SlideShare a Scribd company logo
Hacking: What is it and
   how is it done?
Introduction to Cybersecurity
  Slides by Raymond Borges
Outline
Background
Hacking 101
  The penetration test
    Reconnaissance
    Enumeration
    Gaining access
    Privilege escalation
    Maintaining access
    Stealth
Conclusion
Background
Phone freaks were some of the first hackers

• Phreaking- activity of a culture of people who
  study, experiment with, or explore telecom


• Blue box- tone generator capable of producing
  frequencies to hack phone trunks
Background
Below is the blue box built by Steve Wozniak, on
display at the Computer History Museum and
also the Captain Crunch whistle
The Blue Box
             How did the Blue Box work?
1. User places a long distance telephone call
2. When the call rings he sends the 2600Hz tone
3. Basically, this tone is signaling you hung up
4. Line makes a "Ka-Cheep" noise, followed by
silence, it is now waiting for routing digits
5. Dial a "Key Pulse" followed by telephone #
6. You just made a free call
Phreaking boxes!!!
• Blue- can make calls initiated by generating
  2600Hz tone followed by

• Red- generates tones to simulate inserting
  coins in pay phones

• Black- small electronic circuit added to a
  telephone which provided the caller with a
  free call.
Make your own Red Box
1. Download any free tone generator e.g.
    NCH Tone Generator
2. Create at least one ₵ ₵ or ₵ tone
                        5, 10   25
    sequence by combining 1.7KHz and 2.2KHz
i.e. ₵5=One 66 ms tone
3. Save and playback tone
to payphone microphone
4. Free calls!
Hacking 101
  Hacking - is the investigation and exploitation
  of system vulnerabilities.

Hacking expertise varies, some categories are:
• Newbies- Basic concepts but little practice
• Cyberpunks – Know the tools of the trade
• Coders- Write the tools to automate hacks
• Cyber terrorists-Threats to national security
Hacker Hats
• White hats- Security professionals (defense)
• Black hats- Crackers, bad guys
• Grey hats… In between
The penetration test
Common steps in a pen test or hacking

1.   Reconnaissance
2.   Scanning and enumeration
3.   Gaining access
4.   Escalation of privileges
5.   Maintaining access
6.   Covering tracks
Information Gathering (Recon.)
Scanning
The steps for a scanning methodology are:
1. Identify live systems

2. Discover open ports

3. Identify the OS and services

4. Scan for vulnerabilities
Gaining Access
• Once known vulnerabilities are enumerated
• Learn the extent of usefulness of exploitation

The keystone of security is authentication and
the most used method is the password
Password Attacks
Passive online attack e.g. a packet sniffer
capturing a password in plaintext in network
traffic
Active online attack e.g. password guessing
Offline password cracking e.g. stealing the
password hashes and offline cracking
Keylogging e.g. hardware or software
keystroke logger
Passive online attack
0.http://www.httprecipes.com/1/2/forms.php
1.Run Wireshark
2.Filter http
3.Find post method
4.Follow TCP stream
5. You have username and password in the clear
if server isn’t using https SSL or other encryption
Replay and Man-in-the-middle
• When passwords can’t be caught in plaintext

  Man-in-the-middle
• ARP poisoning
• Session hijacking
  Replay attack
Cain and Abel (ARP poisoning)
1.   Install Cain and Abel
2.   Connect to a network
3.   Select sniffer tab
4.   Start sniffer and select network interface
5.   Select hosts on bottom and press then ok
6.   Select bottom APR tab and click top window
7.   Press and select target IP then hit Ok
8.   Hit then select passwords tab, (http)
Cain and Abel (ARP poisoning)
              Man-in-the-middle (Worked in Firefox7)
•   http://www.voddler.com/ (clueless of attack)
•   http://www.cnet.com/ (clueless of attack)
•   https://www.fxhome.com/ (invalid certificate)
•   https://www.yahoo.com/ (invalid certificate)
•   https://www.amazon.com/ (invalid certificate)

