Hello. My name is James Conrad, and it's my pleasure to be here
with you as we examine the Certified Ethical Hackers series.
Now I did a series a while back, a few years ago, that was also
a Certified Ethical Hackers series but it was relating to older
exam objectives that the EC Council had put out. Most of that
information is still good, but we need to really revamp the whole
thing for current topics and for the current version of this
Certified Ethical Hacker exam. One of the things we'll talk about
here is just an introduction to hacking. Yes, you're watching
an introduction video, and then on our next video will also be
an introduction. And why am I doing that? Because that's actually
one of the exam objectives. In fact, these bullet points that
we're going through pretty well map out to the exam objectives
that the EC Council has set up on their website and certainly
you can go there and download the specifics of each exam objective
on your own. And in fact you'll need to do that to be properly
prepared for the exam. But one of the things you'll be taking
a look at in the introduction is just some basic terminology,
information about how to become a hacker and so on. We'll also
take a look at VMware and Linux. Now this particular bullet is
not in the exam objectives directly. There's no module for that.
However, I know that many of us are administrators who are in
job roles where we don't necessarily use VMware, maybe we don't
really use Linux, so we don't really have a good hands on feel
for those two items. Well, it's going to be pretty important
if you're going to be a hacker to be adept at those two items.
And at least basic capabilities with Linux. We'll also take a
look at footprinting and reconnaissance. The first few bullets
we'll look at here on the next whiteboard are very important,
because you need to make sure that you don't waste time trying
to hack things that don't actually exist or that are not actually
there. And that you've correctly identified things that are there.
Some of these things are going to be what we call passive reconnaissance,
where it's really just public searches for information maybe,
even on the Internet. Then also we're going to be scanning networks.
Now, this is where you have to start being more careful, because
you don't want to become detected and get kicked off the network
or something like that. You have to really keep sly about this
and avoid detection. We'll talk about that as we go here as well.
Enumeration is also going to be very important in this, because
you need to identify or once you're done scanning your networks
and things like this, you need to identify specific users, specific
groups. Maybe identify kind of the hardware that's in use and
things of this nature. So that's where we add all that up. We'll
take a look at system hacking as well. This is where a lot of
the fun really begins in terms of actually doing hacks. You need
to know how to crack passwords, for example. And almost any organization
there's usually going to be some passwords that you can crack.
And that doesn't even matter if it's not an administrator's password,
because you might be able to still log on and escalate privileges
in a couple of different ways, so there's also Trojans and back
doors and there's things that really come into network unnoticed
by the user or they might just be downloading a game maybe it
actually works, the game is fine and everyone seems to be enjoying
it, but somebody may have wrapped a trojan inside of that game,
and you can even do this with common Windows utilities like note
pad or calculate or something like that. You could replace the
Windows versions of those applications with one that has a trojan
or a backdoor in it that allows a hacker to get into your network
and usually take full control of it. Also, viruses very often
will have a similar function to that. Now, sometimes we kind
of synonymize trojans and viruses, they have a lot of similar
functions. Sometimes, however, a virus might just be malicious
or it might be something that will do something like install
a key logger so that people can see everything that you're typing
and get your passwords and things. Worms will then send themselves
out to other folks as well usually through something like your
outlook mailing list or address book. There's also sniffers.
This is going to be really important. Probably Wireshark is the
most common sniffer right now, but there's several different
ones out there, Cain & Abel, many others, that are useful in
doing things like getting passwords. One of the things you have
to be careful of there is to make sure that you don't get too
much information and you need to learn how to write appropriate
filters to get only the information that really matters to you.
And then as we continue on, this is something that is really
a touchy issue for me. That's this social engineering item. Basically
what you do with this is most of the time you're just going to
be lying or telling half truths. And your objective with this
is to get information out of somebody. You might fake that you're
part of their IT staff when you call them up and try to get a
user name and a password out of them. So not always quite that
easy and a lot of users are better educated nowadays, but there's
still many ways of getting social engineering to work. I've been
able to get into buildings and locations where I really wasn't
supposed to be just because I looked like I belonged there. There's
also a lot of this nowadays is coming out through e mail and
phishing emails as well. That's part of social engineering.
Also denial of service is very important. You may want to put
up some fake DNS entries somewhere, but the real DNS server on
that person's network is still providing service. Well, if you
can bring down that DNS server and bring up your own fake DNS
server instead that might be a big part of the denial of service
so that you can use your own services, or it might just be vandalism.
