Offensive Security: Ethical Hacking

Going through this course has shown me that the goal wasn’t just to become a penetration tester, but to gain a hacker’s perspective to become a better defender. And let me tell you, understanding how attacks happen is key to knowing how to stop them.

The course provided a comprehensive overview of cyberattacks, starting from the basics. It covered the spirit of hacking, reminding us that “There is always a way in”. We learned about different hacker types, including White Hat ethical hackers who use their skills for legal purposes, like identifying vulnerabilities before malicious actors do. This ethical foundation is crucial in penetration testing, where a code of ethics is necessary to operate within the legal realm and ensure data safety. Pen testers must have written permission to access systems they test and should never cause actual damage.

We learned about the cyber kill chain model, understanding the steps attackers take and why its so important to know about.

• Reconnaissance: The initial phase of scanning, enumeration, and data collection.
• Weaponization: Identifying a vulnerability and generating a payload.
• Delivery: Getting the payload to the victim.
• Exploit and execute: Running the payload to gain remote access.
• Command and control: Creating a persistent backdoor for future access.

A significant part of the course involved getting hands-on with Kali Linux. This Debian-based OS is specifically designed for penetration testing and security analysis and includes a vast collection of tools. We gained proficiency using tools built into Kali and learned how to utilize them throughout the PT process, from gathering information to reporting.

We explored various attack types and the tools used to execute them:

• Network Scanning: The first step in network attacks to understand the network layout, identify devices, and find vulnerable services. Tools like Nmap and Masscan were essential here, helping us map network structures and identify open ports. We also looked at Zenmap, a GUI for Nmap, and techniques like manual banner grabbing to get more information about services.
• On-Path Attacks: Learning how attackers position themselves between communicating nodes to intercept data. This included ARP Poisoning to trick machines about MAC addresses, DNS Poisoning to redirect traffic to fake websites, and SSL Stripping to downgrade HTTPS to HTTP and capture credentials in plain text. Tools like BetterCap aid in these attacks.
• Password Attacks: Covering brute-force methods, understanding hashing algorithms like MD5 and SHA-1 (and their weaknesses). We learned about wordlist creation tools like Crunch and CUPP, and cracking tools like John the Ripper (for Linux hashes) and Hashcat. We also touched on online attacks using tools like Hydra and Ncrack. The importance of complex passwords and avoiding defaults was highlighted.
• Social Engineering: This was fascinating, learning about hacking people rather than machines. Social engineering uses psychological manipulation to trick individuals into revealing sensitive information. We covered the process from preparation to covering tracks. Phishing attacks, often targeting large audiences, were a key topic. We learned about tools like the Social Engineering Toolkit (SET) and HiddenEye for creating fake sites and collecting credentials.
• Privilege Escalation: A crucial step to gain higher privileges after initial access. We explored techniques for both Windows Local PE and Linux Local/Remote PE. This involves exploiting system or application flaws, understanding privilege rings, and knowing how users and permissions are structured.
• Post Exploitation: What happens after gaining access. This includes maintaining access, covering tracks, and setting up backdoors. We learned about collecting system information, performing lateral movement, and hiding backdoor users. Lateral movement involves using credentials from one compromised machine to access others on the network, often utilizing tools like BloodHound.
• Web Application Security: Understanding the fundamentals was key, covering technologies like HTML, CSS, and JavaScript. We focused on the OWASP Top 10 vulnerabilities, including Injection (like SQL Injection), Broken Authentication, Security Misconfiguration, and XSS (Cross-Site Scripting). We learned to use tools like Burp Suite and OWASP ZAP to intercept and analyze web traffic, scan for vulnerabilities, and perform attacks like brute-force. We also covered SQL Injection in depth, learning database basics and how to exploit flaws to bypass logins or extract data using various techniques and tools like SQLMap.
• Vulnerability Scanners and Reporting: We learned that while automated scanners like Burp Suite Professional, Acunetix, Netsparker, OWASP ZAP, Nikto, and VEGA are useful for finding basic vulnerabilities, they cannot replace the creativity and thoroughness of a human penetration tester. A crucial skill is writing detailed and clear penetration testing reports for different audiences within an organization. We learned about different report sections and the process of investigating systems.
• Regulations: Finally, understanding the legal and ethical landscape is vital. We looked at regulations like GDPR, PCI DSS, and SOX, and how information security practices tie into compliance.

By understanding the tools and techniques used by attackers – from network scanning and social engineering to web application exploits and privilege escalation – I’ve gained a unique perspective. This hands-on knowledge of Offensive Cyber Security practices allows me to identify weaknesses that might be missed otherwise. I can now look at systems and applications with an attacker’s mindset, pinpointing potential vulnerabilities before they are exploited by actual threat actors.

This comprehensive understanding of attack vectors and methodologies is a very valuable asset that has been added into my cyber experience. I’m not just learning about defenses; I’m learning the why and how behind the attacks. This proficiency with tools and processes, combined with an understanding of security reporting and regulations, equips me to contribute significantly to hardening an organization’s defenses and preventing breaches. It’s about being proactive, identifying risks, and speaking the language of both offense and defense in cybersecurity.

These skills provide a strong foundation, and I’m excited to apply what I’ve learned in Python to cybersecurity challenges.

SDSU Global Campus	Ethical Hacking
Classroom Hours:	51.5
Completion Date:	3/9/2022
Skills Practiced:	OWASP, Cyber Kill Chain, Kali, XSS, NMAP