Ethical Hacking | DSE/GE7e | Unit 4: Gaining and Maintaining Access

ETHICAL HACKING
DSE/GE7e — Semester VI / VII

UNIT 4: GAINING AND MAINTAINING ACCESS

Network level attacks and countermeasures, OWASP ZAP, Burp Suite | Duration: 1 Week | Ref[1]:
SYLLABUS
Pg 142,165 | Ref[3]: Ch10(10.17): Pg 68-69 | Ref[5]: Pg 63-64

4.1 Introduction to Gaining Access

Gaining access is one of the most critical phases in ethical hacking. After successfully scanning and
enumerating the target system, the attacker attempts to exploit vulnerabilities to gain unauthorized access.
This phase directly impacts the integrity and confidentiality of the target system.

4.1.1 Definition and Goal

• Gaining access means exploiting discovered vulnerabilities to infiltrate a target system or network.
• The objective is to obtain a foothold — at user-level or administrative level.
• Access can be gained at the OS level, application level, or network level.
• Ethical hackers use this phase to demonstrate the potential impact of real attacks.

4.1.2 Factors Affecting Access

• Architecture and configuration of the target system.
• Skill level of the attacker.
• Level of access achieved — administrator, root, user, or application-level.
• Patch levels and security posture of the system.
• Nature and type of vulnerabilities discovered during scanning.

4.2 Network Level Attacks

Network level attacks exploit weaknesses in network protocols, communication channels, or misconfigured
network services. These attacks can affect an entire network infrastructure simultaneously.

4.2.1 Password Attacks

A) Brute Force Attack
• Attempts every possible combination of characters to find the correct password.
• Effective against weak or short passwords; very slow for long complex ones.
• Tools: Hydra, Medusa, John the Ripper.

B) Dictionary Attack
• Uses a pre-built wordlist of commonly used passwords or phrases.
• Faster than brute force but limited to words in the dictionary.
• Tools: Hashcat, Aircrack-ng.

C) Password Sniffing

Ethical Hacking Notes | Page 1

 Ethical Hacking | DSE/GE7e | Unit 4: Gaining and Maintaining Access

• Captures network packets to extract unencrypted credentials.

• Highly effective on unencrypted protocols: HTTP, FTP, Telnet.
• Tools: Wireshark, tcpdump, Cain & Abel.

4.2.2 Man-in-the-Middle (MitM) Attack

• Intercepts communication between two parties without their knowledge.
• ARP Poisoning: Maps the attacker's MAC address to a legitimate IP.
• DNS Spoofing: Redirects domain lookups to malicious IP addresses.
• SSL Stripping: Downgrades HTTPS connections to unencrypted HTTP.
• Tools: Ettercap, MITMf, Bettercap.

4.2.3 DoS and DDoS Attacks

• DoS floods a target with illegitimate traffic, denying service to legitimate users.
• DDoS uses multiple compromised systems (botnets) for coordinated attacks.
• Types: SYN Flood, UDP Flood, HTTP Flood, Ping of Death, Smurf Attack.
• Countermeasure: Rate limiting, firewalls, IPS, CDN-based filtering.

4.2.4 Session Hijacking

• Exploiting a valid session token to take over a user's authenticated session.
• Active hijacking: taking over an active session; Passive: monitoring only.
• TCP Session Hijacking: Attacker predicts sequence numbers in the TCP handshake.
• HTTP Session Hijacking: Stealing cookies via XSS or packet sniffing.
• Countermeasures: HTTPS, secure/HttpOnly cookie flags, session timeouts, token rotation.

4.2.5 ARP Poisoning / Spoofing

• ARP maps IP addresses to MAC addresses on a local network.
• ARP Poisoning sends forged ARP replies, linking attacker's MAC to a valid IP.
• Allows interception, modification, or stopping of data in transit.
• Countermeasure: Dynamic ARP Inspection (DAI), static ARP entries, VLANs.

4.2.6 IP Spoofing
• Forges the source IP address in packets to impersonate a trusted host.
• Used in DoS attacks and to bypass IP-based authentication.
• Countermeasure: Ingress/egress filtering, reverse path filtering, encryption.