(Invalid certificate, worked in Internet Explorer 9 if continues)
• https://accounts.google.com (Gmail) (sometimes, *cookies)
• https://login.live.com (Hotmail)
Cain and Abel (ARP poisoning)
Secured (Internet Explorer and Firefox)
• http://www.facebook.com
• https://www.facebook.com
• https://www.paypal.com/

Firefox version 7
Secured, detects invalid certificate w/no continue
• https://www.paypal.com
Active online attack (Guessing)
1. Your partner, child or pet’s name, possibly followed by a 0
    or 1 (because they’re always making you use a
    number, aren’t they?)
2. The last 4 digits of your social security number.
3. 123 or 1234 or 123456.
4. “password”
5. Your city, or college, football team name.
6. Date of birth – yours, your partner’s or your child’s.
7. “god”
8. “letmein”                  This list covered about 20% of
9. “money”                    passwords as of March
10. “love”                    31, 2010, according to
                              Lifehacker.com
Offline password cracking
  Passwords on Windows systems found in SAM
C:windowssystem32config
C:windowsrepair copy sam and system files
http://www.youtube.com/watch?v=SDsJbgl2J8E
  Passwords in Linux are found in shadow file
  /etc/shadow

  Crack password hash files (Cain and Abel)
Offline password cracking
1.   Copy sam and system files
2.   Run Cain and Abel
3.   Select cracker tab
4.   Select LM and NTLM
5.   Select plus sign
6.   Add sam and system files
7.   Copy key, exit and paste
8.   Right click and crack with LM up to Vista
Keyloggers
Record every keystroke the user makes

   Software keyloggers can send passwords to
   remote computers
(low risk for hacker)

  Hardware keyloggers may be small dongles
  placed on the back of a desktop
(high risk for hacker)
Other forms of Gaining Access
  Trojans and backdoors
• A Trojan can accomplish any number of things
  from sending email, keylogging and stealing
  data to turning your computer into a zombie.

• Usually it provides an entrance and a form of
  maintaining access by implementing a
  backdoor.
Privilege Escalation
  Once inside a hacker can seek better ways of
  cracking the root or administrator password

• A good tool that is somewhat famous in the
  hacker community is Metasploit.

• Metasploit is a semi-automated tool for find
  vulnerabilities that may lead to role elevation.
Stealth
  Some tactics are:
1. Use passive attacks
2. Use proxies
3. Use the Tor anonymity network if possible
4. Hack from open or public access points
5. Use attack diversions when performing the
   real active attacks that could expose you
Conclusion
Nothing is secure

Security - matter of cost of attack vs info value

Cost can be calculated in $dollars and effort

Active attack = High Risk
Passive attack = Low Risk
References
• Matt Walker, CEH ALL-IN-ONE, 2011
• Williams Stalling, Lawrie Brown, Computer Security, 2008
• Jon Erickson, Hacking The Art of Exploitation, 2008
• http://www.nch.com.au/tonegen/faq.html
• http://sectools.org/index.html
• http://www.lifehacker.com.au/2010/03/how-
  i%E2%80%99d-hack-your-weak-passwords/
• http://www.youtube.com/watch?v=7ezGTP99xSw
• http://www.wireshark.org/docs/wsug_html_chunked/ChW
  orkBuildDisplayFilterSection.html
• http://www.youtube.com/watch?v=C_trnrkkPUs&feature=r
  elated
Questions?




You’ve been hacked!

