Hacking is a systematic process that begins with the first phase of reconnaissance or footprinting. The primary goal of this step is to obtain information that will be useful in the consequent phases. The stage can be subdivided into two; passive reconnaissance that involves information gathering through means such as social engineering, dumpster diving, and network sniffing. The second is active reconnaissance or doorknob rattling that requires probing the system for IP address, services on the network and to discover individual hosts. The second phase of the methodology is the scanning phase. The phase involves taking the information gained in the reconnaissance stage and examining the network for computer names, user accounts, and IP addresses. The tools that can be used in this phase include vulnerability scanners, network mappers, sweepers, port scanners and dialers
The third step in the methodology is gaining access where the actual hacking takes place. It involves exploiting the vulnerabilities that were discovered during scanning and reconnaissance. The stage involves connection that can be achieved through means such as the local area network, local access to a PC, over the internet or offline. Gaining access can be in different forms including session hijacking, stack-based buffer overflows, spear-fishing attacks or denial of service. The fourth phase in the methodology is maintaining access or establishing persistence. The primary purpose is to ensure the hacker can access the system to facilitate future attacks and exploitations. Some of the tools used to maintain such access include Trojans, backdoors, and rootkits. When the hacker owns the system, they can use it as a base for launching future additional attacks.
The fifth phase in the methodology is extracting data. It involves setting a tunnel to the attack platform or to an intermediary dead-drop that is used for pulling off any data that may be considered as important. The sixth phase is covering tracks. The primary purpose is to avoid detection by security personnel, to erase evidence of hacking as well as to continue the use of the owned system. It involves removing traces of attacks in the log files, or intrusion detection system alarms. The machine should be restored back to the way it was before the attack.
The scope in ethical hacking is established by the client before any hacking activity begins (Engebretson 2013) The client and the penetration tester determine the scope by defining the rules that will guide their engagement. Scope establishment also involves specifying the target list that the client wants to be tested. For example, the client will indicate whether the assessment is for the entire organization, a particular location or just one division. Also, the client will specify areas, and system attacks that he does not want to be included in the test. The client contains information on which resources and systems may be incorporated in the test.
The agreement of the scope is important because it is a sign of authorization for the penetrator that he has received from the client. The approval is critical in differentiating between the white hacker from black hackers. The scope is also important because it show that the tester has legal written permission before he began testing. The hacker can, therefore, use it to indemnify himself from any liability for damages that may occur because of work that is within the scope agreed. The scope is also important because it guides the actions of the hacker directing them on what he can and cannot do during the testing process. For example, what tools can the hacker use and that ones will violate the scope agreement. Finally, the scope is critical in identifying when the hacker has accomplished his job. It indicates scope creeps and is a basis for making adjustments to include client needs as changes are made.
Ethics comes into play when conducting ethical hacking because it differentiates a white hacker and a black hacker. Ethics is what contributes to the trustworthiness of the hacker leading the client to believe that the hacker will do the job they have been hired to do (Farsole et al. 2010). Ethics is what guides the hacker to seek expressed permission to examine the network and try to establish potential security risks. Ethics in ethical hacking is what causes the hacker to stay within the rules and regulations set in the scope of the engagement. For example, when the client states some areas of their system as non-targets, ethics requires the hacker to respect the request of the client. Ethics also comes into play by guiding the penetration tester to abide by the company’s and the individual’s privacy. The information and the data the tester gains once inside the system should not be shared with other people other than those the client approves.
Ethics also comes into play in that the hacker is committed to close out his work and not the client’s system vulnerable to attacks. Hackers operating ethically should ensure that the system is left as it was and not vulnerable to be exploited at a later time. Additionally, the hacker should not leave anything in the system in the end that he can use later to attack the system. Ethics also come into play because they guide the hacker in establishing his responsibility to share any security vulnerabilities he locates in the software or hardware that the developer and the manufacturer may not already know. In conclusion, ethics is what makes the white hackers different from the black hackers who have malicious intentions when penetrating systems.
References
Engebretson P. (2013) The Basics of Hacking and Penetration Testing: Ethical Hacking and Penetration Testing Made Easy. (2nd ed.) Massachusetts: Syngress Publishers.
Farsole A., Kashikar G., & Apurva Z. (2010). Ethical Hacking. International Journal of Computer Applications 1(10): 14-20.
