Download Cyber Security Full Course Subtitles (11-Hour Edureka Training for Beginners)

[Music]

hey everybody welcome to this video on

cyber security full course I'm sure that

most of you would have gone online and

checked an image watched a video like

the picture and subscribe to a service

but have you ever wondered how all this

data is kept safe cyber security is the

practice of protecting computers servers

and networks from digital attacks theft

and damage

cyber security is critical for

individuals businesses and organizations

to protect against cyber threats such as

viruses worms and ransomware hey

everybody you are already watching a

video on cyber security full course on

edurica if you love watching videos like

this then consider hitting the like

button and subscribing to our Channel

you can also hit the Bell icon to

receive regular updates from here we

also have hundreds of training programs

and certification courses on our website

so if you are interested in them do

check out the description given below

now let's start this video by seeing

what this video will cover since the

title itself is cyber security full

course I think that it is Justified that

we start with water cyber security after

that we can move on to cyber security

fundamentals this section will cover all

the fundamental concepts that you will

need to understand in order to start

learning cyber security after this we

can check the history of cyber security

how exactly did it start and what made

it evolve into what cyber security is

today we will then see some cyber

security threats and the tools that is

used in this domain once we are done

with that we will tell you the top 10

reasons why you should learn cyber

security along with a few cyber security

skills with this video we really do hope

that you are able to work in this

industry so the next section is how to

become a cyber security engineer

followed by the cyber security career

path

if you are new to this industry then let

me tell you cyber security

certifications are absolutely necessary

if you want to have a good chance in

getting shortlisted we will also need to

cover coding for cyber security to

maximize your knowledge in this domain

in this video we will also see the top

cyber security attacks that have gained

reputation in the recent years

after this we will move on to ethical

hacking we will start by seeing what

ethical hacking means after which we can

learn the phases in ethical hacking once

you are done with this we will move on

to some Core Concepts like ethical

hacking with Kali Linux cryptography

penetration testing Etc in this video we

will also show you how to use nmap a

network scanner that is used to discover

hosts and services on a computer network

by sending packets and analyzing the

responses we will also see a few methods

of cyber attacks like cross-site

scripting DDOS attack SQL injection Etc

after that we will cover steganography a

technique that is used to hide data in a

non-secretive manner to avoid detection

now after all this we really do hope

that you use these skills and succeed in

your career that is why we have included

a ethical hacking roadmap which will

help you plan your career and cyber

security interview questions and answers

to help you ease through the interview

process so now let's get started with

the first topic which is what is cyber

security

foreign

what is cyber security

the onset of digitalization error has

opened up a lot of opportunities for

everyone especially business and

Enterprises

from Mobile Banking to online shopping

to reading news and books everything is

just one click away but it has been

rightly said that everything comes at a

price the more you connect to digital

assets the higher the risk of security

vulnerabilities for your sensitive and

confidential data now the question

arises how are companies securing this

critical data and combating these trips

the answer is cyber security

so what is cyber security

technically cyber security is the body

of Technologies processes and practices

designed to protect networks computers

programs and data from Attack damage or

unauthorized access or misuse of

authorized asset

the goal of cyber security is to reduce

the risk of cyber attacks and protect

organizations and individuals from the

intentional and unintentional

exploitation of security weaknesses and

systems networks and Technologies

you love the product on Amazon and plan

to buy it on your way to checkout you

are given options to pay through your

debit or credit card or UPI with

millions of users sharing such sensitive

information over the platform ever

wondered how Amazon tries to secure this

information

for the Facebook and Google also managed

to secure confidential information off

its millions of users

well from renew privacy policies to

security focused patents to use of AI

for data security each company is

expanding its focus on data protection

to encourage user Trust

with the increasing advancements in the

digital world cyber security threats

will keep getting more complex as

hackers learn to adapt to security

strategies this will increase the

widespread requirement of cyber security

by companies that will be paying more

than ever to land highly skilled cyber

Security Professionals in order to

secure their vulnerable assets from

cyber attacks

foreign

now we are living in a digital era

whether it be booking a hotel room

ordering some dinner or even booking a

cab we're constantly using the internet

and inherently constantly generating

data this data is generally stored on

the cloud which is basically a huge data

server or data center that you can

access online also we use an array of

devices to access this data now for a

hacker it's a golden age with so many

access points public IP addresses and

constant traffic and tons of data to

exploit black hat hackers are having one

hell of a time exploiting

vulnerabilities and creating malicious

software for the same above that cyber

attacks are evolving by the date hackers

are becoming smarter and more creative

with their malware's and how they bypass

virus scans and firewalls still baffle

many people let's go through some of the

most common types of cyber dark snow

so as you guys can see I've listed out

eight cyber attacks that I've played us

since the beginning of the internet

let's go through them briefly so first

on the list we have General malwarez

malware is an all-encompassing term for

a variety of cyber threats including

Trojans viruses and bombs malware is

simply defined as code with malicious

intent that typically steals data or

destroys something on the computer next

on the list we are phishing often posing

as a request for data from a trusted

third party phishing attacks are sent

via email and ask users to click on a

link and enter their personal data

refreshing emails have gotten much more

sophisticated in recent years making it

difficult for some people to discern a

legitimate request for information from

a false one phishing emails often fall

into the same category as spam but are

more harmful than just a simple ad next

on the list we have password attacks a

password attack is exactly what it

sounds like a third party trying to gain

access to your system by cracking a

user's password next next up is DDOS

which stands for distributed denial of

service a Dos attack focuses on

disrupting the service of a network

attackers send High volumes of data or

traffic through the network that is

making a lot of connection requests

until the network becomes overloaded and

can no longer function next up we have

man in the middle attacks by

impersonating the end point in an online

information exchange that is the

connection from your smartphone to a

website the mitm attacks can obtain

information from the end users and

entity he or she is communicating with

for example if you're Banking online the

man in the middle would communicate with

you by impersonating your bank and

communicate with the bank by

impersonating you the man in the middle

would then receive all the information

transferred between both parties which

could include sensitive data such as

bank accounts and personal information

next up we have drive by downloads

through malware on a legitimate website

a program is downloaded to a user system

just by visiting the site it doesn't

require any type of action by the user

to download it actually next up we have

Mal advertising which is a way to

compromise your computer with malicious

code that is downloaded to your system

when you click on an affected ad lastly

we have Rogue softwares which are

basically malwares that are masquerading

as legitimate and necessary security

software that will keep your system safe

so as you guys can see now the internet

sure isn't a safe place as you might

think it is this not only applies for us

as individuals but also large

organizations

there have been multiple cyber breaches

in the past that has compromised the

privacy and confidentiality of our data

if we head over to the site called

information is beautiful we can see all

these major cyber breaches that have

been committed

so as you guys can see even big

companies like eBay AOL Evernote Adobe

have actually gone through major cyber

breaches even though they have a lot of

security measures taken to protect the

data that they contain so it's not only

that small individuals are targeted by

hackers and other people but even bigger

organizations are constantly being

targeted by these guys

so after looking at all sorts of cyber

attacks possible the breaches of the

past and the sheer amount of data

available we must be thinking that there

must be some sort of mechanism and

protocol to actually protect us from

early sorts of cyber attacks and indeed

there is a way and this is called cyber

security in a Computing context security

comprises of cyber security and physical

security both are used by Enterprises to

protect against unauthorized access to

data centers and other computerized

systems information security which is

designed to maintain the confidentiality

integrity and availability of data is a

subset of cyber security the use of

cyber security can help prevent against

cyber attacks data breaches identity

theft and can Aid in Risk Management so

when an organization has a strong sense

of network security and an effective

incident response plan it is better able

to prevent and mitigate these attacks

for example end user protection defense

information and guards against loss of

theft while also scanning computers for

malicious code now when talking about

cyber security there are three main

activities that we are trying to protect

ourselves against and they are

unauthorized modification unauthorized

deletion and unauthorized access these

three terms are very synonymous to the

very commonly known CIA Triad which

stands for confidentiality integrity and

availability

the CIA Triad is also commonly referred

to as the three pillars of security and

most security policies of bigger

organizations and even smaller companies

are based on these three principles so

let's go through them one by one

so first on the list we have

confidentiality confidentiality is

roughly equivalent to privacy measures

undertaken to ensure confidentiality are

designed to prevent sensitive

information from reaching the wrong

people while making sure that the right

people can in fact get it access must be

restricted to those authorized to view

the data in question

it is common as well for data to be

categorized according to the amount and

type of damage that could be done should

it fall into unintended hands more or

less stringent measures can then be

implemented across to those categories

sometimes safeguarding data

confidentiality May involves special

training for those privy to such

documents such training would typically

include security risks that could

threaten this information training can

help familiarize authorized people with

risk factors and how to guard against