4.2.7 DNS Cache Poisoning

• Corrupts DNS cache to redirect users to malicious websites.
• Forged DNS entries persist until the cache expires.
• Used for phishing, malware distribution, and credential theft.
• Countermeasure: DNSSEC, using trusted DNS resolvers.

4.2.8 Replay Attacks

Ethical Hacking Notes | Page 2

 Ethical Hacking | DSE/GE7e | Unit 4: Gaining and Maintaining Access

• Capturing and reusing valid auth data (tokens) to gain unauthorized access.
• Common where timestamps or nonces are absent in the authentication flow.
• Countermeasure: Timestamps, nonces, OTP, and rotating session IDs.

Attack Type Target Mechanism Key Countermeasure

Account lockout, strong

Brute Force Passwords Exhaustive trial
policy

MitM Network Traffic ARP Poisoning, SSL Strip HTTPS, certificate pinning

Secure cookies, session

Session Hijack Active Sessions Cookie theft / seq. pred.
rotation

ARP Poisoning LAN Forged ARP replies Dynamic ARP Inspection

DNS Poisoning DNS Cache Forged DNS entries DNSSEC

Replay Attack Auth Tokens Reuse captured creds Nonces, timestamps, OTP

4.3 Countermeasures for Network Level Attacks

Countermeasures are defensive strategies and tools implemented to detect, prevent, or reduce the impact
of network level attacks.

4.3.1 Firewalls
• Monitor and filter incoming/outgoing traffic based on security rules.
• Types: Packet filtering, Stateful inspection, Application-layer (WAF).
• Should be configured with the principle of least privilege.

4.3.2 IDS / IPS

• IDS monitors traffic and alerts on suspicious activity — does not block.
• IPS actively blocks malicious traffic in real-time.
• Signature-based detects known patterns; Anomaly-based detects deviations from baseline.
• Examples: Snort (open-source IDS/IPS), Suricata.

4.3.3 Encryption
• Encrypting data in transit: TLS/SSL, IPSec, SSH.
• Prevents eavesdropping, data tampering, and replay attacks.
• VPNs create encrypted tunnels for secure communication.

4.3.4 Network Segmentation & VLANs

• Divides a network into segments to limit attack spread.
• VLANs isolate broadcast domains and restrict access between segments.
• Reduces attack surface and limits lateral movement.

4.3.5 Strong Authentication

• MFA combines password with a second factor (OTP, biometric).

Ethical Hacking Notes | Page 3

 Ethical Hacking | DSE/GE7e | Unit 4: Gaining and Maintaining Access

• Certificate-based authentication uses digital certificates instead of passwords.

• SSO with strong identity federation reduces password exposure.

4.3.6 Patch Management

• Regularly update OS, firmware, and software to fix known vulnerabilities.
• Maintain an inventory of all systems and their patch status.
• Use automated tools for patch deployment in large environments.

4.4 OWASP ZAP (Zed Attack Proxy)

OWASP ZAP — Free, open-source web application security scanner by OWASP (Open Web
TOOL
Application Security Project).

4.4.1 Overview
• ZAP = Zed Attack Proxy — one of the world's most popular free security tools.
• Used for manual security testing, automated scanning, and web app penetration testing.
• Acts as a proxy between the browser and the web application to intercept traffic.
• Supported on Windows, Linux, and macOS.

4.4.2 Key Features

• Intercepts and modifies HTTP/HTTPS traffic between browser and server.: Intercepting Proxy
• Automatically detects vulnerabilities: SQLi, XSS, CSRF, etc.: Active Scanner
• Monitors traffic for vulnerabilities without active probing.: Passive Scanner
• Crawls the web application to discover URLs and content.: Spider
• Crawls AJAX-heavy apps that the traditional spider cannot explore.: Ajax Spider
• Sends unexpected/malformed inputs to discover vulnerabilities.: Fuzzer
• Attempts to discover hidden directories and files.: Forced Browse
• Generates detailed reports in HTML, XML, JSON formats.: Report Generation
• Fully scriptable via REST API for CI/CD integration.: API Support

4.4.3 How OWASP ZAP Works

1. Set up ZAP as a proxy in your browser (default: localhost:8080).
2. Browse the target application — ZAP captures all HTTP/HTTPS traffic.
3. Use the Spider to map the entire application structure.
4. Launch Active Scan to automatically test for vulnerabilities.
5. Analyze results; review alerts by risk level (High / Medium / Low / Informational).
6. Generate a report detailing all vulnerabilities with remediation advice.

