Ethical Hacking Full Course 2026 | Ethical Hacking Course for Beginners | Simplilearn

Key Takeaways

Hey everyone, welcome to SimplyLearn's ethical hacking full course. The perfect entry into one of the most exciting and in demand fields in tech today. With cyber attacks happening all around, ethical hackers play a vital role in protecting businesses by spotting and fixing security flaws before their attackers can take advantage. In this course, you'll begin with the basics, understand networks, operating system, and common security issues. You'll also learn how to find weaknesses, test system defenses, and conduct real world penetration tests. Plus, you'll study hacker techniques to help you stay ahead of the game. So, let's get started. Before we comment, if you are interested to step into one of the most in demand fields of 2025, the advanced executive program in cyber security by simply learn is your perfect opportunity. In just six months, you'll gain expertise in ethical hacking, penetration testing, ransomware analysis, and advanced defense strategies through hands-on industry relevant approach. Now, this program offered in collaboration with the triple IT Bangalore and IBM features live interactive classes, real world projects and industry recognized certifications. So, hurry up, plan and enroll now and find the course link in the description box below and in the pin comment. We humans are highly tech-savvy in today's times. With the extensive use of the internet and modern technologies, there is a massive challenge in protecting all our digital data such as net banking information, account credentials, and medical reports to name a few. Have you heard about the deadly W to Cry ransomware attack? The attack happened in May 2017 in Asia and then it spread across the world. Within a day, more than 230,000 computers were infected across 150 countries. The one to cry cryptoorm encrypted the data and locked the users out of their systems. For decryption of the data, the users were asked for a ransom of $300 to $600 in Bitcoin. The users who used the unsupported version of Microsoft Windows and those who hadn't installed the security update of April 2017 were targeted in this attack. The one a cry attack took a toll on every sector. Top tier organizations like Hitachi, Nissan and FedEx had to put their businesses on hold as their systems were affected too. Now this is what you call a cyber attack. To prevent such attacks, cyber security is implemented. We can define cyber security as the practice of protecting networks, programs, computer systems and their components from unauthorized digital attacks. These illegal attacks are often referred to as hacking. Hacking refers to exploiting weaknesses in a computer network to obtain unauthorized access to information. A hacker is a person who tries to hack into computer systems. This is a misconception that hacking is always wrong. There are hackers who work with different motives. Let's have a look at three different types of hackers. Black hat hackers are individuals who illegally hack into a system for a monetary gain. On the contrary, we have white hat hackers who exploit the vulnerabilities in a system by hacking into it with permission in order to defend the organization. This form of hacking is absolutely legal and ethical. Hence, they are also often referred to as ethical hackers. In addition to these hackers, we also have the gray hat hackers. As the name suggests, the color gray is a blend of both white and black. These hackers discover vulnerabilities in a system and report it to the systems owner, which is a good act, but they do this without seeking the owner's approval. Sometimes grey hat hackers also ask for money in return for the spotted vulnerabilities. Now that you have seen the different types of hackers, let's understand more about the hacking that is legal and valid, ethical hacking through an interesting story. Dan runs a trading company. He does online training with the money his customers invest. Everything was going well and Dan's business was booming until a hacker decided to hack the company's servers. The hacker stole the credentials of various trading accounts. He asked for a lumpsum ransom in exchange for the stolen credentials. Dan took the hacker's words lightly and didn't pay the hacker. As a result, the hacker withdrew money from various customers accounts and Dan was liable to pay back the customers. Dan lost a lot of money and also the trust of his customers. After this incident, Dan gave a lot of thought as to what could have gone wrong with the security infrastructure in his company. He wished there was someone from his company who could have run a test attack to see how vulnerable systems were before the hacker penetrated into the network. This was when he realized he needed an employee who thinks like a hacker and identifies the vulnerabilities in his network before an outsider does. To do this job, he hired an ethical hacker, John. John was a skilled professional who worked precisely like a hacker. In no time, he spotted several vulnerabilities in Dan's organization and closed all the loopholes. Hiring an ethical hacker helped Dan protect his customers from further attacks in the future. This in turn increased the company's productivity and guarded the company's reputation. So now you know hacking is not always bad. John in this scenario exposed the vulnerabilities in the existing network and such hacking is known as ethical hacking. Ethical hacking is distributed into six different phases. Let us look at these phases step by step with respect to how Jon our ethical hacker will act. Before launching an attack, the first step John takes is to gather all the necessary information about the organization system that he intends to attack. This step is called reconnaissance. He uses tools like inmap and hping for this purpose. John then tries to spot the vulnerabilities if any in the target system using tools like inmap and expose. This is the scanning phase. Now that he has located the vulnerabilities, he then tries to exploit them. This step is known as gaining access. After Jon makes his way through the organization's networks, he tries to maintain his access