them further aspects of training can

include strong password and password

related best practices and information

about social engineering methods to

prevent them from bending data handling

rules with good intention and

potentially disastrous results next on

the list we have integrity Integrity

involves maintaining the consistency

accuracy and trustworthiness of data

over its entire life cycle data must not

be changed in transit and steps must be

taken to ensure that data cannot be

altered by unauthorized people for

example in a breach of confidentiality

these measures include file permissions

and user access controls Version Control

may be used to prevent erroneous changes

or accidental deletion by authorized

users becoming a problem in addition

some some means must be in place to

detect any changes in data that might

occur as a result of non-human caused

events such as electromagnetic pulses or

silver crash some data might include

checksums even cryptographic checksums

for a verification of Integrity backup

or redundancies must be available to

restore the affected data to its correct

State last but not least is availability

availability is best insured by rigorous

maintaining of all Hardware performing

Hardware repairs immediately when needed

and maintaining a correctly functional

operating system environment that is

free of software conflicts it's also

important to keep current with all

necessary system upgrades providing

adequate communication bandwidth and

preventing the occurrences of

bottlenecks are equally important

redundancy failover and even high

availability clusters can mitigate

serious consequences when hardware

issues do occup fasting is adaptive

Disaster Recovery is essential for the

worst case scenarios that capacity is

reliant on the existence of a

comprehensive Disaster Recovery plan

safeguards against data loss or

interruption in connection must include

unpredictable events such as natural

disasters and Fire

to prevent data loss from such

occurrences a backup copy must be stored

in a geographically isolated location

perhaps even in a fireproof water safe

place

extra security equipments or softwares

such as firewalls and proxy servers can

guard us against down times and

unreachable data due to malicious

actions such as denial of service

attacks and network intrusions

so now that we have seen what we are

actually trying to implement when trying

to protect ourselves on the internet we

should also know the ways that we

actually protect ourselves when we are

attacked by cyber organizations so the

first step to actually mitigate any type

of Cyber attack is to identify the

malware or the Cyber threat that is

being currently going on in your

organization next we have to actually

analyze and evaluate all the affected

parties and the file systems that have

been compromised and in the end we have

to patch the whole treatment so that our

organization can come back to its

original running State without any cyber

breaches so how is it exactly done this

is mostly done by actually calculating

three factors the first factor is

vulnerability the second factor is

threat and the third is risk so let me

tell you about the three of them a

little bit

so first on the list of actual

calculations we have vulnerability so a

vulnerability refers to a known weakness

of an asset that can be exploited by one

or more attackers in other words it is a

known issue that allows an attack to be

successful for example when a team

member resigns and you forget to disable

their access to external accounts change

logins or remove their names from the

company credit cards this leaves your

business open to both unintentional and

intentional threats however most

vulnerabilities are exploited by

automated Dockers and not a human typing

on the other side of the network

next testing for vulnerabilities is

critical to ensuring the continued

security of your systems by identifying

weak points and developing a strategy to

respond quickly here are some questions

that you ask when determining your

security valid abilities so you have

questions like is your data backed up

and stored in a secure off-site location

is your data stored in the cloud if yes

how exactly is it being protected from

cloud vulnerabilities what kind of

security do you have to determine who

can access modify or delete information

from within your organization next like

you could ask questions like what kind

of antivirus protection is in use what

are the license currents are the license

current and is it running as often as

needed also do you have a data recovery

plan in the event of vulnerability being

exploited so these are the normal

questions that one asks when actually

checking their valuability next up is

threat a threat refers to a new or newly

discovered incident with potential to do

harm to a system or your overall

organization there are three main types

of threat National threats like floods

or tornadoes unintentional threats such

as employee mistakingly accessing the

wrong information and intentional

threats there are many examples of

intentional threats including spyware

malware adware companies or the actions

of disgruntled employees in addition

worms and viruses are categorized as

threats because they could potentially

cause harm to your organization through

exposure to an automated attack as

opposed to one perpetrated by human

beings

although these threats are generally

outside of one's control and difficult

to identify in advance it is essential

to take appropriate measures to assess

threats regularly here are some ways to

do so ensure that your team members are

staying informed of current trends in

cyber security so they can quickly

identify new threats they should

subscribe to blogs like wired and

podcasts like the techgenics extreme it

that covers these issues as well as

joint professional associations so they

can benefit from breaking news feeds

conferences and webinars you should also

perform regular threat assessment to

determine the best approaches to

protecting a system against a specific

threat along with assessing different

types of threat in addition penetration

testing involves modeling real world

threats in order to discover

vulnerabilities

next on the list we have risk so risk

refers to the potential for loss or

damage when a threat exploits a

vulnerability example of risks include

Financial losses as a result of business

disruption loss of privacy reputational

damage legal implications and can even

include loss of life risk can also be

defined as follows which is basically

threat multiplied by the vulnerability

you can reduce the potential for Risk by

creating and implementing a risk

management plan and here are the key

aspects to consider When developing your

risk management strategy firstly we need

to assess risk and determine needs when

it comes to designing and implementing a

risk assessment framework it is critical

to prioritize the most important

breaches that need to be addressed

although frequency May differ in each

organization this level of assessment

must be done on a regular recurring

basis next we also have to include a

total stakeholder perspective

stakeholders include the business owners

as well as employees customers and even

vendors all of these players have the

potential to negatively impact the

organization but at the same time they

can be Assets in helping to mitigate

risk so as we see risk management is the

key to cyber security so now let me go

through a scenario to actually

understand how cyber security actually

defend an organization against very

manipulative cybercrime so cyber crime

as we all know is a global problem

that's been dominating the new cycle it

poses a threat to individual security

and an even bigger threat to large

International companies Banks and

governments today's organized cyber

crime far outshadows loan hackers of the

past and now large organized crime ranks

function like startups and often employ

highly trained developers who are

constantly innovating new online attacks

most companies have preventative

security software to stop these types of

attacks but no matter how secure we are

cyber crime is going to happen

so meet Bob he's the chief security

officer for a company that makes a

mobile app to help customers track and

manage their finances so security is of

top priority so Bob's company has an

activity response platform in place that

automates the entire cyber security

process the ARP software integrates all

the security and ID software needed to

keep a large company like Bob's secured

into a single dashboard and acts as a

hub for the people processes and

Technology needed to respond to and

contain cyber attacks let's see how this

platform works in the case of a security

breach while Bob is out on a business

trip irregular activity occurs on his

account as a user Behavior analytics

engine that monitors account activity

recognizes suspicious Behavior involving

late night logins and unusual amounts of

data being downloaded this piece of

software is the first signal that

something is wrong an alert is sent to

the next piece of software in the chain

which is the security information and

event management system now the arp can

orchestrate a chain of events that

ultimately prevents the company from

encountering a serious security disaster

the ARP connects to a user directory

software that Bob's company uses which

immediately recognizes that user

accounts belong to an executive who is

out on a business trip and then proceeds

to lock his account

the ARP sends the incident IP address to

a threat intelligent software which

identifies the address as a suspected

malware server

as each piece of security software runs

the findings are recorded in the arp's

incident which is already busy creating

a set of instructions called A playbook

for a security analyst to follow

the analyst and lox Bob's accounts and

changes his passwords this time the

software has determined the attempted

attack came from a well-known cybercrime

organization using stolen credentials

Bob's credentials were stolen when the

hacker found a vulnerability in his

company's firewall software and used it

to upload a malware infected file now

that we know how the attack happened the

analyst uses the ARP and identifies and

patches all the things the ARP uses

information from endpoint tools to

determine which machines need to be

patched recommends how to bash them and

then allows the analyst to push the

patches to all the computers and mobile

devices instantly meanwhile Bob has to

alert the legal Departments of the

breach and the ARP instantly notifies

the correct person of the situation and

the status of the incident after the

attack is contained and Bob's account is

secured the analyst then communicates

which data may have been stolen or

compromised during the incident he

identifies which geographies

jurisdictions Android registry agencies

cover the users and informations

affected by the attack then the ARP

creates a series of tasks so the

organization can notify the affected

parties and follow all relevant

compliances and liability procedures

in the past a security breach this large

would have required Bob's company to

involve several agencies and third

parties to solve the problem a process

that could have taken months or longer

but in a matter of hours the incident

response platform organized all of the

people processes and Technology to

identify and contain the problem find

the source of the attack fix the

vulnerability and notify all affected

parties and in the future Bob and his

team will be able to turn the cognitive

security tools these tools will read and

learn from tens of thousands of trusted

publication blogs and other sources of

information this knowledge will uncover

new insights and patterns anticipate and

isolate and minimize attacks as they

happen and immediately recommend actions

for Security Professionals to take

keeping data safe and companies like

Bob's out of the headlines

[Music]

