The Five Stages of Ethical Hacking

Posted by Sharan R On 12:30 AM

Phases of hacking 

Phase 1—Reconnaissance
Phase 2—Scanning
Phase 3—Gaining Access
Phase 4—Maintaining Access
Phase 5—Covering Tracks

Phase 1: Passive and Active Reconnaissance
Passive reconnaissance involves gathering information regarding a potential target without
the targeted individual’s or company’s knowledge. Passive reconnaissance can be as simple as
watching a building to identify what time employees enter the building and when they leave.
However, it’s usually done using Internet searches or by Googling an individual or company
to gain information. This process is generally called information gathering. Social engineering and dumpster diving are also considered passive information-gathering methods.
 
Sniffing the network is another means of passive reconnaissance and can yield useful information
such as IP address ranges, naming conventions, hidden servers or networks, and other
available services on the system or network. Sniffing network traffic is similar to building
monitoring: A hacker watches the flow of data to see what time certain transactions take place
and where the traffic is going.

Active reconnaissance involves probing the network to discover individual hosts, IP addresses,
and services on the network. This usually involves more risk of detection than passive reconnaissance
and is sometimes called rattling the doorknobs. Active reconnaissance can give a hacker an
indication of security measures in place (is the front door locked?), but the process also increases
the chance of being caught or at least raising suspicion.

Both passive and active reconnaissance can lead to the discovery of useful information to
use in an attack. For example, it’s usually easy to find the type of web server and the operating
system (OS) version number that a company is using. This information may enable a hacker
to find a vulnerability in that OS version and exploit the vulnerability to gain more access.
 
Phase 2: Scanning
Scanning
involves taking the information discovered during reconnaissance and using it to
examine the network. Tools that a hacker may employ during the scanning phase can include
dialers, port scanners, network mappers, sweepers, and vulnerability scanners. Hackers are
seeking any information that can help them perpetrate attack such as computer names, IP
addresses, and user accounts.

Phase 3: Gaining Access 
This is the phase where the real hacking takes place. Vulnerabilities discovered during the reconnaissance and scanning phase are now exploited to gain access. The method of connection the hacker uses for an exploit can be a local area network (LAN, either wired or wireless), local access to a PC, the Internet, or offline. Examples include stack-based buffer overflows, denial of service (DoS), and session hijacking. These topics will be discussed in later chapters. Gaining access is known in the hacker world as owning the system.

Phase 4: Maintaining Access
Once a hacker has gained access, they want to keep that access for future exploitation and
attacks. Sometimes, hackers harden the system from other hackers or security personnel by
securing their exclusive access with backdoors, rootkits, and Trojans. Once the hacker owns
the system, they can use it as a base to launch additional attacks. In this case, the owned system
is sometimes referred to as a zombie system.
 
Phase 5: Covering Tracks
Once hackers have been able to gain and maintain access, they cover their tracks to avoid
detection by security personnel, to continue to use the owned system, to remove evidence of
hacking, or to avoid legal action. Hackers try to remove all traces of the attack, such as log files
or intrusion detection system (IDS) alarms. Examples of activities during this phase of the
attack include steganography, the use of tunneling protocols, and altering log files.

21 comments

  1. Priya Verma Said,

    Online Cisco Training, Online Linux Training, Online Ethical Hacking Training, Online CCNP Training, Online CCNA Training, Online MCSE Training, Online CCIE Training India, MCITP Training, Online VMware Training and more offered by Zoom Technologies by highly proficient CISCO certified experts - Hyderabad, India.

    Posted on April 23, 2014 at 10:43 AM

     
  2. Cindy Dy Said,


    This is really an interesting topic. I had a great time surfing and found some important tips and information from your blog. Keep it up.

    Bob
    www.gofastek.com

    Posted on December 9, 2015 at 12:58 AM

     
  3. sarah lee Said,

    I really enjoyed reading your article. I found this as an informative and interesting post, so i think it is very useful and knowledgeable. I would like to thank you for the effort you have made in writing this article.


    edupdf.org

    Posted on January 12, 2016 at 6:46 PM

     
  4. Naveen Yadav Said,

    Ethical hacking Training very fruitful to Every Computer user for Security reasons. Nice blog and very well written.

