Hacking Fundamentals

Purpose

Provide foundational knowledge of hacking concepts, network protocols, attack methodologies, and security tools. This skill covers essential theory for aspiring penetration testers and security professionals including network architecture, DNS operations, attack classifications, and tool categories.

Prerequisites

Required Knowledge

Basic computer literacy
Understanding of operating systems
Familiarity with command-line interfaces

Recommended Background

Networking concepts
TCP/IP fundamentals
Basic security awareness

Outputs and Deliverables

Conceptual Understanding - Hacking terminology and classifications
Network Knowledge - Protocol and architecture comprehension
Attack Recognition - Active and passive attack identification
Tool Familiarity - Security tool categories and applications

Core Workflow

Phase 1: Hacker Classifications

Understanding hacker types and motivations:

White Hat Hackers

Ethical hackers and security professionals
Perform authorized penetration testing
Work to improve organizational security
Also called: penetration testers, sneakers, red teams

Black Hat Hackers

Malicious actors seeking unauthorized access
Breach systems for profit or damage
Also known as crackers
Target selection: reconnaissance → information gathering → attack

Grey Hat Hackers

Operate between ethical and malicious
May act illegally with good intentions
Often disclose vulnerabilities publicly
Not motivated by personal gain

Other Categories

Blue Hat: External consultants testing systems pre-launch
Elite Hackers: Highly skilled, discover zero-days
Script Kiddies: Use pre-made tools without understanding
Hacktivists: Politically or socially motivated
Nation State: Government-sponsored cyber operatives

Phase 2: Network Fundamentals

Understanding network types and architecture:

Network Types | Type | Description | |------|-------------| | LAN | Local Area Network - computers in same building | | WAN | Wide Area Network - geographically distributed | | MAN | Metropolitan Area Network - city-wide coverage | | VPN | Virtual Private Network - encrypted tunnel | | Intranet | Private internal company network | | Extranet | Extended intranet for external partners |

Network Benefits for Attackers

Resource sharing creates attack surfaces
File sharing enables data exfiltration
Program sharing may expose vulnerabilities
Centralized services create single points of failure

Phase 3: Protocol Understanding

Key protocols for security assessment:

IP Addressing

# Private IP ranges (non-routable)
10.0.0.0 - 10.255.255.255        # Class A
172.16.0.0 - 172.31.255.255      # Class B
192.168.0.0 - 192.168.255.255    # Class C

# Find your IP
ipconfig /all                     # Windows
ip addr                           # Linux
curl ifconfig.me                  # Public IP

Common Protocols | Protocol | Port | Purpose | |----------|------|---------| | FTP | 20, 21 | File transfer | | SSH | 22 | Secure remote access | | Telnet | 23 | Unencrypted remote access | | SMTP | 25 | Email transmission | | DNS | 53 | Name resolution | | HTTP | 80 | Web traffic | | POP3 | 110 | Email retrieval | | IMAP | 143 | Email access | | HTTPS | 443 | Encrypted web traffic | | RDP | 3389 | Windows remote desktop |

SSH Capabilities

Secure encrypted remote login
Protection against IP spoofing
Port forwarding/tunneling
Replacement for rlogin, rsh, rcp

# SSH connection
ssh user@target.com

# SSH tunneling (port forwarding)
ssh -L 8080:localhost:80 user@target.com

# Dynamic port forwarding (SOCKS proxy)
ssh -D 9050 user@target.com

Phase 4: DNS Architecture

Understand Domain Name System operations:

DNS Hierarchy

Root (.)
├── .com (gTLD)
│   └── example.com
│       └── www.example.com
├── .org (gTLD)
├── .net (gTLD)
└── .uk (ccTLD - Country Code)

DNS Record Types | Record | Purpose | |--------|---------| | A | Maps hostname to IPv4 address | | AAAA | Maps hostname to IPv6 address | | PTR | Reverse lookup (IP to hostname) | | NS | Authoritative name servers | | MX | Mail exchange servers | | CNAME | Canonical name (alias) | | TXT | Text records (SPF, DKIM) | | SOA | Start of authority |

DNS Query Process

Client queries local DNS resolver
Resolver checks cache
If not cached, query root servers
Root refers to TLD servers (.com)
TLD refers to authoritative nameserver
Authoritative returns IP address
Resolver caches and returns to client

DNS Enumeration Commands

# Basic DNS lookup
nslookup target.com
dig target.com

# Specific record types
dig target.com MX         # Mail servers
dig target.com NS         # Name servers
dig target.com TXT        # Text records
dig target.com AXFR       # Zone transfer attempt

# Reverse lookup
dig -x 192.168.1.1

# Use specific DNS server
dig @8.8.8.8 target.com

Phase 5: Proxy Servers

Understanding proxy types and uses:

Proxy Types | Type | Description | |------|-------------| | Anonymous | Hides client IP from server | | High Anonymity | Doesn't identify as proxy | | Transparent | Forwards requests without hiding identity | | Reverse | Protects backend servers |

Proxy for Security Testing

# Configure proxy in terminal
export http_proxy=http://proxy:port
export https_proxy=http://proxy:port

# Burp Suite default proxy
http://127.0.0.1:8080

# Tor SOCKS proxy
socks5://127.0.0.1:9050

Privacy Benefits

Mask source IP address
Bypass geographic restrictions
Encrypted tunnels for sensitive traffic
Chain proxies for enhanced anonymity

Phase 6: Active Attack Types

Attacks requiring direct interaction:

Masquerade Attack

Attacker impersonates legitimate user
Uses stolen credentials or session tokens
Exploits authentication weaknesses
Gains unauthorized privileges

Session Replay Attack

Captures valid session tokens
Replays authentication to gain access
Requires interception of session data
Mitigated by session timeouts and tokens

