The Hackers performs this steps to hack into any system.
Phase 1: Reconnaissance
- Reconnaissance can be described as the pre-attack phase and is a systematic attempt to locate, gather, identify, and record information about the target. The Hacker seeks to find out as much information as possible about the target.
- Business Risk : Notable – Generally noted as “rattling the door knobs” to see of someone is watching and responding.
- Could be the future point of return, noted for ease of entry for an attack when more about the target is known on a broad scale.
Types of Reconnaissance –
Passive Reconnaissance :
- Passive Reconnaissance involves acquiring information without directly interacting with the target.
- For example, searching public records or news releases.
Active Reconnaissance :
- Active Reconnaissance involves interacting with the target directly by any means.
- For example , telephone calls to help desk or technical department.
Phase 2: Scanning
- Scanning is considered the second pre-attack phase. This phase involves taking the information discovered during reconnaissance and using it to examine the network. Scanning involves steps such as intelligent system port scanning which is used to determine open ports and vulnerable services. In this stage the attacker can use different automated tools to discover system vulnerabilities.
- Business Risk : High – Hackers have to get a single point of entry to launch an attack.
- Scanning can include use of dialers, port scanners, network mapping, sweeping, vulnerablity scanners, and so on.
Phase 3 : Gaining Access
- This is the phase where the real hacking takes place. Vulnerabilities discovered during the reconnaissance and scanning phase are now exploited to gain access. The method of connection the Hacker uses for an exploit can be a local area network, local access to a PC, the Internet, or offline. Gaining access is known in the Hacker world as owning the system. During a real security breach it would be this stage where the Hacker can utilize simple techniques to cause irreparable damage to the target system.
- The exploit can occur over a LAN , the internet or as a deception or theft. Examples include buffer overflows, denial of service, session hijacking, and password cracking.
- Influencing factors include architecture and configuration of the target system, the skill level of the perpetrator, and the initial level of access obtained.
- Business Risk : Highest – The hacker can gain access at the operating system level,application level, or network level.
Phase 4 : Maintaining Access
- Once a Hacker has gained access, they want to keep that access for future exploitation and attacks. Sometimes, Hackers harden the system from other Hackers or security personnel by securing their exclusive access with Back-doors, Root kits, and Trojans.
- The attacker can use automated scripts and automated tools for hiding attack evidence and also to create back-doors for further attack.
- The Hacker has compromised the system.
- Hackers may harden the system from other hackers as well by securing their exclusive access with back-doors,Rootkits,or Trojans.
- Hackers can upload, download or manipulate data, application, and configurations on the owned system.
Phase 5 : Clearing Tracks
- In this phase, once Hackers have been able to gain and maintain access, they cover their tracks to avoid detection by security personnel, to continue to use the owned system, to remove evidence of hacking, or to avoid legal action. At present, many successful security breaches are made but never detected. This includes cases where firewalls and vigilant log checking were in place.
- Reasons include the need for prolonged stay, continued use of resources, removing evidence of hacking, or avoiding legal action.
- Examples include steganography, tunneling and altering log files.