for future attacks by installing back doors in the target system. The metas-ploit tool helps him with this. This phase is called maintaining access. John is a brilliant hacker, hence he tries his best not to leave any evidence of his attack. This is the fifth phase, clearing tracks. We now have the last phase that is reporting. In this phase, John documents a summary of his entire attack, the vulnerabilities he spotted, the tools he used, and the success rate of the attack. Looking into the report, Dan is now able to take a call and see how to protect his organization from any external cyber attacks. Don't you all think Jon is an asset to any organization? If you want to become an ethical hacker like John, then there are a few skills that you need to acquire. First and foremost, you need to have a good knowledge of operating environments such as Windows, Linux, Unix, and Macintosh. You must have reasonably good knowledge of programming languages such as HTML, PHP, Python, SQL, and JavaScript. Networking is the base of ethical hacking. Hence, you should be good at it. Ethical hackers should be well aware of security laws so that they don't misuse their skills. Finally, you must have a global certification on ethical hacking to successfully bag a position of an ethical hacker like John. Few examples of ethical hacking certification are certified ethical hacker certification C, CompTIA pinest plus, and licensed penetration tester certification to name a few. Simply learn provides a cyber security expert masters program that will equip you with all the skills required by a cyber security expert. You could have a look at it by clicking the link in the description. So, here's a question for you. In which phase of ethical hacking will you install back doors in the target system? A scanning, B. Maintaining access, C. Clearing tracks, D reconnaissance. Give it a thought and leave your answers in the comments section below. Three lucky winners will receive Amazon gift vouchers. The endless growth of technologies in this area is directly proportional to the number of cyber crimes. Cyber crimes are estimated to cost $6 trillion in 2021. Hence, to tackle these cyber crimes, organizations are continuously on the lookout for cyber security professionals. The average annual salary of a certified ethical hacker is $91,000 in the US and approximately rupes 7 lakhs in India. So, what are you waiting for? get certified and become an ethical hacker like John and put an end to the cyber attacks in the world. So let's talk about hacking and what exactly hacking is. Hacking refers to exploiting weaknesses in a computer network to obtain unauthorized access to information. A hacker is a person who tries to hack into computer systems. Now here there are some key words that we need to understand. First and foremost, exploit. when you're exploiting weaknesses. Weaknesses are technically called vulnerabilities which are basically design flaws, misconfiguration errors, usage of default usernames and passwords which have not been modified. So any misconfiguration or anything that has been left behind by a security administrator that can be misused which means exploited by a hacker to gain unauthorized access. So the next term is unauthorized access something that you're not allowed to do. And when you say a hacker is a person who tries to hack, it's basically a person with malicious intent trying to gain access to a system or a resource that they are not authorized to access in the first place. How do they do it? They find a vulnerability that is a weakness or a flaw and then they misuse it to gain access to that particular network. So here in the diagram you can see that a sender on the left hand side is trying to send some data to the receiver on the right hand side. The hacker would try to gain unauthorized access to the transmission that is being sent and would try to capture the data packets and read the secrets within. Let's look at a business case scenario into hacking. Now there is an organization uh everybody's going around their own business when they realize that their systems may have been compromised. Now they're trying to look at the customer data to ensure that that has not been compromised and trying to assure the customers. However, they do realize that some customer data has been lost and even the company reports have been modified as well. Now, this is the scenario where there have been some security controls in place and those controls have been identified. They realized that there is an attack that has happened and based on that attack, they have realized that the data has now been compromised and the records have been modified uh by the hacker which means that the data is no longer trustworthy and thus cannot be used by the business for any legal transactions. So then the hacker gives a call to the organization or gets connected to the organization demanding a ransom for the data to be replaced to be taken back into the original state where it was trusted and thus the organization can utilize it for business transactions. The organization has probably no backup. So they decide that they want to pay the lumpsum to the hacker to restore that data so that they can continue on with the business. does money exchanges and the hacker is able to restore that data and the business continues at as usual. However, the activity here of a hacker trying to leverage the misconfiguration of the weaknesses in the organization's security thus being able to hack them and uh make these ransomware demands. So the company then wants to figure out even having a security system in place how was the hacker able to hack their systems. Thus, one of the employees comes up with a brilliant idea of identifying vulnerabilities in the network uh to proactively search for any flaws that have been left behind uh so that they can plug those flaws and nobody can misuse them. Thus, they figure out that they want to hire a ethical hacker who would help them identify the security posture of the organization, identify the weaknesses, vulnerabilities and flaws and help them remedy those flaws so that in future scenarios these scenarios will not happen. So before we go into an ethical hacker, let's understand what are the types of hackers. So what are the types of hackers? Hacker is a technically skilled person uh who is very adept with computers. They have good programming skills. They understand how operating system works. They understand how networks work. They understand how to identify flaws and vulnerabilities within all of these aspects. and then they understand and know how to misuse these flaws to get a outcome which would be detrimental to the health of the organization. So there are six type of hackers that have been identified. Black hat hackers, white hat hackers, grey hat, script kitties, nation sponsored hackers and a hackists. So black hat hackers are bas basically uh the malicious hackers who have malicious intent and have criminalistic tendencies. They want to harm the organization by hacking into their infrastructure, by destroying their infrastructure, by destroying their data so that uh they can gain from it from a monetary perspective. Uh these guys are also known as crackers. The main aspect of these uh people are that they have malicious intent. They try to do unauthorized activities and they try it for personal gain. Another important aspect to remember is that a black hat hacker will always try to hide their identity. uh they will spoof their online digital identity by masking it by spoofing their IP addresses, MAC addresses and try to remain anonymous on the network. A white hat hacker on the other hand is also an ethical hacker or a security analyst who's an individual who will do exactly the same thing that a blackhead hacker would do minus the malicious intent plus the intent of helping the organization identifying the flaws and remedying them so that nobody else can misuse those vulnerabilities. So they are authorized to act on the company's behalf. They are authorized to do that activity which would help the company identify those flaws and thus help the company mitigate those flaws improving on their security posture. So these uh these kind of security experts or ethical hackers would help organizations defend themselves against unauthorized attacks. Greyhead hackers is a blend of both white hat and black hat hackers. So here they can work defensively and offensively both. They can accept contracts from organizations to increase their security posture. At the same time, they can also get themselves involved in malicious activities towards other organizations to personally gain or benefit from them by doing unauthorized activity. Script kitties are people uh who are technically not much aware about what hacking is. Uh they rely on existing tools that have been created by other hackers. They have no technical knowledge of what they're doing. It's just a hit or miss for them. So they just get their hands on a tool. they try to execute those tools. Uh if the hack works, it works otherwise it doesn't. So these people are basically who are noobs or newbies who are trying to learn hacking or uh just uh people who with malicious intent who just want to have some fun or trying to impress people around. Then we have the nation or the state sponsored hackers. As the name suggests these hackers are sponsored by their government. Now this may not be a legitimate job but most of the governments do have uh hackers uh enrolled in their pay on um on their organizations to spy on their enemies to spy on various countries and try to figure out uh the aspirations of those countries. So this is basically a spying activity where you are technically trying to get access to other count's resources and then try to spy on them to figure out what their activities have been or what their future plans have been. And then we have the activists who is an individual who has a political agenda to promote and they promote it by doing hacking. So uh these guys what is the difference between a blackhat hacker and a hackist? The black hat hacker may try to hide their identity. A h activist will claim responsibility of what they have done. So for them it's a political agenda political cause and they will try to hack various organizations to promote their cause. They would probably do this by defacing the website and posting the messages that they want to promote on these websites. So what exactly is ethical hacking? Then we have discussed the types of hackers. We have identified a malicious hacker as a black hat hacker with the intent uh of doing harm to an organization's network for personal gain. We have discussed what the ethical hacker is. So an ethical hacker would be doing the same activity but in an authorized manner. So they would have legal contracts that they would be signing with the organization which would give them a definite scope of what they're allowed to do and what they are not allowed to do and the ethical hackers would function within those scopes would try to execute those uh test scenarios where they would be able to identify those flaws or those system vulnerabilities and then they would be submitting a report to the management of what they have found. They would also help the management to mitigate or to resolve those weaknesses so that nobody else can misuse them later on. They might use the same techniques and the same tools that blackhat hackers do. However, the main difference here is that these guys are authorized to do that particular activity. They're doing it in a controlled manner with the intent of helping the organization and not with the intent of personal gains. So, who's an ethical hacker? Again, an ethical hacker is a highly intelligent, highly educated person who knows how computers function, how programming languages work, how operating systems work. They can troubleshoot. They're technically very adept at computing. They understand the architecture. they understand uh how various components in a computer work. They can troubleshoot those components and they can basically be uh very good with programming as well. Now when I say programming, we don't want a ethical hacker to be a good developer of applications. We want them to understand programming in such a way that they can create scripts, they can write their own short programs like viruses, worms, trojans or exploits which would help them achieve the objective that they have set out for. So uh here you can see the ethical hacker there are individuals who perform a security assessment of their companies with the permission of cons concerned authorities. So what is a security assessment? A security assessment is finding out the exact security posture of the organization by identifying what security controls are in place how they've been configured and if there are any gaps in the configurations themselves. So an organization will hire a ethical hacker. say they would give the ethical hacker the information about what information is or what security controls, what firewalls, what IDSS, IPSS, introen detection or introen prevention systems, antiviruses are already in place and then they will ask the ethical hacker to figure out a way to bypass these mechanisms and see if they can still hack the organization. What is the need of an ethical hacker? The need of an ethical hacker is proactive security. The ethical hacker would identify all the existing flaws in an organization and try to resolve those flaws to help secure the organization from blackhead hackers. So ethical hackers would prevent hackers from cracking into an organization's network by securing the organization by improving on their security on a periodic basis and they would also try to identify system vulnerabilities, network vulnerabilities or application level vulnerabilities that would have been missed or have already been missed and then try to figure out a way of plugging them or uh resolving them so that they cannot be misused by other hackers. They would also analyze and enhance an organization security policies. Now what are policies? Policies are basically documents that have been created by an organization of rules that all the employees need to follow to ensure that the security of an organization is maintained. For example, a password policy. A password policy would help users in an organization to adhere to the standards the organization has identified for a password complexity. For example, a password when a user is creating them should adhere to standards where they are using random words. They are uh they contain the alphabet A through Z uppercase and lower case 0 through 9 as numeric and special characters and they're randomized so that the password becomes more more stronger to prevent from brute force attacks. So what would an ethical hacker do at this point in time? They would try to test the strength of the passwords to see if brute force attacks or dictionary attacks are possible and if any of these passwords can be cracked. They would ensure that all the employees are following the policies and all the passwords are are as secured as the policies want them to be. If there are any gaps in the policies or the implementation of the policy, it is the ethical hacker's responsibility to identify those gaps and warn the organization about it. Similarly, they would also try to protect any personal information, any data that is owned by the organization that is critical for the functioning of the organization and they'll try to protect it by from falling into the hacker's hands. Now what are the skills that are required of an ethical hacker? These are the following skills. So first and foremost they should have good knowledge with operating systems such as Windows, Linux, Unix and Mac. Now when we say knowledge about operating systems, it's not only about how to use those operating systems, but how to troubleshoot those operating systems, how these operating systems work, how these operating systems need to be configured, how can they be secured. For example, securing an operating system is not only installing a firewall and an antivirus, but you need to configure permissions on an operating system of what users are allowed to do and what users are not allowed to do. For example, limiting the installation of applications. How are we going to do that? We need to go into the system center, the security center of Windows, and we need to configure security parameters over there of what are acceptable softwares and what are not. Same with Linux and uh Mac softwares, operating systems. So we need to know how we can secure these operating systems. Similarly, all of these would have desktop versions and server versions of operating systems. As a ethical hacker, we need to know the desktop and server versions both how to configure them and how to provide services within the organization on these servers so that they can be consumed in a secure manner by all the employees. At the same time, they should also be knowledgeable of programming languages or scripting languages such as PHP, Python, Ruby, HTML for programming, if you will, because web servers come into the picture. So again, they should not be great developers where they can create huge applications, but they should be able to develop scripts, understand those scripts, analyze those scripts, and figure out what the output should be of those scripts to achieve the hacking goals that they have set out for. An ethical hacker should have a very good understanding about networking. No matter whether you're in application security, you're in network security, or you're in hostbased security. Since a computer will always be connected to a network, either a local area network like a LAN or the internet, we should know how networking works. We should know the seven layers of the OSI model. We should know which protocols work on those seven layers. We should identify the TCP IP model and how OSI model can be mapped to the TCP IP model. We should understand how TCP and UDP work. How uh how each and every protocol is crafted, how they are supposed to behave for us to analyze and understand any network based attacks. We should be very good in security measures. So we should know where those vulnerabilities would lie. What are the latest exploits available in the market and we should be able to identify them. We should be able to know the techniques and the tools of how to deal with security, how to analyze security and then how to implement security to enhance it as well. Along with that, it is important that a security analyst or ethical hacker is aware of the local security