What are Hacker or Ethical and Their Work and their Techniques

                         

                                                          
   

In the computer security context, a hacker is someone who seeks       
 and exploits weaknesses in a computer system or computer network. Hackers may be  motivated by a multitude of reasons, such as profit, protest, or challenge. The subculture  that has evolved around hackers is often referred to as the computer underground and is                                       now a known community. While other uses of the word hacker exist that are not related to computer security, such as referring to someone with an advanced understanding of computers and computer networks, they are rarely used in mainstream context. They are subject to the long standing hacker definition controversy about the true meaning of the term hacker. In this controversy, the term hacker is reclaimed bycomputer programmers who argue that someone breaking into computers is better called a cracker, not making a difference between computer criminals (black hats) and computer security experts (white hats). Some white hat hackers claim that they also deserve the title hacker, and that only black hats should be called crackers.

Classifications

Several subgroups of the computer underground with different attitudes use different terms to demarcate themselves from each other, or try to exclude some specific group with which they do not agree.

Eric S. Raymond (author of The New Hacker's Dictionary) advocates that members of the computer underground should be called crackers. Yet, those people see themselves as hackers and even try to include the views of Raymond in what they see as one wider hacker culture, a view harshly rejected by Raymond himself. Instead of a hacker/cracker dichotomy, they give more emphasis to a spectrum of different categories, such as white hat, grey hat, black hat and script kiddie. In contrast to Raymond, they usually reserve the term cracker for more malicious activity.

According to Ralph D. Clifford, a cracker or cracking is to "gain unauthorized access to a computer in order to commit another crime such as destroying information contained in that system".These subgroups may also be defined by the legal status of their activities.

1.White hat

A white hat hacker breaks security for non-malicious reasons, perhaps to test their own security system or while working for a security company which makes security software. The term "white hat" in Internet slang refers to an ethical hacker. This classification also includes individuals who perform penetration tests and vulnerability assessments within a contractual agreement. The EC-Council, also known as the International Council of Electronic Commerce Consultants, is one of those organizations that have developed certifications, course-ware, classes, and online training covering the diverse arena of Ethical Hacking.

2.Black hat

A "black hat" hacker is a hacker who "violates computer security for little reason beyond maliciousness or for personal gain" (Moore, 2005). Black hat hackers form the stereotypical, illegal hacking groups often portrayed in popular culture, and are "the epitome of all that the public fears in a computer criminal". Black hat hackers break into secure networks to destroy data or make the network unusable for those who are authorized to use the network. Black hat hackers also are referred to as the "crackers" within the security industry and by modern programmers. Crackers keep the awareness of the vulnerabilities to themselves and do not notify the general public or manufacturer for patches to be applied. Individual freedom and accessibility is promoted over privacy and security. Once they have gained control over a system, they may apply patches or fixes to the system only to keep their reigning control. Richard Stallman invented the definition to express the maliciousness of a criminal hacker versus a white hat hacker that performs hacking duties to identify places to repair.

3.Grey hat

A grey hat hacker is a combination of a black hat and a white hat hacker. A grey hat hacker may surf the internet and hack into a computer system for the sole purpose of notifying the administrator that their system has a security defect, for example. Then they may offer to correct the defect for a fee.

4.Elite hacker

A social status among hackers, elite is used to describe the most skilled. Newly discovered exploits will circulate among these hackers. Elite groups such as Masters of Deception conferred a kind of credibility on their members.

5.Script kiddie

A script kiddie (also known as a skid or skiddie) is a non-expert who breaks into computer systems by using pre-packaged automated tools written by others, usually with little understanding of the underlying concept—hence the term script (i.e. a prearranged plan or set of activities) kiddie (i.e. kid, child—an individual lacking knowledge and experience, immature).

6.Neophyte

A neophyte, "n00b", or "newbie" is someone who is new to hacking or phreaking and has almost no knowledge or experience of the workings of technology, and hacking.

7.Blue hat

A blue hat hacker is someone outside computer security consulting firms who is used to bug test a system prior to its launch, looking for exploits so they can be closed. Microsoft also uses the term BlueHat to represent a series of security briefing events.

