Introduction
I am certain that your primary goal is to get certification as a Certified Ethical Hacker (CEH). It’s possible that you’ve already completed the CEH training provided by EC-Council and are looking for a new viewpoint to aid your study for the test.
It’s also possible that you’ve opted to study for the test on your own and have enough experience to do so. No matter how you got here, you’ll benefit from this article’s guidance while you study for the test.
There is a vast variety of information to cover on the test, and it’s important to have a thorough grasp of everything. In particular, if you decide to go to the practical test, this is true. You’ll learn about the exam’s fundamentals in this blog post.
To begin, you’ll discover what ethical hacking is and isn’t. The ethical component of the phrase “ethical hacking” is crucial. In order to pass the test, you must adhere to certain rules. For the rest of your professional life, it’s imperative that you comprehend that code.
To wrap off this series on EC-Council, you’ll learn about the exam’s structure, as well as other valuable information. Despite the fact that some of it may appear minor, it might be useful to have an understanding of the exam’s purpose and the organization that administers it.
In order to really appreciate anything, I like to go to the root of it rather than just enjoy the surface level effects. As a consequence, you’ll have access to the macro description, which you may use or ignore as you see fit. It won’t be on the test, but knowing what’s going on behind the scenes might give you a better idea of what the test is testing for.
Ethics for ethical hackers: A Quick Guide
Ethical hacking is a significant topic that deserves its own section, so let me begin there. “Ethical hacking” isn’t a term you’ll see used. It’s legal hacking. The most crucial element is at the front. Because ethics is not universal, it may be a difficult topic to study. People’s definitions of what is and isn’t ethical vary widely.
The Certified Ethical Hacker certification requires that you comprehend the difference between ethical and unethical conduct. This is an important part of the certification exam and the exam itself. Since you’ll have access to sensitive data and vital systems, it’s imperative that you do your best. You must conduct yourself and your job ethically in order to maintain your status as a professional. Additionally, you must abide by the company’s established code of ethics.
You will be required to swear an oath as part of the code of ethics to safeguard the privacy and intellectual property of your employers and customers by keeping the information you collect through your employment secret.
When you go after other people’s computers, you run the risk of getting access to their private data. It’s possible that you’ll uncover information that’s crucial to the company you work for. The confidentiality of the information is compromised if any of that data is not adequately protected.
You must tell your clients what they need to know if they’ve hired you to do so. Any problems you’ve found should be mentioned here. A possible conflict of interest must be disclosed as well. When it comes to safeguarding your customers, employers, and business interests, you must be honest and do the right thing.
Furthermore, if you discover anything that has the potential to affect a significant number of individuals on the Internet, you must make a responsible disclosure of it. By this, we do not imply making it available to the whole public. The term “collaboration” refers to the process of sharing your results with your company, any relevant vendors, and any computer emergency response teams (CERTs).
Resources offered by the customer or firm will be made available to you as you go about your task. You must sign a code of ethics before using any of the equipment. Nothing you have access to as part of your job or contract may be damaged by you. Occasionally, the testing you do may do harm to the infrastructure supplied by the firm you work for or with.
It’s OK as long as it’s inadvertent or agreed upon by the employer. Keeping communication lines open at all times might help lessen this fear. If an unexpected outage occurs, it is critical that the relevant individuals be informed so that the problem can be fixed.
You are not permitted to participate in any criminal activities, even if you think it’s obvious. You also can’t have a criminal record or have broken any laws. Additionally, even though it is not prohibited, you are not permitted to be a member of any organization that may be called “black hat,” meaning they are engaging in acts that may be considered unlawful, such as the harmful hacking of computer systems.
Ethics and hat colors
As you’ve probably heard, there are three basic types of political hats: white, black, and gray. White hat hackers are those that always put the welfare of others first. Black hat hackers, as the name suggests, are those who engage in illegal activities. In the center are gray hat hackers. They’re doing fantastic work, but they’re using black hat hacking tactics.
Regardless of whether you are employed on a contract basis or on a full-time basis, it is critical that you maintain open lines of communication throughout the duration of your employment. It’s critical to be very forward with the client about what they can and cannot anticipate from your services before accepting the agreement. Everything is obvious and recorded if the extent of your services is documented in writing.
Ethical work may be done as long as the task at hand does not violate any laws, and the scope of operations fits within those of the firm you work for. It is immoral to do anything outside of the realm of systems, networks, and services.
Ethical Hacking: In few words
Data theft, Internet-based crime, and a variety of other assaults on individuals and companies are almost always covered in the news. We’re more likely to hear about the huge hacks, when a lot of people’s personal information is at risk, rather than the smaller ones.
However, the number of system breaches involving a person’s own computer or other electronic device is hidden from view. Affected devices running an embedded Linux implementation include those infected by the Mirai botnet. Over 100,000 devices are believed to have been infected and used as part of the botnet, with the potential for more than one million.
