Ethical Hacking Full Course Revision: All 12 Weeks in One Session

Hello everyone, welcome back. In this video, we are going to revise all 12 weeks of ethical hacking in one session.

So this is an exam oriented revision class. We'll focus on important concepts, core formulas, technical terms

and previous assignment questions. So don't try to memorize each every sentence. Concentrate on understanding

the concepts remembering important numerical values and distinguishing between similar terms. Okay, let's start

with week one introduction to ethical hacking and uh networking. So ethical hacking is a

legal and authorized identification of vulnerabilities in systems and networks. So ethical hackers work with permission

identify the weakness and report them so that they can be corrected.

So first remember three penetration testing approaches. White box Testing means the tester has full or

detailed information about the target. This one blackbox testing means the tester has

little or no prayer information and the gray box means partial. So these three terms are important because exam

questions often ask you to identify the correct testing methodology from this description.

So next the security testing where evaluates whether system and networks have weakness and whether their security

controls are working correctly. Now let's look at the switching uh switching techniques. So packet

switching divides data into packets and shares the network resources. It is suitable for

busted traffic. It is suitable for busty traffic because bandwidth is used as needed. So next is

the TCP IP model. It is commonly represented using four layers application, transport, internet and

network. So each layer a different responsibility in network communication. So next will be

the next the TCP IP model it is commonly represented using the four layers. So the O OSI model has seven layers. Now

remember the difference between the TCP and IP. TCP is a connection oriented and provides reliable order delivery.

UDP is connectionless and does not guarantee delivery.

The internet protocol or IP provides logical addressing and routes packets between the networks.

So it is it is also connectionless. IP itself does not guarantee the packet

delivery. TTL stands for time to live. Route routers decrease the TTL value as the

packet travels through the network. So when it reaches zero the packet is discarded

the packet is discarded. This prevent a packet from circulating in infinity infinity looping.

The MAC address is associated with the data link layer and IP address provides logical addressing at the

internet layer. So port number identify services and points at the transport layer. So these are the different value

numerical value. Try to memorize it. The O OSI model will be having seven layers. TCP IP means four layers. IP v4 address

is 32 bits. Port number 16 bits. IP header check sum 16 bits. IP V4 ln four bits IP header length ln

into four bytes these questions from this you'll be getting the questions for your final exam also maximum value is 15

so maximum IP header length will be 15 into 4 I will be having 60 bytes so the formula for IP header length

header length is equal to ln into four bytes. So these are the exam quick revision

things. Ethical hacking white box, black box, gray box and packet switching your layers

TCP difference between a TCP and UDP. The the main formula will be ln into 4. The length check sum will be it will be

16 bits. So port number where we'll be having is in transport layer. The MAC address will be done in the data link

layer. We'll see some previous assignment questions. So what is the main objective of ethical

hacking? We'll be knowing legal identify the system vulnerabilities. So which of the following

types of penetration testing? White box, black box and gray box. In the option only white box and black box

are given. more busty traffic. We already seen that it is a packet

switching. So it's a connectionless and does not provide reliability. It

will be UDP and TCP will be connection oriented. So which IP header prevents infinite

looping of packets? It is time to leave TTL. These are the other question. The

maximum value 15 and the bytes will be 15 into 4 I will be getting 60 bytes. So

header check sum it is 16 bits. So weak one white box means detailed information.

Black box means little or no information. Gray box means partial information. TCP

reliable. UDP connectionless. IP handles addressing and routing. TTL prevents infinite packet pack packet

looping and ln length will be 15. Header length will be 15. So remember these terms. Now we'll move on to week two. So

week two is about IP addressing fragmentation and uh subnetting. The first three three to four units

we'll be having the basic concepts of computer networks. So here more formulas will be coming. IP fragmentation divides

a packet into smaller fragments when it exits the out outgoing networks. MTU stands for maximum transmission

unit. The three important fragmentation fields are this one identification,

flax and fragment offset. The fragment of offset

provides the specifies a fragment position in unit of 8 bytes. So this is the formula.

For example, if the fragment offset is 1,000 means 100 means the bite position is 800

bytes. 100 into 8 you'll be having 8 800. So next is the fragmentation flags. D don't fragment. D is equal to 1 means

fragmentation is prohibited. M for more fragments. M is equal to 1 means more fragments follow. M is equal

to0 indicates the last fragment. And uh the IP header length we already seen this formula in the week one itself

ln into four bytes it will be mentioned in 32 bits words. So we can to convert into bytes we'll be

multiplying by four. So the maximum mental is 15 giving a maximum IP header length of 60 bytes.

