Ethical Hacking & Penetration Testing

Install VirtualBox and VMware Player, set up Kali Linux as the attack platform, and configure a host-only network to create a controlled hacking lab.

Explore reconnaissance by distinguishing passive and active approaches, and master footprint, scanning, and enumeration to gather critical target information covertly and methodically.

Explore passive footprinting techniques, including passive social engineering, social networking, FCC filings, public records, Internet Archive, and Google searches to gather publicly available information about an organization.

Explore passive social engineering techniques such as dumpster diving, impersonation, and eavesdropping to uncover sensitive information and assess organizational security.

Explore passive footprinting through employees' social networks to uncover personal data and project details, and gather interests for targeted social engineering during penetration testing.

Use Google for passive footprinting to gather public company data, including executives, addresses, phone numbers, LinkedIn profiles, and awards. This information can aid a penetration test without visiting the site.

Whois tracks domain registration information, including the DNS servers and registrant contacts, and shows how privacy-based registration hides contact details via private registration.

Use nslookup to perform domain name lookups and map domains to IP addresses, demonstrating a passive footprint by querying DNS servers for targets like google.com and stellar solutions.

Discover how the internet archive preserves old website copies to reveal historical data like organizational charts and news announcements, including 1999 and 2016 site histories.

Assess how people search reveals personally identifiable information and locations via passive tools on the internet, including hiring a private investigator for social engineering in ethical hacking.

Search publicly traded company financials to uncover partnerships, projects, future initiatives, and locations, without directly interfacing. Use Google Finance and Yahoo Finance to find published financial information.

Use public job postings to infer a company’s IT environment, spotting Windows Server 2012, SharePoint 2012, Cisco switches, and Active Directory for accurate enumeration.

Explore Google hacking as a passive footprinting technique that uses search operators and keywords, such as quotes, plus, minus, and wildcards, to reveal organizational information.

Learn active footprinting within a legal and ethical framework, with permission and VM-based demos on a local network to safely practice penetration testing techniques.

Explores how the domain name system translates hostnames into IP addresses and compares zone transfer with brute-forcing to map DNS records, including A, MX, NS, CNAME, and SOA.

Explore how zone transfer replicates DNS databases across peers to onboard a new server, and how tools like the Digg tool and DNS recon reveal network hosts when allowed.

Explore DNS brute forcing with various tools and online word lists to guess domain names within a network.

Explore active footprinting to map the network using trace route, 3D trace route, and path analyzer pro.

Learn how to mirror a web site to create an offline backup copy using various tools, and practice by copying entire web sites offline.

Learn how to use HTTrack for web mirroring to download an entire site, inspect the copied index.html, view the source code, and experiment with parameter tampering.

Learn how to track emails to see if they are read or opened, and assess fishing e-mail effectiveness. Explore active footprinting and review tools that track email activity.

Learn how sending emails to unknown or junk addresses can reveal IP tracking information in auto reply headers, by examining the response email headers for IP details.

Identify publicly available internal URLs and assess external access, using tools that help discover and test these exposures.

Explore DirBuster's GUI and command line to discover web directories, wordlists, and hidden paths, revealing WordPress uploads, config files, and admin pages.

Implement countermeasures by auditing internal setups, turning off unnecessary services, and restricting DNS zone transfers to a whitelist or specific IP range, while educating employees and applying defense in depth.

Learn how to scan and enumerate target networks to identify ip addresses, open ports, services, operating systems, and architecture using network, port, and vulnerability scans.

Explore the structure of icmp packets, detailing the ip header, icmp header, and icmp payload, with the ip header aligning to other ip traffic.

Explore firewalking, a technique that uses time-to-live analysis of packets to map networks outside a firewall. Analyze IP packet responses to determine whether access filters are in place.

Explore tcp communication basics, including the three-way handshake with syn, syn-ack, and ack packets, sequence number management, and the ethernet and ip headers carrying port numbers and flags.

Compare IPv4 and IPv6, highlighting the hop limit, next header concept, fixed header size, and checksum removal, while noting uneven tool maturity and growing vulnerabilities in IPv6 implementations.

