Ethical Hacking Notes | B.Sc. (Computer Science) Semester 5 | Mumbai University | munotes

Contents

Module I The law and ethics of authorised testing, security vocabulary, the five-phase lifecycle, CVE and CVSS, reconnaissance and scanning, enumeration, system and password security, hashing and salting, and network sniffing

1. How This Course Is Examined: the Journal, the 80 Per Cent Rule and the Two-Hour Practical Paper 1
2. The Law: What Makes Hacking Lawful 5
3. The Rest of the Law: Source Code, Identity, Protected Systems and Confidentiality 10
4. Authorisation in Practice: the Letter, the Scope and the Rules of Engagement 16
5. The Vocabulary: Asset, Threat, Vulnerability, Exploit and Risk 21
6. The CIA Triad, and Which Property Each Attack Breaks 26
7. Hacker Classes, Hacktivism and the Types of Hacking 31
8. Types of Engagement: Black Box, White Box, Grey Box, Internal and External 36
9. The Five Phases of an Engagement: a Lifecycle Model 41
10. The Defender's Mirror: a Control for Every Phase 46
11. The Life of a Vulnerability 51
12. Responsible Disclosure Against Full Disclosure, and the Vendor's Side 56
13. CVE and CWE: Naming the Flaw and Naming the Weakness 61
14. CVSS: the Eight Base Metrics 65
15. CVSS: Working a Score, and the Temporal and Environmental Metrics 69
16. Bug Bounty Programmes 74
17. A Worked Case Study: Heartbleed 78
18. A Worked Case Study: Log4Shell 83
19. Footprinting: Passive Against Active Reconnaissance 88
20. OSINT on People: Names, Roles and the Email Format 93
21. OSINT on Technology and Infrastructure 97
22. Search-Engine Reconnaissance and Document Metadata 102
23. Reducing Your Own Footprint: the Defensive Audit 107
24. How the Domain Name System Resolves a Name 112
25. The Record Types, and What Each One Reveals 117
26. Subdomain Enumeration and Infrastructure Mapping 122
27. Zone Transfers and DNS Hardening 127
28. WHOIS, the Registries and IP Allocation 132
29. The Psychology: the Levers an Attacker Pulls 137
30. Phishing, Spear Phishing, Whaling, Smishing and Vishing 142
31. Pretexting, Baiting, Impersonation and Tailgating 147
32. A Worked Case: Analysing a Real Attack 152
33. Defences: Awareness, Verification and Multi-Factor 157
34. Email Authentication: SPF, DKIM and DMARC 162
35. TCP/IP for the Scanner: Layers, Addresses, Ports and Flags 167
36. The Three-Way Handshake, and Why Scanning Works 172
37. Host Discovery: Finding What Is Alive 177
38. The Scan Types: Connect, SYN, FIN, NULL and XMAS 182
39. ACK Scanning and UDP Scanning 187
40. Port States, Service and Version Detection, and OS Fingerprinting 192
41. Firewall and Filter Detection 197
42. How the Scan Is Seen: Intrusion Detection and the Defender's View 202
43. Enumeration and Banner Grabbing 207
44. SNMP Enumeration 212
45. NetBIOS and SMB Enumeration 217
46. LDAP, SMTP and NTP Enumeration 222
47. Enumeration Countermeasures: What to Close 227
48. System Hacking and Privilege Escalation 232
49. Escalation Routes on Linux and Windows, at Concept Level 237
50. Detecting Persistence: the Auto-Start Audit 243
51. Covering Tracks, and Why a Defender Protects the Logs 249
52. Rootkits: How They Hide and How They Are Found 254
53. Spyware and Keyloggers from the Defensive Side 259
54. Encoding, Encryption and Hashing: Three Different Things 263
55. Symmetric and Asymmetric Encryption at Concept Level 267
56. Hash Functions and the Properties They Must Have 271
57. Why a Password Is Never Encrypted: Storage and Salting 276
58. How Passwords Are Attacked, and the Arithmetic of a Keyspace 281
59. Password Policy, Managers and Multi-Factor Authentication 285
60. Cryptographic Weaknesses to Know 290
61. Hubs, Switches, and Passive Sniffing 294
62. MAC Flooding 299
63. ARP Poisoning and the Man in the Middle 303
64. DNS Spoofing 308
65. Countermeasures: Switch Controls and Encryption in Transit 313

