## Footprinting and Reconnaissance

Footprinting is the initial and crucial phase of ethical hacking, involving the systematic gathering of as much information as possible about a target. The goal is to create a comprehensive profile of the target's network, systems, and organization before any active attacks are launched. This phase helps attackers understand the target's security posture, identify potential vulnerabilities, and plan subsequent attack vectors.

## Types of Footprinting

Passive Footprinting

This method involves collecting information without directly interacting with the target system or network, making it stealthy and difficult to detect.

• Search Engines: Using advanced search operators (Google Dorking) to uncover sensitive files, directories, or specific information.
• WHOIS Lookup: Retrieving domain registration details, including registrant names, addresses, email, and DNS server information.
• DNS Lookup: Querying DNS records (e.g., A, MX, NS, PTR, SPF) to map out network infrastructure, mail servers, and subdomains. Tools like `nslookup` or `dig` are used.
• Social Media Analysis: Gathering employee details, organizational structure, technologies used, and potential internal policies from platforms like LinkedIn, Facebook, or Twitter.
• Open Source Intelligence (OSINT): Leveraging publicly available information from various sources like financial reports, job postings, news articles, and public databases.
• Shodan: A search engine for internet-connected devices, used to find specific types of systems, services, and vulnerabilities exposed to the internet.
• Archive.org (Wayback Machine): Viewing historical versions of websites to uncover past configurations or content.

Active Footprinting

This method involves directly interacting with the target to gather information, which carries a higher risk of detection. While CEH often places heavy active scanning in the "Scanning Networks" phase, initial active probes can be part of advanced footprinting.

• Traceroute: Mapping the network path to a target, revealing routers and network topology.
• DNS Zone Transfer: Attempting to transfer the entire DNS zone file from a server, which can reveal all hosts and subdomains (if misconfigured).

## Information Gathered

Footprinting aims to collect various types of information, including:

• IP Ranges and Subnets: Understanding the network layout.
• Domain Names and Subdomains: Mapping the target's online presence.
• Network Topology: Identifying routers, firewalls, and network devices.
• Operating Systems and Applications: Discovering technologies in use.
• Employee Details: Names, email addresses, phone numbers, roles, and organizational charts.
• Security Policies: Inferring security measures from public information.
• Vulnerability Information: Identifying known weaknesses in technologies used.

## Network Scanning: CEH Revision

Network scanning is a crucial phase in ethical hacking, following reconnaissance. Its primary goal is to identify live hosts, open ports, services running on those ports, operating systems, and potential vulnerabilities within a target network. This active process provides a detailed blueprint of the target's network infrastructure.

## Host Discovery

Before scanning ports, identifying active hosts is essential. Tools like Nmap are invaluable here.

• Ping Sweeps (ICMP): Sending ICMP Echo Request packets to a range of IPs. If an Echo Reply is received, the host is live. Nmap's `-sn` (ping scan) option performs this.
• ARP Scans: For local networks, ARP requests can identify active hosts even if they block ICMP.
• TCP/UDP Pings: Sending TCP SYN or ACK packets to common ports (e.g., 80, 443) or UDP packets to known ports (e.g., 53, 161) can also reveal live hosts, especially if ICMP is blocked.

## Port Scanning Techniques

Port scanning identifies which ports are open, closed, or filtered.

• TCP SYN Scan (-sS): The stealthiest and most common TCP scan. It sends a SYN packet and if a SYN/ACK is received, the port is open, but the scanner sends an RST instead of an ACK, never completing the handshake. This makes it harder for firewalls/IDPS to log. Requires root privileges.
• TCP Connect Scan (-sT): Completes the full three-way handshake. This is noisy, easily logged, but doesn't require root. Used when SYN scans are not possible.
• UDP Scan (-sU): Sends UDP packets to target ports. If an ICMP Port Unreachable message is received, the port is closed. No response usually means the port is open or filtered. Slower and less reliable than TCP scans.
• FIN Scan (-sF), XMAS Scan (-sX), NULL Scan (-sN): These scans exploit RFC 793 behavior. For closed ports, they should respond with an RST. For open ports, they should *not* respond. They are stealthier but less effective against Windows hosts due to different TCP stack implementations.
• ACK Scan (-sA): Used to map firewall rulesets. It determines if ports are filtered (no RST) or unfiltered (RST received), but *cannot* determine if a port is open or closed.

## OS and Service Detection

Beyond just open ports, identifying the specific services and operating systems provides critical information.

• OS Detection (-O): Nmap analyzes TCP/IP stack fingerprints (e.g., initial window size, TCP options) to guess the target's operating system.
• Service Version Detection (-sV): Nmap connects to open ports and queries the services to identify the application and its exact version (e.g., Apache 2.4.41, OpenSSH 8.2p1). This is vital for finding known vulnerabilities.

## Evasion Techniques

Attackers employ methods to bypass security controls during scanning:

• Decoy Scans (-D): Sending scan packets from multiple spoofed IP addresses alongside the real one to confuse logs.
• Fragmentation (--frag): Splitting scan packets into smaller fragments to bypass simple packet filters.
• Timing Options (-T): Adjusting scan speed to avoid detection by IDPS (e.g., `-T0` for paranoid, `-T5` for insane).

Tools: The primary tool for network scanning is Nmap (Network Mapper), renowned for its versatility and powerful features. Other tools include Hping3 for custom packet crafting and Netcat for banner grabbing.

## System Hacking: Privilege Escalation & Malware

System Hacking involves gaining deeper access to a compromised system and maintaining that access. A primary goal is Privilege Escalation, which is the act of gaining higher-level access than initially obtained. This can be achieved through various methods:

• Kernel Exploits: Exploiting vulnerabilities in the operating system's kernel to gain root or system-level privileges.
• Misconfigurations: Leveraging improperly configured services, applications, or file permissions. Examples include SUID/SGID binaries on Linux (allowing a user to run an executable with the permissions of the file owner/group) or weak permissions on Windows services.
• DLL Hijacking: Placing a malicious DLL in a directory where a legitimate application expects to load a system DLL, causing the application to load the malicious one instead.
• Path Environment Variable Exploitation: Manipulating the system's PATH variable to execute a malicious binary instead of a legitimate one when a command is run.
• Scheduled Tasks: Modifying or creating scheduled tasks to execute commands with elevated privileges.

Malware & Evasion

Malware (Malicious Software) is a significant component of system hacking. Key types include:

• Rootkits: Designed to hide the presence of malware and provide persistent backdoor access by modifying core OS components.
• Ransomware: Encrypts user data and demands a ransom for its release.
• Trojans: Disguised as legitimate software but perform malicious actions.
• Spyware: Gathers information about a user without their knowledge.

Malware Analysis can be Static (examining code without execution, e.g., disassemblers) or Dynamic (observing behavior in a controlled environment, e.g., sandboxes). Attackers use Anti-Malware Evasion techniques like polymorphism, metamorphism, and obfuscation to bypass detection.

Password Attacks & Covering Tracks

Password Cracking is crucial for gaining access to other systems or accounts. Techniques include:

• Brute-Force Attacks: Trying every possible combination.
• Dictionary Attacks: Using pre-compiled lists of common passwords.
• Rainbow Tables: Pre-computed tables of hash values to quickly reverse password hashes (e.g., NTLM for Windows).
• Hybrid Attacks: Combining dictionary and brute-force methods.

Covering Tracks is essential to avoid detection and maintain persistence. This involves:

• Clearing Logs: Erasing event logs, web server logs, or other system logs.
• Modifying Timestamps: Using tools like `touch` (Linux) or `Set-ItemProperty` (PowerShell) to change file access, modification, and creation times.
• Steganography: Hiding data, such as malicious payloads or exfiltrated information, within seemingly innocent files (images, audio).
• Alternate Data Streams (ADS): On NTFS file systems, this technique allows data to be hidden within existing files without affecting their apparent size or functionality.

## Malware Threats Overview

Malware, short for malicious software, is any program or file harmful to a computer user. Ethical hackers must understand malware types, propagation methods, and analysis techniques to effectively defend systems. Malware poses significant risks, including data theft, system disruption, and financial loss.