so let us take a trip to the early days

of hacking to start with now the

internet engineering task force is

responsible for maintaining

documentation about protocols and

various specification and processes and

procedures regarding anything on the

internet they have a series of documents

called the request for commence or the

rfcs and according to rfc1389 it says a

Haka is a person who Delights in having

an intimate understanding of the

internal workings of a system computers

and computer networks in particular

while the expression hackers may go back

a long time and have many different

connotations or definitions as far as

computers go some of the earliest

hackers were members of the tech Model

Railroad Club at the Massachusetts

Institute of Technology and what those

people did and the various things that

they did and were involved in are detail

in Stephen Levy's book called hackers

for our purposes now for our purposes

we'll be talk talking about other types

of hackers although the spirit of what

we do goes back to those early days now

the definition of hacking or hackers has

changed particularly in the 1980s and in

part as a result of a couple of people

namely Robert T Morris who was a Cornell

graduate who Unleashed a piece of

software that was called a worm on what

was an early version of the internet

firm went on to cause a lot of damage

and create a lot of downtime on systems

across the country and across the world

now the Morris worm did end up resulting

in something good however that is the

computer Emergency Response Team at

Carnegie Mellon was created primarily in

response to the Morrisville now there is

also Kevin mitnick who is another

well-known hacker who was responsible

for various acts with computer crime

over a couple of decades he was the

first convicted in 1988 so the

definition of hacker or hacking moved

from something benign to something far

more Sinister in popular culture now we

see hacking or hackers in all sorts of

popular culture we've seen them in

hacker movies called War Games also the

movie hackers of course you also see it

in the Matrix movies where you can see

if you look really closely that they are

using a tool called nmap which we will

get into the use of in great detail

later on as we go on now also the movie

sneakers and the movie Swordfish and on

television in addition to other places

you can see the Asians at NCIS regularly

doing things like cracking complex

cryptography in just a matter of seconds

or minutes so what is hacking really

well hacking is about a deep

understanding of something particularly

with relation to computers and Computing

it's also about exploring and the joy of

learning new things and understanding

them very clearly and being able to

manipulate those things in ways that

maybe other people haven't before it's

also about digging into problems to find

out Solutions in creative and

interesting ways and sometimes finding

problems where there weren't problems

previously and that's a little bit about

what is hacking okay so now that we have

talked about what exactly is hacking and

how the meaning and connotations of that

word has changed over time how it came

into existence how it was coined let's

go over the reasons that people normally

hack now you may want to hack just for

fun as discussed previously hacking is a

tradition that goes back several decades

at MIT even preceding the computer

definition of hacking now MIT has a long

and storied history of hacking and

sometimes if a computer-related nature

which in this case happens to be true

and sometimes if a non-computer related

nature instance now here you can see

that mit's homepage has been hacked or

you might even say the faced to indicate

that Disney is buying MIT this was an

April Fool's Day prank in 1998 and again

this is just the kind of hacking that

you would do for fun rather now

sometimes you might want to hack just to

prove a political point or any point for

that matter in this case again Bill

Gates had donated some money to the MIT

which allowed them to have a new

building and he was coming to MIT to

visit and give a talk about Microsoft

Windows and its systems and as you can

see the the Windows systems that are

installed in the entryway at the

building were hacked to be running Linux

instead and you can see here that tux

the penguin is saying welcome to the

William H Gates Building again that some

students who decided that they want to

make a point about Linux and Microsoft

and windows to Bill Gates and they

thought hacking was the best way to go

about it sometimes you hack just for the

challenge here's an example again at MIT

where some students turned the facade of

a building into a Tetris game board now

this was a reasonably difficult hack and

the students went after it just for the

challenge of completing it and it just

so they could have some pride of

ownership and to be able to say that

they were able to pull this off you know

the things that teenagers do to show off

to other teenagers it just increases

with increase in scale now in spite of

its difficulties and its challenges and

all the obstacles and planning that had

to go into it they were able to pull it

off and now they have those bragging

rights so that was one of them and one

of the instances where somebody would

hack just for the challenge and for the

fun in it now sometimes you want to hack

to prevent theft and this is where we

get more specifically in the computer

related hackings you see a lot of

Articles and stories and the News over

the last few years about cyber crime and

here's an example of data theft

compromised and a few within one and a

half million cards for Global Payments

so there are some attackers who got into

this company global payment and they

were able to pull out about a mill

million and a half credit card numbers

during the intrusion there so what you

may want to do is you may want to learn

how to hack in order to find these holes

in your systems or applications or

employer systems so that you can fix

these holes and prevent these

compromises from happening because of

the reputational hit that your company

takes however things like these happen

you have the risk of completely running

out of business so just to protect your

job to protect your company and to

protect your own desire of business you

may just want to learn to hack and

that's a very good reason now you may

also want to find all the problems that

exist in your system for putting them

out and deploying them so that you can

keep these attackers from getting in and

stealing critical or sensitive

information sometimes you may want to

hack to get there before the bad guys

and the same sort of idea is the last

one where we're just going to talk about

and that exactly is ethical hacking now

we were just talking about how sometimes

you may want to hack into your own

system before publishing it out to the

public let's take Internet Explorer for

example now Internet Explorer was

actually published to the public with

some critical error in the code and

these flaws were heavily exploited by

people who actually found them now a

number of people in the world go out

looking for these flaws and they call

themselves security researchers and they

get in touch with the vendors after they

found a flaw or a bug and work with the

vendors to get it fixed what they end up

with is a bit of reputation they get a

name for themselves and that name

recognition may end up getting them a

job or some speaking engagements or book

deal or any number of ways that you

could cash in on some name recognition

from finding these sort of bugs and

getting them fixed if you want to get

there before the bad guys you may think

they're helping out a vendor you may

want to just make a name for yourself

you want to find these sort of bugs

before the bad guys do because think

about the bad guy is finding them is

they don't announce them and they don't

get them fixed and that makes everybody

a little less secure finally you may

want to protect yourself from hacked

computer companies and fight cyber

criminals and this is a new headline

from June 18 2012 and we're starting to

see these sort of news headlines show up

as companies are starting to retaliate

against attackers in order to retaliate

against attackers now in order to

retaliate against Dockers you need to be

able to have the same sort of skills and

techniques and knowledge and experience

that those attackers have and where your

company may want you to learn to hack or

the company may want to bring in people

who are skilled at these sort of

activities so that they can attack the

attackers and hopefully you end up with

more Steely exterior and you get a

reputation for not being a company that

people wanted to go after those are

several reasons and there you go I gave

you around a bunch of reasons as to why

you may want to hack for fun to prove a

point protect yourself to protect the

company to not run out of business and

along with another bunch of reasons okay

so now that we have talked about why you

would want to hack let's move on to the

types of hackers that exist now we're

going to be talking about the different

types of hacking and the first step of

hacking that I want to discuss is

ethical hacking and ethical hackers

which is really what we're going to be

talking about for the rest of these

lessons now an ethical hacker is

somebody who thinks like a black hat

hacker or things like somebody who's

intent on breaking into your systems but

follows a moral compass that's more in

line with probably the majority of the

population so their intent isn't to do

bad things their intent is to look for

bad things and get them fixed so that

bad things don't happen ethical hackers

aren't out to destroy anything and

they're not out to break anything unless

it's deemed to be acceptable as a part

of the engagement and also necessary in

order to demonstrate a particular

ability to the organization that they

are working with so that's an ethical

hacker and there's a certification

that's available from the EC Council

it's a certified ethical hacker and you

know if you find certifications valuable

and this sort of thing is what you want

to do we're seeing a certified ethical

hacker maybe something you might want to

look into now let's talk about black hat

hacker there's plenty of cases of black

hat hackers through yours and let's talk

about a guy in particular called Kevin

mythnic this guy right here is a

particularly good example probably

because he was a black hat hacker for a

lot of his years his goal was to cause

mischief to steal where necessary and

just to be engaged in the lifestyle of

being a hacker and doing whatever was

necessary to continue doing whatever it

craw doing whatever he was doing it

crossed moral boundaries or ethical

boundaries and so Kevin whitnick here

was involved for well over a decade in

computer crime and was finally picked up

by the FBI and he was charged and

prosecuted and he was eventually

convicted of some of the activities that

he was involved with now you may be able

to argue that Kevin is a gray-haired

hacker and as well and a gray hat hacker

is somebody who kind of skirts the line

between black and white hat hacking and

white hat hacking is really what an

ethical hacker is so instead of saying

ethical Hackle he could say white hat

Hackle it's the same idea a white hot

hacker is somebody who acts for good if

you want to think of it like that if you

want to think of it as a good versus

evil and what they're really doing is

they're in it for the technical

challenge they're looking to make things

better make things more efficient

improve them in some way on the other

hand the black hat hacker is out for the

money for the thrill it's really a

criminal activity and the gray-hat

hacker is somebody who may employ the

tactics and technique of a black hat

hacker but have sort of a white heart

focus in other words they're going to do

things that may be malicious productive

in nature but the reason they're doing

it is to improve the security posture of

an organization that they are working

with so you can see there's actually a

book called gray hat hacking it's a

pretty good book and it details a lot of

the tactics and strategies and

techniques we'll be going over in

subsequent lessons in this video now one

other type of hacking that I want to

talk about is this thing called

hacktivism and you'll find hacktivism

all over the place and one example in

the last year or so and certainly in

recent memory is called Love's security

yeah you heard that right it's called

lull's security and you can argue that

lulls is actually a response to another

type of activism an organization called

Anonymous started hacking companies like

Sony to protest their involvement in a

lawsuit regarding a PlayStation 3 hacker

