Complete Cybersecurity Full Course: Threats, Tools & Career Guide

[Music] hey everybody welcome to this video on cyber security full course I'm sure that

most of you would have gone online and checked an image watched a video like the picture and subscribe to a service

but have you ever wondered how all this data is kept safe cyber security is the practice of protecting computers servers

and networks from digital attacks theft and damage cyber security is critical for

individuals businesses and organizations to protect against cyber threats such as viruses worms and ransomware hey

everybody you are already watching a video on cyber security full course on edurica if you love watching videos like

this then consider hitting the like button and subscribing to our Channel you can also hit the Bell icon to

receive regular updates from here we also have hundreds of training programs and certification courses on our website

so if you are interested in them do check out the description given below now let's start this video by seeing

what this video will cover since the title itself is cyber security full course I think that it is Justified that

we start with water cyber security after that we can move on to cyber security fundamentals this section will cover all

the fundamental concepts that you will need to understand in order to start learning cyber security after this we

can check the history of cyber security how exactly did it start and what made it evolve into what cyber security is

today we will then see some cyber security threats and the tools that is used in this domain once we are done

with that we will tell you the top 10 reasons why you should learn cyber security along with a few cyber security

skills with this video we really do hope that you are able to work in this industry so the next section is how to

become a cyber security engineer followed by the cyber security career path

if you are new to this industry then let me tell you cyber security certifications are absolutely necessary

if you want to have a good chance in getting shortlisted we will also need to cover coding for cyber security to

maximize your knowledge in this domain in this video we will also see the top cyber security attacks that have gained

reputation in the recent years after this we will move on to ethical hacking we will start by seeing what

ethical hacking means after which we can learn the phases in ethical hacking once you are done with this we will move on

to some Core Concepts like ethical hacking with Kali Linux cryptography penetration testing Etc in this video we

will also show you how to use nmap a network scanner that is used to discover hosts and services on a computer network

by sending packets and analyzing the responses we will also see a few methods of cyber attacks like cross-site

scripting DDOS attack SQL injection Etc after that we will cover steganography a technique that is used to hide data in a

non-secretive manner to avoid detection now after all this we really do hope that you use these skills and succeed in

your career that is why we have included a ethical hacking roadmap which will help you plan your career and cyber

security interview questions and answers to help you ease through the interview process so now let's get started with

the first topic which is what is cyber security foreign

what is cyber security the onset of digitalization error has opened up a lot of opportunities for

everyone especially business and Enterprises from Mobile Banking to online shopping

to reading news and books everything is just one click away but it has been rightly said that everything comes at a

price the more you connect to digital assets the higher the risk of security vulnerabilities for your sensitive and

confidential data now the question arises how are companies securing this critical data and combating these trips

the answer is cyber security so what is cyber security technically cyber security is the body

of Technologies processes and practices designed to protect networks computers programs and data from Attack damage or

unauthorized access or misuse of authorized asset the goal of cyber security is to reduce

the risk of cyber attacks and protect organizations and individuals from the intentional and unintentional

exploitation of security weaknesses and systems networks and Technologies you love the product on Amazon and plan

to buy it on your way to checkout you are given options to pay through your debit or credit card or UPI with

millions of users sharing such sensitive information over the platform ever wondered how Amazon tries to secure this

information for the Facebook and Google also managed to secure confidential information off

its millions of users well from renew privacy policies to security focused patents to use of AI

for data security each company is expanding its focus on data protection to encourage user Trust

with the increasing advancements in the digital world cyber security threats will keep getting more complex as

hackers learn to adapt to security strategies this will increase the widespread requirement of cyber security

by companies that will be paying more than ever to land highly skilled cyber Security Professionals in order to

secure their vulnerable assets from cyber attacks foreign

now we are living in a digital era whether it be booking a hotel room ordering some dinner or even booking a

cab we're constantly using the internet and inherently constantly generating data this data is generally stored on

the cloud which is basically a huge data server or data center that you can access online also we use an array of

devices to access this data now for a hacker it's a golden age with so many access points public IP addresses and

constant traffic and tons of data to exploit black hat hackers are having one hell of a time exploiting

vulnerabilities and creating malicious software for the same above that cyber attacks are evolving by the date hackers

are becoming smarter and more creative with their malware's and how they bypass virus scans and firewalls still baffle

many people let's go through some of the most common types of cyber dark snow so as you guys can see I've listed out

eight cyber attacks that I've played us since the beginning of the internet let's go through them briefly so first

on the list we have General malwarez malware is an all-encompassing term for a variety of cyber threats including

Trojans viruses and bombs malware is simply defined as code with malicious intent that typically steals data or

destroys something on the computer next on the list we are phishing often posing as a request for data from a trusted

third party phishing attacks are sent via email and ask users to click on a link and enter their personal data

refreshing emails have gotten much more sophisticated in recent years making it difficult for some people to discern a

legitimate request for information from a false one phishing emails often fall into the same category as spam but are

more harmful than just a simple ad next on the list we have password attacks a password attack is exactly what it

sounds like a third party trying to gain access to your system by cracking a user's password next next up is DDOS

which stands for distributed denial of service a Dos attack focuses on disrupting the service of a network

attackers send High volumes of data or traffic through the network that is making a lot of connection requests

until the network becomes overloaded and can no longer function next up we have man in the middle attacks by

impersonating the end point in an online information exchange that is the connection from your smartphone to a

website the mitm attacks can obtain information from the end users and entity he or she is communicating with

for example if you're Banking online the man in the middle would communicate with you by impersonating your bank and

communicate with the bank by impersonating you the man in the middle would then receive all the information

transferred between both parties which could include sensitive data such as bank accounts and personal information

next up we have drive by downloads through malware on a legitimate website a program is downloaded to a user system

just by visiting the site it doesn't require any type of action by the user to download it actually next up we have

Mal advertising which is a way to compromise your computer with malicious code that is downloaded to your system

when you click on an affected ad lastly we have Rogue softwares which are basically malwares that are masquerading

as legitimate and necessary security software that will keep your system safe so as you guys can see now the internet

sure isn't a safe place as you might think it is this not only applies for us as individuals but also large

organizations there have been multiple cyber breaches in the past that has compromised the

privacy and confidentiality of our data if we head over to the site called information is beautiful we can see all

these major cyber breaches that have been committed so as you guys can see even big

companies like eBay AOL Evernote Adobe have actually gone through major cyber breaches even though they have a lot of

security measures taken to protect the data that they contain so it's not only that small individuals are targeted by

hackers and other people but even bigger organizations are constantly being targeted by these guys

so after looking at all sorts of cyber attacks possible the breaches of the past and the sheer amount of data

available we must be thinking that there must be some sort of mechanism and protocol to actually protect us from

early sorts of cyber attacks and indeed there is a way and this is called cyber security in a Computing context security

comprises of cyber security and physical security both are used by Enterprises to protect against unauthorized access to

data centers and other computerized systems information security which is designed to maintain the confidentiality

integrity and availability of data is a subset of cyber security the use of cyber security can help prevent against

cyber attacks data breaches identity theft and can Aid in Risk Management so when an organization has a strong sense

of network security and an effective incident response plan it is better able to prevent and mitigate these attacks

for example end user protection defense information and guards against loss of theft while also scanning computers for

malicious code now when talking about cyber security there are three main activities that we are trying to protect

ourselves against and they are unauthorized modification unauthorized deletion and unauthorized access these

three terms are very synonymous to the very commonly known CIA Triad which stands for confidentiality integrity and

availability the CIA Triad is also commonly referred to as the three pillars of security and