8.Security exploits

A security exploit is a prepared application that takes advantage of a known weakness. Common examples of security exploits are SQL injection,Cross Site Scripting and Cross Site Request Forgery which abuse security holes that may result from substandard programming practice. Other exploits would be able to be used through FTP, HTTP, PHP, SSH, Telnet and some web-pages. These are very common in website/domain hacking.

Techniques:-

Vulnerability scanner

A vulnerability scanner is a tool used to quickly check computers on a network for known weaknesses. Hackers also commonly use port scanners. These check to see which ports on a specified computer are "open" or available to access the computer, and sometimes will detect what program or service is listening on that port, and its version number. (Note that firewallsdefend computers from intruders by limiting access to ports/machines both inbound and outbound, but can still be circumvented.)

Password cracking

Password cracking is the process of recovering passwords from data that has been stored in or transmitted by a computer system. A common approach is to repeatedly try guesses for the password.

Packet sniffer

A packet sniffer is an application that captures data packets, which can be used to capture passwords and other data in transit over the network.

Spoofing attack (Phishing)

A spoofing attack involves one program, system, or website successfully masquerading as another by falsifying data and thereby being treated as a trusted system by a user or another program. The purpose of this is usually to fool programs, systems, or users into revealing confidential information, such as user names and passwords, to the attacker.

Rootkit

A rootkit is designed to conceal the compromise of a computer's security, and can represent any of a set of programs which work to subvert control of an operating system from its legitimate operators. Usually, a rootkit will obscure its installation and attempt to prevent its removal through a subversion of standard system security. Rootkits may include replacements for system binaries so that it becomes impossible for the legitimate user to detect the presence of the intruder on the system by looking at process tables.

Social engineering

When a hacker, typically a black hat, is in the second stage of the targeting process, he or she will typically use some social engineering tactics to get enough information to access the network. A common practice for hackers who use this technique, is to contact the system administrator and play the role of a user who cannot get access to his or her system. An example of this technique is contained in the beginning of the 1995 film Hackers, in which the protagonist Dade "Zero Cool" Murphy makes a phone call to a somewhat clueless employee in charge of security at a TV network company, and then tricks the employee into giving him the modem's phone number by posing, convincingly, as a top-notch accountant who also works for the same company.

Hackers who use this technique have to be quite savvy and choose the words they use carefully, in order to trick the system administrator into giving them information. In some cases only an employed help desk user will answer the phone and they are generally easy to trick. Another typical hacker approach is for the hacker to act like a very angry supervisor and when his/her authority is questioned they will threaten the help desk user with their job. Social engineering is very effective because users are the most vulnerable part of an organization. All the security devices and programs in the world won't keep an organization safe if an employee gives away a password. Black hat hackers take advantage of this fact. Social engineering can also be broken down into four sub-groups. These are intimidation, helpfulness, technical, and name-dropping:

• Intimidation As stated above, with the angry supervisor, the hacker attacks the person who answers the phone with threats to their job. Many people at this point will accept that the hacker is a supervisor and give them the needed information.
• Helpfulness Opposite to intimidation, helpfulness is taking advantage of a person's natural instinct to help someone with a problem. The hacker will not get angry and instead act very distressed and concerned. The help desk is the most vulnerable to this type of social engineering, because it generally has the authority to change or reset passwords, which is exactly what the hacker needs.
• Name-dropping Simply put, the hacker uses the names of advanced users as "key words", and gets the person who answers the phone to believe that they are part of the company because of this. Some information, like web page ownership, can be obtained easily on the web. Other information such as president and vice president names might have to be obtained via dumpster diving.
• Technical Using technology is also a way to get information. A hacker can send a fax or an email to a legitimate user in hopes to get a response containing vital information. Many times the hacker will act like he/she is involved with law enforcement and needs certain data for record keeping purposes or investigations.

Trojan horses

A Trojan horse is a program which seems to be doing one thing, but is actually doing another. A trojan horse can be used to set up a back door in a computer system such that the intruder can gain access later. (The name refers to the horse from the Trojan War, with the conceptually similar function of deceiving defenders into bringing an intruder inside.)