Calculate the data bytes that is equal to total packet size total packet size minus the header size.

For example, if the packet size is 2,000 and the header size we are already seeing that 60 bytes. So the data size

will be 1 1940 bytes. So so the next thing is one of the

important concept IP v4 address classes. So we'll be dividing into class A, class B, class C, class D and class E.

Class A is from 1 to 126 the first octed used for the uniccast.

Class B 128 to 191 uniccast. Class C 192 to 223 it is also uniccast. Class D 224 to 22 multiccast and class D

is for reserved for and for experimental purpose. And the next is the private address private IP address.

So used inside the private networks and are not globally routed as IPv4 10.0.0.0/8

172.16.0.0/12 and 192.168.0.0/16. 0/16.

So be careful 172.13 sorry 172.32 is not a private. So the private ranges within the 172 block

extend from 1726 to 17231. And the next one is the subnetting

divides the total network into smaller logical networks by using the bits from the position of an

address. So it helps organize the address allocation and separate network segments

segmenting. Total address is 2 power 232 32 - n and uh usable host will be 2^ h -2

where h is the number of host bits the formula is as special case uh exception so

apply according to the coing and the next one is vm and c variable length subnet masking

different subnets to use the different mask length and C classless interdomain routing prefix notation such as this /

24. So TCP I'll be having a three-way hand and

shake synchronization synchronization acknowledgement and the last one we'll

be receiving the acknowledgement if LCB segment with synchronization is equal to one and acknowledgement is

equal to zero it indicates the initial connection request. Then next one UDP header eight bytes and

contain four bits source port, destination port, length and the check sum.

Remember these things are uh these are the important concepts that that is a exam quick revision for unit

3. The main things are this one and uh this has we are already

discussed this class B class C your private address ranges initial TCP connection request

UDP and if D is equal to0 don't fragment M is equal to0 more fragments we'll discuss some previous questions

why do we need fragmentation to due to the varying MTU across the networks

and these questions will be having multiple answer. D flag is set zero and M flag set is one

offset is zero. So which of the following is true? The packet has been fragmented and this

and it is the first fragment this also we had already discussed 2,00 and this lener is 15 so bytes will

be 15 into 4 I'll be getting 60 bytes 2,000 - 60 the answer will be 1 9

4 0 in the choice they are given as a range. So this is this will be the range and uh

this example will be surely be asked for your final exam. They will be giving a class address

ranges and which class they belong to. This 128 means class B and this 192 193 also will be belonging to class D.

Private address as we discussed early. This is one of the private address but here they are given as

172.32. It must be 16 to 31. So this is only this is correct.

The correct answer is option C. Synchronization is equal to 1 and acknowledgement is equal to zero.

Initial connection request UDP header we'll be knowing eight bytes. in the next one.

So if you they are giving the question like did this for subnetting. So we have to do the and operation

bitwise and convert this 192 into binary form. For 255 I'll be having eight ones. 1 one one

one. So if you are multiplying this binary convertible value into all one means 1

into 1 I'll be getting one. So the final answer will be for the two terms I'll be having 255 255. So this 192 168 will be

same and this 77 has to be converted into binary. Then you have to multiply it with the binary value of 232.

Any any value multiplied with zero I'll be getting zero. The answer will be this one.

So next is week four uh sorry week three routing and IP IP v6. The main concept is

routing determines how packets move from a source network to a destination network. Static routing,

manual configuration, manually configured routes. Dynamic routing, there is no automatic update. And

dynamic routing allows router to exchange information and update the routes automatically.

So direct versus indirect delivery. Direct delivery when a destination is reached over a

locally connected network same physical network and this one is for another network.

So default route this is the thing 0.0.0. So routing table flags I'll be using

these terms. U denotes route is up. G is oh no G means gateway. H is the post specific route,

dynamically created route, dynamically modified route and uh now the routing protocols

I'll be classifying as interior gateway protocols, exterior gateway protocols. Interior means within an autonomous

system. example your routing information protocol and OSPF open shortest path first then external gateway routing

protocol I'll be having BCP border gateway protocol routing between different autonomous system

different autonomous system so RIP one of the interior routing it uses distance sector routing and uses is the

outcome. So the main drawback is count to infinity problem or routing loop

problems. So it comes under interior plus distance vector plus up count

OPF open shortest path. It uses it is also interior routing. It uses link state. Link state.

So calculates the route with the least cost. Link state plus lease cost. Here it is

distance vector plus the up count and uh border gateway protocol routing between different autonomous systems.

So it uses that ECP port 179 that is interas inter means between different different

autonomous system. So interas plus TCP 179 and these are some BJP BGP messages. The last one is will be IP V6.