You just want to bring it down, because you're mean or something,
I don't know. There's also session hijacking. This is pretty
fun. This is where you can take over someone's existing session
or even just view their existing session so that you can exploit
it later. We'll take a look at hacking Web servers as well. Web
servers on their own are designed to be very public and open
so that people can see it. I mean, people need to sell a product
on their Web page or whatever. But at the same time there's openings
there that might be inadvertently left there that you can exploit,
as well as Web apps, which may not be properly designed or set
up on the website, and you might be able to exploit some of those
as well. And then continuing on, one of the key things that you
really have got to look out for is SQL injection. This has had
a fuel different vulnerabilities over the years. But if you can
properly perform some kind of SQL injection, you can do a lot
of different things to a database. You might be able to exploit
it in terms of getting data out of it or manipulating data. We'll
take a look at hacking wireless signals as well. Now, this is
really easy when it comes to locations where no one with IT knowledge
has adequately protected the environment. Other places, it takes
a little longer, especially if they're using good security measures,
but wireless on its own is actually just radio signals that anybody
can pick up. So that on its own makes it something of less of
a physical barrier than you would have with like a conventional
ethernet wired network. We took a look at evading intrusion detection
systems, firewalls, honeypots, these are all things that could
derail you and prevent a successful penetration test. We take
a look at buffer overflows as well and particularly you know
the tool that's really used almost exclusively nowadays is going
to be Metasploit, that's because it already has everything you
need, and it's got a full database of different exploits that
you can use within it. Cryptography is important to understand
as well, because you need to understand the difficulty that's
involved in some cryptography. It might not be worth your while
to directly hack against something. Or if someone's used a weak
cryptography, then you might be able to use a tool that can decrypt
some of those things quite easily. Also I'm going to take a look
here at pen testing. Now, this is really what we do as Certified
Ethical Hackers. We're really trying to do a penetration test.
Especially because I want to emphasize we're trying to be ethical
here. We're not trying to hack into things that we're not supposed
to hack into. We have likely a contract to be able to get in
there. So we're just testing it out to see what a black hat hacker
would do. We want to try to mirror that as much as possible.
And also pen testing as well as a lot of the other things we'll
be looking at here, that's pretty much what we're doing throughout
the whole series. We don't get to pen testing only when we get
to the last exam objective. We're taking a look at pen testing
throughout the entire thing. It's kind of interwoven. And much
of what we'll be taking a look at in all of these bullets from
the whiteboards I've shown you so far are really kind of interspersed
throughout. So they're not always defined in only a specific
topic. Let's go ahead and take a look at some other important
things to keep in mind as a Certified Ethical Hacker, however,
and the things I'm addressing here aren't really part of the
exam objectives. They're just from me to you as your CB Nuggets
instructor. The first part of this is I'm not really providing
any legal advice. I might tell you what I think is legal or what
I hope is legal or what I hope we can get away with. But it's
not actual legal advice. So you're going to need to get your
own advice in those terms, whether it's your own corporate attorney,
if you work for a corporation, or whether you get your own advice
some other way. Because I'm not an attorney. Although I played
one on television. No, I didn't really. But you can get your
own advice there. I'm just going to give you my own opinion.
That's the best I can do. Also, keep in mind, it might even be
illegal to pen test your own network. If you work for a corporation
and you start doing penetration tests it might be in violation
of your own corporate policy or there might be actual laws against
what you're doing there. So before you do any pen tests, you
must get proper authorization, and don't just get kind of a handshake
from your boss, say, I'm just going to try to do some things,
is that all right, oh, sure, why not, let's go to lunch. You
need to get it in writing somewhere even if it's through an e
mail chain or whatever and that's just my best advice there.
But everything I tell you here really goes back to this one.
That's not actual legal advice. But I just tell you that it could
be illegal. You've got to really watch out there. Another reason
why that might be illegal is you might have subsidiaries in your
corporation. If you start hacking against your company and you
have authorization for that, but it may not extend down to the
subsidiaries which you also have network reach to. That you have
to be careful for. So just be aware of those things. Also, don't
get inpatient. Most hacks are actually unsuccessful. The stuff
that I'll be showing you in this video series, most of it looks
like, wow, he just came up with this and immediately it works.
Some of that stuff takes hours for me to prepare to show you
and there's a lot of trial and error. A lot of these hacking
tools don't have very good help. Some of them don't even have
very much resource out there on the Internet. So you have to
be very patient with how some of this stuff works. But once you
get it going it's very gratifying, and I think you'll find that
it's worth the patience.
Another reason to why some of the hacks are unsuccessful if you're
actually doing pen tests, might be because an organization actually
is very well protected. The best hacker I know I had a conversation
with him this past summer, and I asked him, I said are there
any locations that you've tried to hack that you just actually
can't get in? And he said yes. There are some very difficult
ones. They're usually three letter acronyms and those sorts of
things. But given enough time, he could. But usually he gets
hired to do a penetration test that lasts between one to three
weeks, maybe a month. And if you had more time you could eventually
brute force a password or something like that. But given the
time we have, just can't always get in in an actual penetration
test. Now, the last thing I want to point out here is and you
need to check this with the EC Council's website, this is an
expensive exam. I think it's about 500 bucks or so. And there's
no retakes. So if you fail it and you really want to get your
Certified Ethical Hacker, you have to pay for it again. Wow.
That really hurts. Microsoft exams are much less expensive. I
think they're 125 bucks. And they even have some retake policies
that they offer as special offers every now and then. I think
you can retake it for half price or something like that. But
the Certified Ethical Hacker one is very expensive. So pay careful
attention to this video series and you'll also need to put your
hands on some of your own hacking tools so that you have good
experience with this. I just want you to be very well prepared
before you take that. Also, you do have to have continuing education
credits in order to maintained the Certified Ethical Hacker,
so just be aware of that as well. Well, I gotta tell you, I'm
really looking forward to working through this series with you.
I'm very excited as a hacker to be able to show you some of the
things that we can do for hacking for fun and profit, so to speak.
But, again, realize that we are mostly really doing this as Certified
Ethical Hackers.
But all those disclaimers out of the way, let's get started and
get on our way to the next video where we can start taking a
look at certified ethical hacking.