Ethical Hacking by Krutarth Vasavada

Presented to ATMIYA University
ethical
/ˈɛθɪk(ə)l/
adjective
relating to moral principles or the
branch of knowledge
dealing with these.

Krutarth Vasavada
• B.E. (Electronics and Communication), AITS 2002-06
• M.S. (Computer Engineering), San Jose State University,
California, US
• Certified Cloud Security Professional, ISC2
• 13+ Years into Software Product Development,
Cybersecurity, Information Security Audits, Data
Privacy & Compliance
• Worked in India, USA, EU (currently) in Automobile,
Chemicals, Insurance, Investment Banking, and e-
Commerce domains.

Topics
Let’s Refresh
01
What is hacking?
– Ethical /
Unethical
02
Why hack(ing)?
03
Type of attacks
04
Cause of attacks
05
Prevention
06
Career
Opportunities
07

Let’s Refresh: Why Cybersecurity?
CONFIDENTIALITY
Unauthorized individuals or
entities can not get any
information that is not intended
for them.
INTEGRITY
The accuracy and
completeness of data must be
assured.
AVAILABILITY
It must be ensured that vital
information is available
whenever needed.

Let’s Refresh: How are we dealing with cyber
attacks?
To be honest, pretty badly! Here’s the list of data breaches occurred during the year 2020 so far.

Next Topic
Let’s Refresh
01
What is hacking?
– Ethical /
Unethical
02
Why hack(ing)?
03
Type of attacks
04
Cause of attacks
05
Prevention
06
Career
Opportunities
07

What is Hacking?
Hacking is an attempt to exploit
a computer system or a private
network.
In simple words, it is the
unauthorized access made
over computer network security
systems for some illicit / illegal
purpose.

What is Ethical Hacking?
Ethical Hacking is an attempt to
exploit a computer system or a
private network.
In simple words, it is the
unauthorized access made
over computer network security
systems for some illicit / illegal
known / valid / approved
purpose.

Characteristics of Ethical Hacking
• Target is almost always known
• Identity of technical professionals involved
is known to some extent
• Neither the target system is damaged, nor
information is stolen
• Vulnerabilities are always reported back to
the owner(s)

Who is an ethical hacker?
Person who is
• interested in cybersecurity
• keen to explore various computer networks
• aware of damage a security loophole can cause
• interested in improving overall security of the
target system
Remember, being motivated by monitory reasons is
NOT a bad thing for an ethical hacker.

Next Topic
Let’s Refresh
01
What is hacking?
– Ethical /
Unethical
02
Why
hack(ing)?
03
Type of attacks
04
Cause of attacks
05
Prevention
06
Career
Opportunities
07

Who is interested in hacking – ethically or
otherwise?
Individuals
Corporations
Governments

Why to hack – ethically or otherwise?
Many reasons
• Steal information
• Earn money (not always a bad thing!)
• Just for fun!
• Attack enemy system/company/country/ideology
• To understand the current security status of the
system
• To remain secure

Next Topic
Let’s Refresh
01
What is hacking?
– Ethical /
Unethical
02
Why hack(ing)?
03
Type of
attacks
04
Cause of attacks
05
Prevention
06
Career
Opportunities
07

Hacking Attack
Success, scale, and impact of any hacking attempt
depends on three things.
Exploitability – How easy the system is to exploit?
Prevalence – How widespread/prevalent the
system and vulnerability are?
Detectability – How easy it is to detect the intended
security defect?

Type of Vulnerabilities
Before understanding type of attacks, it is important
to understand type of vulnerabilities.
Let’s go the most trusted industry standard
resource:
Open Web Application Security Project (OWASP)

Commonly Known Cybersecurity Attacks
Denial-of-service (DoS)
and distributed denial-
of-service (DDoS)
Man-in-the-middle
(MitM)
Phishing Drive-by attack
Identity Theft SQL Injection
Cross-site scripting
(XSS)
Eavesdropping
Malware/Ransomware

Next Topic
Let’s Refresh
01
What is hacking?
– Ethical /
Unethical
02
Why hack(ing)?
03
Type of attacks
04
Cause of
attacks
05
Prevention
06
Career
Opportunities
07

How an attack is caused?
Footprinting
Sniffing
Fingerprinting
DNS Poisoning
Social Engineering
Password Hacking

Attack type: Footprinting
In this type of attack, a hacker attempts to gather
something information around
• Domain name
• IP Addresses
• Namespaces
• Employee information
• Phone numbers
• E-mails
• Job Information
Depending on type of the target system, this can be very
crucial or not-so-crucial information.