now lull security was supposedly testing

the treatment of anonymous or was

hacking in support of this group

Anonymous so they hacked a number of

companies and the things like pull

information Asian usernames and password

from the databases at these companies

and they said that the reason was to

shine a light when the security of these

companies and also theoretically to

embarrass the companies with their weak

or poor security postures and the

problem with that that they were doing

this through were posting information

that they had found online and that

information often included details about

customers for these particular

corporations and for an ethical hacker a

white hot hacker that would cross the

boundary of causing harm so there's no

reason for me as an ethical hacker to

post information in a public forum about

somebody because I could be doing damage

to them but in this case law security

and Anonymous specifically loud security

were engaged in the form of hacktivism

and what they were doing was not only

damaging to the cooperation that

certainly was detrimental to those

people so different types of hackers and

different types of hacking we've got

ethical or white attacking we've got

black hat gray hat and then we finally

got hacktivism it's really the goal and

the means that vary from one to the

other okay so now that we've discussed

the types of hackers let's also discuss

the skills necessary to become one so

what we're going to discuss in this part

are the different skills that are

required or will be learned as a part of

this video so initially just for basic

Computing you need a basic understanding

of operating systems and how to work

them there are going to be several

fundamental types of tasks that I won't

be going into any detail at all or and

you'll need to know how to run programs

and do things like open up a command

prompt without me walking you through

and how to do that so I am going to

assume that you have some basic

understanding of how to do these sorts

of tasks also you need an understandings

of the basic system software and you'll

need a basic understanding of how to use

command line utilities there are a

number of tools and programs that we're

going to be going through this video and

many of them use the command line now

whether it's on Windows or Linux still

need to be familiar with typing and

being able to run programs from the

command line and the various command

line switches and parameters us that

those programs or types of programs are

going to use now from a networking

perspective you need a basic

understanding of some simple networking

Concepts you need to know what cables

are and switches and hubs and how

systems are networked together you don't

really need a deep level of

understanding I'll be going through some

protocols as a reasonably deep level

because I think it's important as an

ethical hacker to understand what's

going on at the protocol level so that

you can know better what you are doing

and how to achieve the goals and tasks

that you have before you so we're going

to be going over some protocols so just

understanding what protocols are and how

they go together those sort of things

are necessary from a networking

perspective now we're going to also be

learning a bunch of life skills yes

there are some life skills that it's

important to have I think the most

important one is the ability to accept

failure and persevere and by that I mean

you're going to be just running across

several things that just don't work the

first time around and it's going to take

a little bit of time and stick to

itiveness to plug away and keep going

until you get something to work and the

way that you get things to work is

having an ability to problem solve and

sometimes solving problems requires

being a little creative sometimes you

need thing out of the box and come out a

problem from a different perspective in

order to find a solution throughout the

course of this video you're going to run

across a lot of sticky problems through

the course of learning about being an

ethical hacker and just doing the work

because it's not as simple so here's a

little recipe for how to do this now go

follow this recipe every time and you're

going to be successful every situation

is different every system is different

you're going to run across some pretty

sticky problems and you're going to have

to just wait and get your hands dirty

and keep failing and failing and failing

and failing until you find a way to

succeed so I think those skills are very

necessary to learn how to be an ethical

Hackle digging through some of the

material that we'll be going over in

this video as far as what you're going

to be learning you're going to be

learning about how to use a lot of tools

you're going to learn networking and by

that I mean we're going to be talking

about different protocols involved in

networking systems together you're going

to learn about security and security

postures security is the hard and soil

of ethical hacking it's why we do

ethical hacking in order to make systems

and networks more secure than they were

previously that's the goal from a

networking perspective we're going to be

talking about how to read packets from

Network captures we're going to be going

into tcpip related protocols in a fairly

significant amount of detail and you're

going to understand how protocols

interact with one another so we're going

to do all that and the reading packets

is going to be really important and

we're going to do a fair amount of that

in addition to just a fundamental

approach to learning how to read packets

in several lessons we're going to read

packets as a way of understanding the

different tools that we're using and how

they're going to learn tactics and

methodologies and you get to learn to

use the information you've got other in

order to get more information and

information is really what is this all

about you can't do much anything without

information and sometimes it takes a

fair bit of digging in order to find

that information and what you're going

to learn is the entry points and the

Stepping Stones to get the information

that you need and then once you have

that information you're going to be

learning about ways to exploit it in

order to get deeper into the target

you're going to learn security awareness

we're going to talk about risk and

understanding risks and vulnerabilities

primarily recognize the difference

between a vulnerability and an exploit

and there's a significant difference

there's so security awareness and

understanding what a risk is and how

that impacts your Target and it's going

to be key to a lot of things that we

talked about so it sounds like a lot

we're going to cover a fair bit of

ground not all of it at a deep level

sometimes we're going to skim the

surface but there's an awful lot of

material to be covered so let's get

started into talking about the different

skills that are required or will be

learned as a part of the series of video

so initially just for basic Computing

you need a basic understanding of

operating systems so it sounds like a

lot where that we're going to cover and

a fair bit of it is going to be at a

very deep level and sometimes we're just

going to skip the surface but this is an

awful lot of material to cover so let's

get started okay so that was all about

the skills that we are going to develop

throughout this video and that might be

necessary for you to become an ethical

Hackle now let's talk about the types of

attacks that you might be dealing with

as ethical hacker yourself so now we're

going to be talking about the types of

attacks now one type of attack that

you'll find common particularly in cases

of hacktivism for example or cases where

people are trying to make a particular

point or just be a general pin is this

idea of defacing now defacing goes back

for quite a while it's the idea of sort

of digital graffiti where you've left

your mark or your imprint behind so that

everybody knows you were there primarily

a website thing and it's really just

making alterations to something that

used to be pretty common a long time ago

now it's very particular for businesses

or people or just organizations in

general to have their home pages being

replaced by this other thing that was

along the lines of hey I was here and I

took over your web page we also have a

pretty common one which certainly has

been common over the years and it's a

pretty good part towards quality

exploits and high profile

vulnerabilities and that's buffer

overflow now a buffer overflow is a

result of the way programs are stored in

memory when programs are running they

make use of a chunk of memory called a

star and it's just like a stack of

plates when you put a bunch of plates

down when you pull a plate off you're

gonna pull the top plate you're not

gonna pull the oldest plate you're gonna

pull the one that was on top so the same

thing with the stack here we're

accessing memory and this has to do with

the way function functions are called in

memory when you call a function a chunk

of memory gets thrown on top of the

stack and that's the chunk of memory

that gets accessed and you've got a

piece of data in memory within that

stack and that's called a buffer and

when too much data is sent and try to

put into the buffer it can overflow now

the bounds of the configured area for

that particular buffer it can overflow

the bounds of the configured area for

that particular buffer now the way

Stacks are put together we end up with a

part of the stack where the return

address from the function is stored so

when you overflow the buffer you have

the ability to potentially override that

return at which point you can control

the flow of execution of programs and if

you can control the flow of execution of

the program you can insert code into

that memory that could be executed and

that's where we get buffer overflow that

turns into exploits that creates the

ability to get like a command shell or

some other useful thing from the system

where the buffer overflow is running so

that but a buffer overflow in short

sometimes we also have format string

attacks and sometimes these can be

precursors to buffer overflow formats

now format strings come about because

the C programming language makes use of

these format strings that determines how

data is going to be input or output so

you have a string of characters that

define whether the subsequent input or

output is going to be an integer or

whether it's going to be a character or

whether it's going to be a string or a

floating point that sort of thing so you

have a format string that defines the

input or the output now if a programmer

leaves off the format string and just

gets lazy and provides only the variable

that's going to be output for example

you have the ability to provide that

format string if you provide that format

string what then happens is the program

starts picking the next piece of data

off the stack and displays them because

that way we can start looking at data

that's on the stack of the running

program just by providing a format

string and if I can look at the data I

may be able to find information like a

return address or some other use of

piece of information there is also a

possibility of being able to inject data

into the stack I may be able to find

some information like a return address

or some other useful piece of

information there is also a possibility

of being able to uncheck data into the

stack I may be able to find some

information like a return address or

some other useful piece of information

there is also a possibility of being

able to inject data into the stack using

this particular type of attack now

moving on to our next type of attack is

a denial of service a denial of service

this is a pretty common one and you'll

hear about this a lot this is not to be

confused though with the one that I'll

be talking about after this and that is

a distributed line of service so this

one that you see is that this is a

denial of service staff and a denial of

service is any attack or action that

prevents a service from being available

to its legitimate or authorized users so

you hear about a ping flood or a sin

flood that is basically a sin packet

being sent or machine constantly or a

Smurf attack and Smurf attack has to do

something with icmp Echo requests and

responses using in broadcast addresses

that one's been pretty well shut down

over the last several years you can also

get a denial of service simply from a

malformed packet or a piece of data

where a piece of data is malformed and

sent into a program now if the program

doesn't handle it correctly if it

crashes suddenly you're not able to use

that program anymore so therefore you

are denied the service of the program

and thus the denial of service now as I

said a denial of service is not to be

