Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 109 guests and 4 members online
EH-Net News Feeds
Latest Additions
 
Advertisement

You are here: Home arrow Forum arrow Resourcesarrow Tutorialsarrow Ethical Hacking
EH-Net
February 10, 2012, 05:37:52 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Advertise on EH-Net!! - Reasonable Rates, Highly Targeted Audience.
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Ethical Hacking  (Read 8068 times)
0 Members and 2 Guests are viewing this topic.
lemon4879
Newbie
*
Offline Offline

Posts: 2


View Profile
« on: March 18, 2010, 11:13:12 PM »

I want to see how well i can protect my computer (i have two) and basically i want to know a simple non-harmfull hack or proof i can by-pass to check security. I obviously have full access to my own ip address so any help or links would be nice. and if i could do in a command prompt like power shell tell me please and thanks ahead of time
Logged
xXxKrisxXx
Sr. Member
****
Offline Offline

Posts: 491



View Profile
« Reply #1 on: March 19, 2010, 01:02:11 AM »

Hey lemon4879, welcome to EthicalHacker.net,

I'd start simple with running a few vulnerability scans against the machines you'd like to test. The tools I'd recommend would be nessus and possibly GFI Langard. That'd just be a start of course. In the end you don't want to only make sure your computers protected - there's no such thing as fully protected. Even workstations that have a smart IT Dept get penetrated.

Try to keep yourself educated on what to do & what not to do when your online. These could be simple things like not opening e-mails from untrusted sources, visiting links, etc. Social Engineering still remains an evil attack vector to a decent amount of people - try to learn how to spot these techniques!
« Last Edit: March 19, 2010, 01:12:05 AM by xXxKrisxXx » Logged

OSCP, OWSP, eCPPT
j0rDy
Hero Member
*****
Offline Offline

Posts: 543


View Profile
« Reply #2 on: March 19, 2010, 04:05:26 AM »

some tips on securing your workstations:

apply a decent firewall
install a good virus scanner
always keep you os/system up to date with fixpacks
use you common sense! dont open untrusted emails/websites
if you have wireless, use WPA2 with a good password

there are tons more of security measures you can take, but you will see that these are pretty much sufficient to keep the bad guys out or atleast let them move on to easier targets.

after this follow the instructions from Kris, and you will see that your security is just fine...
Logged

ISC2 Associate, CEH, OSCP, OSWP

earning my stripes appears to be a road i must travel alone...with a little help of EH.net
pizza1337
Full Member
***
Offline Offline

Posts: 156

Resource is Power.


View Profile
« Reply #3 on: March 19, 2010, 05:08:57 AM »

Use something like Secunia Personal Software Inspector   http://download.cnet.com/Secunia-Personal-Software-Inspector/3000-2162_4-10717855.html    http://images.techtree.com/ttimages/story/94022_secunia-psi.jpg 

It will just make sure you have everything up to date.
Logged

Knowledge Resource is Power.
n1p
Jr. Member
**
Offline Offline

Posts: 89


View Profile WWW
« Reply #4 on: March 19, 2010, 05:17:23 AM »

All great advice. Whilst focusing on the security of your desktop is  important, I would also take a look at the security of your router if you are sitting behind one with your two machines. Using a site such as AuditMyPc will give you an indication of how visible your pc is to the internet. You should also scan it for any unchecked open ports that may be exploited by automatic scanners (ssh, ftp) etc.

You also asked for a simple check to determine the security . I would consider using some simple Man-in-the-middle attacks between the two PCs and see if you can obtain any information through that. Using some simple bruteforcers against the web interface of your router is also another simple check, as is some Wifi testing  against your WEP/WPA security Tongue

Any questions, just shout

n1p
Logged
lemon4879
Newbie
*
Offline Offline

Posts: 2


View Profile
« Reply #5 on: March 19, 2010, 02:21:41 PM »

hmm sounds like good advice and i just tried a brute force attack and i failed at it. it was tsgrinder and says timed_event_send_recv: Client is dead, sorry
connection dead after timed_event_send_recv