    Posted on February 2, 2017 at 2:25 AM

     
  5. Thank you for sharing. If you can more read now visit
    Ethical Hacking Training in India
    EC-Council Certification Course in Delhi NCR

    Posted on March 27, 2017 at 2:01 AM

     
  6. Thanks for sharing.
    Learn how to hack.
    http://www.ethicalhackingpremium.ga

    Posted on May 17, 2017 at 3:08 AM

     
  7. Priya Kannan Said,

    Pretty section of content. I simply stumbled upon your site and in accession capital to say that I get actually loved to account your blog posts.
    CCNA Training in Chennai

    Posted on June 28, 2017 at 12:04 AM

     
  8. Naveen Yadav Said,

    Very Nice blog . Thanks for sharing.

    CEH Training in Delhi NCR
    http://www.ssdntech.com/certified-ethical-hacker-training.aspx

    Posted on January 7, 2018 at 10:59 PM

     
  9. Shailendra Said,

    Hooray ! Blog is very helpful for me. I Like it, Thanks for Sharing great content.
    Ethical Hacking Training in Gurgaon
    Ethical Hacking Institute in Gurgaon
    Ethical Hacking Course in Gurgaon

    Posted on February 13, 2018 at 10:24 PM

     
  10. Mahesh Said,

    Thanks, Learned a lot of new things from your post! Good creation and HATS OFF to the creativity of your mind.
    Very interesting and useful blog!
    Ethical Hacking Course in Gurgaon

    Posted on February 17, 2018 at 1:42 AM

     
  11. Unknown Said,

    This blog awesome and i learn a lot about programming from here.The best thing about this blog is that you doing from beginning to experts level.
    Visit: Best Ethical Hacking Course

    Posted on February 27, 2018 at 5:05 AM

     
  12. Jimmy loof Said,

    I have been living with my wife for some years now,i was afraid she has been cheating on me and a friend of mine introduced me to a Private Investigator (Mr Raymond), he helped me and gave me the password to her Facebook and Gmail account and also linked all her phone conversations to me.He saved me from all her lies and infidelity,he gave me all i wanted during our divorce and helped me with evidence in court.his services was cheap,and he was so reliable. I just ,want to openly say thank you.Contact (Gadgethacksolution@gmail.com) .tell him i referred you he will help you

    Posted on March 11, 2018 at 3:58 AM

     
  13. Monika Singh Said,

    croma campus one of the best Ethical Hacking Training in Delhi and real time trainer with job placement support. More details visit at croma campus

    Posted on March 20, 2018 at 2:01 AM

     
  14. excellent piece of information,I do believe all of the concepts you’ve introduced in your post. They’re very convincing and will definitely work. Nonetheless, the posts are too short for novices. May you please extend them a bit from subsequent time. Thank you for the post. Tools is the top most section of the Ethical hacking exam and the most scoring of the sub-sections of the examination. This section of the exam is going to test the expertise on the tools, systems and the programs used by the hackers.

    Posted on April 13, 2018 at 3:49 AM

     
  15. Kritika Said,

    Thanks for posting such amazing post. Well explained. Keep sharing
    Ethical Hacking course in Delhi

    Posted on April 16, 2018 at 12:44 AM

     
  16. Admin Said,

    Beautiful Post..It is beneficially
    Visit: Ethical Hacking Course In Jaipur

    Posted on April 19, 2018 at 8:43 AM

     
  17. Nice Article! Indian Cyber Army's is now coming up with Summer Internship in cyber crime investigation and ethical hacking which is is live now

    Posted on May 24, 2018 at 6:02 AM

     
  18. Nice Article! Indian Cyber Army's is now coming up with Summer Internship in cyber crime investigation and ethical hacking which is is live now

    Posted on May 24, 2018 at 6:02 AM

     
  19. R@tK@K@ Said,

    Ethical Hacking has gained tremendous popularity in the recent times because protecting data from harm is vital for all organizations. There are several companies across India which require ethical hackers. If you live near or in Delhi, then worry not. There are several institutes which provide ethical hacking course in Delhi.

    Posted on June 18, 2018 at 10:08 PM

     
  20. Mahesh Shiva Said,

    Its a wonderful post and very helpful, thanks for all this information.
    Ethical Hacking Training in Delhi

    Posted on June 18, 2018 at 11:00 PM

     
  21. Harish Said,

    It’s a great post. Keep sharing this kind of worthy information. Good luck!

    Salesforce Developer Training in Chennai | Salesforce Training in Chennai

    Posted on June 20, 2018 at 5:49 AM