More Related Content

PPTX
Ethical Hacking Redefined
PPTX
Web defacement
PPTX
Password Stealing & Enhancing User Authentication Using Opass Protocol
PPTX
Hacking by Pratyush Gupta
PPT
Hacking
PPT
Hacking
PPTX
Hacking
Ethical Hacking Redefined
Web defacement
Password Stealing & Enhancing User Authentication Using Opass Protocol
Hacking by Pratyush Gupta
Hacking
Hacking
Hacking

What's hot (20)

PPT
Ulfah
PPTX
PPTX
Trojan horse
PDF
Defcon 22-metacortex-grifter-darkside-of-the-internet
PDF
KeyLoggers - beating the shit out of keyboard since quite a long time
PPT
Trojan backdoors
PPT
Backdoor
PPT
Keyloggers and Spywares
PPTX
Computer securety
PDF
Defcon 22-adrian-crenshaw-dropping-docs-on-darknets-how-peop
PPTX
BackDoors Seminar
DOCX
Introduction to trojans and backdoors
PPTX
Trojans and backdoors
PPTX
Trojan horsies prez
PDF
Ceh v5 module 06 trojans and backdoors
PDF
Let's Hack a House
PPTX
PPT
Keyloggers
PPSX
Detection of running backdoors
PPT
Hacking Presentation
Ulfah
Trojan horse
Defcon 22-metacortex-grifter-darkside-of-the-internet
KeyLoggers - beating the shit out of keyboard since quite a long time
Trojan backdoors
Backdoor
Keyloggers and Spywares
Computer securety
Defcon 22-adrian-crenshaw-dropping-docs-on-darknets-how-peop
BackDoors Seminar
Introduction to trojans and backdoors
Trojans and backdoors
Trojan horsies prez
Ceh v5 module 06 trojans and backdoors
Let's Hack a House
Keyloggers
Detection of running backdoors
Hacking Presentation
Ad

Viewers also liked (17)

PDF
PPT
Addition
PPT
Cain abel
PPT
Tomasz P from Poland
PPT
Freeware Security Tools You Need
PDF
Tcpdump basico
PDF
Introduction to tcpdump
PPTX
Cain
PPTX
Tcpdump
PPTX
Tcpdump hunter
PPT
TCPdump-Wireshark
PPT
Tcpdump
PPTX
Wireshark
PPTX
Cybersecurity 1. intro to cybersecurity
PPTX
Advantages and disadvantages of social media
PPTX
Cyber security presentation
PPTX
Packet sniffers
Addition
Cain abel
Tomasz P from Poland
Freeware Security Tools You Need
Tcpdump basico
Introduction to tcpdump
Cain
Tcpdump
Tcpdump hunter
TCPdump-Wireshark
Tcpdump
Wireshark
Cybersecurity 1. intro to cybersecurity
Advantages and disadvantages of social media
Cyber security presentation
Packet sniffers
Ad

Similar to Cybersecurity cyberlab1 (20)

PPT
ETHICAL HACKING
PPTX
Hacking and cracking
PDF
Introduction of hacking and cracking
PPTX
module 3 of cybersecurity of first year students
PPT
Ethical Hacking
PPT
Cyber security and detailed informat.ppt
PPTX
Ethical hacking
PPTX
Hacking,History Of Hacking,Types of Hacking,Types Of Hackers,Cyber Laws for ...
DOCX
Password hacking
PPT
hacking lecture 3c.ppt
PPT
Ch07.ppt
PPT
Unit-4 Cybercrimes-II Mobile and Wireless Devices.ppt
PPT
Hacking 1224807880385377-9
PDF
Ethical Hacking
PPTX
password cracking and Key logger
PPTX
Ethical hacking 101 - Singapore RSA 2019
PPTX
Hacking
PPTX
Cyber Security Module 3.pptx Cybersecurity is the practice of protecting syst...
PPTX
Inetsecurity.in Ethical Hacking presentation
PPTX
Hacking
ETHICAL HACKING
Hacking and cracking
Introduction of hacking and cracking
module 3 of cybersecurity of first year students
Ethical Hacking
Cyber security and detailed informat.ppt
Ethical hacking
Hacking,History Of Hacking,Types of Hacking,Types Of Hackers,Cyber Laws for ...
Password hacking
hacking lecture 3c.ppt
Ch07.ppt
Unit-4 Cybercrimes-II Mobile and Wireless Devices.ppt
Hacking 1224807880385377-9
Ethical Hacking
password cracking and Key logger
Ethical hacking 101 - Singapore RSA 2019
Hacking
Cyber Security Module 3.pptx Cybersecurity is the practice of protecting syst...
Inetsecurity.in Ethical Hacking presentation
Hacking