Module II Denial of service and botnets, session and web-server security, the OWASP Top Ten, SQL injection, buffer overflows, wireless security, malware analysis, exploit frameworks, and penetration testing methodology and reporting

1. Denial of Service: Attacking Availability 318
2. Volumetric Attacks and Amplification 322
3. Protocol Attacks: the SYN Flood in Depth 327
4. Application-Layer Denial of Service 331
5. Botnets: Architecture and Command and Control 336
6. DDoS Mitigation: the Layered Defence 340
7. Sessions and Tokens: Why They Exist 345
8. How a Session Is Stolen: Prediction, Sniffing and Script 349
9. Session Fixation and Cookie Manipulation 354
10. Cookie Security: Secure, HttpOnly and SameSite 359
11. Cross-Site Request Forgery 363
12. Session Defences in Full 367
13. The Web Server Against the Web Application 371
14. Common Web Server Misconfigurations 375
15. Directory Traversal 379
16. Patch Management 383
17. Hardening and the Security Response Headers 387
18. The OWASP Top 10: What It Is and How It Changed 391
19. A01: Broken Access Control 396
20. Security Misconfiguration and Cryptographic Failures 400
21. Software Supply Chain Failures 404
22. Injection: the Category and Its Members 408
23. Cross-Site Scripting: Stored, Reflected and DOM-Based 412
24. Cross-Site Scripting Defences: Output Encoding and Content Security Policy 416
25. Insecure Design and Authentication Failures 421
26. Integrity, Logging and Exceptional Conditions 425
27. Server-Side Request Forgery 429
28. Input Validation: the Thread Through the Whole List 433
29. SQL Injection: How Input Becomes Logic 438
30. The Types: In-Band, Union-Based and Error-Based 442
31. Blind SQL Injection: Boolean and Time-Based 446
32. Prevention: the Parameterised Query 450
33. Defence in Depth: Least Privilege, Validation and the Web Application Firewall 455
34. Memory Layout: the Stack, the Heap and the Frame 460
35. Stack-Based Buffer Overflow and Return-Address Overwriting 465
36. Heap Overflows and Format-String Flaws, Briefly 469
37. Defences: Bounds Checking, Canaries, DEP, ASLR and Safe Languages 473
38. How Wi-Fi Works: Frames, SSIDs and Association 478
39. WEP and Why It Broke 482
40. WPA and WPA2: AES and the Four-Way Handshake 486
41. WPA3 and the SAE Handshake 490
42. Wireless Attacks: Deauthentication, Evil Twins and Rogue Access Points 494
43. Wireless Best Practice and Enterprise Authentication 499
44. The Malware Families 503
45. Viruses and Worms 507
46. Trojans, Ransomware and Remote Access Tools 511
47. Keyloggers and Spyware: the Architecture 516
48. Detection: Signature, Heuristic and Behavioural 520
49. Safe Analysis: the Sandbox 525
50. Endpoint Protection 529
51. What an Exploit Framework Is 533
52. The Exploit Lifecycle and the Payload 537
53. Post-Exploitation, Bounded by Scope 541
54. The Ethical and Legal Limits of Penetration-Testing Tools 546
55. Why Methodology Matters More Than Tricks 551
56. PTES: the Seven Phases 555
57. The OWASP Testing Guide 559
58. Risk Assessment and Rating 563
59. The Penetration-Test Report 567
60. A Worked Specimen Report 571
61. Retesting and Closing the Engagement 576