BASIC HACKING FOR BEGINNERS-
Index-
SECTION 1:- The Theatrical concepts and Explanation.
1 Concept of Ethical Hacking-
- What Is Hacking
- Types of hacker.
- Why hackers hack?
- Prevention from hacker.
- Steps Performed by hackers.
- Working of an Ethical hacker.
2. Email Hacking-
- How Email Works?
- Email service protocols.
- Email spoofing.
- PHP Mail sending script.
- Email Spamming.
- Phishing.
- Prevention from phishing.
- Email Tracing.
- Keystroke loggers.
- Securing Your Email account.
3. Windows Hacking and Security-
- Security Architecture of Windows.
- Windows user account Architecture.
- Cracking Windows User Account password.
- Windows User Account Attack.
- Counter Measures of Windows Attack.
- To hide a file behind a image.
- Make a private folder.
- To run net user in Vista and Windows 7.
- Brute Force Attack.
- Rainbow table attack.
- Counter Measures for Windows Attack.
4. Trojans in Brief -
- Knowing the Trojan.
- Different Types of Trojans.
- Components of Trojans.
- Mode of Transmission for Trojans.
- Detection and Removal of Trojans.
- Countermeasures for Trojan attacks.
5. Attacks on web servers and Security-
- Introduction to Web Servers.
- The Basic Process: How Web servers work.
- Attacks on Web servers.
- Web Ripping.
- Google Hacking.
- Protecting Your Files from Google.
- Cross Site Scripting (XSS).
- Directory Traversal Attack.
- Database Servers.
- Login Process on the websites.
- SQL injection.
- Input validation on the SQL Injection.
- PHP Injection: Placing PHP backdoors.
- Directory Access controls.
- How Attackers Hide Them While Attacking.
- Types of Proxy Servers.
6. Wireless hacking-
- Wireless Standards
- Services provided by Wireless Networks.
- MAC address filtering.
- WEP key encryption.
- Wireless attacks.
- MAC spoofing.
- WEP cracking.
- Countermeasures for Wireless attacks.
7. Mobile Hacking – SMS & Call forging-
- What Does It Involve.
- Call Spoofing / Forging.
- SMS Forging.
- Bluesnarfing.
8. Information gathering and Scanning-
- Why Information gathering?
- Reverse IP mapping.
- Information Gathering Using Search Engine.
- Detecting ‘live’ systems on target network.
- War diallers.
9. Sniffers-
- What are Sniffers ?
- Defeating Sniffers.
- Ant Sniff.
10. Linux Hacking-
- Why Linux?
- Scanning Networks.
- Hacking tool Nmap.
- Password cracking in Linux.
- SARA (Security Auditor’s Research Assistant).
- Linux Root kits.
- Linux Tools: Security Testing tools.
- Linux Security Countermeasures.
INTRODUCTION-
 |
| COMPUTER HACKING |
Computer hacking is the practice of altering computer hardware and software to carry out a goal outside of the creator‘s original intention. People who slot in computer hacking actions and activities are often entitled as hackers.
The majority of people assume that hackers are computer criminals. They fall short to identify the fact that criminals and hackers are two entirely unrelated things. Media is liable for this. Hackers in realism are good and extremely intelligent people, who by using their knowledge in a constructive mode help organizations, companies, government, etc. to secure credentials and secret information on the Internet.
Years ago, no one had to worry about Crackers breaking into their computer and installing Trojan viruses, or using your computer to send attacks against others. Now that thing have changed, it's best to be aware of how to defend your computer from damaging intrusions and prevent black hat hackers. Rampant hacking is systematically victimizing computers around the world. This hacking is not only common, but is being executed without a flaw that the attackers compromise a system, steal everything of value and entirely rub out their pathway within 20 minutes. So, in this Blog you will uncover the finest ways to defend your computer systems from the hackers.
This Blog is written by keeping one object in mind that a beginner, who is not much familiar regarding computer hacking, can easily, attempts these hacks and recognize what we are trying to demonstrate. Here we have incorporated the best ethical hacking articles in this volume, covering every characteristic linked to computer security.
After Reading in this blog all posts you will come to recognize that how Hacking is affecting our every day routine work and can be very hazardous in many fields like bank account hacking etc. Moreover, after carrying out this book in detail you will be capable of understanding that how a hacker hacks and how you can defend yourself from these threats.
So Take care of yourself and Defend Yourself By hacking the hacker and be safe after that. So If you know how to hack a hacker then you can know how to prevent the hacker.
1. Concept of Ethical Hacking
Hacking
The Art of exploring various security breaches is termed as Hacking.
Computer Hackers have been around for so many years. Since the Internet became widely used in the World, We have started to hear more and more about hacking. Only a few Hackers, such as Kevin Mitnick, are well known.