More from rayborg (6)

PDF
Borges rprojectcs691y
PPTX
Cybersecurity cyberlab3
PPTX
Cybersecurity cyberlab2
PPTX
Research week3 idea
PPTX
Mushroom tutorial http://rjdatamining.weebly.com
PDF
Project 2 Data Mining Part 1
Borges rprojectcs691y
Cybersecurity cyberlab3
Cybersecurity cyberlab2
Research week3 idea
Mushroom tutorial http://rjdatamining.weebly.com
Project 2 Data Mining Part 1

Cybersecurity cyberlab1

  • 1. Hacking: What is it and how is it done? Introduction to Cybersecurity Slides by Raymond Borges
  • 2. Outline Background Hacking 101 The penetration test Reconnaissance Enumeration Gaining access Privilege escalation Maintaining access Stealth Conclusion
  • 3. Background Phone freaks were some of the first hackers • Phreaking- activity of a culture of people who study, experiment with, or explore telecom • Blue box- tone generator capable of producing frequencies to hack phone trunks
  • 4. Background Below is the blue box built by Steve Wozniak, on display at the Computer History Museum and also the Captain Crunch whistle
  • 5. The Blue Box How did the Blue Box work? 1. User places a long distance telephone call 2. When the call rings he sends the 2600Hz tone 3. Basically, this tone is signaling you hung up 4. Line makes a "Ka-Cheep" noise, followed by silence, it is now waiting for routing digits 5. Dial a "Key Pulse" followed by telephone # 6. You just made a free call
  • 6. Phreaking boxes!!! • Blue- can make calls initiated by generating 2600Hz tone followed by • Red- generates tones to simulate inserting coins in pay phones • Black- small electronic circuit added to a telephone which provided the caller with a free call.
  • 7. Make your own Red Box 1. Download any free tone generator e.g. NCH Tone Generator 2. Create at least one ₵ ₵ or ₵ tone 5, 10 25 sequence by combining 1.7KHz and 2.2KHz i.e. ₵5=One 66 ms tone 3. Save and playback tone to payphone microphone 4. Free calls!
  • 8. Hacking 101 Hacking - is the investigation and exploitation of system vulnerabilities. Hacking expertise varies, some categories are: • Newbies- Basic concepts but little practice • Cyberpunks – Know the tools of the trade • Coders- Write the tools to automate hacks • Cyber terrorists-Threats to national security
  • 9. Hacker Hats • White hats- Security professionals (defense) • Black hats- Crackers, bad guys • Grey hats… In between
  • 10. The penetration test Common steps in a pen test or hacking 1. Reconnaissance 2. Scanning and enumeration 3. Gaining access 4. Escalation of privileges 5. Maintaining access 6. Covering tracks
  • 12. Scanning The steps for a scanning methodology are: 1. Identify live systems 2. Discover open ports 3. Identify the OS and services 4. Scan for vulnerabilities
  • 13. Gaining Access • Once known vulnerabilities are enumerated • Learn the extent of usefulness of exploitation The keystone of security is authentication and the most used method is the password
  • 14. Password Attacks Passive online attack e.g. a packet sniffer capturing a password in plaintext in network traffic Active online attack e.g. password guessing Offline password cracking e.g. stealing the password hashes and offline cracking Keylogging e.g. hardware or software keystroke logger
  • 15. Passive online attack 0.http://www.httprecipes.com/1/2/forms.php 1.Run Wireshark 2.Filter http 3.Find post method 4.Follow TCP stream 5. You have username and password in the clear if server isn’t using https SSL or other encryption
  • 16. Replay and Man-in-the-middle • When passwords can’t be caught in plaintext Man-in-the-middle • ARP poisoning • Session hijacking Replay attack