confused with a distributed denial of

service and I know it's pretty trendy

particularly in the media to call it any

denial of service a DDOS or any denial

of service a DDOS now it's important to

know that any denial service is not a

DDOS a DDOS or as you might know a

distributed denial of service is a very

specific thing a distributed denial of

service is a coordinated denial of

service making use of several hosts in

several locations so if you think about

a botnet as an example a botnet could be

used to trigger a distributed denial

service where I've got a lot of bots

that I'm controlling from a remote

location and I'm using all these boards

to do something like sending a lot of

data to a particular server when I've

got a lot of system sending even small

amounts of data all of that data can

overwhelm the server that I'm sending it

to so the idea behind a distributed

denial a service stack is to overwhelm

resources on a particular server in

order to cause that server not to be

able to respond now the first known DDOS

attack used the tool called stockhold

rot which is German for barbed wire now

stockhold Rod came out of some work that

a guy by the name of Mixter was doing in

1999 he wrote a proof of concept piece

of code called tfn which was the tribe

flood Network let me just show that for

you

so you can see on the Wikipedia page

that the triplet Network or tfn is a set

of computer programs that is used to

conduct various DDOS attacks such as

icmp floods in floods UDP floods and

smart attacks now I know many people

don't really consider Wikipedia a really

good source of any sort of knowledge but

it's a good place to start off so if you

want to read about all these types of

attacks like icmb floods and what

exactly is a syn flood you can always do

that from Wikipedia it's not that bad

place of course you shouldn't use

Wikipedia as your final Rosetta Stone

moving on so this program called Old Rod

which was it was used to attack servers

like eBay and Yahoo back in February of

2000 so that attack in February of 2000

was really the first known distributed

denial of service attack which is not to

say that there were in denial of service

tax previously So to that there were

certainly plenty of them but they were

not distributed now this means there

weren't a lot of systems used to

coordinate and create a denial of

service condition and therefore we get

the distributed denial of service stack

so that's a handful of type of attacks

and some pretty common attacks that

you're going to see as an ethical Hackle

when you become an ethical hacker or if

you're trying to become an ethical

hacker you should always know about

these types of attacks okay so in this

lesson we're going to be talking about

penetration testing and some of the

details around how it works and

Logistics and specifically things like

scope so what exactly is penetration

testing so well not surprisingly it's

testing to see if you can penetrate

something which means you're going to

check to see whether you can break into

a particular thing whether it's a server

or in applications depending on the type

of Engagement you've got you may have

the ability to try to break in

physically to a location but primarily

what you're going to be doing with

penetration testing is you're going to

be trying to break into systems and

networks and applications and that's the

kind of what it's all about and this may

actually involve social engineering

attacks so it may require you to make a

phone call to somebody and get them to

give you their username and password or

some other type of social engineering

attack where maybe you send a URL via a

crafted email sometimes it's just

strictly a technical approach where

you're running scans and you're running

Metasploit and you're gaining access

that way or maybe some other type of

technical application sort of connection

sometimes it's physical access that you

need so in order to get access to a

particular system if you can get

physical access then maybe you can get

in so that was all about that's what

exactly penetration testing is it's

checking whether you can get into a

system whether it be physically or on a

network so what are the goals of

penetration testing the goals would be

to assess weakness in an organization

security postures we want to figure out

what they're vulnerable so that they can

go and fix these problems you want to

help them understand their risks

positions better and what they can or

may be able to do to mitigate those

risks and ultimately you want to be able

to access systems in a particular way to

find weaknesses so those are really sort

of the goals of penetration testing now

from a result standpoint when you're

done you're testing what you are going

to do well you're probably going to

generate a report and by that I don't

mean you're going to run some automated

tool and you're going to get it to

generate a report for you you're

actually going to give that to the

client you're actually going to give

your report to the client and then

they're going to write you a really

large check so that's not really how it

works you're going to write a report

detailing the findings in a detailed way

so that it includes what did you do to

find out what you actually found out and

how you can actually mitigate that

particular risk so you should really

include remediation activities in order

to fix this vulnerabilities that you

find and it's pretty easy to walk around

saying hey that's a problem and that's

problem and that's a problem that's

really not a lot of value in that where

there's a value is that hey that's a

problem and here's how you can go about

fixing it so let's talk about the scope

of penetration testing so firstly you

want to actually realize how big is the

bread box and how specifically what is

it that the U2 of the two of you have

agreed that being you the ethical hacker

and the other guy being the authorized

person to give you permissions to

ethically hack have specifically agreed

that you can do penetration testing and

you can Target them as an organization

or the client and what you have agreed

to are any exclusions or any sort of

areas that they say you're not allowed

to touch so anything so like if they've

got a database server maybe or there's a

lot of really sensitive data on it and

there's a little hesitant and they may

put don't touch this thing clause in the

scope so there are a lot of different

reasons why they may exclude areas from

the scope and if they exclude them then

trust their reason and listen to them

what they have to say in terms of this

is what we want you to accomplish so

along those lines you really need to get

a sign off from the target organization

now we've talked about this before and

this is certainly all about the ethics

and trust and it's also about legality

because if you do something that you

don't have permissions to do you could

be prosecuted for that so definitely get

the scope very clear in writing and with

signatures attached to it as to what you

can and what you can't do and always get

approval from the right people and make

sure you get somebody who has the right

level of permissions and is the right

level of management so that they can

sign off on its understanding and accept

the risk that is associated with the

penetration test so let me talk a little

bit about security assessments and how

they differ from penetration tests so

security assessment is a hand in hand

approach with clients so you would walk

in doing a collaborative thing where

your a trusted partner and you are alive

at them and your goal isn't to penetrate

them and point out all the things that

are really bad but it's to get a full

assessment of the risk that the

organization is exposed to and you would

probably provide more details about

fixes that maybe you would in a

penetration test now what we're going to

do is we're going to walk in and make

sure that the policies and procedures

they have in place are really what they

need for the organization and the risk

appetite that they've got and we're

going to make sure that the policies and

procedures have controls that can tell

us whether they are being actually

adhered to or not so the procedures and

policies are being followed a security

assessment is probably a little bit more

comprehensive than a penetration test

and you would look at more factors to

assess the security postures of the

organization in their overall risk and

you would tailor the output based on the

risk appetite and what they're most

interested in and that's not to say that

I'm going to tell them what they want to

hear but if there's something that they

know and I know that they're just not

going to do I'm not going to be making a

big deal out of it because they're

already aware of it and I'll make a note

of it in the report just for a complete

mistake but I'm not going to go out in a

lot of details so it's really kind of a

hand-in-hand collaborative approach

where again you're not just saying that

they want us to say we're providing some

real security and risk guidance towards

their activities and other things so it

may provide an unrealistic view so

you've got a week let's say to do this

penetration test against your target now

you're going to have to go in you're

going to have to get set up you're also

going to have to start doing a bunch of

scans and make sure that you're

Gathering informations and screenshots

and data for your reports you're gonna

have to do all sorts of activities also

during the course of that week you're

going to be engaged in probably

beginning to write your report and

getting a sense of what is going to say

and what's going to be in it if you

don't actually get any major penetration

during the course of that week the

organization may feel like their

quote-unquote secure that's one of the

reasons why penetration testing well

really sexy and chill is nice and all

but if an organization walks out of it

believing that in a week you didn't

manage to get to know get the keys of

the king Kingdom then they might must be

secure that's really misguided view

because undedicated skill and motivated

attacker isn't going to just take a week

or some portion of that week they're

after something they're gonna dedicate

themselves to do it and really go after

it so just because you didn't find a

penetration in some subset of a week

doesn't mean that they're secure and and

invulnerable to attacks it just means

that during the course of that

particular week and other circumstances

that were in place you didn't get a

penetration that was really significant

or major that's all it means it doesn't

mean anything beyond that and if an

organization walks away feeling like

they're secure they're going to end up

not fixing the real vulnerabilities that

may be in place that could expose them

to significant risks so that's

penetration testing it Scopes its goals

and how it differs to security

assessments now it's time to go over

footprinting so what is footprinting

well footprinting is getting an idea of

the entire scope of your target that

means not just scope that he were given

which may be an address block or it may

be a domain name that even maybe a set

of address blocks now what you want to

do is you want to figure out all the

information that's associated with that

in great detail as you can possibly get

so you want the list of domain names as

you're going to go through this you

probably want some sort of database or

Excel spreadsheet or something to keep

track of all the information because

you're going to have a lot of it at the

end you want to be able to find the

information quickly so having some sort

of either notepad going with your notes

or as I said a spreadsheet or a database

so if you can get organized in that way

you want to keep all those sorts of

things down so in this case I want to do

some sort of search on suppose let's say

eddyreka.com now I need Network blocks

so so far we found out that just made up

IP addresses because I'm just putting

information down but I need Netflix

blocks so you may have one IP address

that you can find externally or or

you're going to want to hold range of

internal blocks and you can do a little

bit of digging if you aren't provided

those you want specific IP addresses for

critical systems web servers email

servers databases if you can find any of

these things of those sorts and you want

system architectures and what kind of

stuff are they running are they running

Intel are they running windows are they

running some Unix systems what are they

running what kind of Access Control

lists they have these are going to be

hard to get but you may be able to guess

them and you can guess these by doing

Port scans so what sort of responses you

get back from the port scans with the

filters and or what you don't get back

