Ethical Hacking Lecture 3: Target Scanning

Ethical Hacking and Penetration Testing - Lecture 3

• Lecture focuses on Target Scanning (active information gathering) and Threat Modeling
• The lecture outlines a penetration testing framework including pre-engagement interactions, information gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting.
• OSINT types are categorized into passive, semi-passive, and active information gathering.
• Passive information gathering is generally useful when targeting activity needs to be undetected
• This involves collecting archived information from third-party sources.
• Semi-passive involves gathering data that appears like normal internet behavior.
• This does not include port scanning or crawler techniques
• The goal is to collect metadata to avoid attracting attention during the reconnaissance activities
• Active information gathering is performed to identify the infrastructure
• This includes actively searching for open services, unpublished directories, files, and servers.
• Target scanning includes host discovery, port scanning, and operating system discovery.
• Scanners like Nmap, Netcat and Superscan are discussed
• Banner grabbing is a technique used to gather information about a computer system by connecting to a service and reading the banner returned.
• Information gathered via banners provide details on services, software version, and operating systems.
• Tools like Telnet and Netcat support banner grabbing
• Countermeasures against active information gathering include network topology design for difficulty in scanning, disabling unnecessary services, using firewalls, and implementing network intrusion detection systems to reduce exposure.
• Countermeasures against passive information gathering include reviewing public information sources prior to publication, employing anonymous identities, considering private domain registration, checking files/pages for metadata and be aware of archives like WayBack Machine
• The framework for penetration testing includes pre-engagement interactions, initial assessment, threat modeling, vulnerability analysis, Exploitation and post exploitation, and reporting.
• Threat modeling assesses threats to assets, and approaches include attacker-centric (understanding attack methods), software-centric (assessing softwar vulnerabilities), and asset-centric (examining the value of each asset).
• Microsoft SDL is a threat modeling technique used by developers to enhance security design.
• Steps include system description, creation of checklists, impact assessment and countermeasure planning
• Tools such as the MS SDL threat modelling tool are available to support the process
• The concept of responsible disclosure is presented along with the potential rewards for vulnerability discoveries

Lab Activities

• Students are required to complete Week 3 lab activities on active information gathering using Nmap for target scanning.
• The lab will utilize both Kali Linux and Metasploitable virtual machines.
• The MySay module survey is to be completed.
• Review the coursework specification document and clarify any related questions.

Reading List

• Recommended resources for further research.

Next Week

• A preview of the topics to be covered in the following week, namely Vulnerability Assessment and coursework review.