Professional Documents
Culture Documents
for
Workshop
On
Table of Contents
S. No.
1 2 3 4 5 6 7 8 9 10
Topic
About Us EHIS Course Module Concept of Hacking Email Hacking System Hacking Trojans Attacks on Network Web Server as a Target Wireless Hacking Tool Kit Description
Page No.
3 5 8 15 19 23 26 29 35 39
Join us at:
Yahoo Group: Kyrion_Digital_Securities@yahoogroups.com Orkut Community: Kyrion Digital Securities
Ethical Hacking & Information Security Page 2
About Us
Page 3
Kyrion Digital Securities Kyrion Technologies Pvt. Ltd., an IIT Delhi Alumni Venture, aims to lay a strong underpinning for the technical development of our country, by developing an active interest among youth in new technologies such as Ethical Hacking & Information Security. Computer and Internet being the backbone of every institution, necessitates the measures to be taken to keep the data and network safe from unauthorized access. For this most companies go in for the help of Ethical Hacking, which makes them aware of the shortcomings in their security systems and help them overcome them as effectively as possible. With the ever increasing requirements of professionals in the field of Ethical Hacking & Information Security, Kyrion Technologies Pvt. Ltd. is all geared up to lay the foundation of a new venture, Kyrion Digital Securities. A recent study conducted by NASSCOM, the expected demand of Ethical Hacking professionals by the year 2012 would be around 1,88,000, as opposed to current availability of only about 22,000 professionals. This in itself is a great motivation for students to take up this potential career option. One can hope to be as on the seventh cloud if one gives his/her centpercent. Kyrion Digital Securities at Kyrion Technologies Pvt. Ltd. has been founded by a group of IT Security Experts & Professors of Top Engineering Colleges such as IIT & NITs. It has laid a foundation in the field of Ethical Hacking & Information Security. Kyrion Digital Securities has conceptualized various workshops, products and resources to cater the needs of different section of students' communities and eventually reaching out to an excess of 4,000 students and tutors in different cities across the country. Key Points of Kyrion Digital Securities: An IIT Delhi Alumni Venture Help government to conduct Education and Awareness Programs on Ethical Hacking & Information Security. (ISEA Project) We are providing services to Software Giant such as Microsoft. We have a rich experience of working on cyber cases and giving workshops to Delhi & Uttar Pradesh Police. The Ministry of Home Affair (Forensic Lab, Hyderabad) supports our Head Trainer. We have developed our own software, spywares, bombers, remote administration tools (Trojans) etc. We provide students the knowledge in the field of Ethical Hacking & Information Security by giving live hacking and gateway demonstrations. This would enable them to secure themselves from such kind of attacks.
Page 4
Kyrion Digital Securities Client List of Kyrion Digital Securities: Indian Institute of Science, Bangalore Indian Institute of Technology, Kharagpur Indian Institute of Technology, Roorkee Indian Institute of Technology, Guwahati Indian Institute of Technology, Delhi National Institute of Technology, Jalandhar National Institute of Technology, Warangal National Institute of Technology, Suratkal Vellore Institute of Technology, Vellore SRM University, Chennai Pune Institute of Computer Technology, Pune Banasthali University, Rajashtan Ramrao Adik Institute of Technology, Mumbai North Eastern Institute of Science & Technology, Itanagar Keshav Mahavidyalaya, Delhi Assam Engineering College, Guwahati Jaipur Engineering College, Kukas Haryana College of Technology and Management, Kaithal GLA Group of Institution, Mathura Uttaranchal Institute of Technology, Dehradun Classroom Training Centers: (In Delhi and NCR) South Ex Preet Vihar Ghaziabad Pitampura Gurgoan Janakpuri Faridabad
Page 5
Page 6
Concept of Hacking
Reading the Hackers mind and Understanding the hacking psychology and methodology o Get to know how a Hacker thinks and prepares for his attack o Types of Hackers and their mentality o Steps performed by a Hacker to attack the target o How an attacker uses the freely available resources in his attack o Hiding your identity while performing the attack o Proxy Server
Email Hacking
Email Forgery o How an Email travels from sender to the receiver o Sending fake Emails, how terrorists send threatening Emails Email Password Hacking o Cracking the Email ID Passwords using the fake Websites Email analysis o Tracing the Email path and locating the Original Sender of the Email o IP Tracing
System Hacking
Targeting a Windows System o Cracking Windows password using the Bruteforce technique o How to bypass the Login Screen and directly Login as the Administrator of the Computer o Grant unlimited access to a limited user o How to use a keylogger to hack the passwords on a computer o Hiding secret messages behind images Protecting your System resources o Configuring strong passwords o Change the Boot sequence o Applying the File and Folder security o Hiding files. Encrypting data on the hard disk with a password o Detecting the Keylogger on a Local Computer
Trojans
How does a Trojan works Building a Trojan server and binding it with any other file as hidden Controlling the remote computer from your computer Detection of Trojan on a Local computer and removing it manually
Attacks on Network
Performing the LAN based attacks o Enumerating the Network details
Page 7
Kyrion Digital Securities o Sniffing the Network Data o Poisoning the Network details and hacking the passwords o Perform the DNS Spoofing attack Counter apart the Network attacks o Trace the attacker on the Local Area Network and shutting down the network attacks
Wireless Hacking
Cracking Wireless Network Password o Checking out the Wireless network details and cracking the WEP key encryption on the Wireless network Wireless Security o How can you make your Wireless network secure and very hard to be cracked?