In a world of Black and White, it’s easy to describe the typical Hacker. A general outline of a typical Hacker is an Antisocial, Pimple-faced Teenage boy. But the Digital world has many types of Hackers.
Hackers are human like the rest of us and are, therefore, unique individuals, so an exact profile is hard to outline. The best broad description of Hackers is that all Hackers aren’t equal. Each Hacker has Motives, Methods and Skills. But some general characteristics can help you understand them. Not all Hackers are Antisocial, Pimplefaced Teenagers. Regardless, Hackers are curious about Knowing new things, Brave to take steps and they are often very Sharp Minded.
Hacker
Hacker is a word that has two meanings:
Traditionally, a Hacker is someone who likes to play with Software or Electronic Systems. Hackers enjoy Exploring and Learning how Computer systems operate. They love discovering new ways to work electronically.
Recently, Hacker has taken on a new meaning — someone who maliciously breaks into systems for personal gain. Technically, these criminals are Crackers as Criminal Hackers. Crackers break into systems with malicious intentions.
They do it for Personal gain, Fame, Profit and even Revenge. They Modify, Delete and Steal critical information, often making other people's life miserable.
Hacking has a lot of meanings depending upon the person’s knowledge and his work intentions. Hacking is an Art as well as a Skill. Hacking is the knowledge by which one gets to achieve his Goals, anyhow, using his Skills and Power.
Most people associate Hacking with breaking law, therefore calling all those guys who engage in hacking activities to be criminals. We agree that there are people out there who use hacking techniques to break the law, but hacking is not really about that. In fact, hacking is more about following the law and performing the steps within the limits.
Hacker vs. Cracker
What Is the Difference Between a Hacker and a Cracker?
Many articles have been written about the difference between Hackers and crackers, which attempt to correct public misconceptions about hacking. For many years, media has applied the word Hacker when it really means Cracker. So the public now believe that a Hacker is someone who breaks into computer systems and steal confidential data. This is very untrue and is an insult to some of our most talented Hackers.
There are various points to determine the difference between Hackers and crackers.
Definition - A Hacker is a person who is interested in the working of any computer Operating system. Most often, Hackers are programmers. Hackers obtain advanced knowledge of operating systems and programming languages. They may know various security holes within systems and the reasons for such holes. Hackers constantly seek further knowledge, share what they have discovered, and they never have intentions about damaging or stealing data.
Definition - A Cracker is a person who breaks into other people systems, with malicious intentions. Crackers gain unauthorized access, destroy important data, stop services provided by the server, or basically cause problems for their targets. Crackers can easily be identified because their actions are malicious.
Whatever the case, most people give Hacker a negative outline. Many malicious Hackers are electronic thieves. Just like anyone can become a thief, or a robber, anyone can become a Hacker, regardless of age, gender, or religion. Technical skills of Hackers vary from one to another. Some Hackers barely know how to surf the Internet, whereas others write software that other Hackers depend upon.
Types of Hacker
Let’s see the categories of Hackers on the basis on their knowledge.
Coders
The Real Hackers are the Coders, the ones who revise the methods and create tools that are available in the market. Coders can find security holes and weaknesses in software to create their own exploits. These Hackers can use those exploits to develop fully patched and secure systems.
Coders are the programmers who have the ability to find the unique vulnerability in existing software and to create working exploit codes. These are the individuals with a deep understanding of the OSI Layer Model and TCP/IP Stacks.
Admins
Admins are the computer guys who use the tools and exploits prepared by the coders. They do not develop their own techniques, however they uses the tricks which are already prepared by the coders. They are generally System Administration, or Computer Network Controller. Most of the Hackers and security person in this digital world come under this category.
Admins have experience with several operating systems, and know how to exploit several existing vulnerabilities. A majority of Security Consultants fall in this group and work as a part of Security Team.
Script Kiddies
Next and the most dangerous class of Hackers is Script kiddies, They are the new generation of users of computer who take advantage of the Hacker tools and documentation available for free on the Internet but don’t have any knowledge of what’s going on behind the scenes. They know just enough to cause you headaches but typically are very sloppy in their actions, leaving all sorts of digital fingerprints behind. Even though these guys are the teenage Hackers that you hear about in the news media, they need minimum skills to carry out their attacks.
Script Kiddies are the bunnies who use script and programs developed by others to attack computer systems and Networks. They get the least respect but are most annoying and dangerous and can cause big problems without actually knowing what they are doing.
White Hat Hacker
A White Hat Hacker is computer guy who perform Ethical Hacking. These are usually security professionals with knowledge of hacking and the Hacker toolset and who use this knowledge to locate security weaknesses and implement counter measures in the resources.
They are also known as an Ethical Hacker or a Penetration Tester. They focus on Securing and Protecting IT Systems.
Black Hat Hacker
A Black Hat Hacker is computer guy who performs Unethical Hacking. These are the Criminal Hackers or Crackers who use their skills and knowledge for illegal or malicious purposes. They break into or otherwise violate the system integrity of remote machines, with malicious intent.
These are also known as an Unethical Hacker or a Security Cracker. They focus on Security Cracking and Data stealing.
Grey Hat Hacker
A Grey Hat Hacker is a Computer guy who sometimes acts legally, sometimes in good will, and sometimes not. They usually do not hack for personal gain or have malicious intentions, but may or may not occasionally commit crimes during the course of their technological exploits.
They are hybrid between White Hat and Black Hat Hackers.
Ethical Hacking
Ethical Hacking is testing the resources for a good cause and for the betterment of technology. Technically Ethical Hacking means penetration testing which is focused on Securing and Protecting IT Systems.
Hacktivism
Another type of Hackers are Hacktivists, who try to broadcast political or social messages through their work. A Hacktivist wants to raise public awareness of an issue. Examples of hacktivism are the Web sites that were defaced with the Jihad messages in the name of Terrorism.
Cyber Terrorist
There are Hackers who are called Cyber Terrorists, who attack government computers or public utility infrastructures, such as power stations and air-traffic-control towers. They crash critical systems or steal classified government information. While in a conflict with enemy countries some government start Cyber war via Internet.
Why Hackers Hack?
The main reason why Hackers hack is because they can hack. Hacking is a casual hobby for some Hackers — they just hack to see what they can hack and what they can’t hack, usually by testing their own systems. Many Hackers are the guys who get kicked out of corporate and government IT and security organizations. They try to bring down the status of the organization by attacking or stealing information.
The knowledge that malicious Hackers gain and the ego that comes with that knowledge is like an addiction. Some Hackers want to make your life miserable, and others simply want to be famous. Some common motives of malicious Hackers are revenge, curiosity, boredom, challenge, theft for financial gain, blackmail, extortion, and corporate work pressure.
Many Hackers say they do not hack to harm or profit through their bad activities, which helps them justify their work. They often do not look for money full of pocket. Just proving a point is often a good enough reward for them.
Prevention from Hackers
What can be done to prevent Hackers from finding new holes in software and exploiting them?
Information security research teams exist—to try to find these holes and notify vendors before they are exploited. There is a beneficial competition occurring between the Hackers securing systems and the Hackers breaking into those systems. This competition provides us with better and stronger security, as well as more complex and sophisticated attack techniques.
Defending Hackers create Detection Systems to track attacking Hackers, while the attacking Hackers develop bypassing techniques, which are eventually resulted in bigger and better detecting and tracking systems. The net result of this interaction is positive, as it produces smarter people, improved security, more stable software, inventive problem-solving techniques, and even a new economy.
Now when you need protection from Hackers, whom you want to call, “The Ethical Hackers”. An Ethical Hacker possesses the skills, mindset, and tools of a Hacker but is also trustworthy. Ethical Hackers perform the hacks as security tests computer systems.
Ethical Hacking — also known as Penetration Testing or White-Hat Hacking —involves the same Tools, Tricks and Techniques that Hackers use, but with one major difference:
Ethical hacking is Legal.
Ethical hacking is performed with the target’s permission. The intent of Ethical Hacking is to discover vulnerabilities from a Hacker’s viewpoint so systems can be better secured. Ethical Hacking is part of an overall information Risk Management program that allows for ongoing security improvements. Ethical hacking can also ensure that vendors’ claims about the security of their products are legitimate.
As Hackers expand their knowledge, so should you. You must think like them to protect your systems from them. You, as the ethical Hacker, must know activities Hackers carry out and how to stop their efforts. You should know what to look for and how to use that information to thwart Hackers’ efforts.
You don’t have to protect your systems from everything. You can’t.
The only protection against everything is to unplug your computer systems and lock them away so no
one can touch them—not even you.
That’s not the best approach to information security. What’s important is to protect your systems from known Vulnerabilities and common Hacker attacks.
It’s impossible to overcome all possible vulnerabilities of your systems. You can’t plan for all possible attacks — especially the ones that are currently unknown which are called Zero Day Exploits. These are the attacks which are not known to the world. However in Ethical Hacking, the more combinations you try — the more you test whole systems instead of individual units — the better your chances of discovering vulnerabilities.
