# Module 01 - Introduction to Ethical Hacking

## Learning Objectives
- Understand the CIA Triad and Non-Repudiation principles
- Differentiate between various types of hackers and their motivations
- Learn penetration testing methodologies and team structures
- Master fundamental hacking terminology and concepts
- Explore information security frameworks and standards

---

## Information Security Fundamentals

### The CIA Triad and Non-Repudiation

The **CIA Triad** forms the foundation of information security, representing three core principles that must be maintained to ensure data security.

#### 🔒 Confidentiality
Ensures that information is accessible only to authorized individuals and remains protected from unauthorized access.

**Key Implementation Methods:**
- **Authentication mechanisms**: Username/password combinations, multi-factor authentication
- **Access controls**: Role-based permissions, least privilege principle
- **Encryption**: Data encryption at rest and in transit
- **Physical security**: Secure storage facilities, locked workstations

**Common Attacks:**
- Data breaches and unauthorized access
- Card skimming and identity theft
- Keylogging and credential harvesting
- Phishing and social engineering
- Dumpster diving for sensitive documents

#### 🛡️ Integrity
Ensures that information remains accurate, complete, and unaltered by unauthorized parties during storage and transmission.

**Key Implementation Methods:**
- **Cryptographic hashing**: SHA-256, MD5 checksums for data verification
- **Digital signatures**: Non-repudiation and authenticity verification
- **Message Authentication Codes (MAC)**: Ensuring message integrity
- **Version control**: Tracking changes and maintaining data consistency

**Common Attacks:**
- Man-in-the-Middle (MITM) attacks
- Packet interception and modification
- Data tampering and unauthorized modifications
- Database injection attacks

#### ⚡ Availability
Ensures that information and systems are accessible to authorized users when needed, maintaining business continuity.

**Key Implementation Methods:**
- **Redundancy**: Backup systems and failover mechanisms
- **Load balancing**: Distributing traffic across multiple servers
- **Disaster recovery**: Business continuity planning
- **Regular maintenance**: System updates and performance monitoring

**Common Attacks:**
- Denial of Service (DoS) attacks
- Distributed Denial of Service (DDoS) attacks
- System outages and infrastructure failures
- Resource exhaustion attacks

#### ✍️ Non-Repudiation
Ensures that parties cannot deny their actions or transactions, providing proof of authenticity and accountability.

**Key Implementation Methods:**
- **Digital signatures**: Cryptographic proof of document authenticity
- **Audit logs**: Comprehensive tracking of user activities
- **Timestamps**: Chronological proof of events
- **Legal frameworks**: Binding agreements and documentation

**Example:** In financial transactions, non-repudiation ensures that neither the sender nor recipient can deny that a transaction occurred, supported by bank statements, transaction logs, and digital receipts.

### Historical Security Incidents
- **[FireEye Data Breach](https://malicious.life/episode/episode-101/)** - Advanced persistent threat analysis
- **[Stuxnet Malware](https://malicious.life/episode/episode-7-stuxnet-part-1/)** - Nation-state cyber warfare case study

---

## Types of Hackers

Understanding different hacker classifications helps in comprehending threat landscapes and motivations behind cyber attacks.

### 🎩 White Hat Hackers (Ethical Hackers)
**Legitimate security professionals** who use their skills to improve security systems.

**Characteristics:**
- Work under legal contracts and agreements
- Follow responsible disclosure protocols
- Employed by organizations or work as independent consultants
- Focus on improving security posture

**Examples:**
- **Bug bounty hunters**: Discover vulnerabilities for rewards
- **Penetration testers**: Conduct authorized security assessments
- **Security researchers**: Develop new security methodologies
- **Incident response specialists**: Investigate and mitigate breaches

### 🎩 Black Hat Hackers (Malicious Hackers)
**Cybercriminals** who exploit vulnerabilities for personal gain or malicious purposes.

