Hacker's Methodology, a malicious mindset. 1
In this lecture, we're going to talk 2
about the different steps of the hacking 3
methodology. There are six steps to the 4
hackers methodology. We're going to 5
perform reconnaissance, skin and 6
enumerate the network, gain our access, 7
maintain our access, and then we're going 8
to place back doors, and cover our tracks 9
on our way out. These are the six steps 10
that every hacking evolution tends to go 11
through. We're going to cover each of 12
them in detail further, and then we'll 13
show you tools and techniques to use 14
those, but in this lecture, we'll talk 15
about a brief overview. The first step is 16
performing reconnaissance. So in this 17
case we're going to do everything 18
passively, we don't want to touch the 19
victim network yet. Here, we're going to 20
be looking at open source sites in the 21
Internet. So, we're going to be scanning 22
for things like understanding what their 23
networks look like, from their network 24
ranges, their IP addresses. We might be 25
able to find things like ports and 26
protocols. We might find victim email 27
addresses to launch a spear phishing 28
campaign against. We're going to find out 29
who owns their domain. We might find 30
pattern of life on different employees. 31
This is where we start looking and do 32
spend a lot of our time. Most hacking 33
evolutions take about eighty percent of 34
the hacker's methodology spent in this 35
phase. Everything we do here is very 36
passive, and we're going to be looking at 37
everything from an arm's reach. We don't 38
want them to know who we are and where 39
we're coming from yet. Some of the 40
techniques we use are things like 41
dumpster diving, Internet harvesting, 42
domain information gathering, we'll be 43
receiving any emails we can find, we'll 44
be checking social media and 45
establishing those patterns of life. The 46
second step is where we start getting 47
active. It's called scanning and 48
enumeration. So, here's where we might be doing 49
things like port scanning, actually 50
reaching out and touching the network, 51
finding out what ports are open and what 52
services are on those ports. We'll do our 53
enumeration, where we can start figuring 54
out are they using Windows, or Linux, or 55
Mac. We'll figure out what versions are 56
running. If they're running a web server, 57
are they running Apache, or are they 58
running IIS? These are all the things 59
we're going to find out during our 60
scanning and enumeration phase that's 61
going to help us build our attack before 62
we ever get into stage three. In our 63
third step, we're doing our exploitation 64
and we're gaining access. At this point, 65
we're going actually launch our attack. 66
So, we've spent probably eighty to ninety 67
percent of our time between phases one 68
and phase two at this point, and now 69
we're in our third phase, and our third 70
phase is where we actually launch this 71
attack. This is where we might actually 72
throw an exploit, conduct a social 73
engineering campaign, something where 74
we're being very active, and now our risk 75
level has gone up, because there's a 76
possibility that the organization 77
we're going after can see us, and see 78
what we're doing. At this point, we're 79
either doing client side or remote 80
exploitation. This can be things like 81
social engineering, launching exploits, 82
sending out malicious code that attacks a bug 83
or vulnerability. We could be putting out 84
viruses or Trojans. All the different 85
ways that we can go about it and we'll 86
go through some of those in this course. 87
The fourth phase is we're going to do 88
our escalation of privileges. So, now that 89
we've launched our exploit, we've gained 90
our initial access. Usually we're 91
going to gain access as a user. So for 92
instance, if I do a spear phishing campaign, 93
and one of the users clicks it, it's most 94
likely going to be someone in the 95
generic pool, not a system 96
administrator. So, at this point, I want be 97
able to get system admin rights. At this 98
point, I'm going to have to do something 99
to get from a user level to a system or 100
root level or a domain administrator, and 101
I'm going to always go for the highest 102
privilege that I can get. The way I'll do 103
this is I'll use various exploits and 104
bugs in the operating system, and we'll 105
use those vulnerabilities to our own 106
advantage. For a windows environment, the 107
golden ticket that we're looking for 108
here is the domain admin. Now once I've 109
got those administrative rights, I move 110
into phase five, which is maintaining my 111
access. Just because I have one user 112
account, doesn't mean that I'm going to be able to stay in 113
there because if the system 114
administrators realized that I'm the bad 115
guy, they can just delete that account 116
and then I've lost my access. So, instead, 117
once I get access, I'm going to go and 118
create several user accounts and I'm 119
going to hide myself throughout the 120
system. That way i can gain that 121
persistent access where I can always get 122
back to that network anytime I want. Some 123
of the techniques I'll use here is I'll 124
put network sniffers in there, or key 125
loggers, so I can gain additional user 126
names and passwords. If I'm a domain 127
admin at this point, I can create my own 128
usernames and passwords, and create new 129
accounts. Of course it's better to steal 130
somebody else's because then it's easier to 131
blend in because it's a legitimate user. 132
And again our goal here is to maintain 133
persistent access. That might include 134
punching some holes in the firewall, so 135
we have ports that are open and 136
listening for our return when we want to 137
come back. Finally, the last thing we're 138
going to do in phase six is we're going 139
to hide ourselves, and we're going to 140
cover our tracks. So, at this point, we've 141
created some additional accounts. Now, 142
we're going to put some back doors in 143
and we're going to start going through and 144
clearing out those log files. If there's 145
information we want to steal, this is the 146
point where we're going to start 147
exploiting that information and start 148
downloading it and exfiltrating it. 149
At this point, we might install a rootkit 150
or a backdoor, and this way I can always 151
get back in it, again 152
maintains that persistence like I was doing 153
in phase five, but for the long term. A 154
lot of hackers and attackers at this 155
point have their fingers in a lot of 156
different networks, and they don't always 157
go in and steal everything right away. 158
They might go in, lay the groundwork, and 159
then sit dormant for a while, and then 160
they'll take the information they want, 161
or use that network for some other 162
nefarious purpose. And so as you can see 163
as we've moved through these six phases 164
in the operation, we went from the 165
passive collection reconnaissance, then 166
we started getting more and more active 167
and as we actually get onto the box in 168
stage three and four and five and six, 169
that's where our risk level goes up 170
because if I'm on the box, there's a 171
chance that I can get caught by the 172
system administrator. So I can be very careful 173
in where I go and what I do so I don't 174
set off any alarms and trigger any 175
alerts because I don't want to get 176
caught. I want to be very quiet and very 177
sneaky as I go in, and take the 178
information that I want, and meet my 179
intended purpose.