Monday, August 31, 2020

Business Partner!

I'm interested in funding you either by crediting or partnership.
Posted by at No comments:

Sunday, August 30, 2020

CEH: Gathering Host And Network Information | Scanning

Scanning

It is important that the information-gathering stage be as complete as possible to identify the best location and targets to scan. After the completion of  footprinting and information gathering methodologies, scanning is performed.
During scanning, the hacker has vision to get information about network an hosts which are connected to that network that can help hackers to determine which type of exploit to use in hacking a system precisely. Information such as an IP addresses, operating system, services, and installed applications.

Scanning is the methodology used to detect the system that are alive and respond on the network or not. Ethical hackers use these type of scanning to identify the IP address of target system. Scanning is also used to determine the availability of the system whether it is connected to the network or not.

Types Of Scanning 

Network ScanningIdentifies IP addresses on a given network or subnet
Port ScanningDetermines open, close, filtered and unfiltered ports and services
Vulnerability ScannerDetect the vulnerability on the target system

Port Scanning ​

Port scanning is the process of identifying open and available TCP/IP ports on a system. Port-scanning tools enable a hacker to learn about the services available on a given system. Each service or application on a machine is associated with a well-known port number. Port Numbers are divided into three ranges:
  • Well-Known Ports: 0-1023
  • Registered Ports: 1024-49151
  • Dynamic Ports: 49152-6553

Network Scanning

Network scanning is performed for the detection of active hosts on a network either you wanna attack them or as a network administrator. Network-scanning tools attempt to identify all the live or responding hosts on the network and their corresponding IP addresses. Hosts are identified by their individual IP addresses.

Vulnerability Scanning

This methodology is used to detect vulnerabilities of computer systems on a network. A vulnerability scanner typically identifies the operating system and version number, including applications that are installed. After that the scanner will try to detect vulnerabilities and weakness in the operating system. During the later attack phase, a hacker can exploit those weaknesses in order to gain access to the system. Moreover, the vulnerability scanner can be detected as well, because the scanner must interact over the network with target machine.

The CEH Scanning Methodology

As a CEH, you should understand the methodology about scanning presented in the figure below. Because this is the actual need of hackers to perform further attacks after the information about network and hosts which are connected to the network. It detects the vulnerabilities in the system bu which hackers can be accessible to that system by exploitation of that vulnerabilities.



Related links
Posted by at No comments:

Top 10 Great Gifts For The Hacker In Your Life

Give gifts this holiday season that inspires your favorite hackers to make something great. Our ten top picks for gifts to make 'em smile are perfect for hackers of all styles, ages, and interests.
Holiday gift guides always struggle when faced with nailing down a list for hackers — that's because hackers are as diverse in their interests and fascinations as they are diverse in gender, color, size and everything else. Someone with a multi-focused set of curiosity and unique gifts for finding out what makes the crackable crack may seem like a daunting individual to stuff a stocking for … but don't fret. With a keen eye on the latest interests in hacker culture, we've got a gift guide that can make the hacker in your life smile as they enjoy using your gift to hack and explore throughout the coming year.
The Onion Pi-Iemhacker
Anonymity online: The Onion Pi
One of the most popular "snake oil" (fake) privacy gadgets is the so-called "Tor in a box" — a plug-and-play gadget that promises to make you anonymous online. Nearly all of these are made by clueless charlatans whose products put you at risk for privacy and security breaches. But your favorite hacker can just make or build an "Onion Pi" for $69.95, and with this free tutorial.

