Ethical Hacking Overview

20. Analyzing Findings

Now, when you go through and actually stumble across some particular finding, you need to analyse that finding. It's really interesting because this is kind of a tongue twister. It can really kind of turn you around backward if you're not really careful. So I'm going to give you some examples of this in the questions that you're going to use. But the thing that you need to understand is that a false positive is something that's incorrectly identified. A false negative is something that's incorrectly rejected. A true negative is something that is correctly rejected. And a true positive is something that is correctly identified.

21. Calculating SLE, ARO, ALE

Okay, guys, just one last calculation, and we're going to end up wrapping this thing up. This is going to give us the capability, with some of these formulas, to calculate the single loss expectancy, an annualised rate of occurrence, and an annual loss expectancy, right? So let's give us an example for this. The single loss expectation is, in this example, $50,000 per event. Maybe something happens where a server is taken out and it's going to cost us $50,000 to fix it. With an annualised rate of occurrence of about 50%, the risk is expected to occur once every other year on average. So the annualised loss expectancy is equal to $50,000 times the aro, which is the annualised rate of occurrence, or $25,000.

22. Other Penetration Testing Methodologies

Okay, guys, we're just about ready to wrap this particular section up. And one of the last things we're going to talk about are the penetration testing methodologies. And you probably thought, "Well, wait a minute, Tim." We've already talked about that. That was the one you said was the most popular, the O.S.S. model. And you're absolutely right. We did. We talked about this because it is indeed the most popular. It was written by a gentleman by the name of Peter Herzog. It's not necessarily the only methodology. There are other ones that can be used in a penetration test as well. There's one. For example, the NIST methodology for the National Institute of Standards and Technology They provide a guideline on network security testing. Financial institutions tend to have their own. So this one happens to be for the Federal Financial Institution Examination Council, or FFIEC. And then lastly, we have one of these from the Information System Security Assessment Framework, all right? And you'll typically see it written as "open system" or "Oissg." Now, you may be asking yourself, "Do I need to use all of these?" And the answer is, no, you don't. You are typically told which methodology you should be using in the particular environment that you're bidding on. So if it's a bank or financial institution, it's very likely you're going to be using the FFIEC if it's pretty much anything else. In my experience, it's always been the OSS TMM, but that doesn't mean you couldn't create your own methodology. Now remember, a methodology is nothing more than a described series of steps to get to or achieve some goal. And so if everyone is doing the same steps and we're in sync, that means that we both should arrive at the same determination. So there are companies that may take some things from the OSSM and maybe some other things from this. You can move things around if you would like to, unless there is some reason in your organisation why they want to have it done in a particular way. But the biggest thing is that you've got to be consistent. You've got to do it this way every time, because you're going to be using these penetration tests—the one from last year, the one from six months ago, and so on to compare to the results you have today. And it's interesting because some people look at things that need to be fixed right away, while others sometimes tend to shrug some of this off. and we'll talk about that more in the next particular section.

FootPrinting - Reconnaissance and Information Gathering

1. Introduction to Footprinting

In this section, we'll talk about information that is gathered by the hacker. We'll discuss methods of obtaining information: physical access, social engineering access, digital access, passive versus active reconnaissance foot printing, and we'll discuss tools like Reconciliation and G foot printing tools like Multigo, the most powerful hacking tool on the internet today, and foot printing tools like in his Lookup traceroute and the Edge database. We'll discuss Google and its query operators, the Internet Arcade, the Wayback Machine, the domain name registration, and who is the operator, as well as demonstrations on various topics.

2. What Information is Gathered by the Hacker

In this particular lecture, we're going to take a look at what information is gathered by the hacker. The idea behind "foot printing" a network is to get an idea of how much of the layout and specifications we have without altering the target. Like a bank robber in a heist film, you would look to obtain blueprints of the network and company, including what type of alarm system they have and those kinds of things. Think of Ocean's Eleven or one of those types of films where they plan this out meticulously. They know exactly how much time it takes to get from point A to point B. That's the whole idea behind Foot printing in our Footprinting that we're going to do ourselves. This is going to include things like what servers and versions of software they're running, how the internal network is actually configured, and what formats they use for internal usernames and email addresses.

Once this blueprint is complete, you'll be in a much better position to see what methods, routes, and specifications your attack will actually take and how to exploit it. The first thing the hacker is going to want to know is who owns this system. Is it going to be someone who would perhaps chase after them if they attempt to try and break in? Let's take the example of Kindergartner Day Center and compare that with BankofAmerica.com. If we broke into a kindergarten daycare, it's very unlikely that someone is going to be chasing after us, trying to figure out what we're doing. But boy, the Bank of America, that would be the place where somebody would be doing that. They're going to be interested in who owns these systems. They're going to be interested in what kinds of systems are being used. If we just simply go out to Monster.com or Dice.com, if they're advertising somebody, we need somebody to get off of. We need someone to help move our system from this version of Active Directory to this version of Active Directory. They're actually telling you what kind of systems they actually have. How many offices do we have? The more offices that we have, the more our IT infrastructure is spread out. When I worked at the mortgage company in Dallas, we had 987 branches around the US.

We had our main sport in Dallas. So if I were to attack one of those mortgage branches, it would make sense to attack one of the branches and then ride back in on that connection to the Dallas office. What sort of connectivity do we have between the sites? Are we connected via leased lines, tone lines, or fractional T-1 lines? In other words, connections that we would get from the phone company? Or are we leveraging things over the Internet, perhaps things over the Internet where we're encrypting the connection between them? What type of telephone PABX systems are being used? Now I'm going to take a different approach to this on the next slide, and I'm going to get into that one. Central or decentralised It support. Centralized Support may be easier or less easy to fool, but you need to know where your support is actually located and what servers and services are accessible from the internet. I want to do this really quick example and explain to you that when we were talking about the telephone and PABX system, this is something called walking the ORG chart. When I say "walking the ORG chart," I'm talking about walking the organisational chart of the company. Let's say, for example, we call in at two in the morning and call into the help desk, where Bill is the person we're trying to target. He answers the phone.

This is Bill's cheer at extension 44 21. I'm sorry, I'm not available right now. If you need meeting assistance, you can call my boss, John Sears, at extension 412. Then we hang up the phone and call John Sears. John Sears answers the phone. Hello, this is John Sears at extension 4412. I'm not available right now. If you need immediate assistance, you can call my boss, Greg Simmons, at extension 44 32. We have all of the information needed to pull off what we're trying to do. We call Bill back in, and we explain to Bill.Bill, this is Greg Simmons. Do you know who I am? Yes, Mr. Simmons. Of course I do. Unfortunately, we have a problem with your boss, John Sears. Can I definitely depend on you to keep this conversation between just us? Oh, yes, of course I can do that. I need you to reset John's password, and please do not give him another one until I say so. Can you do that for me? Yes, of course I could do that. Now we've just laid out the fact that Bill can expect to get ahead if he keeps up with and moves ahead of John. Now, this is not going to work if Bill and John are good friends, but you know, any time you're trying to do footprinting or reconnaissance, you have to take a few chances. And so this is what's referred to as "walking the ORG chart."

Prepared by Top Experts, the top IT Trainers ensure that when it comes to your IT exam prep and you can count on ExamSnap CEH Certified Ethical Hacker (312-50v9) certification video training course that goes in line with the corresponding ECCouncil 312-50 exam dumps, study guide, and practice test questions & answers.