Steps Performed By hackers
1) Reconnaissance
2) Scanning
3) Gaining Access
4) Maintaining Access
5) Clearing Tracks
• Performing Reconnaissance
• Scanning and Enumeration
• Gaining access
• Maintaining access and Placing Backdoors
• Covering tracks or Clearing Logs
Phase I: Reconnaissance
Reconnaissance can be described as the pre-attack phase and is a systematic attempt to locate, gather, identify, and record information about the target. The Hacker seeks to find out as much information as possible about the target.Phase II: Scanning and Enumeration
Scanning and enumeration is considered the second pre-attack phase. This phase involves taking the information discovered during reconnaissance and using it to examine the network. Scanning involves steps such as intelligent system port scanning which is used to determine open ports and vulnerable services. In this stage the attacker can use different automated tools to discover system vulnerabilities.Phase III: Gaining Access
This is the phase where the real hacking takes place. Vulnerabilities discovered during the reconnaissance and scanning phase are now exploited to gain access. The method of connection the Hacker uses for an exploit can be a local area network, local access to a PC, the Internet, or offline. Gaining access is known in the Hacker world as owning the system. During a real security breach it would be this stage where the Hacker can utilize simple techniques to cause irreparable damage to the target system.Phase IV: Maintaining Access and Placing Backdoors
Once a Hacker has gained access, they want to keep that access for future exploitation and attacks. Sometimes, Hackers harden the system from other Hackers or security personnel by securing their exclusive access with Backdoors, Root kits, and Trojans. The attacker can use automated scripts and automated tools for hiding attack evidence and also to create backdoors for further attack.
Phase V: Clearing Tracks
In this phase, once Hackers have been able to gain and maintain access, they cover their tracks to avoid detection by security personnel, to continue to use the owned system, to remove evidence of hacking, or to avoid legal action. At present, many successful security breaches are made but never detected. This includes cases where firewalls and vigilant log checking were in place.Working of an ethical hacker
Obeying the Ethical Hacking Commandments:
Every Ethical Hacker must follow few basic principles. If he do not follow, bad things can happen. Most of the time these principles get ignored or forgotten when planning or executing ethical hacking tests. The results are even very dangerous.Working ethically:
The word ethical can be defined as working with high professional morals and principles. Whether you’re performing ethical hacking tests against your own systems or for someone who has hired you, everything you do as an ethical Hacker must be approved and must support the company’s goals. No hidden agendas are allowed! Trustworthiness is the ultimate objective. The misuse of information is absolutely not allowed. That’s what the bad guys do.Respecting privacy:
Treat the information you gather with complete respect. All information you obtain during your testing — from Web application log files to clear-text passwords — must be kept private.Not crashing your systems:
One of the biggest mistakes is when people try to hack their own systems; they come up with crashing their systems. The main reason for this is poor planning. These testers have not read the documentation or misunderstand the usage and power of the security tools and techniques. You can easily create miserable conditions on your systems when testing. Running too many tests too quickly on a system causes many system lockups. Many security assessment tools can control how many tests are performed on a system at the same time. These tools are especially handy if you need to run the tests on production systems during regular business hours.
Executing the plan:
In Ethical hacking, Time and patience are important. Be careful when you’re performing your ethical hacking tests. A Hacker in your network or an employee looking over your shoulder may watch what’s going on. This person could use this information against you. It’s not practical to make sure that no Hackers are on your systems before you start. Just make sure you keep everything as quiet and private as possible. This is especially critical when transmitting and storing your test results. You’re now on a reconnaissance mission. Find as much information as possible about your organization and systems, which is what malicious Hackers do. Start with a broad view of mind and narrow your focus. Search the Internet for your organization’s name, your computer and network system names, and your IP addresses. Google is a great place to start for this.
Don’t take ethical hacking too far, though. It makes little sense to harden your systems from unlikely attacks. For instance, if you don’t have a internal Web server running, you may not have to worry too much about. However, don’t forget about insider threats from malicious employees or your friends or colleagues.
2. Email hacking -
How Email Works?
Email sending and receiving is controlled by the Email servers. All Email service providers configure Email Server before anyone can Sign into his or her account and start communicating digitally. Once the servers are ready to go, users from across the world register in to these Email servers and setup an Email account. When they have a fully working Email account, they sign into their accounts and start connecting to other users using the Email services.
Email Travelling Path
Let’s say we have two Email providers, one is Server1.com and other is Server2.in, ABC is a registered user in Server1.com and XYZ is a registered user in Server2.in. ABC signs in to his Email account in Server1.com, he then writes a mail to the xyz@server2.in and click on Send and gets the message that the Email is sent successfully.
But what happens behind the curtains, the Email from the computer of abc@server1.com is forwarded to the Email server of Server1.com. Server1 then looks for server2.in on the internet and forwards the Email of the server2.in for the account of XYZ. Server2.in receives the Email from server1.com and puts it in the account of XYZ.
XYZ then sits on computer and signs in to her Email account. Now she has the message in her Email inbox.