Attack type: Sniffing
Sniffing is the process of monitoring and capturing all the packets passing
through a given network using sniffing tools.
It is a form of “tapping phone wires” and get to know about the
conversation. It is also called wiretapping applied to the computer
networks.
One can sniff the following sensitive information from a network −
Email traffic
FTP passwords
Web traffics
Telnet passwords
Router configuration
Chat sessions
DNS traffic

Attack type: Fingerprinting
Active Fingerprinting
Active fingerprinting is accomplished by sending specially
crafted packets to a target machine and then noting down
its response and analyzing the gathered information to
determine the target OS.
Passive Fingerprinting
Passive fingerprinting is based on sniffer traces from the
remote system. Based on the sniffer traces (such as
Wireshark) of the packets, you can determine the operating
system of the remote host.

Attack type: DNS Poisoning
DNS Poisoning is a technique that tricks a DNS server into
believing that it has received authentic information when, in
reality, it has not. It results in the substitution of false IP
address at the DNS level where web addresses are
converted into numeric IP addresses.
DNS poisoning is used to redirect the users to fake pages
which are managed by the attackers.

Attack type: Social Engineering
A phishing attack is a computer-based social engineering,
where an attacker crafts an email that appears legitimate.
Such emails have the same look and feel as those received
from the original site, but they might contain links to fake
websites. If you are not careful enough, then you will type
your user ID and password and will try to login which will
result in failure and by that time, the attacker will have your
ID and password to attack your original account.

Attack type: Password/Dictionary Hacking
In a dictionary attack, the hacker uses a predefined list of
words from a dictionary to try and guess the password. If
the set password is weak, then a dictionary attack can
decode it quite fast.

How to prevent attacks
Question: Is it possible to be 100% secure?
Answer: It depends.
Answer Explanation: Don’t put a $10 lock on a $5 bicycle!

Each attack requires unique approach in averting them.
Multiple factors contribute in determining the course of
action.
• Tactical Fix or Strategic Solution?
• Impacted target audience?
• Geography?
• Functional area/Domain?
• Historical trends? etc.

Good News – Ethical Hackers Can Help!
• Know their subject
• Understand impact of an attack
• Aware of known vulnerabilities
• Wide range of tools/technology to choose from
• Most importantly – no malicious intention

Remember…
The more you sweat in peace,
the less you bleed in war!
Ethical hacking is a proactive and preventive measure

What are the skills needed?
computer systems expertise
strong programming skills
computer networking knowledge
patience

Which tools* can help me?
nmap
burp suite
etherpeak
qualysguard
webinspect
postman
etc.
* there can never be an exhaustive or a definitive tool list. Consider these as a
recommendation to start with.

How to avail career opportunities?
Step 1
•Obtain a Bachelor’s degree in Computer Science (or, similar) or A+ Certification
•Gain an understanding of the most common hardware and software technologies.
Step 2
•Get into a programmer’s role for a few years
Step 3
•Proceed to get network certifications or security certification
Step 4
•Keep going through various books, tutorials and papers to understand various computer security aspects
Step 5
•Master the art of penetration testing, footprinting and reconnaissance, and social engineering.
Step 6
•Certified Ethical Hacker (CEH) Certification

In conclusion
“Government agencies and business organizations
today are in constant need of ethical hackers to
combat the growing threat to IT security. A lot of
government agencies, professionals and
corporations now understand that if you want to
protect a system, you cannot do it by just locking
your doors”
EC-Council

Ethical Hacking by Krutarth Vasavada

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à Ethical Hacking by Krutarth Vasavada

Similaire à Ethical Hacking by Krutarth Vasavada (20)

Dernier

Dernier (20)

Ethical Hacking by Krutarth Vasavada