Saturday, November 10, 2007

Hacking 101


It was bound to appear sometime sooner then later. And I have the best of the best all set up to show what's out there all Free and Qpen Source, and readily available just one link away! And like most things the easiest way to learn is to dive right in. The highest recommended Educational Hacking courses are Info Sec Institute;
Info Sec Institute was founded in 1998 by a group information security instructors that desired to build a business by offering the best possible training experience for students. We that felt by providing the best possible hands on training --- that is most practical for today's demanding workplace requirements, the business would grow by leaps and bounds. This original assumption proved true. InfoSec Institute has trained over 10,000 individuals on everything from industry standard certifications as the CISSP to highly technical customized Windows Kernel Reverse Engineering courses.
The Institute for Security and Open Methodologies (ISECOM) is an open-source collaborative community dedicated to providing practical security awareness, research, certification and business integrity. providing certification, training support, and project support services for non-partisan and vendor-neutral funding of our projects and infrastructure. The determination of our research is to provide practical methods and measurements for security and integrity of any scale from the boardroom to the high school classroom. For this, ISECOM works closely with schools, universities, businesses, and government agencies to assure all research provided is peer-reviewed for the highest quality.
The easiest way to learn Security based "Ethical Hacking" is from the Forums of whatever tool you are trying to learn. The Best Software currently are.....
1. Nessus Remote Security ScannerRecently went closed source, but is still essentially free. Works with a client-server framework. Nessus is the world’s most popular vulnerability scanner used in over 75,000 organizations world-wide. Many of the world’s largest organizations are realizing significant cost savings by using Nessus to audit business-critical enterprise devices and applications.
2. Nmap (”Network Mapper”) is a free open source utility for network exploration or security auditing. It was designed to rapidly scan large networks, although it works fine against single hosts. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. Nmap runs on most types of computers and both console and graphical versions are available. Nmap is free and open source.Can be used by beginners (-sT) or by pros alike (–packet_trace). A very versatile tool, once you fully understand the results.
3. John the Ripper
John the Ripper is a fast password cracker, currently available for many flavors of Unix (11 are officially supported, not counting different architectures), DOS, Win32, BeOS, and OpenVMS. Its primary purpose is to detect weak Unix passwords. Besides several crypt(3) password hash types most commonly found on various Unix flavors, supported out of the box are Kerberos AFS and Windows NT/2000/XP/2003 LM hashes, plus several more with contributed patches.
4. Nikto Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 3200 potentially dangerous files/CGIs, versions on over 625 servers, and version specific problems on over 230 servers. Scan items and plugins are frequently updated and can be automatically updated (if desired).Nikto is a good CGI scanner, there are some other tools that go well with Nikto (focus on http fingerprinting or Google hacking/info gathering etc, another article for just those).
5.Wireshark (Formely Ethereal) Wireshark is a GTK+-based network protocol analyzer, or sniffer, that lets you capture and interactively browse the contents of network frames. The goal of the project is to create a commercial-quality analyzer for Unix and to give Wireshark features that are missing from closed-source sniffers.Works great on both Linux and Windows (with a GUI), easy to use and can reconstruct TCP/IP Streams! Will do a tutorial on Wireshark later.
For a resources this one is King.http://sectools.org/
And always remember Hacking is about Education not Harm.


No comments: