Liam Debels
VIVES Hogeschool
CyberSecurity
,1. Introduction .......................................................................................................... 5
1.1. OSI Model ..................................................................................................... 5
1.2. Vulnerabilities sites ........................................................................................ 6
1.3. Trade off ........................................................................................................ 6
1.4. Risk Analysis Matrix........................................................................................ 6
1.5. CIA Triad ....................................................................................................... 7
1.6. What is Ethical hacking .................................................................................. 7
1.7. Basicconcepten van Ethical Hacking ............................................................... 7
1.8. Types of attacks ............................................................................................. 7
1.9. The Phases of Ethical Hacking ........................................................................ 8
1.10. Cyber Kill Chain (Lockheed Martin) .................................................................. 8
2. Footprinting and Reconnaissance........................................................................... 9
1.11. Types ............................................................................................................ 9
1.12. Tools ............................................................................................................. 9
1.13. Techniques .................................................................................................. 10
1.14. Shodan ....................................................................................................... 10
1.15. Website and email footprinting ..................................................................... 10
1.16. DNS Basics ................................................................................................. 11
1.17. Network Discovery Tools .............................................................................. 11
1.18. OSRF Framework ......................................................................................... 11
1.19. Social Engineering in Footprinting ................................................................. 11
1.20. Preventie ..................................................................................................... 12
1.21. Samenvatting .............................................................................................. 12
3. Scanning And Enumeration ...................................................................................13
1.22. Fundamentals of scanning ........................................................................... 13
1.23. Samenvatting .............................................................................................. 15
4. Sniffing and Evasion .............................................................................................16
1.24. Intro ............................................................................................................ 16
1.25. Prtocols ...................................................................................................... 16
1.26. ARP............................................................................................................. 16
1.27. IPv6 ............................................................................................................ 17
1.28. Wiretapping ................................................................................................. 17
1.29. Active & passive sniffing ............................................................................... 17
1.30. MAC flooding ............................................................................................... 18
1.31. ARP Poisoning ............................................................................................. 18
1.32. DHCP Starvation .......................................................................................... 19
1.33. Spoofing...................................................................................................... 20
1.34. Devices to Evade ......................................................................................... 21
1.35. Snort ........................................................................................................... 21
1.36. Firewall ....................................................................................................... 22
, 1.37. Evasion Techniques ..................................................................................... 22
1.38. Firewall Evasion ........................................................................................... 22
1.40. Honeypots .................................................................................................. 23
5. Attacking a System ...............................................................................................29
1.41. Context ....................................................................................................... 29
1.42. Windows Security Architecture ..................................................................... 29
1.43. Golden Ticket / Pass-the-Hash ...................................................................... 29
1.44. SAM File – Extra Information .......................................................................... 29
1.45. Registry and Root Level Keys ......................................................................... 30
1.46. Registry Types of Values ............................................................................... 31
1.47. Registry Important Locations ........................................................................ 31
1.48. Microsoft Management Console ................................................................... 31
1.49. Linux Security Architecture ........................................................................... 31
1.50. Linux Commands ......................................................................................... 31
1.51. Linux Tips .................................................................................................... 32
1.52. System Hacking Goals ................................................................................. 33
1.53. Authentication and Passwords – 3 Types ........................................................ 33
1.54. Default Password Lists ................................................................................. 34
1.55. Password Attacks ........................................................................................ 34
1.56. Privilege Escalation and Executing Applications ............................................. 35
1.57. Hiding Files and Covering Tracks ................................................................... 36
1.58. Rootkits ...................................................................................................... 36
1.59. Samenvatting CHATGPT ............................................................................... 37
6. Webbased hacking and servers .............................................................................39
1.60. Web Organizations ....................................................................................... 39
1.61. OWASP Web Top 10 ..................................................................................... 39
1.62. Error page XSS Attack Example ..................................................................... 39
1.63. Web Server Attack Methodology.................................................................... 39
1.64. Web Server Architecture ............................................................................... 40
1.65. Web Server Attacks ...................................................................................... 41
1.66. Example path traversal ................................................................................. 41
1.67. Web Application Attacks .............................................................................. 42
1.68. Web Application Attacks - SQL Injection ........................................................ 43
1.69. Burp Suite ................................................................................................... 44
