Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 44 guests online
 
Advertisement

You are here: Home arrow Resourcesarrow Tutorialsarrow Ethical Hacking
EH-Net
May 21, 2013, 03:54:54 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Ethical Hacking  (Read 9681 times)
0 Members and 1 Guest are viewing this topic.
lemon4879
Newbie
*
Offline Offline

Posts: 2


View Profile
« on: March 18, 2010, 11:13:12 PM »

I want to see how well i can protect my computer (i have two) and basically i want to know a simple non-harmfull hack or proof i can by-pass to check security. I obviously have full access to my own ip address so any help or links would be nice. and if i could do in a command prompt like power shell tell me please and thanks ahead of time
Logged
xXxKrisxXx
Hero Member
*****
Offline Offline

Posts: 512



View Profile
« Reply #1 on: March 19, 2010, 01:02:11 AM »

Hey lemon4879, welcome to EthicalHacker.net,

I'd start simple with running a few vulnerability scans against the machines you'd like to test. The tools I'd recommend would be nessus and possibly GFI Langard. That'd just be a start of course. In the end you don't want to only make sure your computers protected - there's no such thing as fully protected. Even workstations that have a smart IT Dept get penetrated.

Try to keep yourself educated on what to do & what not to do when your online. These could be simple things like not opening e-mails from untrusted sources, visiting links, etc. Social Engineering still remains an evil attack vector to a decent amount of people - try to learn how to spot these techniques!
« Last Edit: March 19, 2010, 01:12:05 AM by xXxKrisxXx » Logged

eCPPT, GCIH, OSCP, OSWP
j0rDy
Hero Member
*****
Offline Offline

Posts: 590


View Profile
« Reply #2 on: March 19, 2010, 04:05:26 AM »

some tips on securing your workstations:

apply a decent firewall
install a good virus scanner
always keep you os/system up to date with fixpacks
use you common sense! dont open untrusted emails/websites
if you have wireless, use WPA2 with a good password

there are tons more of security measures you can take, but you will see that these are pretty much sufficient to keep the bad guys out or atleast let them move on to easier targets.

after this follow the instructions from Kris, and you will see that your security is just fine...
Logged

ISC2 Associate, CEH, ECSA, OSCP, OSWP

earning my stripes appears to be a road i must travel alone...with a little help of EH.net
pizza1337
Full Member
***
Offline Offline

Posts: 156

Resource is Power.


View Profile
« Reply #3 on: March 19, 2010, 05:08:57 AM »

Use something like Secunia Personal Software Inspector   http://download.cnet.com/Secunia-Personal-Software-Inspector/3000-2162_4-10717855.html    http://images.techtree.com/ttimages/story/94022_secunia-psi.jpg 

It will just make sure you have everything up to date.
Logged

Knowledge Resource is Power.
n1p
Jr. Member
**
Offline Offline

Posts: 89


View Profile WWW
« Reply #4 on: March 19, 2010, 05:17:23 AM »

All great advice. Whilst focusing on the security of your desktop is  important, I would also take a look at the security of your router if you are sitting behind one with your two machines. Using a site such as AuditMyPc will give you an indication of how visible your pc is to the internet. You should also scan it for any unchecked open ports that may be exploited by automatic scanners (ssh, ftp) etc.

You also asked for a simple check to determine the security . I would consider using some simple Man-in-the-middle attacks between the two PCs and see if you can obtain any information through that. Using some simple bruteforcers against the web interface of your router is also another simple check, as is some Wifi testing  against your WEP/WPA security Tongue

Any questions, just shout

n1p
Logged
lemon4879
Newbie
*
Offline Offline

Posts: 2


View Profile
« Reply #5 on: March 19, 2010, 02:21:41 PM »

hmm sounds like good advice and i just tried a brute force attack and i failed at it. it was tsgrinder and says timed_event_send_recv: Client is dead, sorry
connection dead after timed_event_send_recv

I don't know what I did wrong?
Logged
n1p
Jr. Member
**
Offline Offline

Posts: 89


View Profile WWW
« Reply #6 on: March 21, 2010, 11:11:56 AM »

A bit more description of what you are trying to achieve and your setup would help. Also ensure you terminal services server is accessible by you..
Logged
Dengar13
Sr. Member
****
Offline Offline

Posts: 380



View Profile
« Reply #7 on: March 21, 2010, 12:28:53 PM »

In addition to what j0rDy stated, don't broadcast your SSID on your wireless set up.
Logged

A+, Net+, MCP, CEH
MCSE: Security/Messaging
MCSA: Security/Messaging
Former U.S. Marine and damn proud of it!
chrisj
Hero Member
*****
Offline Offline

Posts: 1163


View Profile WWW
« Reply #8 on: March 21, 2010, 09:51:57 PM »

if you have the 2 boxes on their own private network and no other computers on it, get Hacking for Dummies. Read it, and play with the two boxes as you go through the book. Set one up as a testing box, and the other the victim.

LanGuard has a free for 5 ip address version right now. I had some strange experiences with it though, but that could because I have to wait for the trial license to run out.

Happy Pentesting
Logged

OSWP, Sec+
j0rDy
Hero Member
*****
Offline Offline

Posts: 590


View Profile
« Reply #9 on: March 22, 2010, 04:26:55 AM »

In addition to what j0rDy stated, don't broadcast your SSID on your wireless set up.

a good one if you want to go all the way! but remember this is only security through obscurity!
Logged

ISC2 Associate, CEH, ECSA, OSCP, OSWP

earning my stripes appears to be a road i must travel alone...with a little help of EH.net
hayabusa
Hero Member
*****
Offline Offline

Posts: 1632



View Profile
« Reply #10 on: March 22, 2010, 05:36:19 AM »

As long as we went off on wireless...

Lack of SSID broadcast will only take you so far, anyway.  Yeah, it's a mentality, as j0rdy said, of 'security through obscurity,' and ultimately, if you're going to be hit by a hacker, stopping broadcast will only give you a moment of security, as if an attacker is using good tools, the first time your client connects to the AP, they're GOING to have your SSID, anyway.

Wireless security really needs to include WPA2, MAC filtering, time and access permission configuration, and if you really want to be 'safe,' you should be using some sort of VPN or client auth mechanism in addition to the wireless.  Wireless, in and of itself, can only be secured so far (WPA2 is a pretty good start,) so putting that extra gateway / VPN behind the wireless router will add that extra layer of 'OOMPF' behind it all.
Logged

~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCE, OSCP , GPEN, C|EH
Armando
Jr. Member
**
Offline Offline

Posts: 83


Founder of eLearnSecurity


View Profile WWW
« Reply #11 on: March 25, 2010, 08:29:42 AM »

Thought I could add something to the discussion:

  • Check your NetBios shares and null sessions (in the end McKinnon managed to get into Nasa with this). It's something you do from command prompt
  • Get USB Firewall utility to stop autoruns on usb dongles
  • Get PSI as mentioned by pizza
  • Get Sandboxie to run executables which behaviour is unknown, or to run your browser (Hey FF 3.6.2 has some great holes btw)

My 2 cents.
Logged

Founder and Lead Author of eLearnSecurity
Training for Penetration Testers
http://www.elearnsecurity.com

Founder of HACK.ME Free community based web app security virtual labs
https://hack.me
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.099 seconds with 23 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.