**Characteristics:**
- Operate without authorization or legal permission
- Motivated by financial gain, revenge, or ideology
- Cause damage to systems, data, or organizations
- Face legal consequences when caught

**Examples:**
- **Cybercriminals**: Financial fraud and data theft
- **Cyber terrorists**: Attacks on critical infrastructure
- **Nation-state actors**: Espionage and warfare
- **Ransomware operators**: Extortion through encryption

### 🎩 Gray Hat Hackers
**Individuals** who operate between ethical and malicious boundaries.

**Characteristics:**
- May exploit vulnerabilities without explicit permission
- Often disclose findings publicly or to vendors
- Sometimes seek recognition or financial reward
- Legal status often ambiguous

### 👶 Script Kiddies
**Inexperienced individuals** who use existing tools and scripts without deep understanding.

**Characteristics:**
- Limited technical knowledge and skills
- Rely on pre-developed exploits and automated tools
- Motivated by curiosity, recognition, or mischief
- Often target low-hanging fruit or easily exploitable systems

### 🏛️ State-Sponsored Hackers
**Government-backed actors** conducting cyber operations for national interests.

**Characteristics:**
- Well-funded and highly sophisticated operations
- Focus on espionage, intelligence gathering, and strategic advantage
- Target government agencies, critical infrastructure, and intellectual property
- Operate under state protection and resources

---

## Penetration Testing Methodologies

### Testing Approaches

#### 📋 White Box Testing (Crystal Box Testing)
**Complete transparency** with full system knowledge provided.

**Characteristics:**
- Client provides comprehensive system documentation
- Network diagrams, source code, and credentials available
- Simulates insider threat scenarios
- Focuses on thorough vulnerability assessment

**Advantages:**
- Comprehensive coverage of security controls
- Efficient testing with detailed system knowledge
- Identifies complex logical vulnerabilities

#### ⚫ Black Box Testing (Blind Testing)
**Zero knowledge** testing simulating external attacker perspective.

**Characteristics:**
- No prior knowledge of internal systems
- Testers rely on public information gathering
- Simulates real-world attack scenarios
- Emphasizes reconnaissance and enumeration skills

**Advantages:**
- Realistic attack simulation
- Tests external security perimeter
- Validates security awareness and detection capabilities

#### 🔘 Gray Box Testing (Partial Knowledge Testing)
**Limited information** provided to balance realism and efficiency.

**Characteristics:**
- Basic access credentials or network access provided
- Partial system documentation available
- Simulates compromised insider scenarios
- Balances testing depth and time constraints

---

## Cybersecurity Teams

### 🔴 Red Team (Offensive Security)
**Simulated adversaries** conducting realistic attack scenarios.

**Responsibilities:**
- Conduct penetration testing and vulnerability assessments
- Simulate advanced persistent threat (APT) scenarios
- Test physical security controls and social engineering defenses
- Evaluate incident response capabilities

**Tools and Techniques:**
- Social engineering and phishing campaigns
- Network infiltration and lateral movement
- Physical security testing (lock picking, badge cloning)
- Custom exploit development

### 🔵 Blue Team (Defensive Security)
**Security defenders** responsible for protection and incident response.

**Responsibilities:**
- Monitor security events and analyze threat intelligence
- Implement and maintain security controls
- Respond to security incidents and breaches
- Develop and improve security policies and procedures

**Tools and Techniques:**
- Security Information and Event Management (SIEM)
- Intrusion Detection and Prevention Systems (IDS/IPS)
- Endpoint Detection and Response (EDR)
- Threat hunting and forensic analysis

### 🟣 Purple Team (Collaborative Security)
**Integrated approach** combining red and blue team methodologies.

**Approach:**
- Collaborative exercises between offensive and defensive teams
- Real-time feedback and improvement cycles
- Knowledge sharing and cross-training initiatives
- Continuous security posture enhancement

---

## Essential Hacking Terminology

### Core Security Concepts

#### 🔍 Vulnerability
A **security weakness** in a system, application, or network that can be exploited to compromise the CIA triad.