4.4.4 Vulnerabilities Detected by ZAP

• SQL Injection (SQLi)
• Cross-Site Scripting (XSS)

Ethical Hacking Notes | Page 4

 Ethical Hacking | DSE/GE7e | Unit 4: Gaining and Maintaining Access

• Cross-Site Request Forgery (CSRF)

• Insecure Direct Object References (IDOR)
• Security Misconfigurations
• Sensitive Data Exposure
• Broken Authentication and Session Management

4.5 Burp Suite

Burp Suite by PortSwigger — industry-standard web application security testing platform. Editions:
TOOL
Community (free), Professional (paid), Enterprise (automated at scale).

4.5.1 Overview
• Integrated platform for web application security testing.
• Widely used by professional penetration testers and bug bounty hunters.
• Operates as an intercepting proxy for detailed HTTP/HTTPS inspection and manipulation.
• Three editions: Community (free, limited), Professional (full features), Enterprise.

4.5.2 Key Modules

• Proxy: Core component — intercepts and allows modification of HTTP/HTTPS requests.
• Repeater: Manually replay and modify individual HTTP requests for in-depth testing.
• Intruder: Automated fuzzing and brute-force tool. Modes: Sniper, Battering Ram, Pitchfork, Cluster
Bomb.
• Scanner: Automated vulnerability scanner (Pro only) — crawls and actively tests endpoints.
• Spider: Automatically maps app structure, discovers hidden links, forms, and parameters.
• Decoder: Encodes/decodes data: URL, HTML, Base64, Hex, ASCII.
• Comparer: Compares two server responses to highlight subtle differences.
• Sequencer: Analyzes randomness of session tokens to detect predictable IDs.
• Extender: Add custom plugins (BApps) from the community BApp Store.

4.5.3 Burp Suite Testing Workflow

1. Configure browser to route traffic through Burp Proxy ([Link]:8080).
2. Install Burp's CA certificate in the browser to intercept HTTPS.
3. Browse the application — all traffic is captured in the Proxy tab.
4. Send interesting requests to Repeater or Intruder for deeper analysis.
5. Use Scanner (Pro) to automatically identify vulnerabilities.
6. Document and report vulnerabilities with supporting evidence from Burp.

4.5.4 OWASP ZAP vs Burp Suite

Feature OWASP ZAP Burp Suite

Cost Free & Open Source Free (Community) / Paid (Pro)

Ethical Hacking Notes | Page 5

 Ethical Hacking | DSE/GE7e | Unit 4: Gaining and Maintaining Access

Feature OWASP ZAP Burp Suite

Ease of Use Beginner-friendly Moderate learning curve

Active Scanner Yes (free) Yes (Pro only)

Fuzzing Yes (Fuzzer) Yes (Intruder)

API Support Yes (REST API) Yes (REST API)

Session Analysis Limited Yes (Sequencer)

Best For Learning, CI/CD pipelines Professional pen testing, bug bounty

4.6 Maintaining Access

Once access is gained, the attacker installs mechanisms to maintain that access persistently without being
detected.

4.6.1 Backdoors
• Covert method of bypassing normal authentication for future re-entry.
• Can be hardware-based, software-based, or embedded in applications.
• Examples: Netcat listener, reverse shells, Meterpreter sessions (Metasploit).

4.6.2 Rootkits
• Software designed to provide persistent, hidden privileged access.
• Types: User-mode, Kernel-mode, Bootloader (Bootkits), Memory-based rootkits.
• Very difficult to detect — operate at kernel level.
• Countermeasure: Integrity checkers (Tripwire), rootkit detectors (GMER).

4.6.3 Hidden User Accounts

• Attackers create admin-privileged accounts disguised as system accounts.
• Countermeasure: Regular user account audits, principle of least privilege.

4.6.4 Scheduled Tasks / Cron Jobs

• Malicious scheduled tasks ensure persistent code execution at regular intervals.
• Attackers abuse crontab (Linux) or Task Scheduler (Windows).
• Countermeasure: Regularly audit scheduled tasks and cron entries.