7. Wireless Network hacking .....................................................................................45
1.70. Wireless Encryption ..................................................................................... 46
1.71. Threats........................................................................................................ 46
1.72. Network Discovery ....................................................................................... 47
1.73. Attacks ....................................................................................................... 47
1.74. Wireless Encryption Attacks ......................................................................... 48
Liam Debels VIVES Hogeschool Pagina 3 van 60
, 1.75. Tools ........................................................................................................... 48
1.76. WPA Cracking .............................................................................................. 48
1.77. Wireless Sniffing .......................................................................................... 48
8. Mobile Communication and IOT ............................................................................49
1.78. 3 Main Avenues of Attack .............................................................................. 49
1.79. OWASP Top 10 Mobile Risks.......................................................................... 49
1.80. Mobile Platforms – Android ........................................................................... 49
1.81. Mobile Platforms – IOS ................................................................................. 49
1.82. Mobile Platforms .......................................................................................... 50
1.83. Mobile Attacks ............................................................................................. 50
1.84. IoT Architecture ........................................................................................... 51
9. Cloud Security .....................................................................................................53
1.85. Cloud Computing Basics – Types .................................................................. 53
1.86. Implementatiemodellen ............................................................................... 53
1.87. NIST Cloud Architectuur: Rollen en Actoren ................................................... 53
1.88. Aanvullende details NIST Cloud Architectuur ................................................. 55
1.89. Specifieke taken van de Cloud Broker en Auditor ............................................ 55
1.90. Uitgebreide definities van de actoren............................................................. 55
1.91. Aanvulling op Regelgeving (ENISA)................................................................. 55
10. Trojans and other attacks ......................................................................................56
1.92. Malware Basics ........................................................................................... 56
1.93. Trojans ........................................................................................................ 56
1.94. Netcat......................................................................................................... 56
1.95. Trojan Detectie ............................................................................................ 57
1.96. Virus and Worms ......................................................................................... 58
1.97. Worms ........................................................................................................ 58
1.98. Malware Analyseren ..................................................................................... 59
1.99. Malware Voorkomen .................................................................................... 59
1.100. Denial Of Service (DoS) Attacks ................................................................. 59
1.101. Session Hijacking ..................................................................................... 60
1.102. IPSec ...................................................................................................... 60
Liam Debels VIVES Hogeschool Pagina 4 van 60
VIVES Hogeschool
CyberSecurity
,1. Introduction .......................................................................................................... 5
1.1. OSI Model ..................................................................................................... 5
1.2. Vulnerabilities sites ........................................................................................ 6
1.3. Trade off ........................................................................................................ 6
1.4. Risk Analysis Matrix........................................................................................ 6
1.5. CIA Triad ....................................................................................................... 7
1.6. What is Ethical hacking .................................................................................. 7
1.7. Basicconcepten van Ethical Hacking ............................................................... 7
1.8. Types of attacks ............................................................................................. 7
1.9. The Phases of Ethical Hacking ........................................................................ 8
1.10. Cyber Kill Chain (Lockheed Martin) .................................................................. 8
2. Footprinting and Reconnaissance........................................................................... 9
1.11. Types ............................................................................................................ 9
1.12. Tools ............................................................................................................. 9
1.13. Techniques .................................................................................................. 10
1.14. Shodan ....................................................................................................... 10
1.15. Website and email footprinting ..................................................................... 10
1.16. DNS Basics ................................................................................................. 11
1.17. Network Discovery Tools .............................................................................. 11
1.18. OSRF Framework ......................................................................................... 11
1.19. Social Engineering in Footprinting ................................................................. 11
1.20. Preventie ..................................................................................................... 12
1.21. Samenvatting .............................................................................................. 12
3. Scanning And Enumeration ...................................................................................13
1.22. Fundamentals of scanning ........................................................................... 13
1.23. Samenvatting .............................................................................................. 15
4. Sniffing and Evasion .............................................................................................16
1.24. Intro ............................................................................................................ 16
1.25. Prtocols ...................................................................................................... 16
1.26. ARP............................................................................................................. 16
1.27. IPv6 ............................................................................................................ 17
1.28. Wiretapping ................................................................................................. 17
1.29. Active & passive sniffing ............................................................................... 17
1.30. MAC flooding ............................................................................................... 18
1.31. ARP Poisoning ............................................................................................. 18
1.32. DHCP Starvation .......................................................................................... 19