most security policies of bigger organizations and even smaller companies are based on these three principles so

let's go through them one by one so first on the list we have confidentiality confidentiality is

roughly equivalent to privacy measures undertaken to ensure confidentiality are designed to prevent sensitive

information from reaching the wrong people while making sure that the right people can in fact get it access must be

restricted to those authorized to view the data in question it is common as well for data to be

categorized according to the amount and type of damage that could be done should it fall into unintended hands more or

less stringent measures can then be implemented across to those categories sometimes safeguarding data

confidentiality May involves special training for those privy to such documents such training would typically

include security risks that could threaten this information training can help familiarize authorized people with

risk factors and how to guard against them further aspects of training can include strong password and password

related best practices and information about social engineering methods to prevent them from bending data handling

rules with good intention and potentially disastrous results next on the list we have integrity Integrity

involves maintaining the consistency accuracy and trustworthiness of data over its entire life cycle data must not

be changed in transit and steps must be taken to ensure that data cannot be altered by unauthorized people for

example in a breach of confidentiality these measures include file permissions and user access controls Version Control

may be used to prevent erroneous changes or accidental deletion by authorized users becoming a problem in addition

some some means must be in place to detect any changes in data that might occur as a result of non-human caused

events such as electromagnetic pulses or silver crash some data might include checksums even cryptographic checksums

for a verification of Integrity backup or redundancies must be available to restore the affected data to its correct

State last but not least is availability availability is best insured by rigorous maintaining of all Hardware performing

Hardware repairs immediately when needed and maintaining a correctly functional operating system environment that is

free of software conflicts it's also important to keep current with all necessary system upgrades providing

adequate communication bandwidth and preventing the occurrences of bottlenecks are equally important

redundancy failover and even high availability clusters can mitigate serious consequences when hardware

issues do occup fasting is adaptive Disaster Recovery is essential for the worst case scenarios that capacity is

reliant on the existence of a comprehensive Disaster Recovery plan safeguards against data loss or

interruption in connection must include unpredictable events such as natural disasters and Fire

to prevent data loss from such occurrences a backup copy must be stored in a geographically isolated location

perhaps even in a fireproof water safe place extra security equipments or softwares

such as firewalls and proxy servers can guard us against down times and unreachable data due to malicious

actions such as denial of service attacks and network intrusions so now that we have seen what we are

actually trying to implement when trying to protect ourselves on the internet we should also know the ways that we

actually protect ourselves when we are attacked by cyber organizations so the first step to actually mitigate any type

of Cyber attack is to identify the malware or the Cyber threat that is being currently going on in your

organization next we have to actually analyze and evaluate all the affected parties and the file systems that have

been compromised and in the end we have to patch the whole treatment so that our organization can come back to its

original running State without any cyber breaches so how is it exactly done this is mostly done by actually calculating

three factors the first factor is vulnerability the second factor is threat and the third is risk so let me

tell you about the three of them a little bit so first on the list of actual

calculations we have vulnerability so a vulnerability refers to a known weakness of an asset that can be exploited by one

or more attackers in other words it is a known issue that allows an attack to be successful for example when a team

member resigns and you forget to disable their access to external accounts change logins or remove their names from the

company credit cards this leaves your business open to both unintentional and intentional threats however most

vulnerabilities are exploited by automated Dockers and not a human typing on the other side of the network

next testing for vulnerabilities is critical to ensuring the continued security of your systems by identifying

weak points and developing a strategy to respond quickly here are some questions that you ask when determining your

security valid abilities so you have questions like is your data backed up and stored in a secure off-site location

is your data stored in the cloud if yes how exactly is it being protected from cloud vulnerabilities what kind of

security do you have to determine who can access modify or delete information from within your organization next like

you could ask questions like what kind of antivirus protection is in use what are the license currents are the license

current and is it running as often as needed also do you have a data recovery plan in the event of vulnerability being

exploited so these are the normal questions that one asks when actually checking their valuability next up is

threat a threat refers to a new or newly discovered incident with potential to do harm to a system or your overall

organization there are three main types of threat National threats like floods or tornadoes unintentional threats such

as employee mistakingly accessing the wrong information and intentional threats there are many examples of

intentional threats including spyware malware adware companies or the actions of disgruntled employees in addition

worms and viruses are categorized as threats because they could potentially cause harm to your organization through

exposure to an automated attack as opposed to one perpetrated by human beings

although these threats are generally outside of one's control and difficult to identify in advance it is essential

to take appropriate measures to assess threats regularly here are some ways to do so ensure that your team members are

staying informed of current trends in cyber security so they can quickly identify new threats they should

subscribe to blogs like wired and podcasts like the techgenics extreme it that covers these issues as well as

joint professional associations so they can benefit from breaking news feeds conferences and webinars you should also

perform regular threat assessment to determine the best approaches to protecting a system against a specific

threat along with assessing different types of threat in addition penetration testing involves modeling real world

threats in order to discover vulnerabilities next on the list we have risk so risk

refers to the potential for loss or damage when a threat exploits a vulnerability example of risks include

Financial losses as a result of business disruption loss of privacy reputational damage legal implications and can even

include loss of life risk can also be defined as follows which is basically threat multiplied by the vulnerability

you can reduce the potential for Risk by creating and implementing a risk management plan and here are the key

aspects to consider When developing your risk management strategy firstly we need to assess risk and determine needs when

it comes to designing and implementing a risk assessment framework it is critical to prioritize the most important

breaches that need to be addressed although frequency May differ in each organization this level of assessment

must be done on a regular recurring basis next we also have to include a total stakeholder perspective

stakeholders include the business owners as well as employees customers and even vendors all of these players have the

potential to negatively impact the organization but at the same time they can be Assets in helping to mitigate

risk so as we see risk management is the key to cyber security so now let me go through a scenario to actually

understand how cyber security actually defend an organization against very manipulative cybercrime so cyber crime

as we all know is a global problem that's been dominating the new cycle it poses a threat to individual security

and an even bigger threat to large International companies Banks and governments today's organized cyber

crime far outshadows loan hackers of the past and now large organized crime ranks function like startups and often employ

highly trained developers who are constantly innovating new online attacks most companies have preventative

security software to stop these types of attacks but no matter how secure we are cyber crime is going to happen

so meet Bob he's the chief security officer for a company that makes a mobile app to help customers track and

manage their finances so security is of top priority so Bob's company has an activity response platform in place that

automates the entire cyber security process the ARP software integrates all the security and ID software needed to

keep a large company like Bob's secured into a single dashboard and acts as a hub for the people processes and