laws and standards. Why is that? Because an organization cannot do any illegal activity. Whatever responses that they have, whatever security mechanisms, whatever security controls they will implement, they need to be adhering to the local law of the land. They should be legal in nature and should not cause undue harm to any of the employees or any of the third party clients that they are dealing with. So the ethical hackers should be aware of what uh security laws are before they implement security controls or even before they start testing for security controls. And all of these should be backed up by having a global certification or a globally valid certification related to networking related to security, ethical hacking, the law of the land, anything and everything. maybe even programming. Uh it's good to have a certification in PHP, Pearl, Python, Ruby and so on so forth. Why? Because most of the organizations when they hire ethical hackers look out for these certifications especially globally valid certifications so that they can be sure or they can be assured that the person that they are hiring has the required skill set. So let's talk about a few of the tools that a ethical hacker would utilize uh in their testing scenarios. To be honest, there are hundreds of tools out there. What you see on the screen are just a few examples of them. Uh Nessus is a vulnerability scanner. What is a vulnerability scanner? It is an automated tool that is designed to identify vulnerabilities within hosts, within uh operating systems, within networks. So they come with their readymade databases of all the vulnerabilities that have already been identified and they scan the network against that database to find out any possible flaws or any possible vulnerabilities that currently exist on the host or the operating system or on the network. Similarly, there would be application scanners like uh Aunetics or Arachnne that would help you scan applications and identify flaws within those applications as well. Now all of these are automated tools. The essence of ethical hacker is when these tools churn out the reports, the ethical hacker hacker can understand these reports, analyze them, identify the flaws and then craft their own exploits or use existing exploits in a particular manner so that they can get access or they can bypass the access security controls mechanisms that are already in place. How can they do that? With the tool called metas-loit. You see that big M there on the right hand side. That M logo is for a tool called metas-loit which is a penetration testing tool. What is a penetration testing tool? It is that tool that will allow a ethical hacker to craft their exploits or choose their exploits for the vulnerabilities that have been identified by Nessus. Since we are interacting with computers, we will always be interacting using tools. Right? So the first tool Nessus identifies the flaws and the possible list of vulnerabilities. We do a penetration test using metas-loit to validate those flaws and to verify that those flaws actually exist and try to figure out the complexity of those flaws and that's where metasloit helps us do that. Wireshark would be used in the background while we are doing both the activities using Nessus or metasloit to keep a track of what packets are being sent and by received on the network which will help us analyze those packets. So whenever I run a ns scanner I would run a wireshark in the background. it will capture the data packets and I can go through those data packets and analyze that data packets to identify what Nessus is actually trying to do. Similarly, when I try to attack a machine using exploit on metas-loit, I will keep on wireshark running in the background to capture the data packets that have been sent and the responses that I've received from the victim. So that I can also go through those packets and analyze the responses and analyze the attack whether it was successful to what extent was it successful and basically will also give me a validation a proof of the activity that has happened. N MAPAP is another automated tool that allows me to scan for open ports and protocols. So why would I use N MAPAP? Because pro ports and protocols become an entry point for a hacker to gain access to devices. For example, when we connect to a web server, we connect through a web browser, but we automatically connect to port 80 using HTTP and port 443 is using HTTPS. So if I'm connecting to a web server using HTTPS, it is safe to assume that port 443 on the web server is open to accept those connections. Similarly, there would be other services that may be left open on the web server because nobody thought about configuring it or they misconfigured the web server and they left unwanted services running. So end mapap will allow me to scan those ports and services and allow me to understand what services are being offered on that server. So then I can start analyzing that server, identify those flaws within those services and then try to attack them. If the application that I'm analyzing is connected to a database and I want to do a SQL injection attack or if I if Nessus tells me that there is a SQL injection attack that may be possible on that particular application, I can use an automated tool called SQL map or SQL map that would allow me to automatically craft all the queries that are required for a SQL injection attack and help me do that attack at the same time. So here I do not have to manually create my own queries. Uh the SQL map tool would automatically create them for me. What I would do is I would use Nessus to identify that particular flaw. If Nessus reports that flaw, I would then go use the tool SQL map configure it to attack that particular web server. And when I fire off the tool, it will then automatically start directing queries, SQL injection queries to the database to see if those uh databases are vulnerable and if yes, what data can be retrieved from those databases. So all of these tools in a nutshell would help me hack networks, applications, operating systems and host devices. And this is what the ethical hacker does. They use these kind of tool sets. They identify what attacks they need to do. They