we'll tell you about if there's an IDs

around or some you want to do a system

enumeration or you can get access to a

system somehow you want to know

usernames group names so on so the basic

idea of footprinting is gathering

information now if you can get access to

system somehow you want to know

usernames group names so you want system

banners routine tables SM an MP

information if you can get it DNS host

names if you can get those now this is

for both internal and external on the

side if you're doing an internal

penetration test or ethical hacking

engagement you want to know the

networking protocols that are there are

they using TCP or are they using some

UDP or are they on ipx or SPX are they

using decnet or apple talk or are they

using some sort of split DNS in other

words do they have internal DNS servers

that give different form for the

external and will give different

information if you want to check for

remote access possibilities now in the

footprinting process you want to be very

exhaustive you might want to try and

take out email addresses servers domain

name Services I mean IP addresses or

even contact numbers and you want to be

very exhaustive with your approach you

don't want to miss anything out because

if you do that you can continue and also

provide some some launching points for

additional attacks or tests that you may

be able to do but this is definitely a

starting point of the time types of

information that you need to have as you

go about footprinting your target now

next thing that we are going to see is

very interesting this is one of the many

common tools that are out there on the

internet and that is the Wayback machine

or also known as archive.org now while

it might not give you all the

information that you need but it

certainly gives you a starting point and

what we're talking about out here is the

Wayback machine or archive.org so let me

just give you a quick look at what

archive.org looks like okay I already

have it open out here so out here what

you can see is how a website look like

around some time ago so for example if

you want to look at what Google look

like so you just have to search for

Google out here

and wait for results to come back okay

so we see that Google goes way back to

1998 so that was the last capture or the

first capture rather it was the first

capture by the Wayback machine and we

can see that it has a screenshot of

November 11th and how Google looked so

let's see what Google looked like in

November 11th of 1998. so this is what

Google looked like it was there was

actually nothing to it it just said

welcome to Google Google search engine

prototypes and it has some link so yeah

this is what the Google search engine

looked like it had a Stanford search it

had a Linux search and you could do all

sorts of stuff you could just put the

results now what I'm trying to tell you

all is you can see the evolution of a

website through time through the Wayback

machine and this gives you rather in a

informative look into how website has

actually evolved okay now that we know

what footprinting is and how it falls

into the whole recognition process so

let's go over a couple of websites to do

a little bit of historical thinking

about companies and the types of

infrastructure that they may be using

and this information of course is useful

so that we can narrow down our focus in

terms of what we want to Target against

them for attacks now over time we've

improved our awareness about what sorts

of information we may want to divulge so

several years ago you may have gone to a

company's website and discovered that

you could get email addresses and names

of people in positions that you may find

relevant and there were all sorts of

bits of information that could be used

against the company and over time we

have discovered that those sorts of

pieces of information probably don't

belong on a website where they can be

used against a company and so they've

been pulled off now it used to be also

that Google had the ability to pull up

information that it had cached so far

for example if a website is no longer

available or if it was temporarily down

and offline there was a little cash

button that you could click when you did

and the Google search and you could pull

up that cached information so even

though the website wasn't available you

could still get information from

Google's servers now Google's removed

that so we don't have that ability any

longer however there is an internet

archive that we can use so this thing is

called the Wayback machine and I have it

open out here so it's archive.org web so

archive.org is a website that gives us

information about other websites and how

they looked like in years ago and by so

I'm gonna go to the Wayback machine

which you can see is at the archive.org

and I'm gonna go and try and search for

edureka.com so now we're going to take a

historical look at eddyreka.com's

website and you can see we've got some

years and they've got information going

back up to 2013. so let's look at what

this website looked like when it was

just 2013. okay there don't seem to be

any snapshots out here I wonder what's

going on okay so let's go to 2014 and

the first snapshot seems to be on the

September 12th of 2014. actually it's on

May 17 too so let's see what that looked

like

okay so this is what Eddie reggae looked

like back in 2013 or around the 2014

September 12 2014 to be actually exact

now you can see that we have some live

classes and all this pictures there and

they've got this weird picture of this

guy out here I don't know why that was a

thing back in 2014. now we can browse

more advanced screenshots or rather the

screenshots I've taken later on and see

how this company has evolved with this

infrastructure and the way it actually

lays out its content okay so it still

has the fall but I can go a couple of

years ahead and see what this has

actually evolved into so if I were to go

to December 2016

so this is what it looked like to 2016

and we can see that they've added this

weird box out here about Verizon courses

they have added a search bar that kind

of looks weird but it's mostly because

my Internet is slow and it's not loading

all the elements they've also changed

how they've actually laid out the

courses we can also see a change in the

prices I guess so yeah this tells us

about how it evolves as a complete

website now this other website that I

want to talk about is called Netcraft

now Netcraft does internet research

including the types of web servers that

companies run and they have a web server

service you can see here as we scroll

the Apache reverse service has 64.3

percent of the internet Market of course

and that's followed by Microsoft with 13

interesting information may be useful

information but even more useful than

that is looking at what different

companies run for their websites and you

can see here okay so let's try and

search for edireca.go out here so let's

just put it in the website URL and that

Netcraft generate the site report so as

you can see that some of the stuff is

not available we know that the net block

owner is by Amazon Technologies name

server is this thing right here the DNS

admin is AWS DNS host Master we also

have the IP address we can go for a wire

look up the IP on virus total you can do

that there is no IPv6 presence so that's

some information that we can see so we

can obviously opt out to not Target IPv6

ranges then there's also reverse DNS

then we also have a bunch of Hosting

history so this is a history of it and

we know that it's hosted on a Linux

system with an Apache web server and it

was last seen and this was when it was

last updated so this is some very useful

information you can also get information

on stuff like Netflix so if you just

type okay I just spelled that wrong so

let me just change it from the URL out

here so if you go and type for

netflix.com

and you see that it'll show you all

sorts of information so as you see that

it's on an AWS server it's an Amazon

data services Ireland and this is all

the hosting history that it goes along

with it has some standard policy

Frameworks domain-based message

authentication and Reporting

confirmations and there's all sorts of

information that you can get about

websites and their web servers from

Netcraft so the Wayback machine along

with Netcraft may come for some

interesting tools that is available on

the internet from which you can do a

little bit of your reconnaissance

process okay now that we have gone over

Netcraft and the Wayback machine now

it's time to actually get to know how to

use the little information that the site

actually provides so what the next topic

that we're going to go over is using DNS

to get more information now we're going

to be going over a tool and this is

called who is and it is a utility that

is used to query the various Regional

internet registries to store information

about domain names and IP addresses and

let me just show it to you about all the

internet registries that are there so I

have aaron.net open out here and these

are the internet registries that

provides the isps and looks over the

Internet control as a whole so out here

we have afrenic we have apnic we have

Aaron we have laknik and we have ripe

NCC so these are all the regions and all

the different types of stuff that they

support all different countries you can

look at the map that it is supporting

out here by just hovering over the

providers so as you can see all these

Brown region out here is Africa after

Nick then we have apnic which is this

black or grayish thing which is India

and Australia and quite a lot of Asia

then we have Aaron which is a lot of

North America in the United States

mostly Dennis lachnik which is mostly

the Latino site which is the South

American part then we have the rest of

Europe which is ripe NCC and this is the

part that ripen cc is providing internet

to okay so that was all about the

internet registries now let's get back

to the topic and that is using DNS to

get more information now for this we are

going to be using a Linux based system

so I have Ubuntu running on my virtual

machine out here and let me just log

into it so firstly we are going to be

using this query called who is that

looks up these internet registries that

I just showed you let me just quickly

remove this okay

so for acquiring information from the

regional internet registries that I just

talked about you can use two ways to get

information about who owns a particular

IP address so for example I could do who

is and let's see I could do who is

Google or rather

netflix.com and we can get all sorts of

information about Netflix so we can see

that we have the visit Mark monitor then

let's see let's go up and look for all

sorts of information that is being given

to us by this who is query so as you

guys can see I just spent a little bit

too much okay so registry domain 90 we

have the domain ID where it is

registered there's a registered URL is

Mark monitor okay so this is for marking

actually now the creation date is 1997.

so if you haven't realized Netflix been

around for a long time and it's been

updated on 2015 and the registry expiry

date as we see is 2019 so it's going to

actually go off this year then this is

all useful information so we can see all

sorts of domain status the name server

the URL the DNS SEC that it says

unsigned this is very useful information

that is being provided by very simple

query now if you want to know who owns a

particular IP address so let's see did

we get back the IP address out there we

should have got back the IP address but

it's kind of lost on me so to get back

the IP address also for a domain name

server so you know so you could use this

command called dick so your dig

netflix.com

now as you guys can see that it has

returned a bunch of multiple IP

addresses that these are all the IP

addresses that Netflix is so I could do

something like if I was trying to check

out who owned a certain IP address and

for example I have got one of these IP

addresses but let's just assume I don't

know that actually belongs to Netflix so

I can go who was

54.77.108.2 and it'll give me some

information so as you guys can see it is

giving us a bunch of information as to

who this is and how it is happening so

we see that it is from aaron.net and so

we can very smartly assume that it's

from the North American part no we can

also see that it's in Seattle so our

guess was completely right

so it also gives us a range so this is

something very useful so if you see we

now have the range of the IPS that might

be being used by this guy so we indeed

have a 54 and it says it goes up to the

54. there's also 34. now let's check

that out and see what information we get

so who is and let's check it out what

was the IP that we were just seeing is

34.249.125.167. so

34.249.