Page 8
Concept of Hacking
Page 9
Hacking
Hacker is a computer person who is very curious and wants to learn as much as possible about computer systems. Hacking was developing and improving software to increase the performance of computing systems. Hacking has a lot of meanings depending upon the persons knowledge and his work intentions. Hacking is an Art as well as a Skill. It is the knowledge by which one gets to achieve his goals, anyhow, using his skills and power.
Ethical Hacking
Ethical Hacking is testing the resources for a good cause and for the betterment of technology. Technically Ethical Hacking means penetration testing which is focused on Securing and Protecting IT Systems.
Types of Hackers
White Hat Hacker Black Hat Hacker Grey Hat Hacker
Classification of Hackers
Coders Admin Script Kiddies
Coders
Coders are the programmers who have the ability to find the unique vulnerability in existing software and to create working exploit codes. These are the individuals with a deep understanding of the OSI Layer yer Model and TCP/IP Stacks.
Admin
Admin the computer guys who have experience with several operating systems, and know how to exploit several existing vulnerabilities. A majority of Security Consultants fall in this group and work as a part of Security Team.
Script Kiddies
Script Kiddies are the bunnies who use script and programs developed by others to attack computer systems and Networks. They get the least respect but are most annoying and dangerous and can cause big problems without actually knowing know what they are doing.
Page 11
Phase I: Reconnaissance
Reconnaissance can be described as the pre-attack phase and is a systematic attempt to locate, gather, identify, and record information about the target. The hacker seeks to find out as much information as possible about the target.
Kyrion Digital Securities connection the hacker uses for an exploit can be a local area network, local access to a PC, the Internet, or offline. Gaining access is known in the hacker world as owning the system. During a real security breach it would be this stage where the hacker can utilize simple techniques to cause irreparable damage to the target system.
Proxy Servers
A proxy server is a server that acts as an intermediary between a workstation user and the Internet so that the enterprise can ensure security, administrative control, and caching service. Hackers generally use the Proxy server on the Internet to make their Identity invisible to the target.
Page 13
Web Proxies
A Proxy site is a web page which allows you to browse your favorite web sites -- even though your access to those web sites might be blocked by a content filter. If you find that you are blocked from your favorite websites, use one of these web proxy sites to get around the block.
Anonymous Proxies
An anonymous proxy is a piece of software designed to protect the privacy and anonymity of web browsers from web site operators, Internet snoops, and even unfriendly governments.
Page 14
Kyrion Digital Securities The anonymous proxy software resides on a proxy server. The web browser connects to the proxy server and the proxy server connects to the web server. The web server does not know who you are, it only knows who the proxy server is. The proxy server does know who you are -- so you had better choose a proxy server that you trust.
In addition to hiding your IP address, an anonymous proxy server will typically remove traffic such as:
Cookies Pop-ups Banners Scripts Referrer information
Page 15
Email Hacking
Page 16
Kyrion Digital Securities Electronic mail often abbreviated as e-mail or email is any method of creating, transmitting, or storing primarily text-based human communications with digital communications systems.