Identify open ports on a system through port scanning, recognizing default ports and services, while noting that an open port (like 22) does not guarantee the corresponding service is running.

Execute fast scans of common ports and a full port scan to reveal open web and mail ports, then browse the web service to verify it runs.

Explore war dialing as a pink sweep over telephone and voice over IP networks to locate modems vulnerable to exploits, while the course omits live dialing demonstrations.

Perform vulnerability scanning by sending specially crafted packets to open services discovered from IP and port scans to identify the service and version running on each port.

Explore banner grabbing and OS fingerprinting, comparing active fingerprinting with packets detected by intrusion detection systems to identify services, versus passive fingerprinting that listens for signatures but is less accurate.

Covert scanning aims to stay undetected by spoofing the source address and using proxies, bouncing to new proxies when blocked. VORs remove identifying information from traffic, helping avoid blocks.

Explore IP spoofing, where an attacker impersonates on the network, and note how the responses are affected as a key downside.

Explore anonymizers, tools that aim to make internet traffic untraceable, with the example of the website known as Anonymous.

Turn off icmp traffic to deter scanning and enumeration, disable unused services, and configure a firewall to drop suspect packets while using a whitelist approach and disabling operating system banners.

Explore how a proxy acts as a middleman for internet traffic, enabling offensive and defensive uses, and how proxy chains connect multiple proxies to obscure origin.

Explore the onion router (tor), a multi-layer proxy chain developed by MIT and the Naval Research Lab, creating a secure, anonymous bidirectional circuit where each server knows only its neighbors.

Explore active enumeration by re-examining findings from the scanning phase, connecting to targets, and sending data to reveal deeper system details.

discover common enumeration techniques, including banner grabbing with netcat, port enumeration, and get requests, and learn how each method reveals system information during assessments.

Explore NetBIOS null sessions and how they exploit SMB flaws on older Windows hosts to enumerate shares, users and groups, security identifiers, and known machines.

Explain how SNMP functions as a network management protocol for devices like routers and printers, exposing ARP tables, routing tables, and traffic statistics, and using community strings instead of passwords.

Impersonate a DNS server to trigger a zone transfer, dumping the zone file and exposing internal DNS zones.

SNMPv3 enhances security for community strings and message integrity but remains vulnerable to password cracking; NTPv3 adds access control and authentication, with encryption avoided, and DS protects NTP data integrity.

Master how smtp transfers email by sending and receiving messages, used by major providers; learn port 25, mx records, and core commands like helo, ehlo, mail from, and data.

Apply countermeasures by updating operating systems, disabling anonymous logons, using the SMP protocol, hiding banners, enforcing unique strong passwords, white-listing traffic, and restricting DNS zone transfers to new servers.

Explore authentication, password storage, and password cracking, plus privilege escalation. Examine key logger spyware kits and how attackers cover their tracks against system administrators.

Explore how authentication establishes a user's identity using knowledge, possession, digital credentials, and biometrics, and how two-factor and multi-factor authentication enhance security.

Explore the password lifecycle, from avoiding plaintext storage to using hashing with salts to protect passwords and deter rainbow table attacks.

Explore how Microsoft's proprietary authentication differs across Windows versions, and track security enhancements from Windows XP through Windows 10, including password practices.

Investigate how the Windows Security Accounts Manager stores user accounts and password hashes in system32 config, its location set by a registry key, and why offline access is required.

Explore authentication terminology, including basic authentication with base64 and no cryptographic protection, digest, ntlm, kerberos, negotiation, public key and certificate authentication, hardware tokens, biometrics, and multi-factor authentication.

NTLM authentication on Windows servers uses a challenge-response handshake; the client hashes credentials, encrypts the nonce with the hash, and the domain controller validates the result against the stored hash.

Kerberos uses a centralized authentication server to issue a ticket granting ticket at login and service tickets for each service, enabling single sign-on within a service window.

Explore how linux authenticates users by examining the ETSI password and ETSI shadow files, including uid, gid, home, shell, and password hashing with salt and hash data.

Explore how attackers crack passwords by converting hashes back to plain text, using dictionary, hybrid, and brute-force attacks, offline cracking, and social engineering under password rules.