**Types:**
- **Software vulnerabilities**: Buffer overflows, injection flaws, logic errors
- **Configuration vulnerabilities**: Default passwords, misconfigured services
- **Physical vulnerabilities**: Unsecured access points, exposed hardware
- **Human vulnerabilities**: Social engineering susceptibility, poor security awareness

#### 💥 Payload
The **malicious code or script** designed to perform specific actions after successful exploitation.

**Common Payload Types:**
- **Reverse shells**: Establish remote command access
- **Bind shells**: Create listening services for remote access
- **Meterpreter**: Advanced post-exploitation framework
- **Persistence mechanisms**: Maintain long-term access

#### ⚔️ Exploit
The **combination of vulnerability and payload** that enables successful system compromise.

**Exploit Categories:**
- **Local exploits**: Privilege escalation on compromised systems
- **Remote exploits**: Network-based attacks against services
- **Web exploits**: Application-specific vulnerabilities
- **Client-side exploits**: Browser and application-based attacks

#### 🌟 Zero-Day Vulnerabilities
**Previously unknown security flaws** with no available patches or public disclosure.

**Characteristics:**
- Unknown to vendors and security community
- Highly valuable in underground markets
- Difficult to detect with traditional security tools
- Often used in advanced persistent threats (APTs)

**Zero-Day Lifecycle:**
1. **Discovery**: Vulnerability identified by researcher or attacker
2. **Weaponization**: Exploit code developed
3. **Disclosure**: Responsible or malicious disclosure
4. **Patch Development**: Vendor creates security fix
5. **Deployment**: Users apply security updates

### Internet Architecture and Access

#### 🌊 Deep Web vs. Dark Web

##### Deep Web
The **portion of the internet** not indexed by traditional search engines.

**Characteristics:**
- Contains private databases, password-protected sites, and internal networks
- Includes legitimate business systems and academic resources
- Accessible through standard browsers with proper authentication
- Estimated to be significantly larger than the surface web

**Examples:**
- Private social media profiles and messages
- Banking and financial account portals
- Corporate intranets and databases
- Medical records and legal documents

##### Dark Web
A **specialized network** accessible only through anonymity tools like Tor.

**Characteristics:**
- Uses .onion domains for hidden services
- Provides anonymity for users and service operators
- Hosts both legitimate privacy-focused services and illegal activities
- Requires specific software (Tor Browser) for access

**Legitimate Uses:**
- Journalism and whistleblowing in authoritarian regimes
- Privacy-focused communication platforms
- Political activism and free speech advocacy
- Security research and vulnerability disclosure

**Security Considerations:**
- High risk of malware and malicious services
- Law enforcement monitoring and legal risks
- Potential exposure to illegal content and activities

---

## Information Security Threat Landscape

### Network-Based Threats

#### 🌐 Man-in-the-Middle (MITM) Attacks
**Interception and manipulation** of communications between two parties.

**Attack Vectors:**
- **ARP spoofing**: Redirecting network traffic through attacker's system
- **DNS hijacking**: Manipulating domain name resolution
- **SSL stripping**: Downgrading secure connections to plaintext
- **Evil twin wireless networks**: Malicious access points mimicking legitimate ones

**Mitigation Strategies:**
- End-to-end encryption implementation
- Certificate pinning and validation
- Network segmentation and monitoring
- Secure communication protocols (HTTPS, VPN)

#### 💀 Denial of Service (DoS) Attacks
**Overwhelming system resources** to prevent legitimate user access.

**Attack Types:**
- **Volume-based attacks**: Consuming bandwidth or network resources
- **Protocol attacks**: Exploiting network protocol weaknesses
- **Application-layer attacks**: Targeting specific application functions

**Distributed DoS (DDoS):**
- Utilizes multiple compromised systems (botnets)
- Amplifies attack volume and impact
- Difficult to trace and mitigate

#### 🔑 Password-Based Attacks
**Compromising authentication** through various password attack methods.

**Common Techniques:**
- **Brute force attacks**: Systematic password guessing
- **Dictionary attacks**: Using common password lists
- **Credential stuffing**: Reusing breached credentials
- **Rainbow table attacks**: Pre-computed hash lookups

### Host-Based Threats

#### 🏠 Unauthorized Access
**Gaining system access** without proper authorization or credentials.

**Attack Vectors:**
- Exploitation of unpatched vulnerabilities
- Privilege escalation techniques
- Stolen or weak credentials
- Physical security bypasses

#### 🔓 Physical Security Threats
**Direct physical access** to systems and infrastructure.

**Common Vulnerabilities:**
- Unsecured workstations and servers
- Visible network infrastructure
- Inadequate access controls
- Social engineering at physical locations