Fake Email
Fake Email means an Email which has come from an Email ID which was not sent by the Original Email ID Owner. There are so many ways to send the Fake Emails even without knowing the password of the Email ID. The Internet is so vulnerable that you can use anybody's Email ID to send a threatening Email to any official personnel.
Page 17
Phishing
The act of sending an e-mail to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft. The e-mail directs the user to visit a Web site where they are asked to update personal information, such as passwords and credit card, social security, and bank account numbers, that the legitimate organization already has. The Web site,
Page 18
Kyrion Digital Securities however, is bogus and set up only to steal the users information.
Email Tracing
Tracing an Email means locating the Original Sender and getting to know the IP address of the network from which the Email was actually generated. Locating Original Sender in not always possible but we have tried our best to get it. To get the information about the sender of the Email we first must know the structure of the Email. As we all know the travelling of the Email. Each message has exactly one header, which is structured into fields. Each field has a name and a value. Header of the Email contains all the valuable information about the path and the original sender of the Email.
Header Fields
From: Email Address where the Email has come from. To: Email Address of the destination. Subject: Subject of the Email Date: The Local Time of the server when the message was sent. Bcc: Blind Carbon Copy Cc: Carbon copy Content-Type: Information about how the message has to be displayed, usually a MIME type In-Reply-To: Message-ID of the message that this is a reply to. Received: Tracking information generated by mail servers that have previously handled a message References: Message-ID of the message that this is a reply to, and the message-id of this message, etc. Reply-To: Address that should be used to reply to the sender.
You can easily get the IP Address of the sender from the header and then can locate the sender.
Page 19
System Hacking
Page 20
Cracking Windows User Login Password Live Boot Disk Attack Software: Active Password Recovery can be used to create Live Boot Disks for Windows Operating System.
Ethical Hacking & Information Security Page 21
Live Boot Disk can be used to start the Windows and access the SAM File. Attacker can Remove the Passwords from the User Accounts or can set new Passwords on the Accounts. Brute Force Attack
Bruteforce Password Guessing is just what it sounds like: Trying a Random approach by Attempting Different Passwords and hoping that One works. Some logic can be applied by trying passwords related to the persons name, job title, hobbies, or other similar items. Brute force randomly generates passwords and their associated hashes. There are Tools available to perform the Brute force attack on the Windows SAM File. One of the most famous of them is Cain and Able.
Privilege Escalation
Once the Administrator account is Cracked, one can easily Login with the Administrator User Account and Promote any User Account to give him the Administrator privileges. One more thing which an attacker can do is to boot the computer from the Live CD and change the SAM file to promote any Limited User account to Administrator.
Counter Measures for the Windows User Login Password Attack Configuring a Strong Login Password
A strong password is less susceptible to attack by a hacker. The following rules should be applied when youre creating a password, to protect it against attacks: Must not contain any part of the users account name Must have a minimum of eight characters
Page 22
Keyloggers
Keystroke loggers (or Keyloggers) intercept the Targets Keystrokes and either saves them in a file to be read later, or transmit them to a predetermined destination accessible to the Hacker. Since Keylogging programs record every Keystroke typed in via the Keyboard, they can capture a wide variety of Confidential Information, including Passwords, Credit Card Numbers, Private Email correspondence, Names, Addresses, and Phone Numbers. Once installed on the target machine, either Directly by the User, or through Stealthier means, the Keylogger program runs continually in the Background. After the Keystrokes are logged, they can be hidden in the machine for later retrieval or transmitted to the Attacker via the Internet.
Steganography
Steganography is the technique to place text content behind the images. This is generally performed by the Terrorists to Hide the Secret messages behind the Images and conveying the message via sending the Image via Internet. Windows Internal Commands as well as Steganography tool ImageHide can be used to perform this technique. Let us say, image file is Pic.jpg and text file is Message.txt. The command to hide the message would be: Copy /b Pic.jpg+Message.txt Final.jpg To View the Hidden message, Right Click on Final.jpg > Open with > Notepad > Go to the End of the File
Page 23
Page 24
Trojan
Page 25
Definition
Trojans are malicious pieces of code used to install hacking software on a target system and aid the hacker in gaining and retaining access to that system. Trojans and their counterparts are important pieces of the hackers toolkit. Trojans is a program that appears to perform a desirable and necessary function but that, because of hidden and unauthorized code, performs functions unknown and unwanted by the user. Trojan generally consists of two parts: a client component and a server component. For the Trojan to function as a backdoor, the server component has to be installed on the victims machine. Server is part of the Trojan on the Victims Computer. It opens a port in the Victims computer and invites the attacker to connect and administrate the computer. Client Trojan is the part of the Trojan on the Attackers computer. It tries to connect the Victim computer and administrate the computer without the permission of the User.