Attribution Dice
With Attribution Dice ($20), anyone can be a high-priced security consultant, and predict breach headlines before PR firms have a chance to feed them to reporters! With every security breach, hackers roll their eyes when headlines and PR firms roll out the same old, same old terms, methods and culprits. Instead of rolling eyes, your hacker can roll the dice, and wow friends, family, and neighbors with their hacker cyber-powers.
21 Bitcoin Computer
Money is always a welcome gift. Give the gift of going hands-on with Bitcoin with the 21 Bitcoin Computer. "The 21 Bitcoin Computer is ideal for buying and selling digital goods and services. You can use it to create bitcoin-payable APIs, set up your own personal digital goods store, pay people to share your content online, or host online games of skill." It's not cheap ($395) and comes with controversy, but it's a cool toy with a lot of potential, and 21 Inc. is going to be releasing an open source package for the device soon.
Gentleman's Bogota Lockpicks and Clear Practice Lock
Iemhacker-hacking-tutorial
Conventional wisdom suggests that all hackers know how to pick locks, but can they do it in style? A perfect stocking stuffer for slick hackers of all genders is the Gentleman's Bogota lockpick set ($34.95). These featherweights pin discreetly to a collar, hat, sleeve, vest, hemline, or wherever they choose. If the hacker you're shopping for wants to learn to lockpick, or just brush up on technique, throw in the clever Clear Practice Lock ($34.95).
Inverse Path USB Armory
Iemhacker-hacking-news-tutorial-hackernews
In this reviewer's opinion, every hacker should have a USB Armory in their stocking this year. The Inverse Path USB Armory ($130) is a little USB stick with an entire computer onboard (800MHz ARM processor, 512MB RAM), designed to be a portable platform for personal security applications — and lives up to its reputation as "the Swiss Army Knife of security devices."
Hack-A-Day Gift Card
The cornerstone of hacker culture Hack-A-Day has a store offering gift cards and merchandise a-plenty. In it, you'll find a Bukito portable 3D printer ($899.97), ever-popular Facedancer21 and Gootfet42, a low energy Bluetooth Arduino microcontroller called the Lightblue Bean, and the pocket-sized open source robot arm, Mearm.
Hackers 20th Anniversary Blu-Ray Edition
Hack the planet! The 20th anniversary of influential 1995 cyberpunk film "Hackers" was this year, and this cult classic got a special edition Blu-ray release, making it the must-have for the hackers in your life. The 20th anniversary "Hackers" Blu-ray features an hour-long "making of" documentary, rich video and audio transfer for the film itself, and interviews with: Cast members Matthew Lillard, Fisher Stevens, and Penn Jillette; hacking consultants Nicholas Jarecki and Emmanuel Goldstein; Director Iain Softley, and many more involved with the film's production and style.
A Hacker's hope for better sleep: The Re-Timer
Iemhacker-Top-10-Great-gifts-For-hackers
Hackers are increasingly hacking themselves to make their own systems run better, and one thing hackers struggle with is their sleep cycles and feeling rested. Something that can help out is the Re-Timer ($299), a retro-future looking set of glasses and kit that adjusts the circadian rhythm and suppresses the body's production of melatonin (the sleepy hormone our bodies produce which makes us feel tired). Based on 25 years of research and on the market worldwide for three years, the Re-Timer has its own jet lag calculator app, as well as its Sleep App for Fitbit that makes a customized schedule based on actual sleep tracked.
USB Rubber Ducky Deluxe and LAN Turtle
Iemhacker-USB-Rubber-ducky-delux-LAN-turtle
A longtime favorite with hackers, penetration testers and IT professionals, the USB Rubber Ducky Deluxe ($42.99)is a cross-platform (Windows, Mac, Linux, Android) testing and experimentation device that is detected as a keyboard — imagine the possibilities. This stocking stuffer pairs well with its animal friend LAN Turtle ($50), a covert sysadmin and pentest tool for remote access, network intel gathering, and man-in-the-middle monitoring through a simple graphic shell (all in a generic USB ethernet adapter case).
TechShop Gift Certificate
Iemhacker-Top-10-gifts-for-the-hacker
Give the gift of hacking and making: A gift certificate to a TechShop. "Part fabrication and prototyping studio, part hackerspace, and part learning center, TechShop provides access to over $1 million worth of professional equipment and software. We offer comprehensive instruction and expert staff to ensure you have a safe, meaningful and rewarding experience." There are TechShops in Arizona, California, Michigan, Missouri, Pennsylvania, Texas, and Virginia/Washington, D.C. (some states have multiple locations). Future locations include St. Louis, MO and Paris, France.
Products to avoid
If you see these products, run! You're better off with a lump of coal. Don't waste precious holiday money on "snake oil" privacy and security products like these:
  • Anonabox
  • Wemagin
  • Webcloak
  • iGuardian (now SHIELD)
  • LogMeOnce
  • Sever: The Anti-Villain Box
Related word
Posted by at No comments:

CEH Practical: Information-Gathering Methodology

 

Information gathering can be broken into seven logical steps. Footprinting is performed during the first two steps of unearthing initial information and locating the network range.


Footprinting

Footprinting is defined as the process of establishing a scenario or creating a map of an organization's network and systems. Information gathering is also known as footprinting an organization. Footprinting is an important part of reconnaissance process which is typically used for collecting possible information about a targeted computer system or network. Active and Passive both could be Footprinting. The example of passive footprinting is assessment of a company's website, whereas attempting to gain access to sensitive information through social engineering is an example of active information gathering. Basically footprinting is the beginning step of hacker to get hacked someone because having information about targeted computer system is the main aspect of hacking. If you have an information about individual you wanna hack so you can easily hacked that individual. The basic purpose of information gathering is at least decide what type of attacks will be more suitable for the target. Here are some of the pieces of information to be gathered about a target
during footprinting:
  • Domain name
  • Network blocks
  • Network services and applications
  • System architecture
  • Intrusion detection system
  • Authentication mechanisms
  • Specific IP addresses
  • Access control mechanisms
  • Phone numbers
  • Contact addresses
Once this information is assemble, it can give a hacker better perception into the organization, where important information is stored, and how it can be accessed.

