Ethical Hacker's Certification Guide (CEHv11)

A comprehensive guide on Penetration Testing including Network Hacking, Social Engineering, and Vulnerability Assessment

Mohd Sohaib

• Éditeur: BPB Publications
• Année: 2021
• ISBN:
  9789391392161
• Sujet: Ciencia de la computación
• Sous-sujet: Redes de computadoras

Dive into the world of securing digital networks, cloud, IoT, mobile infrastructure, and much more.

Key Features
? Courseware and practice papers with solutions for C.E.H. v11.
? Includes hacking tools, social engineering techniques, and live exercises.
? Add on coverage on Web apps, IoT, cloud, and mobile Penetration testing..

Description
The 'Certified Ethical Hacker's Guide' summarises all the ethical hacking and penetration testing fundamentals you'll need to get started professionally in the digital security landscape. The readers will be able to approach the objectives globally, and the knowledge will enable them to analyze and structure the hacks and their findings in a better way.The book begins by making you ready for the journey of a seasonal, ethical hacker. You will get introduced to very specific topics such as reconnaissance, social engineering, network intrusion, mobile and cloud hacking, and so on. Throughout the book, you will find many practical scenarios and get hands-on experience using tools such as Nmap, BurpSuite, OWASP ZAP, etc. Methodologies like brute-forcing, wardriving, evil twining, etc. are explored in detail. You will also gain a stronghold on theoretical concepts such as hashing, network protocols, architecture, and data encryption in real-world environments.In the end, the evergreen bug bounty programs and traditional career paths for safety professionals will be discussed. The reader will also have practical tasks and self-assessment exercises to plan further paths of learning and certification.

What you will learn
? Learn methodologies, tools, and techniques of penetration testing and ethical hacking.
? Expert-led practical demonstration of tools and tricks like nmap, BurpSuite, and OWASP ZAP.
? Learn how to perform brute forcing, wardriving, and evil twinning.
? Learn to gain and maintain access to remote systems.
? Prepare detailed tests and execution plans for VAPT (vulnerability assessment and penetration testing) scenarios.

Who this book is for
This book is intended for prospective and seasonal cybersecurity lovers who want to master cybersecurity and ethical hacking. It also assists software engineers, quality analysts, and penetration testing companies who want to keep up with changing cyber risks.

Table of Contents
1. Cyber Security, Ethical Hacking, and Penetration Testing
2. CEH v11 Prerequisites and Syllabus
3. Self-Assessment
4. Reconnaissance
5. Social Engineering
6. Scanning Networks
7. Enumeration
8. Vulnerability Assessment
9. System Hacking
10. Session Hijacking
11. Web Server Hacking
12. Web Application Hacking
13. Hacking Wireless Networks
14. Hacking Mobile Platforms
15. Hacking Clout, IoT, and OT Platforms
16. Cryptography
17. Evading Security Measures
18. Practical Exercises on Penetration Testing and Malware Attacks
19. Roadmap for a Security Professional
20. Digital Compliances and Cyber Laws
21. Self-Assessment-1
22. Self-Assessment-2

CHAPTER 1

Cyber Security, Ethical Hacking, and Penetration Testing

Introduction

The pace of innovation and advancement in the field of computing has been phenomenal. From gigantic machines capable of performing a few instructions per minute to handheld devices executing millions of instructions per second, the computing technology has not just evolved but has become more affordable and mainstream. And as with all good things, digital systems come with their own unique set of obstacles; information security being the biggest one. With the amount of information flowing through digital channels, they are the default targets of cyber criminals looking to fulfil their ulterior motives.

This book will help you understand the basics of cyber security, how an attacker works, and what you can do to secure your system. We will be getting into the shoes of a hacker to understand how one operates, strikes, and causes disruption. We will then define processes as a penetration tester to effectively simulate, detect, and mitigate any ill effects of the attacks.