Computer virus

A virus is a self-replicating program that spreads by inserting copies of itself into other executable code or documents. Therefore, a computer virus behaves in a way similar to a biological virus, which spreads by inserting itself into living cells.

While some are harmless or mere hoaxes, most computer viruses are considered malicious.

Computer worm

Like a virus, a worm is also a self-replicating program. A worm differs from a virus in that it propagates through computer networks without user intervention. Unlike a virus, it does not need to attach itself to an existing program. Many people conflate the terms "virus" and "worm", using them both to describe any self-propagating program.

Key loggers

A key logger is a tool designed to record ("log") every keystroke on an affected machine for later retrieval. Its purpose is usually to allow the user of this tool to gain access to confidential information typed on the affected machine, such as a user's password or other private data. Some key loggers use virus-, trojan-, and rootkit-like methods to remain active and hidden. However, some key loggers are used in legitimate ways and sometimes to even enhance computer security. As an example, a business might have a key logger on a computer used at a point of sale and data collected by the key logger could be used for catching employee fraud.

Tools and Procedures

A thorough examination of tools, uses and procedures may be found in the Course workbook by Cengage Learning as part of the E|CSA certification knowledge-base.

Thank you for Reading Hope you Like it :-

Connect Me on Facebook Click Here      

     My facebook Page Free Hacking 

How to Protect Your Website from Hacking Attacks

       If you are a website owner or developer, you are                      probably aware of the  threat of hackers. There are                 many ways to protect your database-driven ASP or                   PHP website from hacker attacks, ranging from weak               to strong security measures. Here you will learn about              the most common and effective ways to slow down                hackers who use methods like SQL injection attacks             and XSS (cross-site scripting) via the URL querystring and form inputs. Two general types of hacker blocking techniques are discussed, including custom error pages and input validation. These methods are simple enough that you can do it yourself with only basic coding knowledge. Your best strategy would be to put up a combination of as many little obstacles as possible.

1.SQL database-driven websites are at risk.

2.Any web page which passes parameters to a database can be vulnerable to attacks. This includes e-commerce shopping carts or any other website that has a form for login, search, etc. Any SQL database-driven website is at risk of hackers who may be able to enter into the database through a back door. Usually these back doors are present in URL querystrings and form inputs, such as Login forms, Search forms, or other user input textboxes that can communicate with a database.

3. An overview of hacking.

4.Generally, a hacker can enter bogus characters into the URL querystring or a textbox. The bogus input is then interpreted as SQL rather than ordinary user data and is executed by the unsuspecting database. As a result, the website may break and display an error, allowing the hacker to glean private information about the database. Even worse, the hacker's hazardous scripts may actually be executed on the database, causing security breaches and/or permanent damage.

5.How hackers do it.

6. The first goal of a hacker is to repeatedly try to break a website, causing it to display a variety of valuable errors that give away private database details. In this way, he can gain insight into the structure of the database and ultimately create a map or footprint of all its tables and columns. The second goal of the hacker is to actually manipulate the database by executing scripts in malicious ways. With control over the database, the hacker may possibly steal credit card numbers, erase data or infect it with viruses, among other nasty things. In essence, the URL querystring and textbox are the two backdoors into a database. Getting errors and manipulating the backdoors are the two methods used by hackers to ultimately destroy a database
.
7. Hack your own website.

8.Let's look at how a hacker might go about breaking into a website. Using the first technique described, he can hack the URL querystring and cause an error to be displayed. You can do a simple test to hack into your own website via the URL querystring. All you have to do is type something else directly into the address bar at the end of your querystring.

9.Type your URL like the following example and press enter:

10.http://www.mywebsite.com/bookreports.asp?reportID=21

11.Now simply add a single quote to the end the querystring and press enter:

12.http://www.mywebsite.com/bookreports.asp?reportID=21'

13.Generate an error.

