Ethical Hacking & Penetration Testing: Kali Linux & Security

Computer Viruses are dangerous programs, because they can be transferred through the most common and popular used file transfer methods; from downloads on untrusted sites, to USB transfers, viruses are known to attach themselves in the most inconspicuous ways. Viruses can infect a system, when pirated software is being downloaded, emails with viruses attached to them are being opened, when anti-virus is outdated.

The following are the basic concepts of ethical hacking:

1: Phase of Pen-testing

Pen-Test, like forensics, is almost as much an art as it is a science – you can only be taught so far, technical techniques and tools are all very well, but you really need a mind that can think sideways and approach a task from as many angles as possible.

How to discover if a target system has been infected with a virus.

A couple of occurrences could point to a virus in the system. However, most of these occurrences are flukes; hence the need to understand the situations that prove a virus has infected a Machine.

Knowing exactly what is running on a computer is paramount to learning what shouldn't be. Creating a reference baseline is the best way I've found to accomplish this. Let's look at three applications that do just that.

Today's viruses are much more complex than the early boot-sector viruses that brought malware to the attention of IT users; they are also just one of several types of malware that now pose threats to information assets. Other common forms of malware include:

Antimalware software protects against infections caused by many types of malware, including all types of viruses, as well as rootkits, ransomware and spyware. Antimalware software can be installed on an individual computing device, gateway server or dedicated network appliance. It can also be purchased as a cloud service -- such as McAfee's CloudAV product -- or be embedded in a computing device's firmware.

Penetration testing is very closely related to ethical hacking, so these two terms are often used interchangeably. However there is a thin line of difference between these two terms. This chapter provides insights into some basic concepts and fundamental differences between penetration testing and ethical hacking.

Session hijacking, also known as TCP session hijacking, is a method of taking over a Web user session by surreptitiously obtaining the session ID and masquerading as the authorized user. Once the user's session ID has been accessed (through session prediction), the attacker can masquerade as that user and do anything the user is authorized to do on the network.

• Session Sniffing – attacker uses a sniffer to capture a valid session token called session id. Attacker then uses the valid token session to gain unauthorized access to the web server.
• Man-in-the-browser – uses a Trojan to intercept the calls between the browser and its security mechanisms or libraries. Its main objective is to cause financial deceptions by manipulating transactions of IB systems

The network level hijacking is implemented on the data flow of the protocol shared by all web appls. By attacking the network level sessions, the attacker gathers some critical information which is used to attack the appl level sessions.

Let’s discuss them in common term’s, Session Hijacking by the name only it suggests that we are hacking someone’s active session and trying to exploit it by taking the unauthorized access over their computer system or Network. So Session Hijacking is the exploitation of valid computer or network session. Sometimes technical guys also call this HTTP cookie theft or more correctly Magic Cookie Hack. Now you guys surely be thinking what is Magic Cookie.

Once the hijacker /attacker make a successful hijack, then he could play the role of a genuine user or can even silently just monitor / watch what communication is happening.

As a session is created for some specific time and during this time the client is authenticated by the server thus during this time the Server and client trust each other for the session. The data transfer that takes place during the session are not authenticated every time till the session is active and it is this benefit that the attacker takes and keeps on stealing information.

A penetration test, colloquially known as a pen test, is an authorized simulated attack on a computer system, performed to evaluate the security of the system. The test is performed to identify both weaknesses (also referred to as vulnerabilities), including the potential for unauthorized parties to gain access to the system's features and data, as well as strengths, enabling a full risk assessment to be completed.

Legal operations that let the tester execute an illegal operation include un-escaped SQL commands, unchanged salts in source-visible projects, human relationships, and old hash or crypto functions. A single flaw may not be enough to enable a critically serious exploit. Leveraging multiple known flaws and shaping the payload in a way that appears as a valid operation is almost always required. Metasploit provides a ruby library for common tasks, and maintains a database of known exploits.

Web Servers store the web pages and provide them to the client upon request processed through HTTP which is the basic protocol to give out information on world wide web. The actual role of web servers is dependent on the way they are implemented; however, the generic web servers store HTML or server-side scripting files such as PHP, ASP, etc. that generate HTML files on-the-fly. 

The type of web server attacks are many and so are the prevention techniques. Firewall offers the certain degree of prevention but is not foolproof. Apart from the generic firewall, there is an advanced level of security that needs to be implemented to ensure complete safety of the web servers.

A web server is a program that stores files (usually web pages) and makes them accessible via the network or the internet. A web server requires both hardware and software. Attackers usually target the exploits in the software to gain authorized entry to the server. Let’s look at some of the common vulnerabilities that attackers take advantage of. 

How to avoid attacks on Web server

An organization can adopt the following policy to protect itself against web server attacks.

• Patch management– this involves installing patches to help secure the server. A patch is an update that fixes a bug in the software. The patches can be applied to the operating system and the web server system.
• Secure installation and configuration of the operating system

The fundamental security problem with web applications — that all user input is untrusted — gives rise to a number of security mechanisms that applications use to defend themselves against attack. Virtually all applications employ mechanism that are conceptually similar, although the details of the design and the effectiveness of the implementation vary greatly.

Session Hijacking - Each unique user is assigned a "session" when they log in to a website. Session hijackers will jump into the session of another user, reading information as it passes between the user and the server.

If unknown users can access your Web application, the odds are almost certain that malicious users will try to gain unauthorized access to your application. Servers that are accessible to the public on the Internet are constantly probed for vulnerabilities. Therefore, it is recommended that you take precautions and build security into all of your Web applications.

Certain tools are essential if you want to hack a web application. Knowledge is key in everything, and this involves hacking. To hack websites as well as web applications, an individual requires knowledge of ASP, PHP, and SQL, among others. Knowledge of such languages combined with access to some web application hacking tools will enable you to hack almost any website or web application with relative ease. Hacking tools make things easier for any hacker because they help to automate the tasks involved. 

More recent PHP versions have register globals set to off by default, however some users will change the default setting for applications that require it. This register can be set to "on" or "off" either in a php.ini file or in a .htaccess file. The variable should be properly initialized if this register is set to "on." Administrators who are unsure should question application developers who insist on using register-globals.

You will need a wireless network enabled device such as a laptop, tablet, smartphones, etc. You will also need to be within the transmission radius of a wireless network access point. Most devices (if the wireless network option is turned on) will provide you with a list of available networks. If the network is not password protected, then you just have to click on connect. If it is password protected, then you will need the password to gain access.