1.33. Spoofing...................................................................................................... 20
1.34. Devices to Evade ......................................................................................... 21
1.35. Snort ........................................................................................................... 21
1.36. Firewall ....................................................................................................... 22
, 1.37. Evasion Techniques ..................................................................................... 22
1.38. Firewall Evasion ........................................................................................... 22
1.40. Honeypots .................................................................................................. 23
5. Attacking a System ...............................................................................................29
1.41. Context ....................................................................................................... 29
1.42. Windows Security Architecture ..................................................................... 29
1.43. Golden Ticket / Pass-the-Hash ...................................................................... 29
1.44. SAM File – Extra Information .......................................................................... 29
1.45. Registry and Root Level Keys ......................................................................... 30
1.46. Registry Types of Values ............................................................................... 31
1.47. Registry Important Locations ........................................................................ 31
1.48. Microsoft Management Console ................................................................... 31
1.49. Linux Security Architecture ........................................................................... 31
1.50. Linux Commands ......................................................................................... 31
1.51. Linux Tips .................................................................................................... 32
1.52. System Hacking Goals ................................................................................. 33
1.53. Authentication and Passwords – 3 Types ........................................................ 33
1.54. Default Password Lists ................................................................................. 34
1.55. Password Attacks ........................................................................................ 34
1.56. Privilege Escalation and Executing Applications ............................................. 35
1.57. Hiding Files and Covering Tracks ................................................................... 36
1.58. Rootkits ...................................................................................................... 36
1.59. Samenvatting CHATGPT ............................................................................... 37
6. Webbased hacking and servers .............................................................................39
1.60. Web Organizations ....................................................................................... 39
1.61. OWASP Web Top 10 ..................................................................................... 39
1.62. Error page XSS Attack Example ..................................................................... 39
1.63. Web Server Attack Methodology.................................................................... 39
1.64. Web Server Architecture ............................................................................... 40
1.65. Web Server Attacks ...................................................................................... 41
1.66. Example path traversal ................................................................................. 41
1.67. Web Application Attacks .............................................................................. 42
1.68. Web Application Attacks - SQL Injection ........................................................ 43
1.69. Burp Suite ................................................................................................... 44
7. Wireless Network hacking .....................................................................................45
1.70. Wireless Encryption ..................................................................................... 46
1.71. Threats........................................................................................................ 46
1.72. Network Discovery ....................................................................................... 47
1.73. Attacks ....................................................................................................... 47
1.74. Wireless Encryption Attacks ......................................................................... 48
Liam Debels VIVES Hogeschool Pagina 3 van 60
, 1.75. Tools ........................................................................................................... 48
1.76. WPA Cracking .............................................................................................. 48
1.77. Wireless Sniffing .......................................................................................... 48
8. Mobile Communication and IOT ............................................................................49
1.78. 3 Main Avenues of Attack .............................................................................. 49
1.79. OWASP Top 10 Mobile Risks.......................................................................... 49
1.80. Mobile Platforms – Android ........................................................................... 49
1.81. Mobile Platforms – IOS ................................................................................. 49
1.82. Mobile Platforms .......................................................................................... 50
1.83. Mobile Attacks ............................................................................................. 50
1.84. IoT Architecture ........................................................................................... 51
9. Cloud Security .....................................................................................................53
1.85. Cloud Computing Basics – Types .................................................................. 53
1.86. Implementatiemodellen ............................................................................... 53
1.87. NIST Cloud Architectuur: Rollen en Actoren ................................................... 53
1.88. Aanvullende details NIST Cloud Architectuur ................................................. 55
1.89. Specifieke taken van de Cloud Broker en Auditor ............................................ 55
1.90. Uitgebreide definities van de actoren............................................................. 55
1.91. Aanvulling op Regelgeving (ENISA)................................................................. 55
10. Trojans and other attacks ......................................................................................56
1.92. Malware Basics ........................................................................................... 56
1.93. Trojans ........................................................................................................ 56
1.94. Netcat......................................................................................................... 56
1.95. Trojan Detectie ............................................................................................ 57
1.96. Virus and Worms ......................................................................................... 58
1.97. Worms ........................................................................................................ 58
1.98. Malware Analyseren ..................................................................................... 59
1.99. Malware Voorkomen .................................................................................... 59
1.100. Denial Of Service (DoS) Attacks ................................................................. 59
1.101. Session Hijacking ..................................................................................... 60
1.102. IPSec ...................................................................................................... 60
Liam Debels VIVES Hogeschool Pagina 4 van 60