Explore privilege escalation by distinguishing horizontal and vertical escalation, illustrating how attackers gain access to other accounts or higher privileges through password changes, password cracking, vulnerabilities, or social engineering.

Examine how dynamically linked libraries are used by software and how malicious code can hijack them by placing a library where the app searches before the real one.

Explore keyloggers, devices that sit between keyboard and application to capture keystrokes and passwords for analysis, in hardware or software form, including screen captures.

Explore hardware keyloggers, their covert installation, and how physical access enables password capture. Learn how devices hidden in keyboards or cables and the back of the computer pose data risks.

Create a malicious software with an embedded key logger and lure a victim to install it via social engineering or a fishing e-mail, then send keystrokes to a remote location.

Install a host-based intrusion detection system, use virtual on-screen keyboards for web logins, and enforce strict physical security to protect servers and prevent unauthorized hardware access.

Spyware runs in the background to collect data such as keystrokes, screenshots, emails, chat sessions, and web interactions, then sends it to the creator server.

Explore advanced parental controls that monitor and control children's computer and internet use, set time limits, block apps, filter web traffic, and log activities, while noting they resemble consumer spyware.

Download software only from trusted sources and scan before installation to avoid bundled spyware, then periodically scan your system with updated anti-malware and anti-spyware tools.

Learn how packet sniffing captures network traffic, comparing passive and active attacks, and explore man-in-the-middle interception using tools like SSL strip, Burp Suite, and the browser exploitation framework.

Explore how pass the hash attacks exploit hashed passwords stored and transported between client and server, how attackers emulate a client to pass the hash, and defend against it.

Explore rootkits, malicious programs that hide themselves to maintain undetected access, and compare user mode rootkits in user space with kernel mode rootkits that grant root access.

Explain how Sony's drm software on millions of CDs acted as a rootkit, hiding itself, altering the operating system, and creating vulnerabilities exploited by malware.

Explore methods for placing a rootkit, including user action like email attachments, infected downloads, or visiting infected sites, and non-user action such as compromising logging credentials or insider threat.

Rootkit countermeasures align with spyware countermeasures to protect systems. Back up critical data, install only from trusted sources, verify signatures, and keep security software up to date with regular scans.

Explore covert hacking techniques to conceal actions and data from system administrators, including hiding data via files and the registry, alternate data streams, manipulating system clock, and corrupting log files.

Learn how attackers cover their tracks after breaking into the system by removing evidence, disabling auditing, and planting back doors to regain access, then restore logging to the preattack state.

Identify default log locations in Windows and Linux, including System32 and /var/log, then review tools to clear event, app, and security logs.

Discover tools to cover your tracks, including invisible folders, invisible secrets, Track Racer Pro, and steganography. Explore steganography in depth in section 19.

Explore three malware types—virus, worm, and trojan—and how each propagates. Viruses replicate with user action, worms self-spread automatically, and trojans hide malicious software in seemingly legitimate downloads.

Explore a list of historically famous malware and direct readers to look up these examples for deeper reading.

Viruses are self-replicating programs that spread through user action, via email attachments or removable media, with replication code and a malicious payload such as key loggers, spyware, or bots.

Explains virus operation: a virus infects other files after a user opens an infected file, then replicates and carries out malicious actions.

Explore worms, self-replicating programs that spread without user action by exploiting vulnerabilities in operating systems or applications, featuring replication mechanisms and a malicious payload.

Explore how a worm is designed, released, and spread, then activated to perform malicious actions, with a key logger example, detection via signatures, and removal by anti-malware.

Identify virus and worm symptoms by noting unusually slow performance, high resource use, random error messages, frequent crashes, Windows Explorer restarts, unknown files with random characters, and auto-sent emails.

Learn how malicious software is classified by what it infects, including boot sector, file viruses, macro Office documents, and network viruses. Virus hoaxes trick users into installing harmful software.

Explore the diverse types of viruses and review essential definitions to refresh on what you may be tested on in ethical hacking and penetration testing.