Message Modification Attack

Intercepts data in transit
Modifies packet headers or content
Redirects traffic to malicious destinations
Man-in-the-middle variations

Denial of Service (DoS)

Overwhelms target with traffic
Depletes system resources
Prevents legitimate access
Variations: SYN flood, UDP flood, HTTP flood

Distributed DoS (DDoS)

Multiple sources attack single target
Uses botnet/zombie networks
Harder to mitigate than single-source
Amplification attacks multiply traffic

Phase 7: Passive Attack Types

Attacks gathering information without detection:

Passive Reconnaissance

Monitors without interaction
Session capture and analysis
Network traffic sniffing
No direct engagement with target

Active Reconnaissance

Engages with target system
Port scanning
Service enumeration
Banner grabbing

Specific Techniques

War Driving: Detecting vulnerable WiFi networks
Dumpster Diving: Searching discarded materials
Shoulder Surfing: Observing user activity
Promiscuous Mode: Capturing all network traffic

Phase 8: Password Cracking Tools

Tools for password recovery and testing:

Online Attack Tools

# Hydra - network password cracker
hydra -l admin -P wordlist.txt ssh://target.com
hydra -L users.txt -P passwords.txt ftp://target.com

# Medusa - parallel password cracker
medusa -h target.com -u admin -P wordlist.txt -M ssh

# Ncrack - network authentication cracker
ncrack -p 22 --user admin -P wordlist.txt target.com

Offline Attack Tools

# John the Ripper
john --wordlist=rockyou.txt hashes.txt
john --show hashes.txt

# Hashcat - GPU-accelerated
hashcat -m 0 hashes.txt rockyou.txt      # MD5
hashcat -m 1000 hashes.txt rockyou.txt   # NTLM

# Ophcrack - Windows password cracker
ophcrack -g -d tables -t tables -f hash.txt

WiFi Password Tools

# Aircrack-ng suite
airmon-ng start wlan0
airodump-ng wlan0mon
airodump-ng -c [channel] --bssid [BSSID] -w capture wlan0mon
aireplay-ng -0 10 -a [BSSID] wlan0mon
aircrack-ng -w wordlist.txt capture.cap

Phase 9: Network Scanning Tools

Tools for discovery and enumeration:

Nmap - Network Mapper

# Host discovery
nmap -sn 192.168.1.0/24

# Port scanning
nmap -sS target.com              # SYN scan
nmap -sV target.com              # Version detection
nmap -O target.com               # OS detection
nmap -A target.com               # Aggressive scan
nmap -p- target.com              # All ports

# Script scanning
nmap --script=vuln target.com
nmap --script=http-enum target.com

Traffic Analysis Tools

# Wireshark - GUI packet analyzer
wireshark

# tcpdump - CLI packet capture
tcpdump -i eth0 -w capture.pcap
tcpdump -r capture.pcap

# Ettercap - MITM tool
ettercap -T -M arp:remote /target1// /target2//

Web Scanning

# Nikto - web vulnerability scanner
nikto -h http://target.com

# Skipfish - web application scanner
skipfish -o output http://target.com

# W3af - web attack framework
w3af_console

Phase 10: Forensics and Debugging Tools

Tools for investigation and analysis:

Digital Forensics | Tool | Purpose | |------|---------| | Sleuth Kit | Disk image analysis | | Autopsy | GUI for Sleuth Kit | | Volatility | Memory forensics | | FTK Imager | Disk imaging | | Encase | Enterprise forensics |

File System Analysis

# Sleuth Kit commands
fls -r image.dd               # List files recursively
icat image.dd [inode]         # Extract file by inode
mmls image.dd                 # Partition layout

# Volatility memory analysis
volatility -f memory.dmp imageinfo
volatility -f memory.dmp --profile=Win7SP1x64 pslist
volatility -f memory.dmp --profile=Win7SP1x64 netscan

Packet Crafting

# Scapy - Python packet manipulation
from scapy.all import *
packet = IP(dst="target.com")/TCP(dport=80)
send(packet)

# Hping3 - packet crafting
hping3 -S target.com -p 80     # SYN packet
hping3 --flood target.com       # Flood mode

Quick Reference

Essential Ports

| Port | Service | Notes | |------|---------|-------| | 21 | FTP | File transfer | | 22 | SSH | Secure shell | | 23 | Telnet | Unencrypted | | 25 | SMTP | Email | | 53 | DNS | Name resolution | | 80 | HTTP | Web | | 443 | HTTPS | Secure web | | 445 | SMB | Windows shares | | 3389 | RDP | Remote desktop |

Attack Type Summary

| Attack | Type | Goal | |--------|------|------| | DoS/DDoS | Active | Deny availability | | Masquerade | Active | Impersonate user | | Session Replay | Active | Steal access | | War Driving | Passive | Find WiFi | | Sniffing | Passive | Capture traffic |

Tool Categories

| Category | Examples | |----------|----------| | Password | Hydra, John, Hashcat | | Scanning | Nmap, Nessus, Nikto | | Traffic | Wireshark, tcpdump | | Forensics | Sleuth Kit, Volatility | | Exploitation | Metasploit, Burp Suite |

Constraints and Limitations

Legal Considerations

Only test systems with authorization
Document all testing activities
Understand local cybercrime laws
Obtain written permission before testing

Ethical Guidelines

White hat mindset required
Report vulnerabilities responsibly
Protect discovered data
Never cause unnecessary harm

Troubleshooting

Network Issues

Cannot reach target:

Verify network connectivity
Check firewall rules
Confirm target is online
Try different ports/protocols

Tool Failures

Scans returning no results:

Verify target address
Check for IDS/IPS blocking
Try slower scan rates
Use different techniques