Wrapper
A wrapper is a program used to combine two or more executables into a single packaged program. The wrapper attaches a harmless executable, like a game, to a Trojans payload, the executable code that does the real damage, so that it appears to be a harmless file. Hackers use it to bind the Server part of the Software behind any image or any other file.
Modes of Transmission
CD or DVD Autorun
Page 26
Trojan Countermeasures
Awareness and preventive measures are the best defense against Trojans. Educate users not to install applications downloaded from the Internet and email attachments. Most commercial anti-virus products can automatically scan and detect backdoor programs before they can cause damage.
TCPView
TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections. On Windows NT, 2000, and XP, TCPView also reports the name of the process that owns the endpoint.
Page 27
Attacks on Network
Page 28
Sniffing
Sniffing is the process of gathering traffic from a network by capturing the data as they pass and storing them to analyze later. Sniffers are used to capture traffic sent between two systems. Depending on how the sniffer is used and the security measures in place, a hacker can use a sniffer to discover usernames, passwords, and other confidential information transmitted on the network. netwo It is a Passive Process.
DNS spoofing
Ethical Hacking & Information Security Page 29
DNS spoofing (or DNS poisoning) is a technique that tricks a DNS server into believing it has received authentic information when in reality it hasnt. When a user requests a certain website URL, the address is looked up on a DNS server to find the corresponding IP address. If the DNS server has been compromised, the user is redirected to a website other than the one that was requested, such as a fake website.
Page 30
Page 31
Web Operations
Web Server
A computer that is responsible for accepting HTTP requests from clients (user agents such as web browsers), and serving them HTTP responses along with optional data contents, which usually are web pages such as HTML documents and linked objects (images, etc.).
At the most basic level possible, the following diagram shows the steps that brought that page to your screen: Web browser formed a connection to a Web server, requested a page and received it. 1. Client sends the request for a Webpage on the Webserver. 2. Webserver receives the request the sends the Webpage code to the Client. 3. Client receives the Webpage code, and the Web Browser converts that code in to design and displays it to the User.
Database Server
The database server is a key component in a client/server environment. It holds the database management system (DBMS) and the databases. Upon requests from the client machines, it searches the database for selected records and passes them back over the network.
Page 32
Syntax Queries:
1. Creating or Inserting the records in the Table INSERT INTO tablename (column1, [column2, ... ]) VALUES (value1, [value2, ...]); The number of columns and values must be the same. If a column is not specified, the default value for the column is used.
Page 33
Kyrion Digital Securities 2. Accessing or Reading the Records SELECT (column1, [column2, ... ]) FROM tablename; SELECT * FROM tablename (for all the fields) 3. Updating the Records UPDATE tablename SET C1 = 1 WHERE C2 = 'a'; 4. Deletion of records DELETE FROM tablename [WHERE condition];
SQL injection
An SQL injection attack exploits vulnerabilities in a web server database that allow the attacker to gain access to the database and read, modify, or delete information. A simple example of a SQL injection attack is to use the single quotation mark as part of an input value to a Web page. These values can be inserted into a login as follows: o Login: admin-o Login: admin'# Database Server ignores everything after "--" or "#" because these characters are the single line comment sequence. They are needed for inputs and queries to terminate without an error. Another example of a SQL injection attack is making the condition true by giving the identical value to a web page. These values can be inserted into a login as follows: o Login: 1' or '1'='1 and Password= 1' or '1'='1 o Login: 1' or '1'='1';-When the Username argument is evaluated, 1=1 will assess to TRUE, and an authentic username will be returned.
Page 34
Website Enumeration
Website Enumeration is checking the structure of a Web site. Acquiring the files and folders from the Website to the Local Computer. This is also known as Web Ripping. It is the ability to copy the structure of a Web site to a local disk and obtain a complete profile of the site and all its files and links.
Google Hacking
As we all know, Google is a Search Engine. It keeps snapshots of pages it has crawled that we can access via the cached link on the search results page. Google hacking can be used to explore the Website by using some Advance Google search operators.