## Types of Malware

• Viruses: Self-replicating programs that attach to legitimate files or boot sectors and require user interaction to spread. They can be polymorphic (change signature to evade detection) or stealth (hide presence).
• Worms: Self-replicating malware that spreads independently across networks without user intervention, often exploiting vulnerabilities to propagate rapidly.
• Trojans: Disguised as legitimate software, Trojans perform malicious actions once executed. Common types include backdoors (remote access), RATs (Remote Access Trojans), and downloaders (fetch more malware).
• Ransomware: Encrypts a victim's files or locks their system, demanding a ransom (usually cryptocurrency) for decryption or access restoration. Notable examples include WannaCry and Ryuk.
• Spyware: Secretly monitors and collects user information, such as keystrokes (keyloggers), browsing history, or sensitive data, transmitting it to an attacker.
• Adware: Displays unwanted advertisements, often bundled with legitimate software, and can sometimes track user activity.
• Rootkits: A collection of tools designed to conceal the presence of malware and maintain persistent access on a compromised system by modifying operating system processes or kernel functions.
• Botnets: Networks of compromised computers (bots or zombies) controlled remotely by an attacker via a Command and Control (C2) server, used for large-scale attacks like DDoS, spamming, or cryptomining.
• Fileless Malware: Operates entirely in memory, leveraging legitimate system tools (e.g., PowerShell, WMI) and processes, making it difficult to detect with traditional signature-based antivirus.
• Logic Bomb: Malicious code intentionally inserted into a software system that executes when specified conditions are met (e.g., date, specific user action, or user deletion).

## Malware Analysis Techniques

• Static Analysis: Examining malware code without executing it. This includes string extraction, disassembling, decompiling, and checking header information to understand its potential functionality.
• Dynamic Analysis: Executing malware in a controlled, isolated environment (sandbox or virtual machine) to observe its real-time behavior, such as file system changes, network activity, and process injection.

## Malware Countermeasures

Effective defense involves a multi-layered approach:

• Antivirus/Anti-malware Software: Uses signature-based, heuristic, and behavioral detection to identify and remove threats.
• Firewalls & IDS/IPS: Monitor and block suspicious network traffic and detect intrusion attempts.
• Patch Management: Regularly update systems and software to fix known vulnerabilities that malware could exploit.
• Security Awareness Training: Educate users about phishing, social engineering, and safe browsing habits to prevent initial infection.
• Application Whitelisting: Only allows approved applications to run, significantly reducing the risk from unknown executables.
• Endpoint Detection and Response (EDR): Advanced tools for continuous monitoring, threat detection, and automated response at the endpoint level.

## Social Engineering Fundamentals

Social Engineering is the psychological manipulation of people into performing actions or divulging confidential information. It exploits human psychology rather than technical vulnerabilities. Attackers leverage natural human tendencies like trust, helpfulness, fear, curiosity, and urgency to achieve their objectives. It's often considered the weakest link in an organization's security posture because even the most robust technical defenses can be bypassed if an attacker can trick an authorized user.

## Common Social Engineering Techniques

• Phishing: A broad category of attacks using deceptive communications (emails, messages) to trick recipients into revealing sensitive information or installing malware.
• Spear Phishing: Highly targeted phishing attacks aimed at specific individuals or organizations, often using personalized information.
• Whaling: A type of spear phishing specifically targeting high-profile individuals like CEOs or executives, due to their access to critical information.
• Vishing: Phishing conducted over voice communication (phone calls), often impersonating IT support or banking officials.
• Smishing: Phishing conducted via SMS text messages, often containing malicious links or requests for personal data.
• Pretexting: Creating a fabricated scenario (a "pretext") to engage a target and extract information. The attacker often assumes a false identity (e.g., IT support, a vendor, a new employee) to establish credibility.
• Baiting: Luring victims with a promise of something desirable (e.g., a free download, a USB drive left in a public place) to compromise their systems or data once they interact with the bait.
• Quid Pro Quo: Offering a small service or gift in exchange for information or access (e.g., "I'll fix your computer if you give me your password" or offering a survey for a prize).
• Tailgating (or Piggybacking): Gaining unauthorized physical access to a restricted area by closely following an authorized person through a security checkpoint without presenting credentials.
• Shoulder Surfing: Directly observing someone's private information, such as passwords or PINs, as they enter it, often in public or semi-public spaces.
• Dumpster Diving: Sifting through discarded materials (trash) to find sensitive information like documents, sticky notes with passwords, old hardware, or corporate directories.
• Impersonation: Pretending to be someone else, often an authority figure or someone known to the victim, to gain trust or induce compliance.

## Mitigation Strategies

The most effective defense against social engineering is comprehensive security awareness training. Employees must be educated about common tactics, how to identify suspicious requests, and the importance of verifying identities. Other crucial defenses include strong security policies, multi-factor authentication (MFA), robust email filtering, physical security controls (like access badges and surveillance), and adhering to the principle of least privilege to limit access to sensitive information.

## Hacking Web Applications: CEH Revision

Web applications are a primary target for attackers due to their accessibility and potential for sensitive data. Ethical hackers must understand common vulnerabilities and testing methodologies to secure these systems.

