1 cs591 chow Hacking Methodology (Steps) An excellent description inside of the back cover page of “Hacking Exposed” text by McClure et al. Scanning Footprinting Enumeration Gaining Access Escalating Privilege Pilferting Covering Tracks Creating Back Doors Denial of Service whois, nslookup Nmap, fping dumpACL, showmount legion, rpcinfo Tcpdump, Lophtcrack NAT Johntheripper, getadmin Rhosts, userdata Config files, registry zap, rootkits Cron,at, startup folder netcat, keystroke logger remote desktop Synk4, ping of death tfn/stacheldraht

2 cs591 chow Footprinting Information gathering. Sam Spade is window-based network query tool. Find out target IP address/phone number range Why check phone numbers? Namespace acquisition. Network Topology (visualRoute). It is essential to a “surgical” attack. The key here is not to miss any details. Note that for penetration tester, this step is to avoiding testing others instead of your client and to include all systems to be tested (sometime the organization will not tell you what their systems consist of). Defense: deploy NIDS (snort), RotoRouter Technique s Open Source search Find domain name, admin, IP addresses name servers DNS zone transfer ToolsGoogleGoogle, search engine, EdgarEdgar Whois (Network solution; arin)‏Network solution arin Nslookup (ls – d) Nslookup (ls – d) dig Sam Spade Sam Spade

3 cs591 chow Scanning Bulk Target assessment Which machine is up and what ports (services) are open Focus on most promising avenues of entry. To avoid being detect, these tools can reduce frequency of packet sending and randomize the ports or IP addresses to be scanned in the sequence. Note that some machine does not respond to ping but responds to requests to ports that actually open. Ardor is an example. Technique s Ping sweepTCP/UDP port scan OS detection ToolsFpingFping, icmpenum WS_Ping ProPack nmap Nmap Nmap Superscan fscan Nmap Nmap queso siphon

4 cs591 chow Enumeration Identify valid user accounts or poorly protected resource shares. Most intrusive probing than scanning step. Techniqueslist user accounts list file sharesidentify applications ToolsNull sessions DumpACL Sid2usre onSiteAdmin Showmount NAT legion Banner grabing with telnet or netcat, rpcinfo netcat

5 cs591 chow Gaining Access Based on the information gathered so far, make an informed attempted to access the target. Techniq ues Password eavesdroppin g File share brute forcing Password File grab Buffer overflow ToolsTcpdump/ssld ump L0phtcrack readsmb NAT legion Tftp Pwddump2(NT )‏ Ttdb, bind IIS.HTR/ISM. DLL

6 cs591 chow Escalating Privilege If only user-level access was obtained in the last step, seek to gain complete control of the system. TechniquesPassword cracking Known Exploits ToolsJohn the ripper L0phtcrack Lc_messages, Getadmin, sechole

7 cs591 chow Pilfering Webster's Revised Unabridged Dictionary (1913) Pilfer \Pil"fer\, v. i. [imp. & p. p. Pilfered; p. pr. & vb. n. Pilfering.] [OF. pelfrer. See Pelf.] To steal in small quantities, or articles of small value; to practice petty theft.PilferedPelf Gather info on identify mechanisms to allow access of trusted systems. TechniquesEvaluate TrustsSearch for cleartext passwords Toolsrhosts LSA secrets User data, Configuration files Registry

8 cs591 chow Covering Tracks Once total ownership of the target is secured, hiding this fact from system administrators become paramount, less they quickly end the romp. TechniquesClear LogsHide tools ToolsZap, Event Log GUI Rootkits file streaming

9 cs591 chow Creating Back Doors Trap doors will be laid in various parts of the system to ensure that privilege access is easily regained whenever the intruder decides. Technique s Create rogue user accounts Schedule batch jobs Infect startup files ToolsMembers of wheel, admin Cron, ATrc, startup folder, registry keys Technique s Plant remote control services Install monitoring mechanisms Replace appls with Trojans ToolsNetcat, remote.exe VNC, B02K remote desktop Keystroke loggers, add acct. to secadmin mail aliases Login, fpnwcint.dll

10 cs591 chow Denial of Services If atacker is unsuccessful in gaining access, they may use readily available exploit code to disable a target as a last resort. Technique s Syn floodICMP techniquesIdentical src/dst SYN requests Toolssynk4Ping to death smurf Land Latierra Technique s Overlapping fragment/offse t bugs Out of bounds TCP options (OOB)‏ DDoS ToolsNetcat, remote.exe VNC, B02K remote desktop Keystroke loggers, add acct. to secadmin mail aliases Trinoo TFN stacheldraht