Millions of new pieces of malware are written every year, many of which take use of newly found security flaws. Every year since 2005, at least 10 million records have been hacked. Nearly 200 million records were hacked in 2017 alone. All of these figures are based on data collected inside the United States alone.
There are only roughly 250 million individuals in the United States, thus it’s reasonable to conclude that every adult has had their personal information hacked several times.. As a point of clarification, the data records we’re referring to are those of individuals, not corporations. The overall worth of intellectual property that may have been taken is unknown, although the hack has been continuing for some time.
As a result, there is a pressing need to enhance the management of information security. Defending against assaults requires an understanding of what such attacks are and how they work. You should try to duplicate the strikes as closely as possible. If firms are testing their own infrastructure for assaults early and often, they may be better positioned to enhance their defenses and keep the actual attackers out.
Ethical hacking, in its purest form, consists of tests like these. It’s all about finding and fixing flaws in order to improve the target’s overall security. That’s possible for a company’s IT infrastructure or simply a single computer on a desktop.
Testing against software to find defects that might be exploited as a way to compromise the program and the system on which it is operating is another possibility. Not to do harm, but rather to improve things by being on the “good” side of things. Businesses may employ or contract individuals to carry out this task. Alternatively, they may have a group of online apps or systems that they wish to have examined. Testing software is another possibility. Many individuals test software, whether it’s open source or commercial.
The term “ethical hacking” may be used to a wide range of activities. When it comes to job descriptions, the word “ethical hacking” may not necessarily appear. Penetration testing, on the other hand, is the phrase used instead. It all boils down to the same principle. As the name suggests, the goal of a penetration test is to break into an organization’s defenses. Ethical hackers may also have this as their end purpose.
Penetration testing may sometimes be known as “red teaming,” in which case the testers are believed to be adversaries of the company and network being tested. In other words, a red team member would behave as if they were an assailant, making every effort to remain undetected.
One of the most difficult components of this kind of activity is the need to think like an attacker. This kind of testing may be difficult and demands a different mindset. The importance of a methodology for doing any kind of testing, including ethical hacking, cannot be overstated. There are a variety of approaches you may use. In the long run, seasoned professionals may have evolved their own unique approach to the job.
In order to guarantee that this work is done ethically, the EC-Council requires that anybody who has achieved the Certified Ethical Hacker (CEH) certification agrees to a code of conduct. This code of ethics ensures that persons with the CEH certification act ethically in service to their employers.
There is an expectation that they will not undermine the security posture and that they will try to improve the security posture rather than harming it.
Ethical Hacking Methodology
The underlying approach is designed to replicate the actions of real-life attackers. Information gleaned from the various stages described here may be used to strengthen a company’s security measures.
Reconnaissance and Footprinting
Reconnaissance is the process of learning as much as possible about your prey. To begin with, you need to know the scope of your project. As a result, you’ll be able to focus your efforts on just those activities that are ethically sound.
Some idea of who your target is, but not necessarily all the specifics, will be in your head. One of the purposes of reconnaissance is to gather information about your target. It’s also possible your firm would like to keep sensitive information from being leaked, even though the Internet and the necessity to do business online necessitate a great deal of information being made publicly available.
It’s important to know the size and breadth of your test during reconnaissance and footprinting.
Footprinting is the process of determining a company’s “footprint,” or the dimensions and external look. This includes identifying network blocks, hosts, locations, and individuals. Throughout the rest of the game, you’ll be able to refer back to this knowledge.
Be aware that when searching for information on your target, you may come across network blocks and hosts that may belong to systems hosted by a third-party service provider, as well. It’s essential to keep track of everything you learn and not simply rely on information regarding network restrictions the organization may have if these systems operate services that give access points or merely contain sensitive data.
You may come across personal information pertaining to workers of your target while executing this activity. When it comes to social engineering assaults, this will come in handy. There are a lot of these kinds of assaults out there. These social engineering efforts may be responsible for as many as 80 to 90 percent of infiltrations, according to some estimates Although they aren’t the only route in, they’re usually the quickest.
Scanning and Enumeration
The scanning and enumeration step begins when you’ve identified the network blocks and the systems available inside them. In addition, you’ll need to know what services are running on every host that’s accessible. These services will serve as gateways in the end. The goal is to get access, and exposed network services may be a way to do so. Also included is information on the service and software operating behind each port that’s accessible through an open port.
This may potentially lead to the collection of data from other services. A web server’s software (nginx, Apache, or IIS) is included in this category. Aside from the program itself, there are services that may give a wealth of information on the inner workings of a business. One such example of this would be usernames.