Structure

We will cover the following topics in this chapter:

• Cyber security introduction
• Principles of security for information systems
• Hacking concepts
• Ethical hacking and penetration testing

Objectives

This chapter will focus on introducing you to the world of Information Systems and the risks associated with them. After going through the chapter, you should be able to have a basic understanding of how an information system works and the properties of a secure information system. We will also go through the general concepts of hacking, the steps taken by hackers, and their impact on the digital landscape. The last section aims to get you familiarized with the world of penetration testing, the importance of having this skill, and how a penetration tester is actually a hacker working on the right side of the law.

The Ten Thousand Feet View

A perfectly secure system is a myth. Well, not really if you are ready to bury the system six feet under concrete and never switch it back on again. But again, not many of us would have the choice or a fitting use case where we would procure a system just to use it as an ornament and never actually use it. For most of us living in the digital age, information and data security is as much a problem as getting the next meal. And though it might not look like that big a concern for most of the uninitiated folks, it surely has the potential to make or break each and every information system available to mankind.

Cyber Security

Before delving deep into the importance and know-how of cyber security, let’s establish a couple of definitions to set the scope.

• Information Systems: Any and all logical and physical assets containing or leading to a piece of data, information, resource, or leverage is an information system. From a piece of memo on your office desk to the mobile phone in your pocket to the enterprise data centers, all in their own existence are information systems.
• Information Security: The protection of an information asset from any unauthorized and unauthenticated access, modification, retrieval or erasure, all the while providing meaningful access to the actual system user constitutes the essence of information security. The security may hence be in the form of a security guard, a lock and key set, or a high-end multi-factor authentication.

The worldwide Information Technology spending was projected to be at $3.8 trillion. The industry in the US alone accounts for $1.8 trillion value-added GDP. For India, the IT and ITES grew to $181 billion in 2018-19.

An interesting and somewhat overlooked fact is that the Information Technology industry forms the backbone of nearly all the industries ranging from manufacturing to last mile goods delivery. This makes it altogether a much larger industry with a sizeable impact on world economies.

What this scale and widespread usage and applications mean is that there are a wide variety of generic and custom solution systems in place at every nook and corner of the digital landscape. And with the information being the new currency, the information systems are the new banks and lockers that everyone is after. With this being said, it is obvious to assume that the systems would naturally be resistant to intrusions and breaches, given their cost, usage, and market reputation at stake. This is one of the biggest myths in the information technology age.

Figure 1.1: Top cyber-attack targets

According the Hiscox, an insurance provider, the digital incidents cost an average of $200,000 and 60% of these businesses go out of business within six months of being victimized. Another report lays out the fact that affected businesses find it hard to attract new customers.

The total cost of hacks all over the world is ever increasing with $400 billion a year at the current rate. 62% of businesses experienced phishing and social engineering attacks in 2018. 71% of the breaches were financially motivated.

Although information and customer records top the itinerary of digital shoplifters, other items include:

• Ransomware: A piece of code to hold digital assets hostage for monetary benefits. The code generally encrypts the information it infects, with the attacker being the only one with the readily available ability to decrypt the compromised information.
• Denial of services by flooding the communication channel with requests to overwhelm the underlying systems and disrupting businesses.
• Financial frauds by impersonating legitimate users or gaining access to their assets via differing means.
• Cyber activism, wherein activists target digital infrastructure supporting unethical business practices or social misdemeanors.
• Cyber terrorism employed by the new age terrorists, wherein they target government and military facilities via their digital infrastructure.
• Maligning target reputation out of revenge or rivalry.

And while a software solution is expected to be inherently secure and tamper-proof, it is not the case for almost all of them. Let’s first define what factors would impact the security of an information system:

• Quality of source code: The quality of the source code deployed for an application would directly affect the security of the application. For a developer, it is of paramount importance that there are no loopholes and backdoor entries to the application. An example of this would be to make sure the application does not process or execute any script code fed externally via inputs.
• Development environment: An unsecure development or testing platform could potentially lead to the inclusion of bugs that are not directly associated with the code and the functionality of the system. These include bugs in a compiled code structure and its interpretation by the underlying system.
• Deployment environment: The actual final place of residence of the application is its deployment environment, which is majorly an ecosystem of multiple software solutions. Since the code will execute in this environment, it is of paramount importance that the environment in itself is as thoroughly sanitized as the code. There could be unrestricted network access, backdoors, and bugs within the deployment environment which might have gone unnoticed by the vendor or unpatched by the system administrator.
• System handlers: The people who maintain the system and have access to the application environment more often than not are the main vectors of breaches. A skipped patch or careless disposal of sensitive waste or simply not following the standard operation guidelines result in massive data breaches all the time.
• End user: While a majority of the development happens in line with the happy scenarios of application usage, the end user is in fact the most unpredictable of all. A good system design could strive to cover all routes of execution, but with applications that have huge user base, this would be an impossible task. Another concern is the malicious user, the one who onboards the system just to break it.
• Technological advancements: While advancements would sound great for a system, there is usually a cost involved in upgrading the solutions already deployed to bring them up at par. This often results in an environment being a mix of technologies that may not complement each other after a period of time as they were during the initiation phases. Also, the vendors tend to stop support and the patching of older systems to focus on maintaining the newer ones. This leaves the older systems at much greater risks.

The six feet deep concrete burial doesn’t sound like a bad idea now, does it? There is just one catch, you will find yourself locked out of the information you store and the retrieval would be a real pain each and every time. This establishes another fact in the information system – the importance of accessibility and availability. There are three basic principles upon which information policies are usually defined:

• Confidentiality: That the information stored remain confidential, clear of prying eyes and void of any unauthorized access.
• Integrity: That the information stored maintains the actual form and remains free of any adulteration via unauthorized means. This includes maintaining records of access and operations by legitimate system users as well to put the onus on them for their actions.
• Availability: The information stored needs to be readily and timely available and accessible to the legitimate party in a manner agreed upon. Similar to justice, information delivered late is useless information.

In addition to these, there are two more principles that help close the information security loop:

• Authenticity: This is to ensure that each user receives a genuine piece of information and is presented a means to check the authenticity at each step of information transfer. This is especially needed when 62% of all businesses are exposed to phishing and social engineering attacks.
• Non-repudiation: This guarantees that a piece of information was successfully and actually sent by an identifiable source and indeed received by the intended destination. Non-repudiation ensures that there is no speculation on the communication of information, and neither the sender nor the receiver can deny participating in the transaction.

Figure 1.2: Components of effective information security solution

A good information system would take these into account and establish an optimal contract to ensure an acceptable security of the digital assets.

The words optimal and acceptable are of paramount importance here. Each of the underlying principle takes its fair share of:

• Effort: To implement a measure would require effort and so would building doorways through it for a legitimate user.
• Time: For every effort, there would be an associated timeline. Further, for each doorway, there would be an introduction of access delay.
• Cost: For every set of effort and time, there would be an associated cost of development as well as maintenance.

In addition to these, there are going to be trade-offs on:

Functionality: With an increase in the number of functionalities, there would be an increase in the application footprint and so would there be an increase in the risk factors. A video addition to a messaging platform would require a video upload, video storage, and video streaming features. These would be additional assets to keep track and control of. Further, their handling would expose more ways to get in and out of the system.

Usability: The digital sy...

Table des matières

• Cover Page
• Title Page
• Copyright Page
• Dedication Page
• About the Author
• About the Reviewer
• Acknowledgement
• Preface
• Errata
• Table of Contents
• 1. Cyber Security, Ethical Hacking, and Penetration Testing
• 2. CEH v11 Prerequisites and Syllabus
• 3. Self-Assessment
• 4. Reconnaissance
• 5. Social Engineering
• 6. Scanning Networks
• 7. Enumeration
• 8. Vulnerability Assessment
• 9. System Hacking
• 10. Session Hijacking
• 11. Web Server Hacking
• 12. Web Application Hacking
• 13. Hacking Wireless Networks
• 14. Hacking Mobile Platforms
• 15. Hacking Cloud, IoT, and OT Platforms
• 16. Cryptography
• 17. Evading Security Measures
• 18. Practical Exercises on Penetration Testing and Malware Attacks
• 19. Roadmap for a Security Professional
• 20. Digital Compliances and Cyber Laws
• 21. Self-Assessment 1
• 22. Self-Assessment 2
• Index