Technology needed to respond to and contain cyber attacks let's see how this platform works in the case of a security

breach while Bob is out on a business trip irregular activity occurs on his account as a user Behavior analytics

engine that monitors account activity recognizes suspicious Behavior involving late night logins and unusual amounts of

data being downloaded this piece of software is the first signal that something is wrong an alert is sent to

the next piece of software in the chain which is the security information and event management system now the arp can

orchestrate a chain of events that ultimately prevents the company from encountering a serious security disaster

the ARP connects to a user directory software that Bob's company uses which immediately recognizes that user

accounts belong to an executive who is out on a business trip and then proceeds to lock his account

the ARP sends the incident IP address to a threat intelligent software which identifies the address as a suspected

malware server as each piece of security software runs the findings are recorded in the arp's

incident which is already busy creating a set of instructions called A playbook for a security analyst to follow

the analyst and lox Bob's accounts and changes his passwords this time the software has determined the attempted

attack came from a well-known cybercrime organization using stolen credentials Bob's credentials were stolen when the

hacker found a vulnerability in his company's firewall software and used it to upload a malware infected file now

that we know how the attack happened the analyst uses the ARP and identifies and patches all the things the ARP uses

information from endpoint tools to determine which machines need to be patched recommends how to bash them and

then allows the analyst to push the patches to all the computers and mobile devices instantly meanwhile Bob has to

alert the legal Departments of the breach and the ARP instantly notifies the correct person of the situation and

the status of the incident after the attack is contained and Bob's account is secured the analyst then communicates

which data may have been stolen or compromised during the incident he identifies which geographies

jurisdictions Android registry agencies cover the users and informations affected by the attack then the ARP

creates a series of tasks so the organization can notify the affected parties and follow all relevant

compliances and liability procedures in the past a security breach this large would have required Bob's company to

involve several agencies and third parties to solve the problem a process that could have taken months or longer

but in a matter of hours the incident response platform organized all of the people processes and Technology to

identify and contain the problem find the source of the attack fix the vulnerability and notify all affected

parties and in the future Bob and his team will be able to turn the cognitive security tools these tools will read and

learn from tens of thousands of trusted publication blogs and other sources of information this knowledge will uncover

new insights and patterns anticipate and isolate and minimize attacks as they happen and immediately recommend actions

for Security Professionals to take keeping data safe and companies like Bob's out of the headlines

[Music] so let us take a trip to the early days of hacking to start with now the

internet engineering task force is responsible for maintaining documentation about protocols and

various specification and processes and procedures regarding anything on the internet they have a series of documents

called the request for commence or the rfcs and according to rfc1389 it says a Haka is a person who Delights in having

an intimate understanding of the internal workings of a system computers and computer networks in particular

while the expression hackers may go back a long time and have many different connotations or definitions as far as

computers go some of the earliest hackers were members of the tech Model Railroad Club at the Massachusetts

Institute of Technology and what those people did and the various things that they did and were involved in are detail

in Stephen Levy's book called hackers for our purposes now for our purposes we'll be talk talking about other types

of hackers although the spirit of what we do goes back to those early days now the definition of hacking or hackers has

changed particularly in the 1980s and in part as a result of a couple of people namely Robert T Morris who was a Cornell

graduate who Unleashed a piece of software that was called a worm on what was an early version of the internet

firm went on to cause a lot of damage and create a lot of downtime on systems across the country and across the world

now the Morris worm did end up resulting in something good however that is the computer Emergency Response Team at

Carnegie Mellon was created primarily in response to the Morrisville now there is also Kevin mitnick who is another

well-known hacker who was responsible for various acts with computer crime over a couple of decades he was the

first convicted in 1988 so the definition of hacker or hacking moved from something benign to something far

more Sinister in popular culture now we see hacking or hackers in all sorts of popular culture we've seen them in

hacker movies called War Games also the movie hackers of course you also see it in the Matrix movies where you can see

if you look really closely that they are using a tool called nmap which we will get into the use of in great detail

later on as we go on now also the movie sneakers and the movie Swordfish and on television in addition to other places

you can see the Asians at NCIS regularly doing things like cracking complex cryptography in just a matter of seconds

or minutes so what is hacking really well hacking is about a deep understanding of something particularly

with relation to computers and Computing it's also about exploring and the joy of learning new things and understanding

them very clearly and being able to manipulate those things in ways that maybe other people haven't before it's

also about digging into problems to find out Solutions in creative and interesting ways and sometimes finding

problems where there weren't problems previously and that's a little bit about what is hacking okay so now that we have

talked about what exactly is hacking and how the meaning and connotations of that word has changed over time how it came

into existence how it was coined let's go over the reasons that people normally hack now you may want to hack just for

fun as discussed previously hacking is a tradition that goes back several decades at MIT even preceding the computer

definition of hacking now MIT has a long and storied history of hacking and sometimes if a computer-related nature

which in this case happens to be true and sometimes if a non-computer related nature instance now here you can see

that mit's homepage has been hacked or you might even say the faced to indicate that Disney is buying MIT this was an

April Fool's Day prank in 1998 and again this is just the kind of hacking that you would do for fun rather now

sometimes you might want to hack just to prove a political point or any point for that matter in this case again Bill

Gates had donated some money to the MIT which allowed them to have a new building and he was coming to MIT to

visit and give a talk about Microsoft Windows and its systems and as you can see the the Windows systems that are

installed in the entryway at the building were hacked to be running Linux instead and you can see here that tux

the penguin is saying welcome to the William H Gates Building again that some students who decided that they want to

make a point about Linux and Microsoft and windows to Bill Gates and they thought hacking was the best way to go

about it sometimes you hack just for the challenge here's an example again at MIT where some students turned the facade of

a building into a Tetris game board now this was a reasonably difficult hack and the students went after it just for the

challenge of completing it and it just so they could have some pride of ownership and to be able to say that

they were able to pull this off you know the things that teenagers do to show off to other teenagers it just increases

with increase in scale now in spite of its difficulties and its challenges and all the obstacles and planning that had

to go into it they were able to pull it off and now they have those bragging rights so that was one of them and one

of the instances where somebody would hack just for the challenge and for the fun in it now sometimes you want to hack

to prevent theft and this is where we get more specifically in the computer related hackings you see a lot of

Articles and stories and the News over the last few years about cyber crime and here's an example of data theft

compromised and a few within one and a half million cards for Global Payments so there are some attackers who got into

this company global payment and they were able to pull out about a mill million and a half credit card numbers

during the intrusion there so what you may want to do is you may want to learn how to hack in order to find these holes

in your systems or applications or employer systems so that you can fix these holes and prevent these

compromises from happening because of the reputational hit that your company takes however things like these happen

you have the risk of completely running out of business so just to protect your job to protect your company and to

protect your own desire of business you may just want to learn to hack and that's a very good reason now you may

also want to find all the problems that exist in your system for putting them out and deploying them so that you can

keep these attackers from getting in and stealing critical or sensitive information sometimes you may want to

hack to get there before the bad guys and the same sort of idea is the last one where we're just going to talk about

and that exactly is ethical hacking now we were just talking about how sometimes you may want to hack into your own

system before publishing it out to the public let's take Internet Explorer for example now Internet Explorer was

actually published to the public with some critical error in the code and these flaws were heavily exploited by

people who actually found them now a number of people in the world go out looking for these flaws and they call

themselves security researchers and they get in touch with the vendors after they found a flaw or a bug and work with the

vendors to get it fixed what they end up with is a bit of reputation they get a name for themselves and that name

recognition may end up getting them a job or some speaking engagements or book deal or any number of ways that you

could cash in on some name recognition from finding these sort of bugs and getting them fixed if you want to get

there before the bad guys you may think they're helping out a vendor you may want to just make a name for yourself

you want to find these sort of bugs before the bad guys do because think about the bad guy is finding them is

they don't announce them and they don't get them fixed and that makes everybody a little less secure finally you may

want to protect yourself from hacked computer companies and fight cyber criminals and this is a new headline

from June 18 2012 and we're starting to see these sort of news headlines show up as companies are starting to retaliate

against attackers in order to retaliate against attackers now in order to retaliate against Dockers you need to be

able to have the same sort of skills and techniques and knowledge and experience that those attackers have and where your

company may want you to learn to hack or the company may want to bring in people who are skilled at these sort of

activities so that they can attack the attackers and hopefully you end up with more Steely exterior and you get a

reputation for not being a company that people wanted to go after those are several reasons and there you go I gave

you around a bunch of reasons as to why you may want to hack for fun to prove a point protect yourself to protect the

company to not run out of business and along with another bunch of reasons okay so now that we have talked about why you

would want to hack let's move on to the types of hackers that exist now we're going to be talking about the different

types of hacking and the first step of hacking that I want to discuss is ethical hacking and ethical hackers

which is really what we're going to be talking about for the rest of these lessons now an ethical hacker is

somebody who thinks like a black hat hacker or things like somebody who's intent on breaking into your systems but

follows a moral compass that's more in line with probably the majority of the population so their intent isn't to do

bad things their intent is to look for bad things and get them fixed so that bad things don't happen ethical hackers

aren't out to destroy anything and they're not out to break anything unless it's deemed to be acceptable as a part

of the engagement and also necessary in order to demonstrate a particular ability to the organization that they

are working with so that's an ethical hacker and there's a certification that's available from the EC Council

it's a certified ethical hacker and you know if you find certifications valuable and this sort of thing is what you want

to do we're seeing a certified ethical hacker maybe something you might want to look into now let's talk about black hat

hacker there's plenty of cases of black hat hackers through yours and let's talk about a guy in particular called Kevin

mythnic this guy right here is a particularly good example probably because he was a black hat hacker for a

lot of his years his goal was to cause mischief to steal where necessary and just to be engaged in the lifestyle of

being a hacker and doing whatever was necessary to continue doing whatever it craw doing whatever he was doing it

crossed moral boundaries or ethical boundaries and so Kevin whitnick here was involved for well over a decade in

computer crime and was finally picked up by the FBI and he was charged and prosecuted and he was eventually

convicted of some of the activities that he was involved with now you may be able to argue that Kevin is a gray-haired

hacker and as well and a gray hat hacker is somebody who kind of skirts the line between black and white hat hacking and

white hat hacking is really what an ethical hacker is so instead of saying ethical Hackle he could say white hat

Hackle it's the same idea a white hot hacker is somebody who acts for good if you want to think of it like that if you

want to think of it as a good versus evil and what they're really doing is they're in it for the technical

challenge they're looking to make things better make things more efficient improve them in some way on the other

hand the black hat hacker is out for the money for the thrill it's really a criminal activity and the gray-hat

hacker is somebody who may employ the tactics and technique of a black hat hacker but have sort of a white heart

focus in other words they're going to do things that may be malicious productive in nature but the reason they're doing

it is to improve the security posture of an organization that they are working with so you can see there's actually a

book called gray hat hacking it's a pretty good book and it details a lot of the tactics and strategies and

techniques we'll be going over in subsequent lessons in this video now one other type of hacking that I want to

talk about is this thing called hacktivism and you'll find hacktivism all over the place and one example in

the last year or so and certainly in recent memory is called Love's security yeah you heard that right it's called

lull's security and you can argue that lulls is actually a response to another type of activism an organization called

Anonymous started hacking companies like Sony to protest their involvement in a lawsuit regarding a PlayStation 3 hacker

now lull security was supposedly testing the treatment of anonymous or was hacking in support of this group

Anonymous so they hacked a number of companies and the things like pull information Asian usernames and password

from the databases at these companies and they said that the reason was to shine a light when the security of these

companies and also theoretically to embarrass the companies with their weak or poor security postures and the

problem with that that they were doing this through were posting information that they had found online and that

information often included details about customers for these particular corporations and for an ethical hacker a

white hot hacker that would cross the boundary of causing harm so there's no reason for me as an ethical hacker to

post information in a public forum about somebody because I could be doing damage to them but in this case law security

and Anonymous specifically loud security were engaged in the form of hacktivism and what they were doing was not only

damaging to the cooperation that certainly was detrimental to those people so different types of hackers and

different types of hacking we've got ethical or white attacking we've got black hat gray hat and then we finally

got hacktivism it's really the goal and the means that vary from one to the other okay so now that we've discussed

the types of hackers let's also discuss the skills necessary to become one so what we're going to discuss in this part

are the different skills that are required or will be learned as a part of this video so initially just for basic

Computing you need a basic understanding of operating systems and how to work them there are going to be several

fundamental types of tasks that I won't be going into any detail at all or and you'll need to know how to run programs

and do things like open up a command prompt without me walking you through and how to do that so I am going to

assume that you have some basic understanding of how to do these sorts of tasks also you need an understandings

of the basic system software and you'll need a basic understanding of how to use command line utilities there are a

number of tools and programs that we're going to be going through this video and many of them use the command line now

whether it's on Windows or Linux still need to be familiar with typing and being able to run programs from the

command line and the various command line switches and parameters us that those programs or types of programs are

going to use now from a networking perspective you need a basic understanding of some simple networking

Concepts you need to know what cables are and switches and hubs and how systems are networked together you don't

really need a deep level of understanding I'll be going through some protocols as a reasonably deep level

because I think it's important as an ethical hacker to understand what's going on at the protocol level so that

you can know better what you are doing and how to achieve the goals and tasks that you have before you so we're going

to be going over some protocols so just understanding what protocols are and how they go together those sort of things

are necessary from a networking perspective now we're going to also be learning a bunch of life skills yes

there are some life skills that it's important to have I think the most important one is the ability to accept

failure and persevere and by that I mean you're going to be just running across several things that just don't work the

first time around and it's going to take a little bit of time and stick to itiveness to plug away and keep going

until you get something to work and the way that you get things to work is having an ability to problem solve and

sometimes solving problems requires being a little creative sometimes you need thing out of the box and come out a

problem from a different perspective in order to find a solution throughout the course of this video you're going to run

across a lot of sticky problems through the course of learning about being an ethical hacker and just doing the work

because it's not as simple so here's a little recipe for how to do this now go follow this recipe every time and you're

going to be successful every situation is different every system is different you're going to run across some pretty

sticky problems and you're going to have to just wait and get your hands dirty and keep failing and failing and failing

and failing until you find a way to succeed so I think those skills are very necessary to learn how to be an ethical

Hackle digging through some of the material that we'll be going over in this video as far as what you're going

to be learning you're going to be learning about how to use a lot of tools you're going to learn networking and by

that I mean we're going to be talking about different protocols involved in networking systems together you're going

to learn about security and security postures security is the hard and soil of ethical hacking it's why we do

ethical hacking in order to make systems and networks more secure than they were previously that's the goal from a

networking perspective we're going to be talking about how to read packets from Network captures we're going to be going

into tcpip related protocols in a fairly significant amount of detail and you're going to understand how protocols

interact with one another so we're going to do all that and the reading packets is going to be really important and

we're going to do a fair amount of that in addition to just a fundamental approach to learning how to read packets

in several lessons we're going to read packets as a way of understanding the different tools that we're using and how

they're going to learn tactics and methodologies and you get to learn to use the information you've got other in

order to get more information and information is really what is this all about you can't do much anything without

information and sometimes it takes a fair bit of digging in order to find that information and what you're going

to learn is the entry points and the Stepping Stones to get the information that you need and then once you have

that information you're going to be learning about ways to exploit it in order to get deeper into the target

you're going to learn security awareness we're going to talk about risk and understanding risks and vulnerabilities

primarily recognize the difference between a vulnerability and an exploit and there's a significant difference

there's so security awareness and understanding what a risk is and how that impacts your Target and it's going

to be key to a lot of things that we talked about so it sounds like a lot we're going to cover a fair bit of

ground not all of it at a deep level sometimes we're going to skim the surface but there's an awful lot of

material to be covered so let's get started into talking about the different skills that are required or will be

learned as a part of the series of video so initially just for basic Computing you need a basic understanding of

operating systems so it sounds like a lot where that we're going to cover and a fair bit of it is going to be at a

very deep level and sometimes we're just going to skip the surface but this is an awful lot of material to cover so let's

get started okay so that was all about the skills that we are going to develop throughout this video and that might be

necessary for you to become an ethical Hackle now let's talk about the types of attacks that you might be dealing with

as ethical hacker yourself so now we're going to be talking about the types of attacks now one type of attack that

you'll find common particularly in cases of hacktivism for example or cases where people are trying to make a particular

point or just be a general pin is this idea of defacing now defacing goes back for quite a while it's the idea of sort

of digital graffiti where you've left your mark or your imprint behind so that everybody knows you were there primarily

a website thing and it's really just making alterations to something that used to be pretty common a long time ago

now it's very particular for businesses or people or just organizations in general to have their home pages being

replaced by this other thing that was along the lines of hey I was here and I took over your web page we also have a

pretty common one which certainly has been common over the years and it's a pretty good part towards quality

exploits and high profile vulnerabilities and that's buffer overflow now a buffer overflow is a

result of the way programs are stored in memory when programs are running they make use of a chunk of memory called a

star and it's just like a stack of plates when you put a bunch of plates down when you pull a plate off you're

gonna pull the top plate you're not gonna pull the oldest plate you're gonna pull the one that was on top so the same

thing with the stack here we're accessing memory and this has to do with the way function functions are called in

memory when you call a function a chunk of memory gets thrown on top of the stack and that's the chunk of memory

that gets accessed and you've got a piece of data in memory within that stack and that's called a buffer and

when too much data is sent and try to put into the buffer it can overflow now the bounds of the configured area for

that particular buffer it can overflow the bounds of the configured area for that particular buffer now the way

Stacks are put together we end up with a part of the stack where the return address from the function is stored so

when you overflow the buffer you have the ability to potentially override that return at which point you can control

the flow of execution of programs and if you can control the flow of execution of the program you can insert code into

that memory that could be executed and that's where we get buffer overflow that turns into exploits that creates the

ability to get like a command shell or some other useful thing from the system where the buffer overflow is running so

that but a buffer overflow in short sometimes we also have format string attacks and sometimes these can be

precursors to buffer overflow formats now format strings come about because the C programming language makes use of

these format strings that determines how data is going to be input or output so you have a string of characters that

define whether the subsequent input or output is going to be an integer or whether it's going to be a character or

whether it's going to be a string or a floating point that sort of thing so you have a format string that defines the

input or the output now if a programmer leaves off the format string and just gets lazy and provides only the variable

that's going to be output for example you have the ability to provide that format string if you provide that format

string what then happens is the program starts picking the next piece of data off the stack and displays them because

that way we can start looking at data that's on the stack of the running program just by providing a format

string and if I can look at the data I may be able to find information like a return address or some other use of

piece of information there is also a possibility of being able to inject data into the stack I may be able to find

some information like a return address or some other useful piece of information there is also a possibility

of being able to uncheck data into the stack I may be able to find some information like a return address or

some other useful piece of information there is also a possibility of being able to inject data into the stack using

this particular type of attack now moving on to our next type of attack is a denial of service a denial of service

this is a pretty common one and you'll hear about this a lot this is not to be confused though with the one that I'll

be talking about after this and that is a distributed line of service so this one that you see is that this is a

denial of service staff and a denial of service is any attack or action that prevents a service from being available

to its legitimate or authorized users so you hear about a ping flood or a sin flood that is basically a sin packet

being sent or machine constantly or a Smurf attack and Smurf attack has to do something with icmp Echo requests and

responses using in broadcast addresses that one's been pretty well shut down over the last several years you can also

get a denial of service simply from a malformed packet or a piece of data where a piece of data is malformed and

sent into a program now if the program doesn't handle it correctly if it crashes suddenly you're not able to use

that program anymore so therefore you are denied the service of the program and thus the denial of service now as I

said a denial of service is not to be confused with a distributed denial of service and I know it's pretty trendy

particularly in the media to call it any denial of service a DDOS or any denial of service a DDOS now it's important to

know that any denial service is not a DDOS a DDOS or as you might know a distributed denial of service is a very

specific thing a distributed denial of service is a coordinated denial of service making use of several hosts in

several locations so if you think about a botnet as an example a botnet could be used to trigger a distributed denial

service where I've got a lot of bots that I'm controlling from a remote location and I'm using all these boards

to do something like sending a lot of data to a particular server when I've got a lot of system sending even small

amounts of data all of that data can overwhelm the server that I'm sending it to so the idea behind a distributed

denial a service stack is to overwhelm resources on a particular server in order to cause that server not to be

able to respond now the first known DDOS attack used the tool called stockhold rot which is German for barbed wire now

stockhold Rod came out of some work that a guy by the name of Mixter was doing in 1999 he wrote a proof of concept piece

of code called tfn which was the tribe flood Network let me just show that for you

so you can see on the Wikipedia page that the triplet Network or tfn is a set of computer programs that is used to

conduct various DDOS attacks such as icmp floods in floods UDP floods and smart attacks now I know many people

don't really consider Wikipedia a really good source of any sort of knowledge but it's a good place to start off so if you

want to read about all these types of attacks like icmb floods and what exactly is a syn flood you can always do

that from Wikipedia it's not that bad place of course you shouldn't use Wikipedia as your final Rosetta Stone

moving on so this program called Old Rod which was it was used to attack servers like eBay and Yahoo back in February of

2000 so that attack in February of 2000 was really the first known distributed denial of service attack which is not to

say that there were in denial of service tax previously So to that there were certainly plenty of them but they were

not distributed now this means there weren't a lot of systems used to coordinate and create a denial of

service condition and therefore we get the distributed denial of service stack so that's a handful of type of attacks

and some pretty common attacks that you're going to see as an ethical Hackle when you become an ethical hacker or if

you're trying to become an ethical hacker you should always know about these types of attacks okay so in this

lesson we're going to be talking about penetration testing and some of the details around how it works and

Logistics and specifically things like scope so what exactly is penetration testing so well not surprisingly it's

testing to see if you can penetrate something which means you're going to check to see whether you can break into

a particular thing whether it's a server or in applications depending on the type of Engagement you've got you may have

the ability to try to break in physically to a location but primarily what you're going to be doing with

penetration testing is you're going to be trying to break into systems and networks and applications and that's the

kind of what it's all about and this may actually involve social engineering attacks so it may require you to make a

phone call to somebody and get them to give you their username and password or some other type of social engineering

attack where maybe you send a URL via a crafted email sometimes it's just strictly a technical approach where

you're running scans and you're running Metasploit and you're gaining access that way or maybe some other type of

technical application sort of connection sometimes it's physical access that you need so in order to get access to a

particular system if you can get physical access then maybe you can get in so that was all about that's what

exactly penetration testing is it's checking whether you can get into a system whether it be physically or on a

network so what are the goals of penetration testing the goals would be to assess weakness in an organization

security postures we want to figure out what they're vulnerable so that they can go and fix these problems you want to

help them understand their risks positions better and what they can or may be able to do to mitigate those

risks and ultimately you want to be able to access systems in a particular way to find weaknesses so those are really sort

of the goals of penetration testing now from a result standpoint when you're done you're testing what you are going

to do well you're probably going to generate a report and by that I don't mean you're going to run some automated

tool and you're going to get it to generate a report for you you're actually going to give that to the

client you're actually going to give your report to the client and then they're going to write you a really

large check so that's not really how it works you're going to write a report detailing the findings in a detailed way

so that it includes what did you do to find out what you actually found out and how you can actually mitigate that

particular risk so you should really include remediation activities in order to fix this vulnerabilities that you

find and it's pretty easy to walk around saying hey that's a problem and that's problem and that's a problem that's

really not a lot of value in that where there's a value is that hey that's a problem and here's how you can go about

fixing it so let's talk about the scope of penetration testing so firstly you want to actually realize how big is the

bread box and how specifically what is it that the U2 of the two of you have agreed that being you the ethical hacker

and the other guy being the authorized person to give you permissions to ethically hack have specifically agreed

that you can do penetration testing and you can Target them as an organization or the client and what you have agreed

to are any exclusions or any sort of areas that they say you're not allowed to touch so anything so like if they've

got a database server maybe or there's a lot of really sensitive data on it and there's a little hesitant and they may

put don't touch this thing clause in the scope so there are a lot of different reasons why they may exclude areas from

the scope and if they exclude them then trust their reason and listen to them what they have to say in terms of this

is what we want you to accomplish so along those lines you really need to get a sign off from the target organization

now we've talked about this before and this is certainly all about the ethics and trust and it's also about legality

because if you do something that you don't have permissions to do you could be prosecuted for that so definitely get

the scope very clear in writing and with signatures attached to it as to what you can and what you can't do and always get

approval from the right people and make sure you get somebody who has the right level of permissions and is the right

level of management so that they can sign off on its understanding and accept the risk that is associated with the

penetration test so let me talk a little bit about security assessments and how they differ from penetration tests so

security assessment is a hand in hand approach with clients so you would walk in doing a collaborative thing where

your a trusted partner and you are alive at them and your goal isn't to penetrate them and point out all the things that

are really bad but it's to get a full assessment of the risk that the organization is exposed to and you would

probably provide more details about fixes that maybe you would in a penetration test now what we're going to

do is we're going to walk in and make sure that the policies and procedures they have in place are really what they

need for the organization and the risk appetite that they've got and we're going to make sure that the policies and

procedures have controls that can tell us whether they are being actually adhered to or not so the procedures and

policies are being followed a security assessment is probably a little bit more comprehensive than a penetration test

and you would look at more factors to assess the security postures of the organization in their overall risk and

you would tailor the output based on the risk appetite and what they're most interested in and that's not to say that

I'm going to tell them what they want to hear but if there's something that they know and I know that they're just not

going to do I'm not going to be making a big deal out of it because they're already aware of it and I'll make a note

of it in the report just for a complete mistake but I'm not going to go out in a lot of details so it's really kind of a

hand-in-hand collaborative approach where again you're not just saying that they want us to say we're providing some

real security and risk guidance towards their activities and other things so it may provide an unrealistic view so

you've got a week let's say to do this penetration test against your target now you're going to have to go in you're

going to have to get set up you're also going to have to start doing a bunch of scans and make sure that you're

Gathering informations and screenshots and data for your reports you're gonna have to do all sorts of activities also

during the course of that week you're going to be engaged in probably beginning to write your report and

getting a sense of what is going to say and what's going to be in it if you don't actually get any major penetration

during the course of that week the organization may feel like their quote-unquote secure that's one of the

reasons why penetration testing well really sexy and chill is nice and all but if an organization walks out of it

believing that in a week you didn't manage to get to know get the keys of the king Kingdom then they might must be

secure that's really misguided view because undedicated skill and motivated attacker isn't going to just take a week

or some portion of that week they're after something they're gonna dedicate themselves to do it and really go after

it so just because you didn't find a penetration in some subset of a week doesn't mean that they're secure and and

invulnerable to attacks it just means that during the course of that particular week and other circumstances

that were in place you didn't get a penetration that was really significant or major that's all it means it doesn't

mean anything beyond that and if an organization walks away feeling like they're secure they're going to end up

not fixing the real vulnerabilities that may be in place that could expose them to significant risks so that's

penetration testing it Scopes its goals and how it differs to security assessments now it's time to go over

footprinting so what is footprinting well footprinting is getting an idea of the entire scope of your target that

means not just scope that he were given which may be an address block or it may be a domain name that even maybe a set

of address blocks now what you want to do is you want to figure out all the information that's associated with that

in great detail as you can possibly get so you want the list of domain names as you're going to go through this you

probably want some sort of database or Excel spreadsheet or something to keep track of all the information because

you're going to have a lot of it at the end you want to be able to find the information quickly so having some sort

of either notepad going with your notes or as I said a spreadsheet or a database so if you can get organized in that way

you want to keep all those sorts of things down so in this case I want to do some sort of search on suppose let's say

eddyreka.com now I need Network blocks so so far we found out that just made up IP addresses because I'm just putting

information down but I need Netflix blocks so you may have one IP address that you can find externally or or

you're going to want to hold range of internal blocks and you can do a little bit of digging if you aren't provided

those you want specific IP addresses for critical systems web servers email servers databases if you can find any of

these things of those sorts and you want system architectures and what kind of stuff are they running are they running

Intel are they running windows are they running some Unix systems what are they running what kind of Access Control

lists they have these are going to be hard to get but you may be able to guess them and you can guess these by doing

Port scans so what sort of responses you get back from the port scans with the filters and or what you don't get back

we'll tell you about if there's an IDs around or some you want to do a system enumeration or you can get access to a

system somehow you want to know usernames group names so on so the basic idea of footprinting is gathering

information now if you can get access to system somehow you want to know usernames group names so you want system

banners routine tables SM an MP information if you can get it DNS host names if you can get those now this is

for both internal and external on the side if you're doing an internal penetration test or ethical hacking

engagement you want to know the networking protocols that are there are they using TCP or are they using some

UDP or are they on ipx or SPX are they using decnet or apple talk or are they using some sort of split DNS in other

words do they have internal DNS servers that give different form for the external and will give different

information if you want to check for remote access possibilities now in the footprinting process you want to be very

exhaustive you might want to try and take out email addresses servers domain name Services I mean IP addresses or

even contact numbers and you want to be very exhaustive with your approach you don't want to miss anything out because

if you do that you can continue and also provide some some launching points for additional attacks or tests that you may

be able to do but this is definitely a starting point of the time types of information that you need to have as you

go about footprinting your target now next thing that we are going to see is very interesting this is one of the many

common tools that are out there on the internet and that is the Wayback machine or also known as archive.org now while

it might not give you all the information that you need but it certainly gives you a starting point and

what we're talking about out here is the Wayback machine or archive.org so let me just give you a quick look at what

archive.org looks like okay I already have it open out here so out here what you can see is how a website look like

around some time ago so for example if you want to look at what Google look like so you just have to search for

Google out here and wait for results to come back okay so we see that Google goes way back to

1998 so that was the last capture or the first capture rather it was the first capture by the Wayback machine and we

can see that it has a screenshot of November 11th and how Google looked so let's see what Google looked like in