1. 14
   As predicted, you may have successfully broken your website and received an error as follows.
2. 15
   Error Type:

1. 16
   Microsoft OLE DB Provider for ODBC Drivers (0x80040E14)
2. 17
   [Microsoft][ODBC SQL Server Driver][SQL Server]Unclosed quotation mark before the character string ' AND users.userID=reports.reportsID'.
3. 18
   /bookreports.asp, line 20
4. 19
   The single quote causes an unclosed quotation mark error and now the once-secret table names and column names of your database are publicly visible. After generating a series of these kinds of valuable errors, a hacker can piece together private database details which will ultimately help him break into and wreak havoc on the database.
5. 20
   Hide website errors.
6. 21
   The top most effective solution for keeping the private details of your database from getting into the hands of a hacker is to setup a custom error page for your website. This way, a hacker will never see any detailed error messages. If you do nothing else, this is the number one thing that every website must have. Otherwise, you are giving the hacker an open invitation into your database and practically offering him all the information he needs to launch an attack.
7. 22
   Setup custom error pages.

1. 23
   Some hosting services automatically use custom error pages to help protect your security. To setup your own custom error page, you will need to consult your web host for instructions. Generally, you will create a new HTML page to look the way you please and that says something short and sweet, like 'Sorry, the page you have requested is unavailable.' Then save it as error404.htm and upload it to your server. Following the instructions from your host, you will change the website settings to point to the new error page. This will stop many hackers right in their tracks.
2. 24
   Manipulate the URL querystring.
3. 25
   Besides fishing for errors, a hacker can enter even more dangerous code than a simple single quote into the URL querystring. In an effort to execute malicious scripts on a database, a variety of creative coding is employed, such as %20HAVING%201=1 or maybe %20;shutdown with no wait-- or much worse. Once the hacker is able to execute scripts, the vulnerable database is like putty in their hands. The hacker never has to know the database login or connection string because he is using the URL querystring which already has an open connection.
4. 26
   http://www.mywebsite.com/bookreports.asp?reportID=21'; drop table myTablename--
5. 27
   Your table is permanently deleted.
6. 28
   Manipulate the form input.
7. 29
   The other most common point of entry besides the URL querystring is the form input. A hacker may manipulate any textbox within an HTML form. A search box or a login form with username and password fields are all prime targets. The hacker can enter bogus characters into the textbox and submit the form. The input is then interpreted as SQL rather than ordinary user data and executed by the database. Again, this attack will either cause an error so he can glean private information about your database, or it may actually insert hazardous scripts and wreak havoc on the database.
8. 30
   fred'; drop table myTablename--
9. 31
   Your table is permanently deleted.
10. 32
    Block input containing malicious code.

1. 33
   By now, you probably have a good idea of how much damage a hacker can do and you are ready and willing to do whatever it takes to stop them.The number one way to block a hacker from manipulating the URL querstrying and textboxes is to block their input. But, how do you determine who they are, what they will input and whether or not it is safe? Unfortunately, you cannot know. So, you must assume that all user input could be potentially dangerous. A common saying in the programming world is that ALL INPUT IS EVIL. Thus, it must be treated with caution. Everything from everybody should be checked every time to ensure dangerous code does not slip in. This is accomplished by checking all input that is submitted via a querystring or form and then rejecting or removing unsafe characters before it ever reaches the database. If this sounds like a lot of trouble, you are right. But, it is the price we pay to protect our websites and databases from the wrath of hackers. It is your responsibility as the webmaster to ensure that only clean, safe input is allowed to enter your database.
2. 34
   Input validation.
3. 35
   To check if the input entered into the URL querystring or textbox is safe, we can use input validation rules. In other words, using ASP code on a web page can validate the input collected from the querystring or form to make sure it contains only safe characters. Once the input is deemed safe, it can be stored in a new variable, inserted into the SQL string and sent to the database. For more details about validation,
4. 36
   The wash and rinse cycle.
5. 37
   Input validation should be a two-part process, like a wash and rinse cycle.We want to thoroughly clean all input by first checking for safe characters and second by checking for bad strings. See the resources at the end of this article for a more in depth discussion on this method.
6. 38
   Filter characters.
7. 39
   Another method that can be used in conjunction with the above two functions, but is considered to be very weak when used alone, is to sanitize the input by filtering or escaping.
8. 40
   A well-known threat is the single quote or apostrophe because it breaks the SQL statement. Following is an ASP example that renders the single quote harmless, by replacing it with two single quotes.
9. 41
   'doubleup single quotes
10. 42
    newSafeString = replace(searchInput, "'", "")
11. 43
    Other variations for the replace function include stripping out the script tag and replacing it with a space. Or, filter out characters such as the dollar sign $ quotation mark " semi-colon ; and apostrophe ' the left and right angle brackets <> the left and right parentheses ( ) the pound sign # and the ampersand &. Or convert these characters to their HTML entities.
12. 44
    Remember to use a solution that best fits your website or consult a professional.
13. 45
    Finally, there are a few other security measures that you can research and explore on your own. Remember a hacker can easily save a copy of your webpage, then modify the HTML and javascript, then re-upload the page. Therefore, it is best to never use javascript alone for input validation since it can easily be removed, and instead duplicate any javacript validation with ASP validation. Also, hidden input fields are a threat in the same way since they can easily be altered to include bogus code. Other tips include: Never give away any clues about your database, including making your input field names the same as the database field names. Always set a max length for inputs and truncate the excess.
14. 46
    If you would like to pursue more advanced security techniques, please see the resources at the end of this article. Topics discussed include, password policies, buffer overrun, creative table and column names, table name aliases, set and check data types, .bak files, stored procedures with parameters, and log files.

