<h1>Introduction to Ethical Hacking</h1>

Hackers exploit vulnerabilities and compromise security controls to gain unauthorized access to system resources in an organization. Hacking can modify system or application features contrary to the original purpose and can steal or corrupt data.

In contrast, ethical hacking involves using the same hacking tools and techniques to identify vulnerabilities in a system and address them before they can be exploited. To beat a hacker, one needs to think like a hacker.

There are different types of hackers:

• Black Hat Hackers: Individuals with extraordinary computing skills who use these advanced skills with malicious intent.
• White Hat Hackers: Ethical hackers with advanced computing skills who use their skills for defensive purposes.
• Gray Hat Hackers: Advanced computer users who work both offensively and defensively and often are security consultants, or white hat hackers who moonlight as black hat hackers.

Ethical hackers must uncover vulnerabilities in the systems and review the compliance of existing security practices to industry standards. Afterwards, it is their responsibility to analyze and strengthen security policies, network infrastructure, and end-user practices to safeguard the organization from cyber threats.

Here is a brief overview of the five phases of hacking:

Often, the terms Footprinting and Reconnaissance are used interchangeably referring to the process of gathering information to create a blueprint or map of an organization’s network and systems.

Phase1 - Reconnaissance

In general terms, reconnaissance is the act of gathering preliminary data or intelligence on a target in order to better plan for the attack.

Reconnaissance can be performed actively or passively:

• Passive Reconnaissance – gathering information without interacting directly with the target
• Active Reconnaissance – gathering information in ways that might be detected by the target

Passive reconnaissance is usually done using open-source intelligence (OSINT) techniques and tools but can also rely on other approaches like dumpster diving. The goal is to gather or connect information on your target to try to understand who they are, what they do, their networks size and structure, and relationships to other organizations.

Active reconnaissance might involve collecting more specific data to reduce the focus area such as finding out specific IP addresses or domain names. There are also other ways to do footprinting like impersonating a website by mirroring it and even using information of current employees for impersonation.

Phase 2 - Scanning and Enumeration

After getting some surface knowledge of the network now it’s time to scan the network. The phase of scanning requires the application of technical tools to gather further intelligence on the target, but in this case, the intel being sought is more commonly about the systems that they have in place. It involves taking the information discovered during reconnaissance and using it to examine the network. In this phase, the hacker identifies a quick way to gain access to the network and look for information.

Scanning

Scanning is a set of techniques used to sweep the network devices to find vulnerabilities or open doors than can be used to enter the network or system. In general, there are three types of scanning:

• Network Scanning – Done to actually find the systems that are online in order to prevent wasting time targeting systems that don’t even exist. Ping sweep is a popular method done to find the systems that are running or online.
• Port Scanning – Different tools are used to identify the services or applications running on those system. Here, TCP/UDP ports are scanned. The operating system and its version number are usually identified in this scan. Nmap is a popular tool just to do this.
• Vulnerability Scanning – To make the attack more specific, automated tools are used to find vulnerabilities.

The results of the scanning process will then be used to plan out the rest of the hacking activities.

Enumeration

Often forgotten, enumeration is the last of three pre-attack stages:

This is a progression, it starts out very broad, and footprinting is used to narrow it down; then scanning is used to figure out what's available; finally, enumeration organizes and prioritizes what’s really relevant for the attacks. Combining the information of all the three stages the attacker gets an attack surface which he will try to exploit.

Looking at this from a standpoint of progression, the attack starts at the top with footprinting where possibly the entire Internet is the starting point. Footprinting will slim that down to the target network. The result might be a network of, let's say, 700 IP addresses. Then scanning is used to find out the alive hosts and information about them. So out of those 1,000 IP addresses, let's say 300 of them are actually open and have something running on it. And then enumeration will try to find particular information from those alive hosts. Information such as usernames, machine names, share paths, etc. is collected in this last stage.

Phase 3 - Gaining Access

Having designed the blueprint of the target’s network with the help of data collected during Phase 1 and Phase 2, it’s time for the hacker to gain access to the target’s systems, taking control of one or more network devices in order to either extract data from the target, or to use that device to then launch attacks on other targets.

Vulnerabilities discovered during the reconnaissance and scanning phase are now exploited to gain access. The method of connection the hacker uses for an exploit can be a LAN (wired or wireless), local access to a PC, the Internet, or offline.

Quite often the attack starts with social engineering, like phishing, but it is also very common to use more in depth techniques. Examples include stack-based buffer overflows, denial of service (DoS), and session hijacking.

Phase 4 - Maintaining Access

Once the hacker has gained access, he wants to keep that access for future exploitation and attacks.

Maintaining access requires taking the steps involved in being able to be persistently within the target environment in order to gather as much data as possible. The attacker must remain stealthy in this phase, so as to not get caught while using the target’s environment.

No overt exploitation or attacks will occur at this time.  If there is no evidence of detection, a waiting game is played letting the victim think that nothing was disturbed. 

The controlled system can be used as a base to launch additional attacks. In this case, the owned system is sometimes referred to as a zombie system.

Phase 5 - Covering Tracks

Covering tracks simply means that the attacker must take the steps necessary to remove all semblance of detection. Any changes that were made, authorizations that were escalated etc. all must return to a state of non-recognition by the target’s network administrators.

Hackers do this by clearing the cache and cookies, tampering the log files and closing all the open ports. This step is important because it clears the system information making hacking a great deal harder to track.