Ethical Hacking

Ethical Hacking is an authorized practice of bypassing system security to identify potential data breaches and threats in a network. 

Ethical hacking is a subpart of cyber security. It involves finding vulnerabilities and reporting them to the system’s owner.

Ethical hackers hack into the system to find the flaws in the system and keep it safe.

Ethical hackers aim to investigate the system or network for weak points that malicious hackers can exploit or destroy. They collect and analyze the information to figure out ways to strengthen the security of the system/network/applications.

Type of Hackers

i. “White Hat” hacking – practice of ethical hacking

ii. “Black Hat” hacking describes practices involving security violations. The Black Hat hackers use illegal techniques to compromise the system or destroy information.

iii. “Grey Hat” hacking - “Grey Hat” hackers don’t ask for permission before getting into your system. But Grey Hats are also different from Black Hats because they don’t perform hacking for any personal or third-party benefit. These hackers do not have any malicious intention and hack systems for fun or various other reasons, usually informing the owner about any threats they find. Grey Hat and Black Hat hacking are both illegal as they both constitute an unauthorized system breach, even though the intentions of both types of hackers differ.

Ethical Hacker Roles and Responsibilities

Ethical Hackers must follow certain guidelines in order to perform hacking legally.

The most important rules of Ethical Hacking:

• An ethical hacker must seek authorization from the organization that owns the system. Hackers should obtain complete approval before performing any security assessment on the system or network.
• Determine the scope of their assessment and make known their plan to the organization.
• Report any security breaches and vulnerabilities found in the system or network.
• Keep their discoveries confidential. As their purpose is to secure the system or network, ethical hackers should agree to and respect their non-disclosure agreement.
• Erase all traces of the hack after checking the system for any vulnerability. It prevents malicious hackers from entering the system through the identified loopholes.

Phases of Ethical Hacking

The five phases of ethical hacking (not necessarily a hacker has to follow these 5 steps in a sequential manner) are:

Phase 1: Reconnaissance 

This phase is also called as Footprinting and information gathering Phase, and int this phase hacker gathers information about a target before launching an attack.  It is during this phase that the hacker finds valuable information such as old passwords, names of important employees.

Footprinting is a method that used for collecting data from target system. These data include important areas such as:

1. Finding out specific IP addresses
2. TCP and UDP services
3. Identifies vulnerabilities

There are also other ways to do footprinting, including impersonating a website by mirroring it, using search engines to find information about the organization, and even using the information of current employees for impersonation. 

Phase 2: Scanning 

In this phase, hackers are probably seeking any information that can help them perpetrate attack such as computer names, IP addresses, and user accounts. In fact, hacker identifies a quick way to gain access to the network and look for information. This phase includes usage of tools like dialers, port scanners, network mappers, sweepers, and vulnerability scanners to scan data.

Basically, at this stage, four types of scans are used:

1. Pre-attack: Hacker scans the network for specific information based on the information gathered during reconnaissance.
2. Port scanning/sniffing: This method includes the use of dialers, port scanners, and other data-gathering equipment.
3. Vulnerability Scanning: Scanning the target for weaknesses/vulnerabilities.
4. Information extraction: In this step, hacker collects information about ports, live machines and OS details, topology of network, routers, firewalls, and servers.

Phase 3: Gaining Access

At this point, the hacker has all the information to attack. The hacker gains access to the system, applications, and network, and escalates their user privileges to control the systems connected to it.

Phase 4: Maintaining Access 

Once a hacker has gained access to the system, they keep that access for future exploitation and attacks. The hacker secures access to the organization’s Rootkits and Trojans and uses it to launch additional attacks on the network.

The hacker from this point creates a new administrator account for themselves based on the naming structure and tries to blend in. 

Phase 5: Clearing Tracks

An intelligent hacker always clears all evidence so that in the later point of time, no one will find any traces leading to hacker.

A hacker clears his traces by

1. Clearing the cache and cookies
2. Modifying registry values
3. Modifying/corrupting/deleting the values of Logs
4. Clearing out Sent emails
5. Closing all the open ports
6. Uninstalling all applications that he/she be used