Downloaded 487 times
Uploaded bysumit dimri
Ethical Hacking and Network Security
The document is a presentation by Sumit Dimri on various aspects of computer security, including definitions, vulnerabilities, and practical hacking techniques such as Google hacking and social engineering. It discusses the importance of securing information, common attack vectors, and tools used for network security. Additionally, it provides insight into methods like sniffing, ARP spoofing, and hacking web servers specifically targeting vulnerabilities in PHP applications.
In this document
Powered by AI
Presentation introduction and agenda outlining key topics such as Google hacking, sniffers, and social engineering.
Defines security, its necessity, and vulnerability among various groups including financial and government institutions.
Explains Google hacking, its importance in information gathering, and provides search syntax techniques for effective data retrieval.
Introduction to sniffers for network monitoring and ARP spoofing as a tactic for enhancing internet speed.
Defines steganography and its use in hiding information within images for malicious purposes.
Explains social engineering techniques, including manipulation tactics, vulnerabilities of humans, and categories of social engineering methods.
Discusses common web servers, vulnerabilities in PHP applications, and step-by-step methods for exploiting these vulnerabilities.
Wrap-up of the presentation, expressing thanks to the audience.
More Related Content
Similar to Ethical Hacking and Network Security
Ethical Hacking and Network Security
- 1. Glimpse on ComputerSecurity A presentation by – Sumit Dimri
- 2. AGENDA SECURITY GOOGLE HACKING SNIFFERS ARP SPOOFING STEGANOGRAPHY SOCIAL ENGINEERING HACKING WEB SERVER
- 3. NetworkSecurity
- 4. A Brief Historyof the World
- 5. Overview What issecurity? Why do we need security? Who is vulnerable?
- 6. What is “Security”Dictionary.com says: 1. Freedom from risk or danger; safety. 2. Freedom from doubt, or fear; confidence. 3. Something that gives or assures safety, as: 1. A group or department of private guards: Call building security if a visitor acts suspicious. 2. Measures adopted by a government to prevent attack. 3. Measures adopted, as by a business or homeowner, to prevent a crime such as burglary or assault: Security was lax at the firm's smaller plant. … etc.
- 7. Why do weneed security? Protect vital information while still allowing access to those who need it Trade secrets, medical records, etc. Provide authentication and access control for resources
- 8. Who is vulnerable?Financial institutions and banks Internet service providers Government and defense agencies Contractors to various government agencies Multinational corporations ANYONE ON THE NETWORK
- 9. Security related URLshttp://www.robertgraham.com/pubs/network-intrusion-detection.html http://online.securityfocus.com/infocus/1527 http://www.snort.org/ http://www.cert.org/ http://www.nmap.org/ http://grc.com/dos/grcdos.htm http://lcamtuf.coredump.cx/newtcp/
- 10. Google Hacking Playsa very important role in collecting information about the target. Google has a variety of special search syntaxes. List of employees, their personal details. Sometimes simple searches yield personal pages and non authorized information. Google can assist an ethical hacker in many ways.
- 11. What is G o o g l e ? A powerful full-text search engine that indexes over 10 billion websites A tool A site that has launched a vocabulary all its own
- 12. How does G o o g l e TM work?
- 13. The special syntaxesINTITLE intitle: restricts your search to the titles of web pages. Intitle: “HACKING”
- 14.
- 15. INURL inurl: restrictsyour search to the URLs of web pages. This syntax tends to work well for finding search and help pages because they tend to be rather regular in composition. Inurl: hacking
- 16.
- 17. SITE Site: allowsyou to narrow your search by either a site or a top-level domain. Site:edu
- 18.
- 19. LINK Link: returnsa list of pages linking to the specified URL. Enter link:www.orkut.com and you’ll be returned a list of pages that link to Orkut.
- 20.
- 21. FILETYPE Filetype: searchesthe suffixes or filename extensions. Filetype:ppt google hacking
- 22.
- 23.
- 24.
- 25. What are Sniffers?Sniffers monitor network data. A sniffer usually act as network probes or “snoops”-examining network traffic but not intercepting or altering them. Ettercap is the best tool for sniffer.
- 26.
- 27.
- 28.
- 29. ARP Spoofing Gettingmax internet speed using ARP spoofing.
- 30. ARP POISONING :arp-a 15-441 Networks Fall 2002
- 31.
- 32. What is Steganography?The process of hiding data in images is called Steganography. Attackers can embed information such as: Source code for hacking tool. List of compromised servers. Plans for future attacks.
- 33.
- 34.
- 35.
- 36.
- 37. What Is SocialEngineering Social engineering is the human side of breaking into a corporate network. An employee may unwittingly give away key information in an email or by answering questions over the phone with someone they don’t know.
- 38. Art Of ManipulationThe goal of a social engineer is to trick someone into providing valuable information or access to that information. It preys on qualities of human nature, such as the desire to be helpful, the tendency to trust people and the fear of getting in trouble.
- 39. Human Weakness Peopleare usually the weakest link in the security chain. Social engineering is the hardest form of attack to defend against because it cannot be defended with hardware or software alone.
- 40. Human Based SocialEngineering Human based social engineering can be broadly categorized into: Technical support Third person approach Dumpster Diving Shoulder Surfing
- 41. Computer Based SocialEngineering These can be divided into the following categories: Mail attachments Websites Spam Mail
- 42. Reverse Social EngineeringMore advanced method of gaining illicit information is known as “reverse social engineering”. This is when the hacker creates a persona that appears to be in a position of authority so that employees will ask him for information, rather than the other way around.
- 43. Hacking Web ServersPopular web servers Apache web server IIS Web server Sun ONE web server
- 44. Invading PHP serverSites with PHP 4.4 have a SQL injection vulnerability in them which makes their Admin control panel easily accessible . This tutorial is applicable on PHP4.4 machines with Apache running in parallel with them.
- 45. Steps for webhacking 1. Search the server Make a Google dork to find sites running Apache and PHP4.4 . 2. Scan the server Start by scanning them using Nmap,Do and intense scan and find the open ports. If you find port 2000 open, then you have almost got it. Most websites running
- 46. PHP4.4 have thisport for admin login. Now just login using port 2000 http://www.website.com:2000 And you will be comfortably login into admin Page like this-
- 47.
- 48. 3.Hack the siteNow in the fields, you have to type- Username – admin Password – a’ or 1=1 or ‘b Domain - a’ or 1=1 or ‘b And press go , you will login into admin.
- 49.
- 50.
- 51. Now you havehacked into admin. Actually sites based on PHP4.4 have the vulnerability in them that they are vulnerable to SQL injection. It will Literally take 20 seconds.
- 52. Thanks For yourtime
Editor's Notes
- #7 In other words, having systems in place beforehand which prevent attacks before they begin.
- #12 Since November 2004, the number of indexed pages has doubled. A googol is (10 100 ) Google’s Motto is “Don’t Be Evil”
- #13 Web servers: There’s actually more than 100 of these around the country. Which is one of the reasons why Google moves so quickly. Index Servers & Doc servers: There’s also redundancy built into the index and doc servers so the millions of people hitting Google at the same time don’t bog it down.