4.7 Privilege Escalation

Privilege escalation is the process of gaining higher-level permissions than those initially obtained — a
critical step toward full system compromise.

4.7.1 Types of Privilege Escalation

• Gaining access to resources of another user at the same privilege level.: Horizontal
• Gaining higher privileges (user → admin, admin → root). Also called traditional privilege
escalation.: Vertical

Ethical Hacking Notes | Page 6

 Ethical Hacking | DSE/GE7e | Unit 4: Gaining and Maintaining Access

4.7.2 Common Techniques

• Running SUID programs to execute commands as root.: SUID/SGID Abuse (Linux)
• Injecting malicious code into legitimate processes.: DLL Injection (Windows)
• Using stolen access tokens of higher-privileged processes.: Token Impersonation (Windows)
• Exploiting unpatched OS vulnerabilities (e.g., Dirty COW, MS17-010).: Kernel Exploits
• Exploiting overly permissive sudo rules on Linux.: Sudo Misconfigurations
• Replacing a service binary to run as SYSTEM.: Weak Service Permissions

4.8 Important Tools Summary

Tool Category Purpose Platform

Scanning, proxying,
OWASP ZAP Web App Testing Cross-platform
spidering

Intercepting proxy, fuzzing,

Burp Suite Web App Testing Cross-platform
scan

Exploit vulnerabilities,
Metasploit Exploitation Cross-platform
post-exp

Brute-force on network
Hydra Password Attacks Linux/Windows
services

John the Ripper Password Cracking Password hash cracking Cross-platform

ARP poisoning, traffic

Ettercap MitM Attacks Linux
sniffing

Network traffic capture &

Wireshark Packet Analysis Cross-platform
analysis

Creating reverse/bind
Netcat Backdoor / Shell Cross-platform
shells

Extract passwords from

Mimikatz Credential Dumping Windows
Windows mem

MitM, ARP spoofing,

Bettercap Network Attacks Cross-platform
monitoring

4.9 Quick Revision & Key Points

These points are especially important for examinations. Focus on understanding concepts, not just
EXAM NOTE
memorizing definitions.

Network Level Attacks:

• ARP Poisoning maps attacker's MAC to a valid IP — enables MitM attacks.
• Session hijacking exploits TCP sequence numbers or stolen session cookies.
• Replay attacks reuse captured authentication data. Nonces and timestamps prevent them.
• DNS cache poisoning redirects legitimate queries to malicious IPs. DNSSEC prevents it.

Ethical Hacking Notes | Page 7

 Ethical Hacking | DSE/GE7e | Unit 4: Gaining and Maintaining Access

OWASP ZAP:
• Free and open-source. Runs as an intercepting proxy (default port: 8080).
• Key features: Active Scanner, Passive Scanner, Spider, Ajax Spider, Fuzzer.
• Detects OWASP Top 10 vulnerabilities. Integrates with CI/CD pipelines.

Burp Suite:
• By PortSwigger. Community (free) and Professional (paid) editions.
• Key modules: Proxy, Repeater, Intruder, Scanner (Pro), Decoder, Sequencer, Comparer.
• Intruder attack modes: Sniper, Battering Ram, Pitchfork, Cluster Bomb.

Maintaining Access:
• Backdoors allow re-entry without re-exploitation. Rootkits hide presence at kernel level.
• Privilege escalation: Horizontal (same level, different user) vs. Vertical (higher privileges).
• Common techniques: SUID abuse, DLL injection, token impersonation, kernel exploits.

References
1. Patrick Engbretson, The Basics of Hacking and Penetration Testing, 2nd Ed., Syngress, 2013. [Pg
142, 165]
2. Georgia Weidman, Penetration Testing: A Hands-On Introduction to Hacking, 1st Ed., No Starch
Press, 2014.
3. Michael Nieles et al., An Introduction to Information Security, NIST SP 800-12 Rev. 1, 2017.
[Ch10(10.17): Pg 68-69]
4. National Information Security Policy and Guidelines, 2014.
5. Peter Kim, The Hacker Playbook 3, Zaccheus Entertainment, 2018. [PDF pg. 63-64]

— End of Unit 4 Notes —

Ethical Hacking Notes | Page 8