Ethical Hacking and Penetration Testing

Explore reconnaissance as the first phase of ethical hacking, gathering technical and non-technical information via active and passive methods to identify the target, OS fingerprinting, and open ports.

Explore footprinting as part of reconnaissance, compare active and passive footprinting, and learn to collect domain name information, IP address information, emails, and phone numbers to narrow the focus.

Learn footprinting methods and tools for ethical hacking, including active and passive reconnaissance. The lecture demonstrates using Google advanced search, the harvester, Hunter.io, Shodan, Whois, and HTTrack to map targets.

Identify open ports and services, discover operating system and architecture, assess vulnerabilities, and profile the target network through scanning techniques and reconnaissance.

Discover live hosts on a network by ping sweep in ethical hacking, identify devices by subnet, and use Kali's Discover tool to scan whole networks or specific subnets.

Learn to perform port scanning with Nmap, identify open ports, services and versions, and gather operating system information across single hosts, hostnames, domains, and entire subnets.

Learn how to capture and analyze packets with Wireshark, select interfaces, start and stop captures, and apply filters to inspect traffic by IP and port.

Explore tcp flags and their roles in initiating, maintaining, and terminating connections. Learn syn, ack, fin, rst, psh, and urg, plus sequence and acknowledgment numbers.

Explore scanning beyond ids and firewall using full scan and half connect scan techniques, including syn, udp, fin, Xmas, and null scans to assess target service availability while evading logs.

Learn idle (zombie) scanning, a stealth technique that uses a zombie host’s IP as the sender to probe a target, revealing open ports via forged packets and IP ID patterns.

Vulnerability scanning automatically identifies weaknesses across servers, application servers, networks, and devices, used by an organization and attackers to reveal known flaws from a knowledge base and guide security improvements.

Learn how to set up vulnerability scanning using Nessus, from downloading and installing the essential version to activation, plugin download, and starting the console for target scans.

Learn to perform vulnerability scanning with Nessus, configure and run on-demand scans against IPs or subnets, and interpret results to prioritize critical vulnerabilities.

Ethical hackers map vulnerabilities and entry points to test how far they can access a target, using remote code execution exploits via metasploit within defined scope.

Demonstrates gaining access to a Windows 10 computer by injecting a payload into legitimate software hosted on a web server, and discusses privilege escalation.

Explore privilege escalation, including horizontal and vertical escalation, as attackers move from initial access to higher privileges on Windows 10, with demonstrations of bypassing UAC and keystroke capture.

Maintain access after gaining entry by deploying persistent payloads and privilege escalation, bypassing user access control, and ensuring automated reconnection even after reboot.

Explore the final phase of ethical hacking: clearing traces to hide footprints and evade incident response, with logs and event records demonstrated in Windows 10 environments.

Explore malware and its forms, including viruses, trojans, rootkits, spyware, adware, ransomware, and botnets, and learn how criminals exploit them to compromise computers.

Watch a malware demonstration using a remote access trojan, showing how attackers build a malicious program, distribute it via sources, and configure startup persistence to control a victim's system.

Demonstrate using swanzy crypto to encrypt and obfuscate malware samples and test antivirus detection, illustrating how some antivirus programs fail to identify encrypted threats.

Understand sniffing, the practice of monitoring and capturing network data packets with sniffers in promiscuous mode. Compare passive sniffing on hubs to active sniffing on switches.

Mac flooding is an attack that floods a switch with many fake mac addresses, filling the mac table and causing fail-open behavior, with a lab demo using macof and Wireshark.

Understand how DHCP assigns IP addresses automatically via MAC addresses, broadcast discovery, offers, requests, and acknowledgments, with lease terms and rogue attacks like starvation and rogue DHCP servers.

Explore how DNS name resolution works and identify attacker techniques that manipulate the DNS client cache, DNS servers, and records to redirect traffic to malicious hosts.

Explore ARP poisoning, or spoofing, a cyber attack that fools the default gateway by corrupting ARP mappings, enabling man-in-the-middle sniffing to capture credentials.

Explore how web servers and web applications face attacks such as denial of service, dns amplification, directory traversal, phishing, brute force, and cross-site scripting, exploiting vulnerabilities in applications and databases.

Demonstrates a ddos attack using icmp ping and syn flooding, exploring botnet-driven, multi-device attacks, and the impact on network traffic and resources, with defense considerations like icmp blocks.

Conducts a practical phishing attack demonstration using a social engineering toolkit, credential harvester, and site cloning to capture login details, then emphasizes awareness and avoiding suspicious links.

Explore a practical SSH brute force demonstration, from discovery and port scanning to password cracking with Crunch-generated dictionaries and Medusa, using a vulnerable lab vm to recover a user password.

Learn a web application attack using Burp Suite to intercept traffic, configure a proxy, and perform a cluster bomb brute-force on username and password with Intruder.

Explore wireless network authentication and encryption, from open and shared key methods to centralized eap-radius with wpa, wpa2, and wpa3, and examine related attack risks.

Explores wireless network attacks, showing how to crack a WPA2 password using monitor mode, packet capture, fake authentication, replay attacks, and dictionary-based cracking.