165. I don't know let's see you can also

put in a random IP address it doesn't

really matter and it'll give you the

information so let's see is this in some

IP address even this seems to be an RN

IP address and it's also based in

Seattle and we get a bunch of

information so that's how you can use

the who is query and the bigquery to

actually get all sorts of information

about the domain name service and get

information from a DNS basically so now

let's go over some theoretical part that

is for DNS so using DNS to get

information so firstly what is a domain

name service and why do we need it so a

domain name service is a name given to

an IP address so that it's easy to

remember of course you it's easy to

remember names and mnemonics rather than

a bunch of random weird numbers now this

was mainly so that we can map names to

IP addresses and we can get the a bunch

of information from the hostname

resolution so that's the purpose of IP

addresses now we will also be looking at

how to find network ranges okay now

before we get on to actually moving on

to how to find out the network ranges

let me just show you how you can also

use who is so who is suppose you want to

know the domains with the word Foo in it

so you could go who is Foo and this will

give you a whole bunch of things about

how Foo exists and all the sorts of

foods that there is on the end internet

so that was one interesting flag and if

you want to know how to use more about

who is you could just go dash dash hell

I guess yeah so this is all the types of

stuff that we can do with who is so you

can set the host we can set the port

that we want to search for then we can

set with the elf live you can find one

level that specific match and we can do

an exact match do an inverse lookup for

specified attributes then we can also

set the source we can set verbose type

and we can choose for a request template

there's a bunch of stuff they can do so

you could suppose say who is verbos and

suppose eddyreka dot code and it'll give

you a verbose version of this is a ripe

database query service objects are an

rpsl format the arrive databases

objectives so okay let's try something

else like who is netflix.com

okay I'm sorry I was supposed to do

verbose and I kept doing etch it's silly

me so you do V and it'll give you a much

more like this is a ripe database again

I think I'm doing something wrong okay

just for that thing okay V and tight

okay or let's just see that's let me

just show you how to use a primary keys

are return only primary Keys okay let's

see let's try that out okay so it seems

to be that this is a ripe database query

service and objects are an rpsl format

so it won't really work for that thing

and it also says that no entries found

because it's this error so this is for

some layer lesson so for now I hope I

gave you a good idea of how to use Hue

is like you could just go who is then

some IP address like

192.168.101 or some gateway address like

that or you could just go for a domain

name service like Facebook and get all

sorts of information about Facebook when

the query actually returns you something

okay so let's move on to network ranges

now now in this part of the video we're

going to be going over the utility call

who is which is used for getting

information from the DNS now let me just

show you a website out here so this is

the original internet registries so the

internet registries are used to store

information about domain names and IP

addresses and there are five Regional

internet registries first is iron which

is responsible for North America America

so that would be the US and Canada then

we have lachnik which is responsible for

Latin America and portions of the

Caribbean then there's ripe that's

responsible for Europe and Middle East

and Central Asia there's afternik which

is responsible for Africa and finally we

have apnic which is responsible for Asia

Pacific Rim so that's the regional

internet registries and as I said who is

is responsible for acquiring information

from the various Regional internet

registries as you can use who is to get

information about who owns a particular

IP address for example let me just open

up my Ubuntu system let me clear this

out first so as I was just saying for

example you could go who is facebook.com

okay so as you guys can see we could

find out pretty quickly about who owns a

particular IP address so for example I

could do who is and just go facebook.com

and tell me about who it belongs to it

also gives you who owns a particular IP

address and who's responsible for them

from the information you can get email

addresses that belong to a particular

company this one has an email address

for techcontact of ipreg adrate so you

can get all sorts of email addresses

Tech contacts and all sorts of stuff out

there the registry database contains

only.com and Dot net and all sorts of

information now I want to query a

different IP address and different

information belongs in the different

Regional internet registries of course

so if I want to go to a protocol

database I would have to use the minus H

flag so I could do who is Aaron net and

remember the IP address and I'm going to

query that again and of course I get the

same information back because I went

there so you could just go who is Edge

and then follow it with an IP address so

it's only like 34.205.