Footprinting Tools 

Footprinting can be done using hacking tools, either applications or websites, which allow the hacker to locate information passively. By using these footprinting tools, a hacker can gain some basic information on, or "footprint," the target. By first footprinting the target, a hacker can eliminate tools that will not work against the target systems or network. For example, if a graphics design firm uses all Macintosh computers, then all hacking software that targets Windows systems can be eliminated. Footprinting not only speeds up the hacking process by eliminating certain tool sets but also minimizes the chance of detection as fewer hacking attempts can be made by using the right tool for the job. Some of the common tools used for footprinting and information gathering are as follows:
  • Domain name lookup
  • Whois
  • NSlookup
  • Sam Spade
Before we discuss these tools, keep in mind that open source information can also yield a wealth of information about a target, such as phone numbers and addresses. Performing Whois requests, searching domain name system (DNS) tables, and using other lookup web tools are forms of open source footprinting. Most of this information is fairly easy to get and legal to obtain.

Footprinting a Target 

Footprinting is part of the preparatory pre-attack phase and involves accumulating data regarding a target's environment and architecture, usually for the purpose of finding ways to intrude into that environment. Footprinting can reveal system vulnerabilities and identify the ease with which they can be exploited. This is the easiest way for hackers to gather information about computer systems and the companies they belong to. The purpose of this preparatory phase is to learn as much as you can about a system, its remote access capabilities, its ports and services, and any specific aspects of its security.

DNS Enumeration

DNS enumeration is the process of locating all the DNS servers and their corresponding records for an organization. A company may have both internal and external DNS servers that can yield information such as usernames, computer names, and IP addresses of potential target systems.

NSlookup and DNSstuff

One powerful tool you should be familiar with is NSlookup (see Figure 2.2). This tool queries DNS servers for record information. It's included in Unix, Linux, and Windows operating systems. Hacking tools such as Sam Spade also include NSlookup tools. Building on the information gathered from Whois, you can use NSlookup to find additional IP addresses for servers and other hosts. Using the authoritative name server information from Whois ( AUTH1.NS.NYI.NET ), you can discover the IP address of the mail server.

Syntax

nslookup www.sitename.com
nslookup www.usociety4.com
Performing DNS Lookup
This search reveals all the alias records for www.google.com and the IP address of the web server. You can even discover all the name servers and associated IP addresses.

Understanding Whois and ARIN Lookups

Whois evolved from the Unix operating system, but it can now be found in many operating systems as well as in hacking toolkits and on the Internet. This tool identifies who has registered domain names used for email or websites. A uniform resource locator (URL), such as www.Microsoft.com , contains the domain name ( Microsoft.com ) and a hostname or alias ( www ).
The Internet Corporation for Assigned Names and Numbers (ICANN) requires registration of domain names to ensure that only a single company uses a specific domain name. The Whois tool queries the registration database to retrieve contact information about the individual or organization that holds a domain registration.

Using Whois

  • Go to the DNSStuff.com website and scroll down to the free tools at the bottom of the page.
  • Enter your target company URL in the WHOIS Lookup field and click the WHOIS button.
  • Examine the results and determine the following:
    • Registered address
    • Technical and DNS contacts
    • Contact email
    • Contact phone number
    • Expiration date
  • Visit the company website and see if the contact information from WHOIS matches up to any contact names, addresses, and email addresses listed on the website.
  • If so, use Google to search on the employee names or email addresses. You can learn the email naming convention used by the organization, and whether there is any information that should not be publicly available.