## Common Web Application Vulnerabilities

The OWASP Top 10 provides a standard awareness document for developers and web application security. Understanding these categories is crucial.

Injection

Injection flaws occur when untrusted data is sent to an interpreter as part of a command or query.

• SQL Injection (SQLi): Malicious SQL queries are inserted into input fields to manipulate database queries, potentially leading to data theft, modification, or even remote code execution. Common types include Union-based, Error-based, Blind (Boolean-based, Time-based).
• Command Injection: Injecting OS commands through an application to execute them on the server.

Cross-Site Scripting (XSS)

XSS allows attackers to inject client-side scripts into web pages viewed by other users.

• Reflected XSS: Malicious script is reflected off the web server, typically in an error message or search result, and executed in the victim's browser.
• Stored XSS: Malicious script is permanently stored on the target server (e.g., in a database, comment field) and delivered to victims when they request the affected page.
• DOM-based XSS: The vulnerability lies in client-side code rather than server-side, manipulating the Document Object Model (DOM) environment.

Broken Authentication and Session Management

Vulnerabilities in authentication or session management can allow attackers to compromise user accounts.

• Weak Credentials: Easily guessable passwords.
• Session Hijacking: Stealing or predicting session IDs to impersonate a legitimate user.
• Improper Session Management: Predictable session tokens, lack of session expiration, or not invalidating sessions after logout.

Broken Access Control

Attackers can exploit flaws in access control to bypass authorization checks and access unauthorized functionality or data.

• Insecure Direct Object References (IDOR): Directly accessing internal implementation objects (e.g., file paths, database keys) without proper authorization checks.

Security Misconfiguration

This category covers a broad range of issues, including default credentials, unpatched flaws, unnecessary features, and misconfigured HTTP headers.

• Default Credentials: Using factory-set usernames and passwords.
• Unnecessary Services: Running services or features that are not required.

Cross-Site Request Forgery (CSRF) & Server-Side Request Forgery (SSRF)

• CSRF: Tricking a victim's browser into sending an authenticated request to a vulnerable web application.
• SSRF: An attacker can induce the server-side application to make HTTP requests to an arbitrary domain chosen by the attacker, potentially targeting internal systems.

File Upload Vulnerabilities

Improper validation of uploaded files can lead to remote code execution if an attacker uploads a malicious script (e.g., a PHP shell) that the server then executes.

## Key Tools for Web App Hacking

• Burp Suite: An integrated platform for performing security testing of web applications (proxy, scanner, intruder, repeater).
• OWASP ZAP (Zed Attack Proxy): A free, open-source integrated penetration testing tool for finding vulnerabilities in web applications.
• SQLMap: An open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws.
• Nikto: A web server scanner that performs comprehensive tests against web servers for multiple items, including over 6700 potentially dangerous files/programs, outdated server versions, and version-specific problems.

## Mitigation Strategies

Implementing secure coding practices, regular security audits, input validation, output encoding, strong authentication mechanisms, and proper access controls are essential for mitigating these risks.

## Hacking Wireless Networks

Wireless networks, particularly Wi-Fi, are a common target for ethical hackers due to their widespread use and potential vulnerabilities. Understanding these vulnerabilities and attack vectors is crucial for the CEH exam.

Wi-Fi Security Protocols

• WEP (Wired Equivalent Privacy): This is the weakest protocol and should never be used. It's vulnerable to attacks due to its use of a small Initialization Vector (IV) and the RC4 stream cipher, allowing for quick cracking by capturing enough packets.
• WPA/WPA2 (Wi-Fi Protected Access):
• WPA-PSK (Pre-Shared Key): Common in home/small office networks. It relies on a shared passphrase. Attacks often target the 4-way handshake process, where the PMK (Pairwise Master Key) is derived. Attackers capture this handshake and perform offline dictionary or brute-force attacks against the passphrase.
• WPA-Enterprise (802.1X/RADIUS): Used in larger organizations, providing stronger authentication via a central server (RADIUS). It's more resistant to dictionary attacks as each user has unique credentials.
• KRACK (Key Reinstallation Attack): A critical vulnerability in WPA2 that allowed attackers to reinstall the pairwise key, leading to re-use of nonces and potential decryption of traffic.
• WPA3: The latest standard, offering significant improvements. It uses Simultaneous Authentication of Equals (SAE), also known as Dragonfly Key Exchange, to provide stronger protection against offline dictionary attacks and forward secrecy.