identify the right tool for that particular attack and they write their exploits. They create those attacks and then they start attacking. Analyze the response and then give a report to the management uh providing them feedback about how the attack was created or crafted, what was the response to that attack and whether the attack was successful or not. If successful, they would also give recommendations of what to do to prevent these attacks from happening in the future. So when we are doing these attacks or when we want to launch these attacks, what is the process that that we would follow? So there are six steps that we would do as a ethical hacker. If you are just a hacker, you probably wouldn't do the sixth step which is a reporting step. So the first step that would be done is the reconnaissance phase which is the information gathering phase which is very important from ethical hacker's perspective or a hacker's perspective because if I want to attack someone or something as a digital device, I need to know what I'm attacking. I need to know the IP address of the device, the MAC address of those devices. I need to know the operating system, the build or the version of that operating systems, applications on top, the versions of those applications. So I know what I'm attacking. For example, if I if I want to attack a server, I assume it's a Windowsbased server and I use a particular tool to attack it, but it actually turns out to be a Linux based server, my attacks are going to be unsuccessful. So I need to focus my attack based on what is there at the other end. So in my information gathering phase, I want to identify all of that information. Once I have that information done, I'm going to scan those servers using tools like end mapap that we just talked about. And we're going to try to see the open ports, open services and protocols that are running on that server that can give me possible entry points within the network or within the device or within the operating system. At the same time along with the scanning with end mapap I would run a vulnerability scanner the necess vulnerability scanner we talked about or acunetics for applications and then I would try to identify vulnerabilities in those applications operating systems or networks. Once I have identified those vulnerabilities in the scanning phase I would then move on to the gaining phase where I would then craft my exploits or choose existing exploits and start attacking the attacking the victim. At this point in time, if my attack is successful, I will probably have gained access uh by either cracking passwords or escalating privileges or exploiting a vulnerability that I may have found during the scanning phase. Once I have gained my access, I want to maintain my access. Why? Because the vulnerability may not be there for long. Maybe somebody updated the operating system and hence the flaw was no longer exist existing or somebody changed the password that may I may have cracked. Thus, I no longer have access. So what do I do to maintain my access? I install Trojans or backdoor entries to those systems using which I can secretly in a covert manner get access to those devices at my own will at my own time as long as those devices are available over the network. So that's where I maintain my access. I have hacked them. Now I want to maintain my access. So I install a software which would give me a backdoor entry to that device no matter what. Once I've done this I want to clear my track. So whatever activity that I've been doing for example installing a Trojan a Trojan is also a software that would create directory directories and files once installed on the victim's machine. So I want to hide that. If I have access data stores if I have modified data I want to hide that activity because if the victim comes to know that something has happened they would start they would start increasing their security parameters. They might start scanning their devices. They may take them offline. Thus my hack would no longer be efficient. The reason I'm clearing my tracks is that the victim doesn't find out that they have been hacked or they have been compromised. Or even if they do find out that they've been compromised, they cannot trace the compromise back to me. So I would be deleting references of any of the IP addresses or MAC addresses that I may have used to attack that particular device. And this is where I will be able to identify where those logs were created, where those traces are. Once I take off those traces, the victim would not be any wiser of whether they have been compromised or who compromised their system. And if I am successful at all of these stages or what to whatever extent the success that I've achieved in any of these stages, I would then create a report based on that and I would report to the management about the activities that we have been able to do and whatever we have been able to achieve out of those activities. For example, we identified 10 different flaws. There were 20 different attacks that we wanted to do. what attack did we do? What was the outcome of that attack? What was the intended or or the expected output of that attack? I'll create a report which would give a detailed analysis of all the steps that were taken along with screenshots and evidences of what activity was conducted, what was the output, what was the expected output and I would submit that report to the management giving them an idea of what vulnerabilities and flaws exist in their environment or their devices that need to be mitigated so that the security can be enhanced. So these are the six steps that the ethical hacking process would take. uh just going through this the uh reconnaissance is where you're going to use hacking tools like N map MAP edge pane to obtain information about targets there are hundreds of tools out there depending on what information you want then in scanning again N map MAPAP Nexpose these kind of tools to be utilized to identify open ports protocols and services in gaining access you're going to exploit a vulnerability by using the metasloit tool that we talked about in the previous slides in the maintaining access you're going to install back doors you can