Education on Ethical Hacking

There are formal education training for ethical hacking. University of Abertay offers BSc (Hons) Ethical Hacking & Countermeasures, MSc/PGDip Ethical Hacking & Countermeasures.

WHOIS

Several operating system provide a WHOIS utility. To conduct query from the command line the format is:
whois -h hostname identifier (e.g. whois -h whois.aim.net )
Command flag can be added to obtain more specific information. Flags can be categorized under query type and only one flag may be used from a query type.

• Query-by-record-type
• n Network address space
• a Autonomous systems
• p Point of contact
• o Organizations
• c End-user customers
• Query-by-attribute
• @ Search for matches by the domain-portion of an email address
• ! Search for matches by handle or id
• . Search for matches by name
• Display flags
• + Show details (aka "full") but cannot be used with the record hierarchy sub query
  
• - Show summary (aka "list")
• Record hierarchy
• <>
• > Display record related down the hierarchy. For network, display subdelegation or subnet, below the network
• Wild card queries
• WHOIS supports wild card queries. Append the query with *. This can be used in combination with any flag define above

There are five types of queries that can be carried out on a WHOIS database.

• Registrar - This gives information on potential domains matching the target.
• Organizational - This lists all known instances associated with the particular target and the number of domain associated with the organization.
• Domain - This can be used to find the company address, domain name, administrator and his/her phone number, and the system's domain servers.
• Network - This gives all information related to a particular network of a single IP address. Network enumeration can help ascertain the network block assigned or allotted to the domain.
• Point of Contact (POC) - Display all information related to a specific person, typically administrative contacts. Also known as query by "handle".

If the organization is a high security company, it can opt to register a domain in the name of a third party, as long as they agree to accept responsibility.

SmartWhois
SmartWhois is a network information utility that allow available information about an IP address, hostname or domain name, including country, state or province etc.
SmartWhois is available for download at www.tamos.com.

Unearthing Initial Information

Open source footprinting
Perform whois request, searching thorough DNS tables are other forms of open source footprinting. Most of the information is fairly easy to get and within legal limits. One easy way to check for sensitive information is to check the HTML source code of the website to look for links comments, Meta tags etc.
The attack can choose to source information from:

• A web page (save it offline, e.g. using offline browser such as Teleport pro at http://www.tenmax.com/teleprot/pro/home.htm )
• Yahoo or other directories (Tifny is a comprehensive search tool for USENET newsgrops)
• Multiple search engines (All-in-one, Dogpile), groups.google.com is a great resource for searching large number of news groups archives without having to use a tool
• Using advanced search (e.g. AltaVista where revers links can be unearthed to vulnerabile sites)
• Search on publicly trade companies (e.g. EDGAR)
• Dumpster diving (to retrieve document that is carelessly disposed)
• Physical access (False ID, temporary/contract employee etc)

Apart from surfing the site, the attacker can use whois or nslookup to collect information. http://www.allwhois.com/ is considered a comprehensive whois interface.
There are tools available to aid whois:

• Sam Spade
• Smart Whois
• Netscan

Reader is encouraged to read RFC 1034, 1035 and standards std/std13 - Internet standard for Domain Name.

Footprinting

Footprinting is the blueprinting of the security profile of an organization undertaken in methodological manner.
The information unveil at various network level can include details of domain name, network blocks, network services and applications, system architecture, intrusion detection systems, specific IP address, access control mechanisms and related lists, phone numbers, contract addresses, authentication mechanisms and system enumeration.
Information gathering activity can be broadly divided into seven phases:

1. Unearth initial information
2. Locate network information
3. Ascertain active machine
4. Discover open ports /access ports
5. Detect operating system
6. Uncover services on ports
7. Map the networks

Footprinting includes the first two phases listed above. Footprinting is required to ensure that isolated information repositories that are critical are not overlook or left undiscovered.

Deliverables

In the final phase of evaluation the ethical hacking report with the results of hacking activities, vulnerabilities found and recommendation given to avoid exploit. The objective should be to bring into effect of permanent security solution rather than temporary patch. If social engineering testing has exposed problems report should address this issue with specific recommendation to raise awareness of the people concerned. The report must include specific recommendation on how to close the vulnerability and keep them closed.
Usually, the ethical hacking report is delivered in hard copy and soft copy destroyed for security reason. For instance, if this report is accessed by the wrong people or people with wrong intension, it can have catastrophic consequence. One of common example is that the report is use by corporate espionage, the cracker can use the information to break into the system. However for long term client, the ethical hacker might need the information for further investigation. In this case the organization can stored it in encrypted form in an offline system with very limited access. Hard copy should be stored in a safe with all copy numbered.
There are certain issues to be considered in delivering report, such as who would receive the report, and how the sensitive report would be conveyed. The ethical hacker would have ongoing responsibility to ensure the safety of all information they retain, so in some cases all information is destroyed at the end of the contract.

Security Test

Security test can be conducted in two approaches:

• Black-box
  This means the ethical hacker has no prior knowledge or information about the system. This simulate a true web-hacking, beginning with nothing but the company name. From here the ethical hacker gathers information about the network and the business from as many outside source as possible.
  
• White-box
  This means the ethical hacker has complete knowledge of the network infrastructure to be tested. This help ethical hacker adopt a structured and formal approach. However, a good ethical hacker will also test the validity of the information provided initially, rather than work under the assumption that it is true.

It is considered by some security expert that the black-box testing is closely intimate a real web hacking. However, this need not hold good as script kiddies can easily know detail of the network and operating system and run scripts to exploit vulnerabilities. More often that not, the attacker is no total stranger to the system. He as access to insider information or may be he is an insider. Many organizations are subject to attack from internal sources where full system knowledge can be assumed.
If monetary resource and time are constraint, black box testing may not be the best option. This is where the organization may consider internal testing.
All forms of security testing can be of value to the organization; however it is up to the organization to decide what work in best of its interest under the given circumstance. A black-box test may highlight how supposedly confidential information is leaked. A white-box test is likely toe dedicate more time to probing for vulnerabilities and will address security of all external connection.

Modes of Ethical Hacking

There are several ways to conduct security evaluation.

• Remote network
  This simulates the intruder launching an attack across the internet. The primary defense that must be defeated here are border firewall, filtering routers etc.
• Remote dial-up network
  This simulates the intruder launching an attack against the organization's modem pools. The primary defense that must be defeated here are user authentication scheme.
  
• Local network
  This simulates an employee or other authorized person who have legal/authorized connection to the organization network. The primary defense must be defeated here are intranet firewall, intranet web server and server security measures.
  
• Stolen equipment
  This is to test how user protection their information assets. For example, if a stolen laptop has stored password or critical information that can be easily accessed, this can a security breach. Attacker may remote dial up to the main server of the organization with proper authentication.
• Social engineering
  This test evaluate the integrity and awareness of the target organization's personnel. A typical quoted example of social engineering is that of an intruder calling the computer help line and asking for the external telephone number of the modem pool. Defense against this kind of attack is the hardest because people and personalities are involved. To be of assistance come naturally in organizations gearing more toward a service orientation and this may inadvertently lead to security compromise. Often see scenario include telling someone who appears to be lost where the computer room located, or let someone into the building who does not have proper identification credentials. The only defense against this is to raise the security awareness.
• Physical entry
  This test acts out the physical penetration of the organization's building. The primary defense here are strong security policy, security guard, access control and monitoring and security awareness.