SECRETS OF A SUPER HACKER
GO THROUGH THE USER GUIDE FOR ANY COMMERCIAL TOOL JOIN AN ONLINE OR FORMAL CLASS TO LEARN MORE ABOUT THE TOOL EXECUTING THE PLAN YOU NEED TO BE PATIENT AND HAVE ENOUGH TIME ON YOUR HANDS TO PERFORM THE HACK YOU ALSO HAVE TO BE CAREFUL WHILE PERFORMING THE HACK AN EMPLOYEE LOOKING OVER YOUR SHOULDER OR A HACKER IN THE NETWORK WILL ALWAYS WATCH WHAT’S GOING ON, AND THIS PERSON WILL USE THE INFORMATION THEY HAVE OBTAINED AGAINST YOU YOU CANNOT EXPECT TO PERFORM AN ETHICAL HACK WHEN THERE ARE NO CRACKERS IN THE NETWORK, BECAUSE THAT DOES NOT HAPPEN YOU HAVE TO ENSURE THAT YOU KEEP EVERYTHING PRIVATE AND QUIET THIS IS CRITICAL WHEN YOU ARE DERIVING, TRANSMITTING AND STORING THE RESULTS OF THE TEST YOU SHOULD TRY TO ENCRYPT THESE FILES AND EMAILS USING TOOLS LIKE PRETTY GOOD PRIVACY (PGP) AND OTHERS THE LEAST YOU CAN DO IS TO PROTECT THE FILES USING A PASSWORD YOU’RE ON A MISSION TO GET AS MUCH INFORMATION AS YOU CAN ABOUT THE SYSTEM YOU’RE TESTING THIS IS WHAT A CRACKER WILL DO YOU SHOULD BEGIN WITH A BROAD PERSPECTIVE AND THEN NARROW YOUR FOCUS: 1 LOOK FOR THE NAME OF THE ORGANIZATION, COMPUTER, NETWORK SYSTEM AND THE IP ADDRESS; THIS INFORMATION WILL OFTEN BE AVAILABLE ON GOOGLE 2 NOW, NARROW THE SCOPE AND TARGET THE SYSTEMS THAT YOU’RE TESTING A CASUAL ASSESSMENT WILL TURN UP SOME INFORMATION ABOUT THE SYSTEM, REGARDLESS OF WHETHER YOU ARE ASSESSING WEB APPLICATIONS OR PHYSICAL-SECURITY 3 NARROW THE FOCUS WITH A CRITICAL EYE AND PERFORM AN ACTUAL SCAN YOU SHOULD ALSO PERFORM DETAILED TESTS ON THE SYSTEM 4 IF YOU WANT TO PERFORM AN ATTACK, DO IT NOW EVALUATING THE RESULTS YOU SHOULD NOW ASSESS THE RESULTS OF YOUR HACK TO IDENTIFY WHAT YOU’VE DISCOVERED IT’S ADVISED THAT YOU MAKE THE ASSUMPTION THAT THESE SECRETS OF A SUPER HACKER VULNERABILITIES WERE NEVER UNCOVERED BEFORE; THIS IS WHERE THE RESULTS COUNT YOU NEED MORE EXPERIENCE TO EVALUATE THE RESULTS AND IDENTIFY THE CORRELATION BETWEEN THE VULNERABILITIES, AND THEN YOU’LL KNOW YOUR SYSTEMS BETTER THAN ANYBODY ELSE THIS WILL MAKE THE EVALUATION PROCESS SIMPLER GOING FORWARD THE FINAL STEP IS TO SUBMIT A FORMAL REPORT TO YOUR CUSTOMER OR TO THE UPPER MANAGEMENT AND OUTLINE YOUR RESULTS YOU MUST ALWAYS KEEP BOTH PARTIES IN THE LOOP TO SHOW THEM THAT THEIR MONEY WAS WELL SPENT MOVING ON WHEN YOU HAVE FINISHED THE ETHICAL HACKING TEST, YOU’LL NEED TO IMPLEMENT THE ANALYSIS AND ALSO GIVE THE CUSTOMER SOME RECOMMENDATIONS THIS WILL HELP TO ENSURE THE SECURITY OF YOUR SYSTEMS WHEN YOU RUN THESE TESTS, NEW SECURITY VULNERABILITIES WILL APPEAR THE INFORMATION SYSTEMS WILL ALWAYS CHANGE, AND THESE WILL BECOME MORE COMPLEX YOU’LL UNCOVER NEW HACKER EXPLOITS AND MORE SECURITY VULNERABILITIES AS TIME GOES ON A SECURITY TEST IS A SNAPSHOT OF HOW SECURE YOUR SYSTEMS ARE YOU SHOULD REMEMBER THAT THINGS CAN CHANGE AT ANY TIME, ESPECIALLY WHEN YOU ADD A NEW SYSTEM, APPLY PATCHES OR UPGRADE THE SOFTWARE THAT’S WHY IT’S IMPORTANT TO HAVE A PLAN BY WHICH YOU PERFORM REGULAR TESTS TO ASSESS THE SYSTEM’S SECURITY SECRETS OF A SUPER HACKER CHAPTER PHASES OF ETHICAL HACKING AS MENTIONED EARLIER, THERE IS A SET PROCESS THAT YOU SHOULD FOLLOW BEFORE YOU BEGIN TO HACK A SYSTEM OR NETWORK ETHICALLY THIS CHAPTER COVERS THE DIFFERENT PHASES OF THE ETHICAL HACKING PROCESS, WHICH WILL HELP YOU OR ANY OTHER ETHICAL HACKER PLAN AN ATTACK EVERY ORGANIZATION OR COMPANY HAS A SECURITY MANUAL THAT WILL EXPLAIN THE PROCESS DIFFERENTLY MOST CERTIFIED ETHICAL HACKERS FOLLOW THE SIX PHASES THAT WILL BE DISCUSSED IN THIS CHAPTER RECONNAISSANCE THE FIRST PHASE OF THE PROCESS IS THE RECONNAISSANCE PHASE THIS PHASE IS ALSO CALLED THE INFORMATION-GATHERING PHASE IT’S IN THIS PHASE THAT THE HACKER SHOULD COLLECT AS MUCH INFORMATION AS THEY CAN ABOUT THE TARGET SYSTEM OR NETWORK INFORMATION IS OFTEN ACCUMULATED ABOUT THE FOLLOWING GROUPS: 1 HOST 2 NETWORK 3 PEOPLE RECONNAISSANCE CAN BE CATEGORIZED INTO TWO TYPES: ACTIVE AND PASSIVE ACTIVE RECONNAISSANCE IN THIS TYPE OF RECONNAISSANCE, THE HACKER WILL INTERACT DIRECTLY WITH THE TARGET SYSTEM OR COMPUTER TO GATHER INFORMATION FOR EXAMPLE, THE HACKER CAN USE THE NMAP TOOL TO SCAN THE NETWORK OR SYSTEM PASSIVE RECONNAISSANCE IN THIS TYPE, THE HACKER WILL TRY TO GATHER INFORMATION ABOUT THE SYSTEM OR NETWORK WITHOUT INTERACTING DIRECTLY WITH THE NETWORK, COLLECTING DATA FROM WEBSITES, SOCIAL MEDIA, ETC