You can look for the particular File type, Password files and Directories. Even you can find out the IP based CCTV Cameras. Intitle: Searches the text in the title of the Website. Inurl: Finding the text in the URL of the Website. Filetype: Searching for Files of a Specific Type Site: To narrow the Search to Specific Sites
To Find the IP Based CCTV Cameras Inurl:indexframe.shtml axis The Wayback Machine
Archive.org, called the Wayback Machine. Hackers use this website to have a look how other websites looked in the past.
Page 35
Page 36
Wireless Hacking
Page 37
Kyrion Digital Securities The popularity in Wireless technology is driven by two major factors: Convenience and Cost. A Wireless Local Area Network (WLAN) allows workers to access Digital Resources without being locked to their desks. Mobile users can connect to a Local Area Network (LAN) through a Wireless (radio) connection.
War Driving
War Driving is detecting the Wireless Networks and checking out their properties. WAR Driving is of two types: o Active War Driving o Passive War Driving
Page 38
Use a WEP Key: You can use the WEP Key protection on your Wireless Network to protect
your Wireless Network Connection. Although this is not the ultimate security measure but will
Ethical Hacking & Information Security Page 39
Kyrion Digital Securities help you a lot against the Script Kiddies who do not know how to break into the WEP Protection.
WPA: Wi-Fi Protected Access: WPA employs the Temporal Key Integrity Protocol (TKIP)
which is a safer RC4 implementationfor data encryption and either WPA Personal or WPA Enterprise for authentication. WPA Enterprise is a more secure robust security option but relies on the creation and more complex setup of a RADIUS server. TKIP rotates the data encryption key to prevent the vulnerabilities of WEP and, consequently, cracking attacks.
Mac Filtering: An early security solution in WLAN technology used MAC address filters: A network administrator entered a list of valid MAC addresses for the systems allowed to associate with the Wireless Access Point. Choosing the Best Key: Always use a long WPA Key with lower as well as upper case letters
including numbers and special characters. A Sample Key: 12345@abcde&FGHI
Page 40
Page 41
Concept of Hacking
Email Hacking
Putty: Telnet Connection tool o Putty is a Connection based tool used to Setup the Telnet connection with the Open Relay Server to send the Fake Emails. Fakemail.php: PHP Fakemail Web Script o This is the PHP Webmail Script, which is used to send Fake Emails when uploaded on the Web Server.
System Hacking
Cain and Abel: Password Cracking Tool o Cain is the tool to crack the Windows Password using several types of Automated Password Guessing attacks like Brute Force. Image Hide: Steganography Tool o Image Hide loads of text in images using the concept of Steganography. Streams: Streaming Tool o Streams will examine the files and directories you specify and inform you of the name and sizes of any named streams it encounters within those files. Streams make use of an undocumented native function for retrieving file stream information. Offline Password Cracker: Windows Live Disk o This is Windows Live Disk used to reset the Password of any User Account in Windows XP and Windows Vista. This is disk is also used for the Privilege Escalation. Active Password Cracker This is Windows Live USB Disk used to Crack the Windows User Accounts password. Soft Central Keylogger: Keylogger o This is Software Keylogger which can be installed automatically on the Victim's computer. This program record every keystroke typed in via the keyboard, it can capture a wide variety of confidential information, including passwords, credit card numbers, private email correspondence, names, addresses, and phone numbers.
Page 42
Kyrion Digital Securities Password Recovery Tools Process Explorer o This is the utility that displays detailed information about processes running under Windows. For each process it displays memory, threads, and module usage. For each DLL, it shows full path and version information.
Trojan
Beast: Trojan Netbus: Trojan o These are the Trojans which are used for the Remote Administrator of the Victim's computer. Microjoiner: Wrapper Program o This is the program to bind the Server part of the Software behind any image or any other file. TCPView: Local Network Connection Viewer o TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections.
Sniffing
Cain and Abel: ARP Poisoning Tool o Apart from Password Cracking, Cain can also be used to Sniff the Network traffic and launch the Man in the Middle attack. Hacker uses this tool to redirect all the network traffic to the Sniffer device and get all the Username and Password sent in the Network.
Wireless Hacking
Net Stumbler: War Driving Tool o This is the best War Driving tool available for Windows.
Page 43