use metasloit at the same time uh you can craft your own scripts to create a Trojan and install it on the victim's machine. Once you have achieved that, clearing tracks is where you're going to clear all evidences of your activity so that you do not get caught or the victim doesn't even realize that they have been hacked. And once you have done all of this, we are going to create reports that are going to be submitted to the management to help them understand the current security evaluation of their organization. So now let's see how we can hack using social engineering. Now what is social engineering? Social engineering is the art of manipulating humans into revealing confidential information which they otherwise would not have revealed. So this is where your social skill and your people skills come into the picture. If you're able to communicate effectively to another person, they would probably give up more information that they intended to give out. Let's look at look at examples. Right? If you see on the screen fishing activity, what is fishing? We receive a lot of fake emails on a regular basis. We have always received those emails where we have won a lottery of a few million dollars, but we have never realized that we didn't purchase a lottery to win a lottery in the first place. We have always had those Nigerian frauds where a prince died in some South African country and you out of 7 billion people on the planet have been identified where they want to transfer a few hundred million through your account and they want to give you 50% of that money in return as thank you. So, some very basic attacks where you go on two websites and there's a banner flashing at you saying, "Congratulations, you're the 1 millionth visitor to this website. Click here to claim your prize." All of these are social engineering attacks, fishing attacks, fake websites, fake communications being sent out to users to prey on their gullibility. Most of humans always have that dream of striking it rich, winning a huge lottery once and for all, and living their life lavishly ever after. But sadly in the real world that's not that doesn't happen that often. And if you're receiving those mails, it is very important that you first research the validity of those those communications before you even want to act upon them. So why are humans susceptible to social engineering? Because humans have emotion. Machines do not. Try pleading with a machine to give you access to a account that you have forgotten a password to. The machine wouldn't even know what you're doing. Try pleading with a human sympathy or empathy where you could try to create a social engine injuring attack where you can plead with them saying if I do not get access to this account immediately I might lose my job and then that would put my family into problems. Somebody would feel empathy or sympathy towards you and help you reset that password and give you access to that account. It's how good the attack is and how convincing you are for the success of this attack to happen. So what is a familiarity exploit? Attackers interact with victims to gain information which will benefit the attackers to crack credentials. As passwords, if we want to reset our passwords, what do we have as a mechanism to resetting passwords? We have some security questions that we set up. Those questions are nothing but personal information that we would know. But through a social engineering attack, we it would be easily be able to uh gather the information that you have set for your security questions. The security questions can be as simple as the first school that you attended. you probably have that listed on your LinkedIn profile where a per person can just go in there and see your academic qualifications and identify the school that you were in right similarly it might also be a question what was your mother's maiden name that's a very good attack and that's uh I mean if a person can interact with you let's say they're trying to take a survey and they approach you for a feedback on a particular product that you have been utilizing and they ask you these questions you wouldn't think twice before giving those answers as long as the request sounds legitimate to us we are able to justify that request, we do answer those queries. So, it's upon us to verify the authenticity of the request coming in before we answer it. Fishing as discussed would be fraudulent emails which appear to be coming from a trusted source. So, email spoofing comes into mind, fake websites and so on so forth. Exploiting human curiosity, curiosity killed the cat, right? So there was there's so many physical attacks where hackers just keep pen drives lying around in a parking lot. Now this is a open generic attack. Whoever falls victim will fall victim. So if I just throw around a few USBs in the parking lot obviously with Trojans implemented on them. Some people who are curious or who are looking for a couple of freebies might take up those pen drives plug them in their computers to see what data is on the pen drives. At the same time, once they plug in there those pen drives on their computers, the virus or the Trojan would get infected and cause harm to their machine. Then exploiting human greed. We just talked about the Nigerian frauds and the lotteryies, those kind of attacks, the fake money-making gimmicks. Now, basically this is where you prey upon the person's uh greed kicking in and they clicking on those links in order to uh get that money that has been promised to them in that email. So one of the safest mechanism to keep data private and to keep yourself secure is using encryption. Now encryption can happen through cryptography. What is cryptography? Cryptography is the art of scrambling data using a particular algorithm so that the data becomes unreadable to the normal user. The only person with the key to unscramble that data would be able to unscramble it and make sense out of that data. So we're just making it unreadable or non-readable by using a particular key or a particular algorithm and then we're going to send the key to the end user. The end user using the uh same key would then decrypt that data. If anybody compromises that data while it