Introduction

This is the introduction for a series of articles that I will be writing to document my journey in the Certified Ethical Hacker course.

What is a Hacker:

To start off this series, let me first elaborate what a Hacker is. He/she is a person who has the necessary utilities and skill required to gain access to any system.

Hackers can be further divided into five categories:

1. White Hat
2. Back Hat
3. Grey Hat
4. Script Kiddies
5. State Sponsored Hackers

White Hats:

These hackers are synonymous with ethical Hackers. They are security professionals who have the skills and utilities to gain access to any system that is required, but refrains from doing without the permission of the system owner. Only upon permission being granted will they access the system. The objective of a white-hat is to find any vulnerabilities and security weaknesses within the system they are trying to hack into.

Black Hat:

These are hackers who use their skill and utilities for malicious purposes. They break into systems without the permission of the user- illegally - in order to gain either steal, destroy, deny access to or compromise an valuable data present in the system.

Grey Hats:

These are hackers who use their skills and utilities for either offensively or defensively purposes according to the circumstances. They are mostly interested in the tools and techniques available at their disposal and experiment with them out of curiosity, not for intentions as malicious as back-hats.

Script Kiddies:

They are novices/ beginners new into the field of cyber security who use existing scripts and open-source tools to play around and familiarize themselves with it.

State Sponsored Hackers:

Hackers who are employed by the government to carry out operations that include penetrating other countries to gain confidential intel.

Objective of An Ethical Hacker:

It is mainly trying to determine what an intruder can see on a targeted network, as well as what a hacker can do with the information acquired. In order to estimate the above, an ethical hacker does a penetration test (pen-test in short), to test the security of the system and to identify vulnerabilities.

When hired to identify threats of a system, an ethical hacker will ask the organization what data needs to be protected, from whom, and what resources the organization is willing to expend to gain protection.

Once the details have been provided, the ethical hacker will carry out the pen-test and upon completion, provide a documentation of the various result in the form of a pen-test report.

Goals of an Attacker:

Whether carried out by an malicious actor or an ethical hacker, there are a few con

Terminologies used in Ethical Hacking:

In order to communicate the with other security professionals in an efficient and clear manner, it is necessary to have knowledge of a few basic hacking terminologies. They are as follows:

Hack Value:

This expression is used to denote the value that a certain piece of data may have for a malicious hacker to want access to it.

Threat:

An environment or situation that could lead to a potential breach of security. It is often prioritized when performing security analysis. Malicious hackers and their use of software and techniques is also considered as a threat.

Exploit:

A piece of software or technology that takes advantage of a bug, glitch or vulnerability, to gain unauthorized access to, privilege escalation, or denial of service of a computer system. A malicious hacker will look for exploits in order to gain access to to a system for an initial attack. Exploits generally consists of a few lines of code, which when executed will on a system, will expose a vulnerability.

Vulnerability:

It is weak-point, loophole or cause in a system or network which upon execution can lead to unexpected and undesirable results. Exploits are used in order to take advantage of vulnerabilities.

Payload:

This is part of an exploit. It is the section within the exploit containing the actual code which is malicious.

Zero Day:

It is a vulnerability that is previously unknown to the developer and vendors of the software.

Malware:

It is a piece of software which is designed to perform some type of malicious activity to its target.

Backdoor:

It is an method of accessing a software by bypassing the customary security mechanisms in the software, such as login.

Types of Penetration testing:

Penetration testing as discussed earlier is the process of performing malicious action as that of a hacker to a system in order to identify vulnerabilities. Penetration testing are of different types depending on the amount of information available.

White Box Testing:

This type of testing provides access to the code of the software. It is conducted primarily to test the internal structures, design and coding of the software being tested. The main goal is to improve the design, usability and security of the software.

Black Box Testing:

This type of testing is done without providing any details of the internal code of the software. It focuses mainly on the input and output of the software and is entirely based on the requirements and specifications of the software.

Grey Box Testing:

It is a type of testing of an application or software with partial knowledge of the internal structure and code. The purpose is to identify detects of the software due to improper code or improper use of the application.

Teams in Penetration testing:

Red team:

Red Teams simulate a potential adversary in methodology and techniques Red Teams often attack an organization through technical, social, and physical means, often using the same techniques used by Black Hat Hackers to test the organization or information systems protections against these hostile actors.

Blue team:

A blue team consists of security professionals who have an inside out view of the organization. Their task is to protect the organization’s critical assets against any kind of threat. Being aware of the business objectives of the organization, their main task is to strengthen security of the organization to block intruders from gaining access.