5 Attack Methodology
There are a few schools of thought when it comes to attack methodologies�the plan of attack that a hacker adopts when it comes to penetration testing a network. There are a few variances here and there but most people agree that a good methodology to adopt involves more or less five (5) steps:
- Reconaissance
- Scanning and Enumeration
- Gaining Access (and Escalation of Privileges)
- Maintaining Access
- Covering Your Tracks
The preceding steps are the official attack methodology proposed by the EC-Council in its Certified Ethical Hacker (CEH) certification. For the purpose of the rest of the lessons, well stick to these steps, unless something else comes along.
Lets look at these steps a little more in-depth:
RECONNAISSANCE
Reconnaissance is the act of gathering information. An attacker will attempt to gather as much information about a target (a company, a web site, or a platform) as they can. This reconnaissance can be either passive or active. For instance, an attacker wanting to gather information passively might perform some extremely thorough and pointed internet searches to find out as much as possible about a company. They might try to find Organization Charts, personnel listings, contact information.
BackTrack has some excellent reconnaissance tools built into it and well discuss them more in-depth in the next lesson. Also, well discuss a few tools that I think happen to do excellent jobs in the passive act of reconnaissance.
When we discuss active reconnaissance, however, were typically speaking about an attacker who is scanning ports or services in order to obtain more in-depth knowledge about his victim. Walking along firewall rules and dumpster diving are other examples of this kind of reconnaissance.
SCANNING AND ENUMERATION
Utilizing port scanners, vulnerability scanners and performing war dialing are all examples of what an attacker would use to accomplish this task. Were going to focus a lot of our time on nmap and nessus during these lessons but well determine if there are any other scanning tools that help perform these tasks better.
GAINING ACCESS (AND ESCALATION OF PRIVILEGES)
This step in an attack methodology is where the actual hack or attack takes place. The attacker launches some sort of attack against a service, a port, a login, etc. and is able to gain access to the system.
MAINTAINING ACCESS
Once an attacker penetrates a system, they will most likely want to return for future use and theyll want to make sure that the system is easier to gain access next time. This is performed through the use of tools like rootkits and Trojan Horses that leave backdoors into systems.
COVERING YOUR TRACKS
Once you have implemented an attack, taken control of a box and left yourself a backdoor to enter any time you like, you need to cover your tracks and hide all signs you were ever there. This includes emptying of logs and wiping of system data.
SUMMARY
All right. Now that weve determined what steps make up our attack methodology, lets take an in-depth look at Reconnaissance.