November 11th of 1998. so this is what Google looked like it was there was actually nothing to it it just said

welcome to Google Google search engine prototypes and it has some link so yeah this is what the Google search engine

looked like it had a Stanford search it had a Linux search and you could do all sorts of stuff you could just put the

results now what I'm trying to tell you all is you can see the evolution of a website through time through the Wayback

machine and this gives you rather in a informative look into how website has actually evolved okay now that we know

what footprinting is and how it falls into the whole recognition process so let's go over a couple of websites to do

a little bit of historical thinking about companies and the types of infrastructure that they may be using

and this information of course is useful so that we can narrow down our focus in terms of what we want to Target against

them for attacks now over time we've improved our awareness about what sorts of information we may want to divulge so

several years ago you may have gone to a company's website and discovered that you could get email addresses and names

of people in positions that you may find relevant and there were all sorts of bits of information that could be used

against the company and over time we have discovered that those sorts of pieces of information probably don't

belong on a website where they can be used against a company and so they've been pulled off now it used to be also

that Google had the ability to pull up information that it had cached so far for example if a website is no longer

available or if it was temporarily down and offline there was a little cash button that you could click when you did

and the Google search and you could pull up that cached information so even though the website wasn't available you

could still get information from Google's servers now Google's removed that so we don't have that ability any

longer however there is an internet archive that we can use so this thing is called the Wayback machine and I have it

open out here so it's archive.org web so archive.org is a website that gives us information about other websites and how

they looked like in years ago and by so I'm gonna go to the Wayback machine which you can see is at the archive.org

and I'm gonna go and try and search for edureka.com so now we're going to take a historical look at eddyreka.com's

website and you can see we've got some years and they've got information going back up to 2013. so let's look at what

this website looked like when it was just 2013. okay there don't seem to be any snapshots out here I wonder what's

going on okay so let's go to 2014 and the first snapshot seems to be on the September 12th of 2014. actually it's on

May 17 too so let's see what that looked like okay so this is what Eddie reggae looked

like back in 2013 or around the 2014 September 12 2014 to be actually exact now you can see that we have some live

classes and all this pictures there and they've got this weird picture of this guy out here I don't know why that was a

thing back in 2014. now we can browse more advanced screenshots or rather the screenshots I've taken later on and see

how this company has evolved with this infrastructure and the way it actually lays out its content okay so it still

has the fall but I can go a couple of years ahead and see what this has actually evolved into so if I were to go

to December 2016 so this is what it looked like to 2016 and we can see that they've added this

weird box out here about Verizon courses they have added a search bar that kind of looks weird but it's mostly because

my Internet is slow and it's not loading all the elements they've also changed how they've actually laid out the

courses we can also see a change in the prices I guess so yeah this tells us about how it evolves as a complete

website now this other website that I want to talk about is called Netcraft now Netcraft does internet research

including the types of web servers that companies run and they have a web server service you can see here as we scroll

the Apache reverse service has 64.3 percent of the internet Market of course and that's followed by Microsoft with 13

interesting information may be useful information but even more useful than that is looking at what different

companies run for their websites and you can see here okay so let's try and search for edireca.go out here so let's

just put it in the website URL and that Netcraft generate the site report so as you can see that some of the stuff is

not available we know that the net block owner is by Amazon Technologies name server is this thing right here the DNS

admin is AWS DNS host Master we also have the IP address we can go for a wire look up the IP on virus total you can do

that there is no IPv6 presence so that's some information that we can see so we can obviously opt out to not Target IPv6

ranges then there's also reverse DNS then we also have a bunch of Hosting history so this is a history of it and

we know that it's hosted on a Linux system with an Apache web server and it was last seen and this was when it was

last updated so this is some very useful information you can also get information on stuff like Netflix so if you just

type okay I just spelled that wrong so let me just change it from the URL out here so if you go and type for

netflix.com and you see that it'll show you all sorts of information so as you see that

it's on an AWS server it's an Amazon data services Ireland and this is all the hosting history that it goes along

with it has some standard policy Frameworks domain-based message authentication and Reporting

confirmations and there's all sorts of information that you can get about websites and their web servers from

Netcraft so the Wayback machine along with Netcraft may come for some interesting tools that is available on

the internet from which you can do a little bit of your reconnaissance process okay now that we have gone over

Netcraft and the Wayback machine now it's time to actually get to know how to use the little information that the site

actually provides so what the next topic that we're going to go over is using DNS to get more information now we're going

to be going over a tool and this is called who is and it is a utility that is used to query the various Regional

internet registries to store information about domain names and IP addresses and let me just show it to you about all the

internet registries that are there so I have aaron.net open out here and these are the internet registries that

provides the isps and looks over the Internet control as a whole so out here we have afrenic we have apnic we have

Aaron we have laknik and we have ripe NCC so these are all the regions and all the different types of stuff that they

support all different countries you can look at the map that it is supporting out here by just hovering over the

providers so as you can see all these Brown region out here is Africa after Nick then we have apnic which is this

black or grayish thing which is India and Australia and quite a lot of Asia then we have Aaron which is a lot of

North America in the United States mostly Dennis lachnik which is mostly the Latino site which is the South

American part then we have the rest of Europe which is ripe NCC and this is the part that ripen cc is providing internet

to okay so that was all about the internet registries now let's get back to the topic and that is using DNS to

get more information now for this we are going to be using a Linux based system so I have Ubuntu running on my virtual

machine out here and let me just log into it so firstly we are going to be using this query called who is that

looks up these internet registries that I just showed you let me just quickly remove this okay

so for acquiring information from the regional internet registries that I just talked about you can use two ways to get

information about who owns a particular IP address so for example I could do who is and let's see I could do who is

Google or rather netflix.com and we can get all sorts of information about Netflix so we can see

that we have the visit Mark monitor then let's see let's go up and look for all sorts of information that is being given

to us by this who is query so as you guys can see I just spent a little bit too much okay so registry domain 90 we

have the domain ID where it is registered there's a registered URL is Mark monitor okay so this is for marking

actually now the creation date is 1997. so if you haven't realized Netflix been around for a long time and it's been

updated on 2015 and the registry expiry date as we see is 2019 so it's going to actually go off this year then this is

all useful information so we can see all sorts of domain status the name server the URL the DNS SEC that it says

unsigned this is very useful information that is being provided by very simple query now if you want to know who owns a

particular IP address so let's see did we get back the IP address out there we should have got back the IP address but

it's kind of lost on me so to get back the IP address also for a domain name server so you know so you could use this

command called dick so your dig netflix.com now as you guys can see that it has

returned a bunch of multiple IP addresses that these are all the IP addresses that Netflix is so I could do

something like if I was trying to check out who owned a certain IP address and for example I have got one of these IP

addresses but let's just assume I don't know that actually belongs to Netflix so I can go who was

54.77.108.2 and it'll give me some information so as you guys can see it is giving us a bunch of information as to

who this is and how it is happening so we see that it is from aaron.net and so we can very smartly assume that it's

from the North American part no we can also see that it's in Seattle so our guess was completely right

so it also gives us a range so this is something very useful so if you see we now have the range of the IPS that might

be being used by this guy so we indeed have a 54 and it says it goes up to the 54. there's also 34. now let's check

that out and see what information we get so who is and let's check it out what was the IP that we were just seeing is

34.249.125.167. so 34.249. 165. I don't know let's see you can also

put in a random IP address it doesn't really matter and it'll give you the information so let's see is this in some

IP address even this seems to be an RN IP address and it's also based in Seattle and we get a bunch of

information so that's how you can use the who is query and the bigquery to actually get all sorts of information

about the domain name service and get information from a DNS basically so now let's go over some theoretical part that

is for DNS so using DNS to get information so firstly what is a domain name service and why do we need it so a

domain name service is a name given to an IP address so that it's easy to remember of course you it's easy to

remember names and mnemonics rather than a bunch of random weird numbers now this was mainly so that we can map names to