Syntax

whois sitename.com
whois usociety4.com

Read more


  1. Hacker Tool Kit
  2. Pentest Tools Review
  3. Hacking Tools For Games
  4. Hacker Hardware Tools
  5. Free Pentest Tools For Windows
  6. Hacking Tools For Mac
  7. Hacking Tools And Software
  8. Pentest Tools Free
  9. Underground Hacker Sites
  10. Hacker Tools Apk Download
  11. Hacking Tools Name
  12. Pentest Reporting Tools
  13. Hacker Tools
  14. Hacker
  15. Hacker Tools For Windows
  16. New Hack Tools
  17. Pentest Tools Github
  18. Hack Website Online Tool
  19. Hack Tool Apk No Root
  20. Hacker Techniques Tools And Incident Handling
  21. How To Install Pentest Tools In Ubuntu
  22. Hacker Tools Linux
  23. Game Hacking
  24. Pentest Tools For Android
  25. Pentest Tools Url Fuzzer
  26. Hacking Tools Pc
  27. Hacker Tools Software
  28. Hacker Tools Mac
  29. Hacker Tools
  30. Hacking Tools For Mac
  31. Beginner Hacker Tools
  32. Hack App
  33. Underground Hacker Sites
  34. Hacking Tools Free Download
  35. Usb Pentest Tools
  36. Android Hack Tools Github
  37. Pentest Tools Windows
  38. Hackers Toolbox
  39. Usb Pentest Tools
  40. Hack Tools
  41. Hacker Tools Apk
  42. Pentest Recon Tools
  43. Termux Hacking Tools 2019
  44. Pentest Tools List
  45. How To Hack
  46. Hacker Tools Software
  47. Hacking App
  48. Hacking Tools For Beginners
  49. Hacking Tools For Pc
  50. Hacker Tools For Ios
  51. Hack Tools Pc
  52. Hacker Tools
  53. Underground Hacker Sites
  54. Pentest Tools Framework
  55. Hacking Tools Windows 10
  56. Android Hack Tools Github
  57. Hack Tools For Windows
  58. Hacking Tools For Windows Free Download
  59. Hacking Tools For Windows 7
  60. Tools 4 Hack
  61. Hacking Tools Name
  62. Hack Tool Apk
  63. Hacker Tools
  64. Hack Apps
  65. Physical Pentest Tools
  66. Hacking Tools Software
  67. Hack Tools For Pc
  68. Pentest Tools Url Fuzzer
  69. Hack Tools Github
  70. Hack Apps
  71. Hacking Tools Free Download
  72. Pentest Tools Linux
  73. Pentest Tools Github
  74. Hacking Tools For Pc
  75. Hacker Techniques Tools And Incident Handling
  76. Pentest Tools Subdomain
  77. Hacking Tools Mac
  78. Free Pentest Tools For Windows
  79. Hacking Tools Pc
  80. Hacker Hardware Tools
  81. Blackhat Hacker Tools
  82. Android Hack Tools Github
  83. Pentest Tools Find Subdomains
  84. Top Pentest Tools
  85. Pentest Tools Nmap
  86. Hacker Tools List
  87. New Hack Tools
  88. Pentest Tools Review
  89. Hacking Tools For Pc
  90. Hacking Tools Kit
  91. Hack Tools For Games
  92. Pentest Tools Alternative
  93. Hacker Hardware Tools
  94. Hack Tools For Pc
  95. World No 1 Hacker Software
  96. Hacker
  97. Hacking App
  98. Pentest Tools Nmap
  99. Hacking Tools Name
  100. Hacking App
  101. Hacker Tools For Pc
  102. Pentest Tools Android
  103. Hack Tool Apk
  104. Hack App
  105. Hacking Apps
  106. Free Pentest Tools For Windows
  107. Hacker Tools 2020
  108. How To Make Hacking Tools
  109. Hacking Tools For Beginners
  110. Hack Tools For Games
  111. Best Hacking Tools 2020
  112. Hacking Tools For Windows
  113. Hacker Hardware Tools
  114. Hacker Tool Kit
  115. Hacker Tools Free Download
  116. Hacker Tools Apk Download
  117. Hacking Tools And Software
  118. Termux Hacking Tools 2019
  119. Hack Tools Download
  120. Hacking Tools Windows 10
  121. Hack Tools Github
  122. Pentest Tools Alternative
  123. Hacker Search Tools
  124. How To Make Hacking Tools
  125. Pentest Recon Tools
  126. Hacking Tools
  127. Hacker Tools List
  128. Underground Hacker Sites
  129. Hacking Tools For Kali Linux
  130. Easy Hack Tools
  131. Pentest Tools Port Scanner
  132. Pentest Tools Port Scanner
  133. Hacker Tools Windows
  134. Hack Tools Github
  135. Nsa Hack Tools
  136. Usb Pentest Tools
  137. Hack Apps
  138. Pentest Tools Framework
  139. Pentest Tools Linux
  140. Nsa Hack Tools
  141. Pentest Tools Apk
  142. Hack Rom Tools
  143. Hacker Tools Free Download
  144. Hack Tools For Windows
  145. Computer Hacker
  146. Pentest Tools Android
  147. Hacker Tools Hardware
  148. Physical Pentest Tools
  149. Hacking Tools Mac
  150. How To Hack
  151. Nsa Hack Tools
  152. Hacking Tools And Software
  153. Hacker Tools Github
  154. Hacker Hardware Tools
  155. Pentest Tools Find Subdomains
  156. Pentest Tools Website Vulnerability
  157. Pentest Tools Url Fuzzer
  158. Nsa Hack Tools
  159. Pentest Tools Online
Posted by at No comments:
Subscribe to: Posts (Atom)