I don't know what I did wrong?
Logged
n1p
Jr. Member
**
Offline Offline

Posts: 89


View Profile WWW
« Reply #6 on: March 21, 2010, 11:11:56 AM »

A bit more description of what you are trying to achieve and your setup would help. Also ensure you terminal services server is accessible by you..
Logged
Dengar13
Sr. Member
****
Offline Offline

Posts: 378



View Profile
« Reply #7 on: March 21, 2010, 12:28:53 PM »

In addition to what j0rDy stated, don't broadcast your SSID on your wireless set up.
Logged

A+, Net+, MCP, CEH
MCSE: Security/Messaging
MCSA: Security/Messaging
Former U.S. Marine and damn proud of it!
chrisj
Hero Member
*****
Offline Offline

Posts: 949


View Profile
« Reply #8 on: March 21, 2010, 09:51:57 PM »

if you have the 2 boxes on their own private network and no other computers on it, get Hacking for Dummies. Read it, and play with the two boxes as you go through the book. Set one up as a testing box, and the other the victim.

LanGuard has a free for 5 ip address version right now. I had some strange experiences with it though, but that could because I have to wait for the trial license to run out.

Happy Pentesting
Logged

OSWP, Sec+
j0rDy
Hero Member
*****
Offline Offline

Posts: 543


View Profile
« Reply #9 on: March 22, 2010, 04:26:55 AM »

In addition to what j0rDy stated, don't broadcast your SSID on your wireless set up.

a good one if you want to go all the way! but remember this is only security through obscurity!
Logged

ISC2 Associate, CEH, OSCP, OSWP

earning my stripes appears to be a road i must travel alone...with a little help of EH.net
hayabusa
Hero Member
*****
Offline Offline

Posts: 1202



View Profile
« Reply #10 on: March 22, 2010, 05:36:19 AM »

As long as we went off on wireless...

Lack of SSID broadcast will only take you so far, anyway.  Yeah, it's a mentality, as j0rdy said, of 'security through obscurity,' and ultimately, if you're going to be hit by a hacker, stopping broadcast will only give you a moment of security, as if an attacker is using good tools, the first time your client connects to the AP, they're GOING to have your SSID, anyway.

Wireless security really needs to include WPA2, MAC filtering, time and access permission configuration, and if you really want to be 'safe,' you should be using some sort of VPN or client auth mechanism in addition to the wireless.  Wireless, in and of itself, can only be secured so far (WPA2 is a pretty good start,) so putting that extra gateway / VPN behind the wireless router will add that extra layer of 'OOMPF' behind it all.
Logged

~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCP , GPEN, C|EH
Armando
Jr. Member
**
Offline Offline

Posts: 53


Founder of eLearnSecurity


View Profile WWW
« Reply #11 on: March 25, 2010, 08:29:42 AM »

Thought I could add something to the discussion:

  • Check your NetBios shares and null sessions (in the end McKinnon managed to get into Nasa with this). It's something you do from command prompt
  • Get USB Firewall utility to stop autoruns on usb dongles
  • Get PSI as mentioned by pizza
  • Get Sandboxie to run executables which behaviour is unknown, or to run your browser (Hey FF 3.6.2 has some great holes btw)

My 2 cents.
Logged

Founder and Lead Author of eLearnSecurity
Training for Penetration Testers
http://www.elearnsecurity.com

1 Free pentesting video every week:
http://www.youtube.com/user/eLearnSecurity
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.16 | SMF © 2011, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.25 seconds with 23 queries.
 

gk_static-ad_feb2012.jpg
Global Knowledge Training: Build Security Skills to Protect and Defend

offsec_130x200-2_jan-feb2012.png
Offensive Security
AWE Live in the Caribbean!
March 5 - 9, 2012

SANS Deals 4 EH-Netters
$150 OFF Any SANS Course in Any Format!
Coupon Code: Refer_EHN
Including SANS Phoenix 2012, SANS 2012
Recent Forum Topics

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!

Vote For EH-Net

Add to Technorati Favorites
technorati fave

 
         
Advertisement

© 2012 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.