Some SMTP servers will return acceptable usernames if they are requested in the proper manner. Server Message Block (SMB) and Common Internet File System protocols may be used to request information from Windows servers. Details such as shared folders, users, and certain policy information are also available. The goal of this phase is to amass as much data as possible so that you have a starting point for the following step.
This step might take a long time, particularly if you’re dealing with a large network or company. The more information you can get from this stage, the simpler it will be for you to go on to the next.
Gaining Access
A penetration test is all about gaining access, and for many individuals, this is the most exciting element of the process. You may use this evidence to show that some services are at risk. This may be accomplished by abusing the service in some way.
Theoretical or false positives have no place when you can demonstrate that a system or its contents have been hacked. Ethical hacking must always include documentation, and this example emphasizes the importance of that component.
“Hey, I accomplished this,” on its alone, isn’t going to enough. You’ll have to show or verify that you were able to get into the system in some manner.
Social engineering assaults, rather than technical attacks, are significantly more likely to be used by attackers to obtain access to systems, despite the fact that they are more difficult to detect. Enumeration is crucial since it gives you a list of people to target in social engineering assaults.
Social engineering attacks may be carried out in a variety of methods, including through email, which can either infect a computer with malware or collect personal information from the user. For example, the login and password might be included here.
Getting them to go to a website is another way to get them to give you their information. It’s possible that you, the attacker, have placed malicious code on this page in order to infect the victim’s computer. Perhaps you’re just trying to get their opinion on something. Malware has been referenced twice in this article. An understanding of how malware works and where it may be utilized is a key aspect of getting access.
Performing social engineering assaults isn’t something you’ll be expected to do all the time. While many companies are aware of social engineering assaults, they may not want or anticipate you to carry out phishing attacks or other web-based attacks. As a result, despite their relative simplicity, these approaches should not be relied upon to gain access to systems.
Maintaining Access
Once you’ve gained access, mimicking typical assault tactics is the best way to keep it. As soon as the user turns off their machine, you will no longer have access to the system. The system may need to be re-compromise as a result of this.
It is possible that the next time you try to breach, you will be denied access since vulnerabilities are not always successful. In addition, you may have exploited a vulnerability that has since been patched. Because the vulnerability has been eliminated, your next attempt may fail.
To ensure that you have access to the system and maybe the whole company network, you need to provide yourself with other methods of gaining access.
Another stage at which malware might be advantageous is here. There are several rootkits out there that may give a backdoor as well as the ability to hide your activities and presence on a computer. Access to the computer may need the use of third-party software. Following the first penetration, you may need to transfer the program onto your target machine.
As a result, this step isn’t as straightforward as it first seems to be. To ensure that you have access, there may be a lot of reasons. Maintaining access is possible in a variety of ways. Techniques vary per operating system, although newer versions and updates might make older ones more difficult.
The difficulty of ethical hacking is partly due to the fact that it is context-dependent. There are no simple solutions or methods. Because of fixes that are available but not installed, a single Windows 10 machine may be vulnerable. Windows 10 systems that have been updated and configured with permissions and other security measures may be more difficult to get into.
Covering Tracks
Covering your tracks is the process of erasing or concealing any evidence you may have accessed. As a last precaution, you should ensure that you have uninterrupted access. Malware may be used to guarantee that your activities are not tracked or to misreport system information, such as network connections.
If you’re attempting to hide anything, bear in mind that your behaviors may serve as proof of your efforts. For instance, deleting logs from a Windows computer leaves a log entry stating that the logs have been deleted. Anyone keeping an eye on the logs may see this as a sign that evidence has been attempted to be removed.
It’s not a certainty that the log wipe was malicious, but it may be enough to inspire someone to look into the matter further. Covering tracks might be difficult because of this. However, this may be precisely what you’ve been asked to do—challenge and test the operational skills of the team. Because of this, it is critical to keep in mind the goals of your relationship.
Summary
Certifying Ethical Hacker certification requires that you comprehend the difference between ethical and unethical conduct. Because ethics is not universal, it may be a difficult topic to study. Knowing what’s going on behind the scenes might give you a better idea of what the test is testing for.
You will be required to safeguard the privacy and intellectual property of your employers and customers. The confidentiality of the information is compromised if any of that data is not adequately protected.
Ethical hackers may also have this as their end purpose. Penetration testing may sometimes be known as “red teaming,” in which testers are believed to be adversaries of the company being tested. The EC-Council requires that Certified Ethical Hacker (CEH) certification agrees to a code of conduct.
The underlying approach is designed to replicate the actions of real-life attackers. Information gleaned from the various stages described here may be used to strengthen a company’s security measures.
Scanning and enumerating the network blocks and systems available inside them. These services will serve as gateways in the end. The goal is to amass as much data as possible so that you have a starting point for the next step. This step may take a long time, particularly if dealing with a large network or company. Social engineering assaults, rather than technical attacks, are significantly more likely to be used by attackers to obtain access to systems.
