4. Ethical Hacking

Question 1

computer misuse act

Answer 1

unethical hacking is against the law

• unauthorised access to computer materials
• unauthorised access with intent to commit of facilitate crime
• unauthorised modification computer materials

Question 2

what is hacking

Answer 2

breaking into computer systems for personal, professional, military gains

Question 3

international laws

Answer 3

when actions cross borders, abide by MOUs. If not look at ethics

Question 4

what is a hacker

Answer 4

anyone who breaks into computer system

1. white hat
   - authorised to hack
2. black hat
   - unauthorised
   - malicious intent
3. grey hat
   - sometimes good sometimes bad

communicate with leet speak (1337)

greatest risk are unhappy employees

Question 5

types of pen testing

Answer 5

1. black box
   - attacker is in steath mode
   - typically, attacker has no preknowledge of target system
   - employees may be included in the test
2. white box
   - tester is open and thorough
   - test all known assets of the system
   - does not need to cover tracks
   - detailed information regarding target is known prior

Question 6

pen testing activites

Answer 6

1. reconnaissance
2. scanning and enumeration
3. exploitation
4. post exploitation
5. covering tracks

Question 7

reconnaissance

Answer 7

gather information about target

• google dorking
• social engineering
• dumpster diving
• looking for names, emails, IP address, technologies used, vulnerabilities of technologies

1. passive
   - gather data without target knowledge
2. active
   - interact directly with target

Question 8

scanning and enumeration

Answer 8

• have a list of ip address to attack
• scan the ports of each IP to look for open ports
• services running behind port can be attacked
• use pings to check if target is up before scanning

Question 9

exploitation

Answer 9

• know what exploits to run against known vulnerability
• exploit with suitable tools and techniques
• goal is to get admin access

Question 10

post exploitation

Answer 10

• most payload do not give permanent access

- setup backdoor or account to maintain access even if system gets rebooted

Question 11

cover tracks

Answer 11

black hat

• wants to keep using techniques and tools
• hide exploit files
• erase presence

white hat

• restore system to original state
• write pen test report that covers the scope, objectives, records, findings, and how to patch vulnerabilities