Thankyou for Reading this is for knowledge Purpose :-

Connect Me on Facebook :-

My New Facebook page hit Like :-    

How to Become a Hacker

                   Deepak Bhardwaj Hacker's Tips $ Tricks

How to Become a Hacker

  There is a community and shared culture of expert programmers and networking wizards that traces its history back through decades to the first time-sharing minicomputers and the earliest ARPAnet experiments. The members of this culture were the first "hackers." Breaking into computers and phreaking phone systems have come to symbolize hacking in popular culture, but hacking culture is much more complex and moralistic than most people know. Learn basic hacking techniques, how to think like a hacker, and how to gain respect in order to crack your way into the complex world of hacking.
I'm Here to Solving your Problems:-    
Connect Me on Facebook Click Here:-
My New Page on Facebook Free Hacking Trickes:-

Part 1 of 3: Learning Basic Hacking Skills

1.Run Unix. Unix is the operating system of the Internet. While you can learn to use the Internet without knowing Unix, you can't be an Internet hacker without understanding Unix. For this reason, the hacker culture today is pretty strongly Unix-centered. A Unix like Linux can run along side Microsoft Windows on the same machine. Download Linux online or find a local Linux user group to help you with installation.^[1]

• A good way to dip your toes in the water is to boot up what Linux fans call a live CD, a distribution that runs entirely off a CD without having to modify your hard disk. This is a way to get a look at the possibilities without having to do anything drastic.
• There are other operating systems besides Unix, but they're distributed in binary — you can't read the code, and you can't modify it. Trying to learn to hack on a Microsoft Windows machine or under any other closed-source system is like trying to learn to dance while wearing a body cast.
• Under Mac OS X it's possible to run Linux, but only part of the system is open source — you're likely to hit a lot of walls, and you have to be careful not to develop the bad habit of depending on Apple's proprietary code

Write HTML. If you don't know how to program, learning basic HyperText Mark-Up Language (HTML) and gradually building proficiency is essential. What you see when you look at a website of pictures, images, and design components is all coded using HTML. For a project, set out to learn how to make a basic home page and work your way up from there.

• In your browser, open the page source information to examine the HTML to see an example. Go to Web Developer > Page Source in Firefox and spend time looking at the code.
• You can write HTML in a basic word processing program like Notepad or SimpleText and save your files as "text only," so you can upload them to a browser and see your work translated.^[2]
• You'll need to learn to format tags and learn to think visually using them.^[3] "<" is used to open a tag and "/> is used to close it. "
  " is the opening for a line of paragraph code. You'll use tags to signal anything visual: italics, formatting, color, etc. Learning HTML will help you to understand better how the Internet works.

Learn the language of programing. Before you start writing poems you have to learn basic grammar. Before you break the rules you have to learn the rules. But if your ultimate goal is to become a hacker, you're going to need more than basic English to write your masterpiece.^[4]

• Python is a good "language" to start off with because it's cleanly designed, well documented, and relatively kind to beginners. Despite being a good first language, it is not just a toy; it is very powerful, flexible, and well-suited for large projects. Javais an alternative, but its value as a first programming language has been questioned.^[5]
• If you get into serious programming, you will have to learn C, the core language of Unix. C++ is very closely related to C; if you know one, learning the other will not be difficult. C is very efficient with your machine's resources, but will soak up huge amounts of your time on debugging and is often avoided for that reason, unless the efficiency of your computer is especially important.