Common Attack Techniques

• Deauthentication Attacks: Attackers send deauthentication frames to clients, forcing them to disconnect from the AP. This is often done to capture the 4-way handshake when the client reconnects.
• Evil Twin Attacks: A rogue Access Point (AP) is set up with the same SSID as a legitimate network. Users unknowingly connect to the fake AP, allowing the attacker to intercept traffic, capture credentials (e.g., via a captive portal), or launch further attacks.
• WPS (Wi-Fi Protected Setup) Attacks: WPS, designed for easy device connection, can be vulnerable to brute-force attacks on its 8-digit PIN, especially the 'Pixie Dust' attack. It's recommended to disable WPS.
• Packet Sniffing and Analysis: Tools like Wireshark or Kismet are used to capture wireless traffic, identify network details, and look for unencrypted data or handshakes.
• Aircrack-ng Suite: A powerful collection of tools for auditing Wi-Fi networks, including `airmon-ng` (monitor mode), `airodump-ng` (packet capture), `aireplay-ng` (injection attacks, deauthentication), and `aircrack-ng` (password cracking).

Mitigation Strategies

• Use WPA3 where possible, or WPA2-Enterprise. Avoid WEP and WPA-PSK with weak passphrases.
• Employ strong, complex passphrases for WPA2-PSK.
• Disable WPS functionality.
• Regularly audit wireless networks for rogue APs and vulnerabilities.
• Implement network segmentation to limit the impact of a compromised wireless segment.

## Introduction to Cryptography

Cryptography is the practice and study of techniques for secure communication in the presence of adversarial behavior. It aims to achieve four primary security goals:

• Confidentiality: Keeping information secret from unauthorized individuals.
• Integrity: Ensuring that information has not been altered or tampered with.
• Authentication: Verifying the identity of a user, process, or device.
• Non-repudiation: Preventing an entity from denying previous actions or commitments.

## Types of Cryptographic Algorithms

Symmetric-Key Cryptography

• Uses a single shared secret key for both encryption and decryption. This key must be securely exchanged between communicating parties.
• Advantages: Very fast and efficient for encrypting large amounts of data.
• Disadvantages: The secure distribution and management of the shared key is a significant challenge.
• Algorithms: AES (Advanced Encryption Standard) is the current industry standard, supporting 128, 192, and 256-bit keys. DES (Data Encryption Standard) and 3DES (Triple DES) are older and less secure, primarily for legacy systems.

Asymmetric-Key (Public-Key) Cryptography

• Uses a pair of mathematically linked keys: a public key (freely shared) and a private key (kept secret by its owner).
• Advantages: Solves the key distribution problem, enables digital signatures, and facilitates secure key exchange for symmetric encryption.
• Disadvantages: Significantly slower than symmetric encryption, making it unsuitable for bulk data encryption.
• Algorithms: RSA (Rivest-Shamir-Adleman) is widely used for encryption, digital signatures, and key exchange. ECC (Elliptic Curve Cryptography) provides comparable security with smaller key sizes, making it efficient for mobile and constrained environments.

Hashing

• A one-way function that transforms input data of any size into a fixed-size string, called a hash value or message digest.
• Purpose: Primarily used for integrity checking (detecting data tampering) and secure password storage.
• Properties: Deterministic (same input always yields same output), computationally infeasible to reverse, and collision resistance (extremely difficult to find two different inputs that produce the same hash).
• Algorithms: SHA-256 (Secure Hash Algorithm 256) is widely used. MD5 (Message Digest 5) and SHA-1 are considered cryptographically broken due to known collision vulnerabilities and should not be used for new applications.

## Digital Signatures and PKI

• Digital Signatures: Provide integrity, authentication, and non-repudiation. They are created by hashing a document and then encrypting that hash with the sender's private key. The signature is verified using the sender's public key.
• Public Key Infrastructure (PKI): A framework that manages digital certificates and public-key encryption. It binds public keys with respective user identities through a Certificate Authority (CA). X.509 is the standard for digital certificates.

## Cryptographic Attacks

• Brute-force attack: Trying every possible key until the correct one is found.
• Known-plaintext attack: Attacker has access to both plaintext and its corresponding ciphertext.
• Chosen-plaintext attack: Attacker can choose arbitrary plaintexts to be encrypted and obtain the corresponding ciphertexts.
• Frequency analysis: Exploiting statistical patterns in ciphertext to deduce the plaintext (e.g., common letters in a language).
• Side-channel attacks: Exploiting information leaked from the physical implementation of a cryptosystem (e.g., timing, power consumption, electromagnetic radiation).