176.98 so that's just a random IP

address I just made up and it says that

who is option okay so it's a it's a

capital H okay so let's see that

and we get all sorts of information back

from that so area 8 iron and all sorts

of stuff now I can get information about

domains as well so if I can query

something like netflix.com and I can

find out that this is that actually

Netflix and there's an administrative

contact and the technical content and

you can see the different domain servers

the servers that would have authority of

information about the DNA sentries for

that particular domain you can also see

other information like when the record

was created and a whole bunch of

different phone numbers that you can

contact and additional restoring

information about IP addresses and

domain name sometimes it will store

information about particular host names

and there may be other reasons why you

would store a hostname or particular

information about hostname on the system

whether one of the rirs now if I want to

wanted to look up something specifically

once I had found that I could now do a

lookup on who is suppose let's say

something like who is Foo so let's say

who is Foo now if you already don't have

who is installed you can easily install

it by just going apt install who is on

your Unix system and that should do the

trick and then you can start use this

really Nifty tool okay so that was all

about using who is now let's get on to

actually using how to find out Network

ranges for a domain okay so now let's

talk about how we're going to be going

over and fighting Network ranges so

suppose you've got the engagement and

you only know the domain name and you

don't know much beyond that and you're

expected to figure out where everything

is and what everything is so how do you

go about doing that well you use some of

the tools that we either have been

talking about or will soon be talking

about in more detail and the first thing

I'm going to do is I'm going to use the

domain name eddyreka.com and I'm going

to look up edureka.com and see if I get

an IP address back so let's just head

over there and go Whois

edireca.co or we could use the host

keyword

so as you see we get an IP address back

and that is

34.210.230.35 and that is the IP address

and you see that I've got back an IP

address so here's just an IP address and

I don't know what that IP just belongs

to and I also don't know how big the

network range or network block is and

that's associated with so what I'm going

to do is uh who is and I'm going to look

up with Aaron who owns that IP address

so you can basically go who is

34.210.230 not 35. so as you guys can

see that gives us a bunch of information

and who is now this doesn't seem to have

a very big Network range but unlike

something like Netflix so suppose we

were to do some like host netflix.com

and see now we have a bunch of IP

addresses so suppose we will do who is

let's see who is

52.19.40 the 147. now I'm expecting

Netflix to be a much larger company and

have a better yeah now see we get net

range so this is the network range that

we're talking about so we had a random

IP address and now we have found the

network range so that's how you find

network ranges and this can be very

useful so this gives me evidence that

netflix.com has a presence on different

addresses the one I have also located by

looking up that particular hostname so

I've got one address here that I can

look and let's take a look at the

website because there may be different

address now if I didn't have that I

could also go and do something like an

MX flag so let's see I could go dig and

this will give us all the mails so dig

MX

and let's see let's see what MX does

actually you go help so we could do dig

hyphen Edge for a list of options so

these are all the options that we have

and the one that we're gonna use is

something like this a dig MX and we say

it's online

netflix.com so these are all the

mailings and mxs that we have gotten

from Netflix and this is information

regarding it's still producing

information that's a big thing to

produce okay so as I was just saying you

can use the MX flag and I could get back

all the mail handlers in this case and

their mail is being handled by Google

and let's see wait let's go on top then

it's going to tell me that Google's not

particularly surprising and other things

I can do is check for different host

names since I'm assuming DNS probably

doesn't allow Zone answers since most

DNS servers don't anymore although they

used to you may have to start guessing

so I could do something like webmails

that we find out here

so this shows us a dump of all the

outstanding memory stuff okay so that

was all about finding Network ranges now

moving on to our next topic is using

Google for recognizance now some people

also call this Google hacking now if you

know how to use Google to exactly Target

and find what you are looking for Google

is an excellent tool for recognition

purposes and today I'm going to show you

how you could use Google exactly for

your searches so first of all let's open

a tab of Google

um let's open up here so let's go to

google.com Okay so now we're going to be

talking about how we can use Google to

actually gain some information or some

targeted information so this is in

general called Google hacking now when I

say Google hacking I'm not meaning by

breaking into Google to steal

information I'm talking about making use

of specific keywords that Google uses to

get the most out of the queries that you

submit so for example a pretty basic one

is the use of quotations you code things

in order to use specific phrases is

otherwise Google will find pages that

have instances of all those words rather

than the word specifically together in

particular order so I'm going to pull

this query up and this shows a list of

let me just show it to you so if you go

index off

now this is showing us an index of all

the films now this is basically all

those index of sites that you want

so as you guys can see the show this

index of all sorts of films that are

there now you can use index of and you

see that we have also an index of

downloads or something like that hype

from.com slash download and it is an

index of all sorts of stuff now you can

go into some folder and check them out G

Jones giversity giberical I don't know

what these are but some sort of stuff

and this is how you can use Google Now

let me just show you some more tricks so

you can use this so suppose you're using

Google to find for something like a

presentation so you could use something

like file type dbdx and it'll search for

every type of file there that is pbd

okay let's try some other side dot PVD

so config okay so this brings up all the

types of files that have some configs in

them so this is some gaming

configuration as we see there's some

digital configuration of Liverpool now

you could also use something like this

thing in url and you can use another

root

and this will give you all the things

which root in their URL so

kingroot.n Digital Trends and how to

root Android so that's in the root and

suppose you want to say something like

all in file type or suppose you want

some extension so so dot PBT dot pptx

does that work um let's search for

JavaScript files okay I think it's JS

okay that doesn't seem to work either

this shows us all the things with JS in

it no it's just external JS I'm doing

this wrong

so you could use file type so let's see

file type and we go

see duck

so these are all the documents that you

could find with the file type thing and

you could also do GES I guess Yep this

will give you all the JavaScript files

that are there so this is how you can

use Google to actually narrow down your

searches so suppose you want a

particular set of keyword and we want to

make sure we get the passwords file from

Google okay so now let's go into more

details about the various things you can

find using Google hacking techniques now

while Google hacking techniques are

really useful for just general searching

in Google they're also useful for

penetration testers or ethical hackers

you can narrow down information that you

get from Google you get a specific list

of systems that may be vulnerable so we

can do things like look for error pages

that do in the title error so I'm going

to get a whole bunch of information so

suppose like we go in title and we say

error

so as that we get all sorts of stuff and

we can do the mines Google part so if

you do a minus Google will not show you

the stuff that's from Google

so we get a various documentation pages

about different vendors and the errors

that they support so here's one talk

about Oracle about Java error where you

know something more specific we may be

able to get errors about all sorts of

other stuff so this is how you could use

the Google hacking technique to your own

advantage of your penetration tester now

let's also show you something called the

Google hacking database now this is very

useful for an ethical hacker now the

Google hacking database was created

several years ago by a guy called Johnny

Long who put this Google hacking

database together to begin to compile a

list of searches that would bring up

interesting information now Johnny has

written a couple of books on Google

hacking so we're at the Google hacking

database website here and you can see

them talk about Google Docs and all

sorts of stuff now you can see that we

can do all sorts of searches like in

URLs BC bsp this brings up some portal

Pages now out here you can bring up some

password APS password in url now this

will give you also are some stuff on

Google so suppose you go in url it's

like

ABS password now you can get all sorts

of stuff like which have passwords in

their URL so maybe you can just guess a

password from there too now that was

Google hacking so Google hacking entries

and they also have a number of

categories and that you can look through

to find some specific things so you may

be interested in of course and you can

search specific information that you may

be looking for with regards to specific

product for example let me just show you

exploit database these are all the

certain types of stuff you can go

through out here and and as you see we

have all sorts of stuff like this is an

SQL injection thing this is something

regarding pure archive Towers so these

let you get a foothold into some

password tracking attempts and you can

do some Brute Force checking and you can

see here if it talks about the type of

search it is and what it reveals you can

just click here on Google Search and

we'll actually bring up Google for the

list of responses that Google generates

so let's look at this one here this type

is a log so this is something about

cross-size drifting logs and we can also

see some party logs if I was not wrong

so there's some denial of service POC

and we can see a bunch of stuff and if

you continue to scroll down there are a

lot of interesting information in here

so somehow somebody's got a party log

that has a lot of information they've

got it up on a website and it's

basically a bunch of information that

you can see you can also get some

surveillance video sometimes and you can

look into them and this is basically how

you could use Google so it's basically a

list of queries that you can go through

and this is a very useful site if you're

a penetration tester and looking for

some help with your Google hacking

terminologies so that's it for Google

hacking now let's move on okay so now

it's time for some networking

fundamentals and what better place to

begin with tcbip now we're going to be

talking about the history of TCP and the

network that eventually morphed into the

thing that we now call the internet so

this thing began in 1969 and it spun out

of this government organization called

arpa which Advanced research projects

agency and they had an idea to create a

computer network that was resilient to a

certain type of military attacks and the

idea was to have this network that could

survive certain types of war and

war-like conditions so arpa sent out

this request for proposals to BBN which

is Bolt bearnick and Newman and they

were previously an acoustical consulting

company and they won the contract to

build what was called the arpanet the

first connection was in 1969 so that's

where we get the idea that the internet

began in 1969 and the internet as we

call it now didn't really begin but

arpanet did and arpanet has a long

history that goes through NSF net in

1980s and after arpanet was sort of

decommissioned and a lot of other

networks were folded into this this

thing called NSF net that then turned

into what we now call the internet and

once a lot of other networks were

connected into its first protocol on the

arpanet initially there were 18 to 22

protocols which is very first protocol

defining communication on arfanet and it

was called 1822 protocol because BBN

report 1822 which describes how it

worked shortly and after that there was

this thing called the network control

program and the network control program

consisted of arpanet's host to host

protocol and an initial control protocol

now they're certainly not a direct

correlation or an analogy here but if

you want to think about it in particular

where you could say that the art net

host to host protocol is kind of like

UDP and the initial connection protocol

or ICP it's kind of like TCP so the host

to host protocol provided a

uni-directional flow control steam

stream between host which sounded a

little bit like UDP and ICP provided a

bi-directional pair of streams between

Two Hosts and again these aren't perfect

analogies but the host to host protocol

is a little bit like UDP and ICP is a

little bit like TCP now now the first

router was called an interface message

processor and that was developed by BBN

it was actually a rocketized Honeywell

computer that had special interfaces and

software so the first router wasn't

Roundup built piece of Hardware but it

was actually an existing piece of

Hardware that was specially purposed for

this particular application so Honeywell

had this computer that they made out and

BBN took that and made some specific

Hardware in faces and wrote some special

software that allowed it to turn into

this interface message processor which

passed messages over arpanet from one

location into another so where did IP

come in here in 1973 so IP came in here

as well in 1973 as I just said and a guy

by the name of Vint Surf and another guy

by the name of Robert Khan took the

ideas of NCP and what the arpanet was

doing and they tried to come up with

some Concepts that would work for the

needs that the arpanet had and so by

1974 they had published a paper that was

published by the IEEE and they proposed

some new protocols they originally

proposed a central protocol called TCP

later on TCP was broken into TCP and IP

to get away from the monolithic concept

that TCP was originally so they broke it

into more modular protocols and thus you

get TCP and IP so how do we get to our

version 4 which is ipv4 since that's the

kind of Internet that we're using right

now version 6 is coming and has been

coming for many many years now but we're

still kind of version four so how did we

get here between 1977 and 79 and we went

through version 0 to 3 By 1979 and 90

1980 we started using version 4 and

that's eventually became the de facto

protocol on the internet in 1983 when

NCP was finally shut down because of all

the hosts on the arpanet were using TCP

by that point in 1992 a work began on an

IP Next Generation and for a long time

all of the specifications in the rfcs

talked about PNG eventually and ipng

became known as IPv6 you may be

wondering where ipv5 went well it was

especially purposed protocol that had to

do something with streaming and

certainly not a widespread thing one of

the differences between ipv4 and IPv6 is

that IPv6 has a 128-bit address which

gives us the ability to have some

ridiculously large numbers of devices

that have their own unique IP address

ipv4 by comparison has only 32-bit

addresses and as you've probably heard

we're well on our way to exhausting the

number of IP addresses that are

available and we've done a lot of things

over the years to conserve address space

and use address space so we can continue

to extending to the point till where we

completely run of ipv for addresses

another thing about IPv6 is it attempts

to fix some of the inherent issues in IP

and some of those has to do with

security concerns and there are

certainly a number of flaws and ipv4 and

when they start working on IP Next

Generation or IPv6 they try to address

some of those concerns in some of those

issues and they may not have done it

perfectly but it was certainly an

attempt and IPv6 attempted to fix some

of the issues that were inherently in IP

and so that's the history of tcpip till

where we reached today okay so now that

we've discussed a brief history on TCP

and how it came about to the TCP version

4. let's discuss the model itself now

we're going to be discussing two models

and those are the OSI model and the TCP

IP model now as I said we'll be talking

about the OSI and TCP models for Network

protocols and the network Stacks OSI

first of all is the one that you see out

here it's the one on the left hand side

of the screen and OSI stands for open

systems interconnect and in the late

1970s they started working on a model

for how a network stack and network

protocols would look originally the

intent was to develop the model and then

develop the protocols that went with it

but what ended up happening was after

they developed the models tcpip started

really taking off and the TCP IP model

was what went along with it and much

better what was going on with TCP IP

which became the predominant protocol

and as a result The OSI protocols never

actually got developed however we still

use the OSI model for teaching tool as

well as a way of describing what's going

on within the network stack and the

networked applications you'll often hear

people talking about different layers

like that's the layer 2 problem or we're

under layer 3 space now continuing

through these lessons I'll refer

occasionally to the different layers and

when I do that I'm referring to the OSI

model so let's take a look at the OSI

model starting from the bottom we have

the physical layer which is where all

the physical stuff lives the wires and

cables and network interfaces and hubs

repeater switches and all that sort of