such as "Penetration Testing Fundamentals: A Hands-On Guide to Reliable Security Audits" provide comprehensive training on these methodologies.