So V4 will be using 32-bit address while V6 will be using 128 bit addresses. It will not be it will not use the

traditional addressing class A, class B and class C. [snorts] Base header size is 40 bytes

and these are the transition. This is a quick revision. So what you We have seen direct delivery indirect

delivery default route RIP

the drawback is count to infinity problem and this one PGP inter enter inter means different

different autonomous system plus it uses that TCP port 179 IPv6 128 bits header is 40 bytes

No, no traditional classes like class A, class B and class C. Transition you'll be having dual stack tunneling and

translation. So these are some previously asked uh assignment questions.

A routing table entry that is manually configured remains unchanged unless manually modified. dash is called the

routing table entry static and these are the other questions and this denotes a multiple

andable answer can be selected as we seen already count to infinity problem it occurs in RIP

different different autonomous system or interas we are will be using border gateway

protocol. So week four is about visualization reconc

uh visualization allows multiple virtual machines to run on one physical computer.

IPA super supervisor or also called as a virtual machine monitor manages the virtual machines and allocates

resources. There are two types of approaches. One is a pack passive and another one will

be active. Passive means gather information indirectly without

directly probing the target. Example include WHIS, Netcraft, the wayback machines and

search engine operators. Active involves direct communication with the target. So it can reveal more technical

information but it has a greater risk of detection. So these are the examples of passive

and Google search operator. So remember these tools whis provides domain registration

information. Domain registration information. Netcraft provides a website and hosting

related information. The wayback machine provides historical website snapshots.

Historical website snapshots. Now the search operators the quotation marks are used to search

for an exact face. The site this one site operator restricts results to a

particular website or a domain. Then file type operator searches for files of a specified type.

And the next one is a NMAP network delivery and scanning tool. It fuses include host dis discovery,

port scanning, service and uh version detection and operating system detection,

ICMP sweep. So ICMP type 8 echo request and type zero echo replay. And the next will

be the post discovery. So these are the main thing you have to remember

and these are some previous questions. So which of the following statement is true? A hypervisor allows

only one host to run multiple virtual machines by sharing the resources. Passive. Passive as I told information

about the target is collected indirectly and there is no chance of deduction. Active means it will be collected

directly. And these are the other questions. Sweep

is used to detect the live host. And this one-ph

tells nm a to skip the port scanning and perform only host discovery.

So focus on passive versus active difference. the purpose of uh WHIS and the wayback machines, Google search

operators and MP request versus reply. So passive means indirect active means

direct. WHIS provides registration information. Way back provides historical snapshots.

ICMP type 8 is request and type zero is replay. So how many ports does uh NMAP can scan?

So it it will be th00and ports and coming to the week five vulnerability scanning and system

hacking. First distinguish port scanning from vulnerability scanning. Port scanning

identifies open, closed or filtered ports on a target system.

It is not same as the full vulnerability assessment. Then coming to the vulnerability

scanning searches for security weakness in system networks and applications that is identify the

weakness in the systems. So these are some tools and NMAP scripting engine or NS extends

NMAP through scripts that automate different checks. The script script default opens the

default NSC scripts and these are the other concepts. Excess is a remote security scanning

tool that examines computer and networks for vulnerabilities and generates scan reports. Password cracking is there.

Attempts to recover or guess passwords. Privilege escalation occurs when a user gains permission

beyond the current access level. Two types vertical privilege escalation

horizontal privilege escalation. So the last one will be malware. It's a malicious software intended to perform

unwanted or harmful actions. Know the difference between these terms?

Surely questions will be asked on this. This is a quick revisions for the

week five. Virus attaches to host or a program. W means can self-propagate

deep inside it. Targen distinguishes itself as a legitimate software and this ransomware holds data or access

for a ransom. Least privilege grant only the permission required. So these are some questions asked the

previous assignments. So which of the following NMBB scripts checks for vulnerability to a slow

lowrisisk do attack? It will be slow check. Uh this is the last one address

resolution protocol. It maps IP address to a MAC address in a local network. Next is about V six.

Main thing many formulas we'll be using here security attacks and cryptography security attacks security attack

categories cryptographics algorithm and key formulas first remember the four classic security attack categories

interruption affects availability. So this is the attack type and this is

the what type of security it is. Example do denial of service and in interception it it affects the confidentiality

unauthorized reading of data modification it affects the integrity and fabrication it affects the

authenticity inserting fake messages or data Just try to memorize this pass.