  • 17. Cain and Abel (ARP poisoning) 1. Install Cain and Abel 2. Connect to a network 3. Select sniffer tab 4. Start sniffer and select network interface 5. Select hosts on bottom and press then ok 6. Select bottom APR tab and click top window 7. Press and select target IP then hit Ok 8. Hit then select passwords tab, (http)
  • 18. Cain and Abel (ARP poisoning) Man-in-the-middle (Worked in Firefox7) • http://www.voddler.com/ (clueless of attack) • http://www.cnet.com/ (clueless of attack) • https://www.fxhome.com/ (invalid certificate) • https://www.yahoo.com/ (invalid certificate) • https://www.amazon.com/ (invalid certificate) (Invalid certificate, worked in Internet Explorer 9 if continues) • https://accounts.google.com (Gmail) (sometimes, *cookies) • https://login.live.com (Hotmail)
  • 19. Cain and Abel (ARP poisoning) Secured (Internet Explorer and Firefox) • http://www.facebook.com • https://www.facebook.com • https://www.paypal.com/ Firefox version 7 Secured, detects invalid certificate w/no continue • https://www.paypal.com
  • 20. Active online attack (Guessing) 1. Your partner, child or pet’s name, possibly followed by a 0 or 1 (because they’re always making you use a number, aren’t they?) 2. The last 4 digits of your social security number. 3. 123 or 1234 or 123456. 4. “password” 5. Your city, or college, football team name. 6. Date of birth – yours, your partner’s or your child’s. 7. “god” 8. “letmein” This list covered about 20% of 9. “money” passwords as of March 10. “love” 31, 2010, according to Lifehacker.com
  • 21. Offline password cracking Passwords on Windows systems found in SAM C:windowssystem32config C:windowsrepair copy sam and system files http://www.youtube.com/watch?v=SDsJbgl2J8E Passwords in Linux are found in shadow file /etc/shadow Crack password hash files (Cain and Abel)
  • 22. Offline password cracking 1. Copy sam and system files 2. Run Cain and Abel 3. Select cracker tab 4. Select LM and NTLM 5. Select plus sign 6. Add sam and system files 7. Copy key, exit and paste 8. Right click and crack with LM up to Vista
  • 23. Keyloggers Record every keystroke the user makes Software keyloggers can send passwords to remote computers (low risk for hacker) Hardware keyloggers may be small dongles placed on the back of a desktop (high risk for hacker)
  • 24. Other forms of Gaining Access Trojans and backdoors • A Trojan can accomplish any number of things from sending email, keylogging and stealing data to turning your computer into a zombie. • Usually it provides an entrance and a form of maintaining access by implementing a backdoor.
  • 25. Privilege Escalation Once inside a hacker can seek better ways of cracking the root or administrator password • A good tool that is somewhat famous in the hacker community is Metasploit. • Metasploit is a semi-automated tool for find vulnerabilities that may lead to role elevation.
  • 26. Stealth Some tactics are: 1. Use passive attacks 2. Use proxies 3. Use the Tor anonymity network if possible 4. Hack from open or public access points 5. Use attack diversions when performing the real active attacks that could expose you
  • 27. Conclusion Nothing is secure Security - matter of cost of attack vs info value Cost can be calculated in $dollars and effort Active attack = High Risk Passive attack = Low Risk
  • 28. References • Matt Walker, CEH ALL-IN-ONE, 2011 • Williams Stalling, Lawrie Brown, Computer Security, 2008 • Jon Erickson, Hacking The Art of Exploitation, 2008 • http://www.nch.com.au/tonegen/faq.html • http://sectools.org/index.html • http://www.lifehacker.com.au/2010/03/how- i%E2%80%99d-hack-your-weak-passwords/ • http://www.youtube.com/watch?v=7ezGTP99xSw • http://www.wireshark.org/docs/wsug_html_chunked/ChW orkBuildDisplayFilterSection.html • http://www.youtube.com/watch?v=C_trnrkkPUs&feature=r elated