1. MUHAMMAD DANIYAL (CS-13-32)

2. THREAT:anaction oreventthatmightcompromise
security. Athreat isapotential violationofsecurity.
VULNERABILITY–existenceofaweakness,design,or
implementation errorthatcanleadtoanunexpectedand
undesirableeventcompromisingthesecurityofthesystem.
EXPLOIT–adefinedwaytobreachthesecurityofanITsystem
throughavulnerability.
ATTACK–anassaultonthesystemsecuritythatisderivedfrom
anintelligentthreat. Anattackisanyactionthatviolatessecurity.
WHAT YOU SHOULD KNOW FIRST ...

3. HACKER CATEGORIES…
BLACK HAT…
individualswithextraordinary computing skills,resorting to
maliciousordestructive activities. Alsoknownascrackers.
WHITE HAT…
individualsprofessing hacker skillsandusingthem for
defensive purposes. Alsoknownassecurity analysts.
GRAY HAT…
individuals who work both offensively and
defensively at various times.
SUICIDERS…
individualswhoaimtobringdowncritical infrastructure for a
“cause” (Hacktivism) anddonotworryaboutpunishment.

4. HACKER QUALITIES…
A HACKER SHOULD…
HAVEdeepknowledgeoftargetplatforms,suchasWindows,
UnixandLinux
 Havebasicknowledgeofnetworkingandrelatedhardwareand
software
befamiliarwithvulnerabilitystudy.
be“highlytechnical”tolaunchsophisticatedattacks
bepreparedtofollowastrictcodeofconduct(whitehats)
Professionalsneedtoknowwhatitistheyaretryingtoprotect,
againstwhom,andwhatresourcesitiswillingtoexpendinorderto
gainprotection.

5. PHASES OF HACKING…
Reconnaissance
Scanning
Gaining
Access
Maintaining
Access
Cleaning

6. 1. RECONAISSANCE…
Reconnaissancereferstothepreparatoryphasewhereanattacker
seekstogatherasmuchinformationaspossibleaboutatargetprior
tolaunchinganattack.
TYPES OF RECONAISSANCE…
Passivereconnaissanceinvolvesacquiringinformationwithoutdirectlyinteracting
withthetarget.
Ex:Searchingpublicrecordsornewsreleases.
Activereconnaissanceinvolvesinteractingwiththetargetdirectlybyanymeans.
Ex:Telephonecallstohelpdeskortechnicaldepartments

7. 2. SCANNING…
iTreferstothepre-attackphasewhenthehackerscansthenetwork
forspecificinformationonthebasisofinformationgatheredduring
reconnaissance.Hackershavetogetasinglepointofentrytolaunch
anattack.

8. TYPES OF SCANNING…
 Portscanning–aseriesofmessagessenttoacomputertolearnaboutservices.
 NetworkScanning–aprocedureforidentifyingactivehostsonanetwork.
 VulnerabilityScanning–automatedprocessofproactivelyidentifyingvulnerabilitiesof
computingsystems.

9. PHASES OF SCANNING…
Check for live
systems
Identify services
Banner grabbing
OS
fingerprinting
Scan for
vulnerabilities
Draw network
diagrams of
vulnerable hosts
Prepare proxiesAttack

10. 3. GAINING ACCESS…
 Gainingaccessreferstothepenetrationphase. Thehackerexploitsthe
vulnerabilityinthesystem.
 Thehackercangainaccessattheoperatingsystemlevel,applicationlevel,
ornetworklevel.

11. HOW TO GAIN ACCESS ??!
Thereareseveralwaysanattackercangainaccesstoasystem.
Theattackermustbeabletoexploitaweaknessorvulnerabilityin
asystem.

12. HOW TO GAIN ACCESS ??!
Applyingpatchesandhotfixesarenoteasyintoday’scomplex
networks.
 AttackerslookforOSvulnerabilities andexploitthemtogain
accesstoanetworksystem.
OS ATTACKS… APPLICAION LEVEL ATTACKS
SHRINK WRAP CODE… MISCONFG. ATTACKS

13. HOW TO GAIN ACCESS ??!
Securityisoftenanafterthoughtandusuallydeliveredasan“add-on”
component.Poorornon-existenterrorcheckinginapplicationsleadstobuffer
overflowattacks.
OS ATTACKS… APPLICAION LEVEL ATTACKS
SHRINK WRAP CODE… MISCONFG. ATTACKS

14. HOW TO GAIN ACCESS ??!
WhenyouinstallanOSorapplication,itcomeswithtonsofsamplescriptsto
makethelifeofanadministratoreasy.Theproblemis“notcustomizingthese
scripts”.Thiswillleadtodefaultcodeorshrinkwrapcodeattack
OS ATTACKS… APPLICAION LEVEL ATTACKS
SHRINK WRAP CODE… MISCONFG. ATTACKS

15. HOW TO GAIN ACCESS ??!
Inordertomaximizeyourchancesofconfiguringamachinecorrectly,remove
anyunneededservicesorsoftware.
OS ATTACKS… APPLICAION LEVEL ATTACKS
SHRINK WRAP CODE… MISCONFG. ATTACKS

16. 4. MAINTAINING ACCESS…
Thephasewherethehackertriestoretainownershipofthe
system.
Compromisingoftarget
Hackerscanupload,download,ormanipulatedata,applications,
andconfigurationsontheownedsystem.

17. 5. COVERING TRACKS…
 Coveringtracksreferstotheactivitiesthatthehackerdoestohide
theiractions.
Examplesincludesteganography,tunneling,andalteringlogfiles.

18. Conclusion…
 Hackingisanart,notascience.
 Hackersneedonlyasinglepointofentry.
 You’reonlyasstrongasyourweakestlink.
 Wherethere’sawill,there’saway.
 NeverunderestimateaHacker’sdetermination.
 Securityshouldneverbeanafterthought.

19. IF THERE IS ANY QUESTION, PLEASE ASK