Interruption means availability, interception, confidentiality. Okay. The next one is symmetric key cryptography

uses the same secret key. Symmetric. So same secret key for encryption and decryption

faster than the asymmetric cryptography suitable for encrypting large amounts of data. Remember these things. Examples

are dees, triple dees and aes. Whereas a symmetric key uses public private key pair.

Same key will same key will not be used. The keys are different roles in encryption and decryption depending upon

the protocol. Examples are your RSA and your DEF element. DS and AS

DS DS and triple DES and AS also will be having advanced encryption standard. A

is a symmetric block cipher with a fixed 128 bit block size length are 120.

This will be surely will be asked in the exam. It support it supported key length. It

not only supported 128, it supports 128, 192 and 252. RSA asymmetric key algorithm

prime factorization problem the main thing the concept what we'll be using in RSC for the key counts the end user each

need the distinct shared symmetry key for each every pair the number of keys will be given by n into n minus one by 2

the diff element and key exchange. So this one what I told number of keys is equal to n into n

minus one by 2 public key system number of case is 2 n. If the number of keys depends on

cryptographic system the formula is this one number of n into n minus one by 2. For public key system number of keys is

equal to 2 into n. Then the we'll be having a substitution cipher each plain text letter which replaced

with another letter corresponding to a mapping or a key. So this is the formula. Surely problems will be asked

in this by using this formula. just you have to convert the cipher plain text into

cipher text by using the you have to add the key and you have to take mod 26.

So these are the important concepts what you have seen. A quick revision.

Memorize these four terms. Symmetric key same as symmetric different. And uh memorize

this block size also. DS 56 AES 128. AES can also support 128, 192 and 256. symmetric key n into n - 1 by 2 private

public key 2 n shift cipher I'll be using p + k mod 26 so these are the

previous previously asked questions 100 parties want to exchange messages securely using public cryptographic RSA

the number of distinct key will be 200 and this one we also we have seen just memorize it

attack the do it is a interruption here you have to apply the formula then you have to calculate it

a as I It not only supports 128, it also

supports 192 and 256. So week seven is about ash function, digital signature, SSL and IP security.

A cryptographic ash function takes input of a variable length and produces a fixed length output.

The same input produces the same ash. Different input can produce same ash value. This is called a collision

collision. So in this we'll be having an key dash or modified modification detection code

MDC message authentication code MAC and many ash algorithms. So these are the examples SHA 512.

So ash mapping many to one same input means same as different

messages plus same as is called collision. So un key dash I'll be using the term called as MDC for integrity

MD5 means it is a 128 bit ash sa memorize these four parts definitely you'll be getting a questions

in this sa 1 means 160 bit sa 256 256 bit dash 512 5 bit output 512 block size is,024

SSL authentication integrity and privacy IP sector tunnel the entire original

packet protected. So these are some previously asked

questions. Two messages m1 and m2 are fed to as function never be true. So the second option will

be never be true. Unkey dash function as I told MDC is for integrating

SHA 512 - bits blocks we have seen already,24 UN key function

MD5 and SHA 26 valid signature created by nonrepudiation.

So IP IP sector transport information with production. I'll be using the transport mode

and VK is about stemography biometrics and de denial of service. Stegnography

hides the existence of a message by embedding it inside another medium such as image, audio or video.

Encryption is different. Encryption hides the meaning of information while

stegnography attempts to hide the existence of information. know the difference between both encryption and

uh steography. So one technique is least significant bit signography or I'll be calling as

LSB. So in an RCB image each pixel has three colors

red, green and blue. If one bit is hidden in each channel three bits can be stored per pixel.

This is the capacity formula in bytes width height and uh number of colors

channels into hidden bits per channel divided by 8. Since they are asking in bytes we are dividing by 8.

Physiological biometrics include fingerprints, iris patterns and retina patterns. Biological biometrics includes

your signature signature dynamics keytop patterns are and these are the other terms. Iris and

retina recognization denial of service. Edo attacks attempts to prevent legitimate user from accessing a

service. It affects the availability. Smurf attack and ping of death attack. Distributed denial of service. domain

name system maps the human readable domain names to IP address. So these are the

terms you have to remember steography encryption difference between a stemography and encryption LSP plus J

JPEG I'll be going against lossy compression three colors per pixel this is an

example 200 into 150 RGB of death oversized IP packets. And these are some previously asked

questions 200 into 150 which is stored in 24 bits three colors. They're asking the LSB.

This one denial of service attack. Example of denial of service attack is

ring of death smurf attack. And coming to the week nine, sniffing, social engineering and network attacks.

