Footprinting - The First Step of Every Hacker

Hello readers, well you are learning hacking so suppose you wish to hack something for example a website, server or anything else. What would be your first step? If you have read my post Basic Terminologies then you must be knowing that first of all you have to gather information about the target. So how does one do that, is what we are going to know about today. We call this act of gathering information about the target as Footprinting. It can be active as well as passive i.e., it could be done using the resources available online or it can be done even offline. Apart from the technical information gathered during this step such as e-mails, passwords, type of OS etc that can be used during the attack phase, a lot of non-technical information is also gathered which can be used for other purposes such as to social engineer someone. 
 There are many ways with the help of which you can gather information about the target. Some of them are explained below:-
1. Crawling : Visiting the target website(if any) for information like emails, phone no's etc is what we call crawling. The best way of crawling is by downloading the target's entire website using softwares such as Black Widow or IDM and then analysing it.
2. Whois : We can even query the whois database against the company's domain name(the website) to get the details about the technical staff who are managing the website, email addresses, other information about the domain name along with the details about the registration by doing the whois lookup at whois.com. We can even locate the name servers with the help of this utility.
3.Search Engines : If used properly a lot of information can also be unearthed using the search engines such as Google and Bing. For example, a hacker could search a website through Google by searching “site:www.the-target-site.com” this will display every page that Google has of the website. You could narrow down the number of results by adding a specific word after. For example the hacker could search “site:www.the-target-site.com email”. This search could list several emails that are published on the website. Another search you could do in Google is “inurl:robots.txt" this would look for a page called robots.txt. If a site has the file “robots.txt”, it displays all the directories and pages on the website that they wish to keep anonymous from the search engine spiders. Occasionally one might come across some valuable information that was meant to be kept private in this file.
4. Trace route : Another way of footprinting is to use the tracert command in command prompt(CMD) to see where our request is being forwaded and through which devices. In Linux systems traceroute and tracepath commands can be used.

5. Social Networking Websites : Websites such as Facebook, Twitter, LinkedIn and other social networking websites can also be used to gather information about the target which can be deployed in later stages. for example if you are targeting a company then you can compile a list of the employees working in the company by the above discussed methods and then look for their details on such social networking sites which can be helpful for social engineering attacks.
Well I think that's enough for today but don't forget to practice.

Networking Basics Part II - Ports and Protocols

Hello readers, I know many of you might be thinking that I am focusing too much on the theory part without even telling you about a single hack until now and you should because that's natural. But don't worry my dear friends I will soon be coming to that part too. I know many of you are already aware about the basics but there are also people who don't know even a bit of it. I have to think about them too.
 Many of you might have heard that if someone does illegal activities on the internet then the cops can easily catch hold of him by tracking him down. But how do they do so. They simply track the Internet Protocol(IP) Address of him, which gives them his exact location and they go to the acquired address and then Boom! So what's this Internet Protocol. That is what we are going to explore today along with some other important protocols and ports(associated with the type of protocol used for communication).
 First of all - What is a Port and a Protocol? Well to understand this consider the situation when you call someone using your cell phone. As soon as the other person, whom you are calling picks up your call you can communicate with him. In this situation the cell phones that is the end points allowed you to communicate with each other. Similarly in computer networking a port is an application-specific or process-specific software construct serving as a communications endpoint in a computer's host operating system. The purpose of ports is to uniquely identify different applications or processes running on a single computer and thereby enable them to share a single physical connection to a packet-switched network like the Internet. During the course of communication a system of digital rules is followed, which is called a protocol.
 Every service has its own unique port number and associated protocol. For instance the file transfer service used to copy a file from one host to another over a TCP/IP based network uses the File Transfer Protocol(FTP) and runs on port number 21.

 Some Common Services along with their Port and Protocol are given in the figure below :

Before saying bye bye let me explain you the two most important protocols that constitute the Internet Protocol Suite. The first one being Transmission Control Protocol(TCP) and the other one Internet Protocol(IP). Therefore the Internet Protocol Suite is also referred to as TCP/IP.

1.TCP or Transmission Control Protocol : It provides the service of exchanging data reliably directly between two network hosts. In particular, TCP provides reliable, ordered delivery of a stream of bytes from a program on one computer to another program on another computer. It is the protocol on which the major Internet applications rely on, such as the World Wide Web(WWW), email, and file transfer.

2.IP or Internet Protocol : It handles addressing and routing messages across one or more networks i.e., it has the task of delivering data from the source host to the destination host solely based on their addresses. It is the primary protocol that establishes the Internet.