### Operational Security Threats

#### 🔄 Unpatched Systems
**Outdated software and operating systems** vulnerable to known exploits.

**Risk Factors:**
- Delayed patch management processes
- Legacy systems without security updates
- Critical systems with limited maintenance windows
- Shadow IT and unmanaged devices

#### 🌟 Zero-Day Exploits
**Advanced threats** exploiting unknown vulnerabilities.

**Characteristics:**
- No available patches or signatures
- High success rate against targeted systems
- Often used in targeted attacks and APTs
- Require advanced detection and response capabilities

---

## Ethical Hacking Methodology

### The Five Phases of Ethical Hacking

#### 🔍 Phase 1: Reconnaissance (Information Gathering)
**Systematic collection** of information about the target to understand the attack surface.

##### Passive Reconnaissance
**Information gathering** without direct interaction with target systems.

**Techniques:**
- **Open Source Intelligence (OSINT)**: Public records, social media, websites
- **Search engine reconnaissance**: Google dorking, cached pages
- **Social media analysis**: Employee information, organizational structure
- **DNS enumeration**: Subdomain discovery, DNS records analysis

**Tools:**
- theHarvester, Maltego, Recon-ng
- Google, Shodan, Wayback Machine
- Social media platforms and public databases

##### Active Reconnaissance
**Direct interaction** with target systems to gather detailed information.

**Techniques:**
- **Network scanning**: Port scans, service detection
- **Social engineering**: Phone calls, emails, physical interaction
- **Website analysis**: Technology stack, directory structure
- **DNS zone transfers**: Detailed DNS record enumeration

**Considerations:**
- Higher detection risk
- May trigger security alerts
- Requires careful timing and approach

#### 🔬 Phase 2: Scanning and Enumeration
**Detailed analysis** of discovered systems and services for potential vulnerabilities.

**Scanning Activities:**
- **Port scanning**: Identify open ports and running services
- **Operating system detection**: Fingerprint target systems
- **Service version detection**: Identify specific service versions
- **Vulnerability scanning**: Automated vulnerability identification

**Enumeration Activities:**
- **Service enumeration**: Extract detailed service information
- **User enumeration**: Identify valid usernames and accounts
- **Share enumeration**: Discover network shares and resources
- **Application enumeration**: Identify web applications and technologies

**Common Tools:**
- Nmap, Zenmap, Masscan
- Nikto, OpenVAS, Nessus
- enum4linux, SMBclient, SNMPwalk

#### 🚀 Phase 3: Gaining Access (Exploitation)
**Successful compromise** of target systems using identified vulnerabilities.

**Exploitation Methods:**
- **Password attacks**: Brute force, dictionary, credential stuffing
- **Vulnerability exploitation**: Buffer overflows, injection attacks
- **Social engineering**: Phishing, pretexting, physical security bypasses
- **Wireless attacks**: WEP/WPA cracking, evil twin attacks

**Considerations:**
- Minimize system disruption
- Document all actions and findings
- Maintain professional boundaries
- Follow scope limitations

#### 🔒 Phase 4: Maintaining Access (Post-Exploitation)
**Establishing persistent access** for continued assessment and demonstration.

**Persistence Techniques:**
- **Backdoor installation**: Remote access tools and hidden services
- **Rootkit deployment**: Deep system-level persistence
- **Account creation**: Privileged user accounts for ongoing access
- **Scheduled tasks**: Automated execution mechanisms

**Advanced Techniques:**
- **Living off the land**: Using legitimate system tools
- **Registry modification**: Windows persistence mechanisms
- **Startup folder entries**: Automatic execution on boot
- **Service installation**: System-level service persistence

**Ethical Considerations:**
- Temporary access only
- No data exfiltration beyond scope
- Immediate removal after testing
- Documented cleanup procedures

#### 🧹 Phase 5: Covering Tracks (Evidence Removal)
**Systematic removal** of evidence and restoration of original system state.

**Cleanup Activities:**
- **Log file modification**: Remove or obfuscate attack traces
- **File system cleanup**: Delete temporary files and tools
- **Registry restoration**: Revert system configuration changes
- **Account removal**: Delete created accounts and permissions

**Documentation Requirements:**
- Complete action inventory
- System state verification
- Cleanup confirmation
- Client notification

---

## Information Security Standards and Compliance

### Industry Standards and Frameworks

#### 💳 PCI DSS (Payment Card Industry Data Security Standard)
**Comprehensive security framework** for organizations handling payment card data.

**Key Requirements:**
1. **Install and maintain firewall configuration**
2. **Do not use vendor-supplied defaults** for system passwords
3. **Protect stored cardholder data** with strong encryption
4. **Encrypt transmission** of cardholder data across open networks
5. **Use and regularly update anti-virus software**
6. **Develop and maintain secure systems and applications**
7. **Restrict access** to cardholder data by business need-to-know
8. **Assign unique ID** to each person with computer access
9. **Restrict physical access** to cardholder data
10. **Track and monitor** all network access to cardholder data
11. **Regularly test security systems and processes**
12. **Maintain policy** that addresses information security

#### 🏥 HIPAA (Health Insurance Portability and Accountability Act)
**Healthcare data protection** regulations ensuring patient privacy and security.

**Security Rule Requirements:**
- **Administrative safeguards**: Security management processes
- **Physical safeguards**: Workstation and media controls
- **Technical safeguards**: Access control and audit controls
- **Risk assessment**: Regular security evaluations

**Protected Health Information (PHI):**
- Any individually identifiable health information
- Includes electronic, paper, and oral communications
- Requires explicit patient consent for disclosure
- Subject to breach notification requirements

#### 🌐 ISO 27001 (Information Security Management Systems)
**International standard** for information security management systems (ISMS).

**Core Components:**
- **Risk management**: Systematic risk assessment and treatment
- **Security controls**: Comprehensive control framework (ISO 27002)
- **Continuous improvement**: Regular review and enhancement
- **Management commitment**: Top-level security governance

**Certification Benefits:**
- Demonstrates security commitment to stakeholders
- Provides competitive advantage in business relationships
- Ensures systematic approach to security management
- Facilitates regulatory compliance

---

## Practical Information Gathering

### System Information Commands

#### Windows System Reconnaissance
```bash
# Comprehensive System Information
systeminfo                           # Detailed system configuration
wmic computersystem get domain        # Domain membership status  
wmic computersystem get totalphysicalmemory  # Physical memory information
wmic logicaldisk get caption,size,freespace  # Disk space information

# User and Group Enumeration
net user                             # List all local user accounts
net user [username]                  # Detailed user information
net localgroup                      # List all local groups
net localgroup administrators        # List administrator group members
whoami /all                         # Current user privileges and groups
whoami /priv                        # User privileges only

# Security and Access Information
net accounts                        # Account policy information
net share                          # Shared resources on the system
wmic startup list full             # Startup programs and services
```

**Use Cases:** Initial system reconnaissance, privilege assessment, and security configuration analysis.
**Limitations:** Requires appropriate user privileges; some commands may trigger security logging.

#### Linux System Reconnaissance
```bash
# System Information Gathering
uname -a                            # Complete system information
cat /etc/os-release                 # Operating system details
cat /proc/version                   # Kernel version information
hostnamectl                         # Hostname and system information

# User and Permission Analysis  
cat /etc/passwd                     # User account information
cat /etc/group                      # Group membership details
id                                  # Current user and group IDs
sudo -l                            # Available sudo privileges
groups                             # Current user group membership

# Security-Related Information
cat /etc/shadow                     # Password hashes (requires root)
find / -perm -4000 2>/dev/null     # SUID binaries for privilege escalation
find / -perm -2000 2>/dev/null     # SGID binaries
crontab -l                         # User's scheduled tasks
```

**Use Cases:** Unix/Linux system assessment, privilege escalation identification, and configuration review.
**Limitations:** Many commands require elevated privileges; output may be extensive on production systems.

### Network Information Gathering

#### Network Configuration Analysis
```bash
# Windows Network Information
ipconfig /all                       # Comprehensive network configuration
netstat -an                        # All active network connections
netstat -rn                        # Routing table information
arp -a                             # ARP table entries
nbtstat -A [IP]                    # NetBIOS information for target IP

# Advanced Windows Network Commands
netsh wlan show profiles           # Wireless network profiles
netsh interface show interface    # Network interface status
route print                        # Detailed routing information
netsh firewall show state         # Firewall configuration (legacy)
```

```bash
# Linux Network Information  
ifconfig -a                        # All network interface configuration
ip addr show                       # Modern interface information
netstat -tuln                      # TCP/UDP listening ports
ss -tuln                          # Modern socket statistics
route -n                          # Kernel routing table
ip route                          # Advanced routing information

# Network Discovery and Analysis
arp -a                            # ARP table entries
cat /proc/net/tcp                 # TCP connection information
lsof -i                           # Open network files and connections
```

**Use Cases:** Network topology mapping, active connection analysis, and security configuration assessment.
**Limitations:** Network visibility limited to local subnet; some information requires administrative privileges.

### Environment and Path Analysis

#### System Environment Discovery
```bash
# Windows Environment Analysis
set                                # All environment variables
echo %PATH%                        # System PATH variable
echo %USERPROFILE%                # User profile directory
dir /s /b *.exe | findstr /E .exe  # Executable file discovery
wmic process list full            # Running process information

# Windows Software and Service Enumeration
wmic product get name,version      # Installed software inventory
sc query                          # Service status information
tasklist /svc                     # Running processes with services
wmic service list brief           # Service configuration summary
```

```bash
# Linux Environment Analysis
env                               # Environment variables
echo $PATH                        # PATH variable content
echo $HOME                        # User home directory
which [command]                   # Command location discovery
locate [filename]                 # File location search

# Linux Process and Service Analysis
ps aux                           # Running process information  
systemctl list-units --type=service  # Systemd service status
service --status-all             # SysV service status (legacy)
netstat -tlnp                    # Process-to-port mapping
```

**Use Cases:** Software inventory, security tool detection, and potential attack vector identification.
**Limitations:** Output volume can be substantial; some commands may require elevated privileges for complete information.

### Advanced Reconnaissance Techniques

#### Automated Information Gathering
```bash
# PowerShell-Based Windows Enumeration
Get-ComputerInfo                  # Comprehensive system information
Get-LocalUser                     # Local user accounts
Get-LocalGroup                    # Local security groups
Get-Process                       # Running processes
Get-Service                       # System services
Get-HotFix                       # Installed updates and patches

# One-liner PowerShell system survey
Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, TotalPhysicalMemory, CsProcessors
```

```bash
# Bash-Based Linux Enumeration Script
#!/bin/bash
echo "=== System Information ==="
uname -a
echo "=== Network Configuration ==="  
ip addr
echo "=== User Information ==="
whoami && id
echo "=== SUID Binaries ==="
find / -perm -4000 -type f 2>/dev/null
```

**Use Cases:** Rapid system assessment, automated security auditing, and comprehensive reconnaissance.
**Considerations:** Scripts may trigger security monitoring; ensure proper authorization before execution.

---

## Additional Resources

### Essential Reading
- **[NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)** - Comprehensive cybersecurity guidance
- **[OWASP Top 10](https://owasp.org/www-project-top-ten/)** - Critical web application security risks
- **[SANS Reading Room](https://www.sans.org/reading-room/)** - Security research and white papers
- **[CVE Database](https://cve.mitre.org/)** - Common vulnerabilities and exposures

### Research Papers and Case Studies
- **["A Survey of Information Security"](https://ieeexplore.ieee.org/document/8423146)** - Academic security research overview
- **[CIA Triad Analysis](https://www.techrepublic.com/article/the-cia-triad/)** - Foundational security principles
- **MITRE ATT&CK Framework** - Adversary tactics and techniques knowledge base

### Professional Development
- **Certification Paths**: CEH, CISSP, CISM, OSCP
- **Training Platforms**: Cybrary, Pluralsight, LinkedIn Learning
- **Practice Labs**: VulnHub, TryHackMe, Hack The Box
- **Conference Resources**: DEF CON, Black Hat, BSides events

---

*Last Updated: January 2024 | CEH v12 Compatible*