1.Think creatively. Now that you've got the basic skills in place, you can start thinking artistically. Hackers are like artists, philosophers, and engineers all rolled up into one. They believe in freedom and mutual responsibility. The world is full of fascinating problems waiting to be solved. Hackers take a special delight in solving problems, sharpening their skills, and exercising their intelligence.

• Hackers have a diversity of interests culturally and intellectually, outside of hacking. Work as intensely as you play, and play as intensely as you work. For true hackers, the boundaries between "play," "work," "science," and "art" all tend to disappear, or to merge into a high-level creative playfulness.
• Read science fiction. Go to science fiction conventions, which is a great way to meet hackers and proto-hackers. Consider training in a martial art. The kind of mental discipline required for martial arts seems to be similar in important ways to what hackers do. The most hacker-ly martial arts are those which emphasize mental discipline, relaxed awareness, and control, rather than raw strength, athleticism, or physical toughness. Tai Chi is a good martial art for hackers.2.

2. Love solving problems. No problem should ever have to be solved twice. Think of it as a community in which the time of everyone is hackers is precious. Hackers believe sharing information is a moral responsibility. When you solve problems, make the information public to help everyone solve the same issue.

• You don't have to believe that you're obligated to give all your creative product away, though the hackers that do are the ones that get most respect from other hackers. It's consistent with hacker values to sell enough of it to keep you in food and rent and computers.
• Read older pieces, such as the "Jargon File" or "Hacker Manifesto" by The Mentor. They may be out of date in terms of technical issues, but the attitude and spirit are just as timely.

3.  Learn to recognize and fight authority. The enemy of the hacker is boredom, drudgery, and authoritarian figures who use censorship and secrecy to strangle the freedom of information. Monotonous work keeps the hacker from hacking.

• Embracing hacking as a way of life is to reject so-called "normal" concepts of work and property, choosing instead to fight for equality and common knowledge.

4. Be competent. Anyone who spends time on Reddit can write up a ridiculous cyberpunk user name and pose as a hacker. But the Internet is a great equalizer, and values competence over ego and posture. Spend time working on your craft and not your image and you'll more quickly gain respect than modeling yourself on the superficial things we think of "hacking" in popular culture.

Part 3 of 3: Earning Respect

1.Write open-source software. Write programs that other hackers think are fun or useful, and give the program sources away to the whole hacker culture to use. Hackerdom's most revered demigods are people who have written large, capable programs that met a widespread need and given them away, so that now everyone uses them.

2.Help test and debug open-source software. Any open-source author who's thinking will tell you that good beta-testers (who know how to describe symptoms clearly, localize problems well, can tolerate bugs in a quickie release, and are willing to apply a few simple diagnostic routines) are worth their weight in rubies.

• Try to find a program under development that you're interested in and be a good beta-tester. There's a natural progression from helping test programs to helping debug them to helping modify them. You'll learn a lot this way, and generate goodwill with people who will help you later on.

3.Publish useful information. Another good thing is to collect and filter useful and interesting information into web pages or documents like Frequently Asked Questions (FAQ) lists, and make those generally available. Maintainers of major technical FAQs get almost as much respect as open-source authors.

4.Serve the hacker culture itself. This is not something you'll be positioned to do until you've been around for a while and become well-known for one of the four previous items. The hacker culture doesn't have leaders, exactly, but it does have culture heroes and tribal elders and historians and spokespeople. When you've been in the trenches long enough, you may grow into one of these.

• Hackers distrust blatant ego in their tribal elders, so visibly reaching for this kind of fame is dangerous. Rather than striving for it, you have to sort of position yourself so it drops in your lap, and then be modest and gracious about your status.

Thank you For Reading ;---

Connect Me on Facebook Click Here:-

My New Page On Fcebook Free Hacking Tricks Click Here:-