Explore how viruses conceal themselves as legitimate apps, use sparse infection to evade detection, apply encryption and code manipulation to defeat signatures, and disable anti-virus software with packers.

Explore common distribution techniques for viruses and malware, including direct transfer, infected sites, phishing, spam emails, instant messaging, social media, web scripting, usb access, and browser hijacking.

Explore virus making tools for customization and creation of new viruses, and learn how these tools support researching, testing, and understanding how viruses work.

Select antivirus software from trusted sources and keep signature database up to date to detect new viruses, avoid unknown attachments, risky sites, and block unapproved outbound connections via a firewall.

Trojan software mimics legitimate programs, tricks users into downloading, and installs malicious code to compromise and destroy the system.

Explore Trojan terminology, including covert channels or tunnels, overt channels, wrappers, shells and reverse shells, backdoors, and tunneling, and their roles in bypassing firewalls within ethical hacking.

Identify several trojan types, including defacement trojans, proxy server trojans, and botnet trojans, and explain how each enables traffic relays, file uploads via an FPP server, and remote command access.

Compare bind and reverse shells to understand how attackers gain shell access, highlighting why firewalls block incoming connections and why reverse shells connect back to a listener.

Examine other trojan types, including remote access trojans that grant attackers control, key loggers, and botnets; note destructive trojans that delete files or disable security software and steal data.

Explore how attackers leave backdoors after a breach to regain access later, staying hidden and undetected to prolong control and avoid patch efforts.

Analyze trojan analysis through real-world malware cases, including a Flight Sim Labs incident that shipped embedded malware to deter piracy and exfiltrate chrome usernames and passwords.

Explore common historical Trojans and the port numbers they use to communicate back on, as presented in a concise table.

Explore tools that disguise malware as legitimate files or games using icons and wrappers, such as Windows executables disguised as a Word document, to deceive users.

Explore historical trojan examples and examine what they did and how they worked to understand their methods in ethical hacking.

Explore how a trojan construction kit enables building trojans and delivering them, with spy and stealth tool examples illustrating malware concepts within ethical hacking and penetration testing.

Patch systems regularly and keep anti-malware up to date, deploy a host-based intrusion detection system, and avoid attachments from trusted sources to spot anomalies in normal traffic with ids.

Learn about warez, or pirated software, that is illegally modified and distributed, often containing malicious files, pop-up ads, ransomware, spyware, and dormant logic bombs triggered by events.

Explore ransomware concepts, including how attackers hold victims' data hostage via encryption, demand ransom, and threaten exposure or illegal activity, while highlighting mitigations like backups and disconnecting a system.

Explore packet sniffing as intercepting and listening to traffic between source and destination, including logical and physical wiretaps that copy data for monitoring and later analysis.

Define key terminology for packet sniffing in ethical hacking and penetration testing. Explain that sniffing means listening to or sampling data packets as they traverse the network.

Explore passive sniffing, where you listen to data as it travels across the wire without the target noticing, achievable with a device placed in promiscuous mode.

Activate active sniffing by sending specific packets to the target to provoke abnormal observations and responses destined for other hooks, using arp poisoning and mac flooding.

Explore how the address resolution protocol (arp) translates between ip and mac addresses as devices join networks, obtain temporary ip addresses, and how arp caches map these addresses.

Review collision domains in networking and explain that every machine within a domain can see all the traffic; sniffing is passive within the domain you operate on.

Master sniffer placement by aligning it with what you observe and your access level, while considering network layout, VPN or other networking architecture, learned through trial and error.

Explore sniffing techniques such as port mirroring and arp poisoning, and learn to tap into traffic on the same subdomain.

Utilize a spectrum analyzer and a wireless card capable of packet injection to perform wireless sniffing. Align your work with ethical hacking and penetration testing in wireless security assessments.

Learn about the legal risks of sniffing and wiretapping and how to avoid violating laws when performing network sniffing in ethical hacking contexts.

Explore the tcp packet header, detailing source and destination ports, sequence and acknowledgement numbers, data offset, reserved bits, and flags, including window size, urgent pointer, options, and data.

Explore the compact UDP packet header, including source port, destination port, length, and checksum, followed by the data.