IP addresses and we can get the a bunch of information from the hostname resolution so that's the purpose of IP

addresses now we will also be looking at how to find network ranges okay now before we get on to actually moving on

to how to find out the network ranges let me just show you how you can also use who is so who is suppose you want to

know the domains with the word Foo in it so you could go who is Foo and this will give you a whole bunch of things about

how Foo exists and all the sorts of foods that there is on the end internet so that was one interesting flag and if

you want to know how to use more about who is you could just go dash dash hell I guess yeah so this is all the types of

stuff that we can do with who is so you can set the host we can set the port that we want to search for then we can

set with the elf live you can find one level that specific match and we can do an exact match do an inverse lookup for

specified attributes then we can also set the source we can set verbose type and we can choose for a request template

there's a bunch of stuff they can do so you could suppose say who is verbos and suppose eddyreka dot code and it'll give

you a verbose version of this is a ripe database query service objects are an rpsl format the arrive databases

objectives so okay let's try something else like who is netflix.com okay I'm sorry I was supposed to do

verbose and I kept doing etch it's silly me so you do V and it'll give you a much more like this is a ripe database again

I think I'm doing something wrong okay just for that thing okay V and tight okay or let's just see that's let me

just show you how to use a primary keys are return only primary Keys okay let's see let's try that out okay so it seems

to be that this is a ripe database query service and objects are an rpsl format so it won't really work for that thing

and it also says that no entries found because it's this error so this is for some layer lesson so for now I hope I

gave you a good idea of how to use Hue is like you could just go who is then some IP address like

192.168.101 or some gateway address like that or you could just go for a domain name service like Facebook and get all

sorts of information about Facebook when the query actually returns you something okay so let's move on to network ranges

now now in this part of the video we're going to be going over the utility call who is which is used for getting

information from the DNS now let me just show you a website out here so this is the original internet registries so the

internet registries are used to store information about domain names and IP addresses and there are five Regional

internet registries first is iron which is responsible for North America America so that would be the US and Canada then

we have lachnik which is responsible for Latin America and portions of the Caribbean then there's ripe that's

responsible for Europe and Middle East and Central Asia there's afternik which is responsible for Africa and finally we

have apnic which is responsible for Asia Pacific Rim so that's the regional internet registries and as I said who is

is responsible for acquiring information from the various Regional internet registries as you can use who is to get

information about who owns a particular IP address for example let me just open up my Ubuntu system let me clear this

out first so as I was just saying for example you could go who is facebook.com okay so as you guys can see we could

find out pretty quickly about who owns a particular IP address so for example I could do who is and just go facebook.com

and tell me about who it belongs to it also gives you who owns a particular IP address and who's responsible for them

from the information you can get email addresses that belong to a particular company this one has an email address

for techcontact of ipreg adrate so you can get all sorts of email addresses Tech contacts and all sorts of stuff out

there the registry database contains only.com and Dot net and all sorts of information now I want to query a

different IP address and different information belongs in the different Regional internet registries of course

so if I want to go to a protocol database I would have to use the minus H flag so I could do who is Aaron net and

remember the IP address and I'm going to query that again and of course I get the same information back because I went

there so you could just go who is Edge and then follow it with an IP address so it's only like 34.205.

176.98 so that's just a random IP address I just made up and it says that who is option okay so it's a it's a

capital H okay so let's see that and we get all sorts of information back from that so area 8 iron and all sorts

of stuff now I can get information about domains as well so if I can query something like netflix.com and I can

find out that this is that actually Netflix and there's an administrative contact and the technical content and

you can see the different domain servers the servers that would have authority of information about the DNA sentries for

that particular domain you can also see other information like when the record was created and a whole bunch of

different phone numbers that you can contact and additional restoring information about IP addresses and

domain name sometimes it will store information about particular host names and there may be other reasons why you

would store a hostname or particular information about hostname on the system whether one of the rirs now if I want to

wanted to look up something specifically once I had found that I could now do a lookup on who is suppose let's say

something like who is Foo so let's say who is Foo now if you already don't have who is installed you can easily install

it by just going apt install who is on your Unix system and that should do the trick and then you can start use this

really Nifty tool okay so that was all about using who is now let's get on to actually using how to find out Network

ranges for a domain okay so now let's talk about how we're going to be going over and fighting Network ranges so

suppose you've got the engagement and you only know the domain name and you don't know much beyond that and you're

expected to figure out where everything is and what everything is so how do you go about doing that well you use some of

the tools that we either have been talking about or will soon be talking about in more detail and the first thing

I'm going to do is I'm going to use the domain name eddyreka.com and I'm going to look up edureka.com and see if I get

an IP address back so let's just head over there and go Whois edireca.co or we could use the host

keyword so as you see we get an IP address back and that is

34.210.230.35 and that is the IP address and you see that I've got back an IP address so here's just an IP address and

I don't know what that IP just belongs to and I also don't know how big the network range or network block is and

that's associated with so what I'm going to do is uh who is and I'm going to look up with Aaron who owns that IP address

so you can basically go who is 34.210.230 not 35. so as you guys can see that gives us a bunch of information

and who is now this doesn't seem to have a very big Network range but unlike something like Netflix so suppose we

were to do some like host netflix.com and see now we have a bunch of IP addresses so suppose we will do who is

let's see who is 52.19.40 the 147. now I'm expecting Netflix to be a much larger company and

have a better yeah now see we get net range so this is the network range that we're talking about so we had a random

IP address and now we have found the network range so that's how you find network ranges and this can be very

useful so this gives me evidence that netflix.com has a presence on different addresses the one I have also located by

looking up that particular hostname so I've got one address here that I can look and let's take a look at the

website because there may be different address now if I didn't have that I could also go and do something like an

MX flag so let's see I could go dig and this will give us all the mails so dig MX

and let's see let's see what MX does actually you go help so we could do dig hyphen Edge for a list of options so

these are all the options that we have and the one that we're gonna use is something like this a dig MX and we say

it's online netflix.com so these are all the mailings and mxs that we have gotten

from Netflix and this is information regarding it's still producing information that's a big thing to

produce okay so as I was just saying you can use the MX flag and I could get back all the mail handlers in this case and

their mail is being handled by Google and let's see wait let's go on top then it's going to tell me that Google's not

particularly surprising and other things I can do is check for different host names since I'm assuming DNS probably

doesn't allow Zone answers since most DNS servers don't anymore although they used to you may have to start guessing

so I could do something like webmails that we find out here so this shows us a dump of all the

outstanding memory stuff okay so that was all about finding Network ranges now moving on to our next topic is using

Google for recognizance now some people also call this Google hacking now if you know how to use Google to exactly Target

and find what you are looking for Google is an excellent tool for recognition purposes and today I'm going to show you

how you could use Google exactly for your searches so first of all let's open a tab of Google

um let's open up here so let's go to google.com Okay so now we're going to be talking about how we can use Google to

actually gain some information or some targeted information so this is in general called Google hacking now when I

say Google hacking I'm not meaning by breaking into Google to steal information I'm talking about making use

of specific keywords that Google uses to get the most out of the queries that you submit so for example a pretty basic one

is the use of quotations you code things in order to use specific phrases is otherwise Google will find pages that

have instances of all those words rather than the word specifically together in particular order so I'm going to pull

this query up and this shows a list of let me just show it to you so if you go index off

now this is showing us an index of all the films now this is basically all those index of sites that you want

so as you guys can see the show this index of all sorts of films that are there now you can use index of and you

see that we have also an index of downloads or something like that hype from.com slash download and it is an

index of all sorts of stuff now you can go into some folder and check them out G Jones giversity giberical I don't know

what these are but some sort of stuff and this is how you can use Google Now let me just show you some more tricks so

you can use this so suppose you're using Google to find for something like a presentation so you could use something