is being sent over the network since it is encrypted they would not be able to read it. So the encryption algorithm would be something like this. Now if you see uh the computer word once made into unreadable format would look like eq o r xv gt for a end user it wouldn't make any sense but the person who has a key to unscramble that would be able to convert it back to computer and then understand the meaning of that word. So this is just a substitution cipher that is being shown on the screen. So what is the alphabet? The key is alphabet plus three. So c plus three alphabets that becomes e o becomes q. M becomes o. So the key that is utilized to scramble the data is the character that you are at the third character from there would be the corresponding key. So the encrypted message is also known as a cipher. The decryption is just the other way around where you know the key now and you can now figure out what that e correspondent to by going back three characters in the alphabet. Most of the times a certified ethical hacker must decrypt a message without knowing the secret key. So let's say a ransomware has affected your organization or has affected a device and you want to figure out uh or you want to decrypt that data. Now as a ethical hacker, you wouldn't be for paying a ransom uh to the hacker, would you? So it is now your prerogative of how you're going to work around and how you're going to try to crack the encryption mechanism, how to crack the cipher to decrypt that message and see what's within it. Right? Decryption without the use of a secret key. That is known as a crypt analysis. Cryp analysis is the reversing of an algorithm to figure out what the decryption was without using a key. So cryp analysis can be done using various formats. The first one is a brute force attack. Second is a dictionary attack. The third one is a rainbow table attack. A brute force attack is trying every combination permutation and combination of the key to figure out what the key was. It is 100% successful but may take a lot of time. A dictionary attack is where you have created a list of possible encryption mechanisms, a list of possible cracks and then you try to figure out whether those cracks work or not. Rainbow tables are where you have an encrypted text in hand and you're trying to figure out uh the similarities between the text that you have and the encrypted data that you wanted to decrypt in the first place. So in the brute force attack, you're trying every possible combination permutation of what the key would be. In dictionary attack, you have a word list that would tantamount to the key. And if you're you're trying to match all the words listed in the text file or the word list to see if any of those words are going to work to decrypt that data. Here in the rainbow table, the cipher text is compared with another cipher text. You find out similarities and then you try to work or reverse engineer your way accordingly. So let's have a quick demo on cryptography before we end this session. So to begin with the demo of cryptography, we are on a website called spammimic.com which will help us scramble the message that we created into a completely format which would be unrelated to the topic at hand. So if I say I want to encode a message, turn a short message into spam. So what this does is want to send across a secret message. You type in the secret message a short one and it will convert that into a spam mail. You send it across. So whoever is reading that spam mail would never get an idea of the embedded message within it. So if I want to type in a message here, hi this is a secret message. The password is askd at the rate 1 2 3 4 and I want to send this out to people or to one of my colleagues but I want to send it out in a secret manner so that others are not aware of this. So when I press on encode what the algorithm would do is it will convert this message into a spam mail. So my message hi this is a secret message the password is at the rate 1 2 3 4 or asd at the rate 1 2 3 4 gets converted into this. Now if you read it dear e-commerce professional this letter was specially selected to be sent to you. This doesn't make sense. There is nowhere or no reference to the actual message that I've already said. So if I copy this entire message and I send it let's say via email to the recipient. Now the thing is that the recipient needs to know that I've encoded it using spam mimic. The algorithm rem needs to remain the same. So once they know that it is spam mimic what they can do is now in this instance what I'm going to do is I'm going to open up a new browser and I'm going to go to the same website and at this point in time I'm going to click on decode. When I click on decode I'm going to paste the message that I have just copied. There we are. And this message is now being copied into a different browser. And if I decode this, you will see that it will convert it back to the original message that there was. So the key is there at spam mimic and it is embedded within the message. So whenever we paste the message in the decode factor, it knows what the key was and it can decrypt that message and give me the actual message that was embedded within it. There we are, the entire message. This is what we created in the Google Chrome browser and in the Firefox browser we decoded. Similarly, if I want to protect these kind of messages, there is an aspen encrypt.com website where let's say we use text encryption and I want to encrypt the same message. This is a secret message. The password is ASD at the rate 1 2 3 4. And then I give it a password to protect this message. Let's say the word password. And I use the cipher to scramble this by using let's say AES which is the strongest cipher right now and I say encrypt. So this is what the encryption would look like. And basically uh if I don't have the password over here, if I decrypt it, you would see that the error has occurred. Now if I type in the password over here and then decrypt it, it will be able to convert that back into the unscrambled text and it will give me what the original message was. This is a secret message. The password is ASD at the rate 1 2 3 4. So if I want to keep my data secure from