Packet sniffing means capturing and examining network packets. It can be used for troubleshooting and security

analysis, but it can also be misused to capture sensitive information. Wireshock is a packet capture and network analysis

tool. It displays packet details and provides protocol information and statistics

and these are the other terms. So coming to the social engineering, social engineering manipulates people

into revealing confidential information are performing action that compromise security.

That is a social engineering. In reverse social engineering, the attacker prevents themsself as an

authority and supports person and the victim approaches them for

assistance. Synchronization flooding. We are already seen this three-way handshake

and remember this term slow loris. Loris is a do attack that keeps HTTP

connection opens by sending the partial request without completing them. Then botnet is there.

Wireshark mode and Wireshark does not perform SQL

injection or manipulate live traffic. social engineering and this is the river

social engineering flooding slow botnet.

So these are some more important concepts and these are some previously asked

questions. uh next week will be hardware security. So

hardware based attacks hardware attacks target the physical device chip or its implementation to

obtain the secret information and cause unintended behavior that is the hardware things. There are many terms are there.

Physical probing involves accessing the internal chip signal using physical techniques. Reverse engineering examines

the internal structure internal internal structure and functionality of a chip.

Now the next will be the side channel attacks. Side channel attacks infer information

from physical characteristics of a device while it performs computation rather than attacking the algorithm

directly. Then differential power analysis hardware

hardware proen is a done malicious modification inserted into a chip chip design or the circuitry

physical uncolonable functions and these are the properties. Please know about hardware attacks, physical

probing, side channel attack, EM analysis, PUF

and the squaring and the multiplication term. And this one is also important one.

And these are some previously asked questions. Which of the following attacks hardware

are invasive in nature? Physical probing and reverse engineering. Physical uncolleable function PF.

So week 10 physical probing is invasive side channel includes timing power and EM. SP examines power traces

directly. DPA uses multiple measurements and statistical analysis. PF supports device unique authentication.

Week 11 is about metasplit, metasloit, SQL map, SQL injection and XLS. The practical security testing must be

performed only on the system for which you have authentication. That is the these parts.

Metasloit is a framework for security testing. So remember the network variables.

Sorry, just uh recall this concepts. Encoder, SQL map, SQL injection.

The main parts will be this yellow last Our last DBS database names, tables

know this symbols and uh what is the concepts stored XSS

stored script reflected input and unsafe? And these are the previously asked

questions. Which of the following metasloit models is used to take advantage of a

vulnerability on same target that is exploit is used to remove target port

set rebound and these are the SQL map. Which of the following SQL map contains extract credential related information?

users, password and current user. So coming to the last week, week 12 focuses on NMAP options and wire

wireshock re capture. So NMAP is used for the network

discovery and scanning. These and all we are already discussed including host discovery, port scanning.

Performs ICMP echo discovery. This one and type zero echo replay.

Then - SN performs the host discovery without port scanning and PN option skips host

discovery and treats the specified host as online. iPhone ST performs TCP connection scan

which is designed as a offen scan. SP optional items service and version detection.

Remember these the terms or which purpose you are reaching which uh syntax or

which part. So which option is used for ICMP echos sweep? Just now you have seen it is P

type zero means host is live by default 1,000 NMP scans means 1,000. The same type of question has been

repeated in the previous week assignments also. So it open NMAP treats all host as online.

So in this unit the we have to remember all the syntax like this

everything will be questions will be from the syntax only. So these are the most important formulas

and must memorize things. The first one networking seven layers. TCP IP four layers. IPv4 32 32

bits. Port is 16 bits. Headder is ln into 4. Maximum is IP header is 60

bytes. Subnetting. And these are the formulas.

Addressing class A, class B, class C, private address and routing. The important term is RAIP, OSPF,

PGP and recurrence and scanning NMAP options cryptography you'll be

applying some formula symmetric key public key and ashing MD5 security properties is so in each unit

one one term is important. Few units we'll be applying the formula. Remaining term you we have to memorize it.

What is the objective of ethical hacking? To legally identify system vulnerabilities.

Then connection less mean. So I'll be going for UDP. Formula for IP V4 header length is LN *

4 bytes. Which routing uses OP count? I'll be going for RIP.

Then which routing protocol is a link state? I'll be going for OPF. So like that we'll be having many many

questions. So we have now revised the important concepts from all 12 weeks of ethical

hacking. My final advice is to revise in st three stages. First understand the core concepts. Second memorize the

formulas, numerical facts, tool names and command options. Third, practice the previous questions without looking at

the answer. Use the keep your uh so in this revision helped you like the video, subscribe to engineering study desk and

share it with your classmates who are preparing for the same examination. Thank you for watching. All the best for

your exam. Thank you.