Explore the IPv4 packet header and its fields, including version, flags, time to live, protocol type, source and destination addresses, and options.

Analyze the arp packet header, focusing on hardware type and addressing fields, and learn how the opcode defines message types and how common hardware type values relate to arp.

Explore how MAC addresses form a unique six-octet identifier, with the first three octets specifying the vendor and the last three the device serial number, in ethical hacking contexts.

Explore how a mac flood attack overflows ARP tables, forces a router into hub mode, and enables sniffing of all traffic across the network.

Impersonate a gateway with an ARP reply that ties the gateway IP to the attacker's MAC. Redirect traffic through the attacker to modify it before it reaches the destination.

Explore dns spoofing, where the first dns response wins; an attacker can reply before the legitimate dns server, leading the victim to trust the attacker's ip as the domain’s server.

Explain how a man-in-the-middle attack works as an active sniffing attack, with the attacker participating in the conversation between two devices and using poisoning and DNS spoofing as tactics.

Explore how unencrypted ports and protocols enable sniffing and man-in-the-middle attacks, and identify vulnerabilities in common network communications.

Learn how the ICMP router discovery protocol extends ping to help hosts discover new routers by listening for broadcasts, while spoofed messages can redirect traffic to a fake attacker router.

Examine how intrusion detection systems identify signatures and anomalies in network traffic, and how attackers seek false negatives by slowing, flooding, or fragmenting packets to overwhelm or evade ids.

Explore how firewalls enforce rules and can translate networks or ports, a router's job, and how to tunnel traffic in an allowed route or port such as HDTV.

Encrypt network traffic to thwart sniffing; replace hubs with switches, use static ARP, enable port security, disable unused ports, and apply strong wireless authentication.

This lecture explains denial of service attacks and their impact on service availability, illustrating targets like bandwidth, servers, and applications, and offers an overview of common attacker tools.

Analyze the impact of denial of service attacks on customers, revenue, reputation, and business services, and explain how the most disruptive attacks aim to permanently damage systems.

Differentiate denial-of-service classifications by contrasting a single attacker denial of service with a distributed denial-of-service attack using a botnet created by trojans, viruses, or worms.

Explore common dos attack types, including buffer overflows, ping flood, ping of death, teardrop, and smurf attacks, and learn how this section covers them.

Explain how a SYN flood overwhelms a server by sending many SYN messages, causing the server to respond and devote resources to attacker connections, denying service to normal users.

Explore how a UDP flood overwhelms a victim host by sending UDP packets with spoofed source IPs to random destination ports, exhausting resources and disrupting normal access.

Explore rst injection, where an attacker monitors a connection and spoofs a reset packet, terminating the user's connection with a server and disrupting the user's experience.

Explore the christmas attack, flooding a server with packets that have fin, push, and urgent flags in the header to bog processing and deny service to normal users.

A botnet attack expands methods across multiple compromised hosts to attack a target, with each bot or zombie remotely controlled, and a botnet overseen by the bot herder.

Learn how a smurf attack uses broadcast pings to amplifiers to impersonate the victim and overwhelm a target, with amplifiers mirroring traffic without direct control by the attacker.

Explore Fraggle attack mechanics, a UDP-based denial technique used in ethical hacking and penetration testing, using spoofed source IPs to exploit amplifiers and overwhelm a victim with echo responses.

Explore how a buffer overflow can cause a denial of service by crashing a program when an input exceeds a 40-byte buffer, overwriting the frame pointer and return address.

Explore how trojans install bot software on a victim's device, turning it into a bot that waits for commands and is controlled via internet relay chat or peer-to-peer services.

Explore how botnets use covert channels and tunneling for command and control, with default ports such as 5190 and alternative protocols like ping, DNS, and HDTV protocols.

Identify denial of service symptoms, typically on servers rather than client devices, via sudden, unexplained degradation of server performance, slow or unavailable internet, frequent crashes or restarts.

Configure the firewall to block incoming packets from untrusted sources, block inbound pings, and add redundancy with extra bandwidth to prevent denial of service, while blocking suspicious outbound traffic.