 With that we come to the end for this post, Be Rocking!!

Networking Basics

Hello readers, and MERRY CHRISTMAS to all of you. If you want to become a hacker then you must have good knowledge of Networking and your basics should be crystal clear. That's exactly is what we are going to explore today.

 So, first of all - What is networking? Well, Networking is connecting devices together so that they can communicate with each other, in order to share data, files, and other computing resources. It happens all around us from PCs to ATMs and cell phones.
 Basically there are three types of network :-
1.LAN or Local Area Network : The computer network covering a small physical area, like a home, office, or small groups of buildings, such as a school, or an airport. Main features being higher data transfer rates, smaller geographic area, and lack of a need for leased telecommunication lines.
2.WAN or Wide Area Network : The computer network that covers a broad area i.e., any network whose communications links cross metropolitan, regional, or national boundaries. This is in contrast with personal area networks(PANs), local area network(LANs), campus area networks(CANs), or metropolitan area networks(MANs) which are limited to a room, building, campus or specific metropolitan area(e.g., a city) respectively.
3.WLAN or Wireless Local Area Network : The network that links two or more networking devices using some wireless distribution method (typically spread-spectrum or OFDM radio) and usually providing a connection through an access point to the wider internet. This gives users the mobility to move around within a local coverage area and still be connected to the network.
Common Networking Devices include Hub. Switch, Router and Wireless Access Point.
Since we are talking about networking, let me throw some light on the terms Internet and Intranet because mostly people are confused between the two and often consider them alike. Internet is a global system of interconnected computer systems that use the standard Internet Protocol Suite(TCP/IP) to serve billions of users worldwide.It is a network of networks. Whereas Intranet is a private computer network that uses Internet Protocol technologies to securely share any part of an organisation's information or other resources within that organisation. The term is used in contrast to internet, a network between organisations, and instead refers to  a network within an organisation.
That's all for today, and once again MERRY CHRISTMAS!!!

Basic Terminologies

Hello readers, from today onwards you all will be taking your first step towards becoming a professional ethical hacker. OK let's start, well to understand who is an ethical hacker you should first know who is a hacker. Basically a hacker is a person who - loves to explore computer technology and takes it to the next level, someone who is good at programming and also who loves to explore the details of programmable systems and know how to stretch their capabilities. However due to common stereotype, Hacking today refers to breaking into computer systems without authorization, and a hacker is a criminal as per law. In true sense people who break into computer systems or networks without authorization are crackers(or Black Hat Hackers) and not hackers(White Hat Hackers). Now, when the hacker uses his in-depth knowledge of the computer systems and programming to understand flaws or vulnerabilities which exist in a system and then uses this knowledge to fix these security issues, the whole process can be termed as Ethical Hacking and the person who do this(i.e. hacking with ethics or as per law with prior authorization) is called an Ethical Hacker.

 An ethical hacker generally takes the following steps while gaining access into a system to find out vulnerabilities :-

Technically there are three levels of hackers:-
1.Neophyte - A newbie in this field of computer security with almost no knowledge.
2.Script Kiddie - A non-expert who uses tools or scripts made by others to hack into system with little knowledge about the concept working behind the tool.
3.Elite - Also known as 1337, it is a term used to describe the most technically advanced hackers who use cutting edge technology and specializes in  one or more of domains like network or web application security, exploit development and reverse engineering  malware analysis/development or cyber forensics.
 You are currently a neophyte or may be a script kiddie but soon if you continue to read my posts and are able to gain the knowledge which I will be sharing with you, even you could become an Elite.
  

Introduction : The Need For Ethical Hackers

With the evolution of technology and the increasing complexity of computer systems, the requirement for skilled persons(called Ethical Hackers) to handle the security of such systems has risen up. That's why I(a CISE) decided to start this blog so that anyone who is interested in learning and mastering such skills can easily acquire them by learning Ethical Hacking. It requires a lot of hardwork and determination to gain expertise but don't worry with time and practice you will get better and better. With the ability to think like a hacker, you’ll be able to protect yourself from hackers attacking you. You may wish to seek a career in Ethical Hacking – Usually hired by an organization, an ethical hacker uses the same tools and techniques as a hacker to find and secure vulnerabilities in computer systems. Or you may just show off ur newfound skills to your friends, and just hack because you want to. It’s FUN!! That's enough of blah!blah!blah from the next post we will get started on our wonderful journey of Ethical Hacking...