book

Ethical Hacking

Name: Ethical Hacking
ISBN: 9781808654053

by Rheinwerk Publishing, Inc, Florian Dalwigk

July 2026

Intermediate

729 pages

33h 9m

English

Packt Publishing

Read now

Unlock full access

Notes on Usage
1 Introduction
1.1 What Is Ethical Hacking?
1.2 Protection Goals of Information Security
1.3 Motivations for Hacking Attacks
1.4 Types of Hackers
1.5 The Cyber Kill Chain
1.6 Hacker Ethics
1.7 Advanced Persistent Threats
1.8 Common Vulnerabilities and Exposures
1.9 Common Vulnerability Scoring System

1.10 Classification of Attacks
1.11 The MITRE ATT&CK Framework
1.12 Tactics, Techniques, and Procedures
1.13 Indicators of Compromise
1.14 Security Models
1.14.1 Defense in Depth1.14.2 The Diamond Model1.14.3 Zero-Trust Model1.14.4 The Pyramid of Pain
1.15 Information Warfare
1.16 Practice Questions
2 TryHackMe
2.1 TryHackMe Overview
2.2 Hacking Lab
2.2.1 Setting Up a Hacking Lab2.2.2 Installing VirtualBox and Kali Linux on Windows2.2.3 Installing VirtualBox and Kali Linux on macOS2.2.4 Setting Up Kali Linux2.2.5 Setting Up an OpenVPN Connection2.2.6 AttackBox
2.3 Starting and Solving Hacking Challenges
2.4 Support from AI: ShellGPT
3 Footprinting and Reconnaissance
3.1 What is Footprinting?
3.2 Active and Passive Footprinting
3.2.1 Footprinting with Search Engines3.2.2 Google Hacking3.2.3 Shodan3.2.4 Reverse Image Search3.2.5 Video Search Engines3.2.6 Meta Search Engines3.2.7 Internet of Things Search Engines3.2.8 Social Networks3.2.9 People Search Engines3.2.10 Job Portals3.2.11 The Wayback Machine (Archive.org)3.2.12 Geographic Search Engines3.2.13 Email Tracking3.2.14 Domain Name System Lookups and Whois3.2.15 Active Footprinting
3.3 Well-Known Files
3.4 Footprinting on the Dark Web
3.5 Tools for Footprinting
3.5.1 Finding Subdomains with Sublist3r3.5.2 Collecting Information with theHarvester3.5.3 Finding User Names with Sherlock3.5.4 Creating Word Lists with Custom Word List Generator3.5.5 Reading Metadata with ExifTool
3.6 Protection against Footprinting
3.7 OhSINT
3.7.1 Preparation3.7.2 Finding The User’s Avatar3.7.3 Finding the City Where the Person Is Located3.7.4 Finding the Service Set Identifier of the Wireless Access Point3.7.5 Finding the Email Address of the Target Person3.7.6 Finding the Origin of the Email Address3.7.7 Finding Where the Target Person Went on Vacation3.7.8 Finding the Secret Password
3.8 Practice Questions
4 Scanning
4.1 Ports and Services
4.2 The OSI Model
4.3 HTTP
4.4 ICMP, UDP, and TCP
4.5 Hping3
4.6 Wireshark
4.7 Nmap
4.7.1 Scanning Techniques with Nmap4.7.2 Host Discovery with AI4.7.3 Protection against Ping Sweeps4.7.4 Scanning Ports and Services with Nmap4.7.5 Scanning Ports and Services with AI4.7.6 Protection Against Port Scanning
4.8 Banner Grabbing
4.9 Practice Questions
5 Enumeration and Fuzzing
5.1 What Is Enumeration?5.1.1 Network Basic Input/Output System Enumeration5.1.2 Simple Network Management Protocol Enumeration5.1.3 Lightweight Directory Access Protocol Enumeration5.1.4 Simple Mail Transfer Protocol Enumeration5.1.5 Domain Name System Enumeration5.1.6 Server Message Block Enumeration5.1.7 Network File System Enumeration5.1.8 Remote Procedure Call Enumeration5.1.9 Active Directory Enumeration5.1.10 Web Enumeration
5.2 Gobuster
5.3 What Is Fuzzing?
5.3.1 Dumb Fuzzing5.3.2 Smart Fuzzing (Generation-Based Fuzzing)5.3.3 Mutation-Based Fuzzing5.3.4 Coverage-Guided Fuzzing5.3.5 Protocol Fuzzing5.3.6 Web Fuzzing
5.4 Fuzz Faster U Fool
5.4.1 Fuzzing Directories and Files5.4.2 Parameter Fuzzing5.4.3 Subdomain and DNS Fuzzing
5.5 WPScan
5.6 Practice Questions
6 Metasploit
6.1 Exploits
6.2 Searching for Exploits
6.3 The Metasploit Framework
6.3.1 Metasploitable 26.3.2 vsftpd Exploit6.3.3 Enumerating SMTP Users6.3.4 Billing: Access to the Server
6.4 Practice Questions
7 Cryptography
7.1 Introduction to Cryptography7.1.1 Protection Goals of Cryptography7.1.2 Types of Cryptography7.1.3 Government Access to Keys and Key Escrow7.1.4 The Kerckhoffs Principle
7.2 Ciphers
7.2.1 The Caesar Cipher7.2.2 The Vigenère Cipher7.2.3 The Book Cipher
7.3 The XOR Operation
7.4 The Feistel Network
7.5 Encryption Algorithms
7.5.1 The RSA Algorithm7.5.2 The Diffie-Hellman Algorithm
7.6 Hash Algorithms
7.7 One-Time Pad
7.8 Digital Signatures
7.9 Quantum Cryptography
7.10 Public Key Infrastructure
7.11 Email Encryption
7.12 Cryptanalysis
7.13 Practice Questions
8 Covert Communication
8.1 Why Is Covert Communication Used?
8.2 Classic Techniques and Modern Equivalents
8.3 Steganography
8.3.1 The Least Significant Bit Method8.3.2 File Overlay8.3.3 Alternate Data Streams8.3.4 Steghide
8.4 Communication via Side Channels
8.5 The Darknet
8.5.1 The Tor Network8.5.2 Hidden Services8.5.3 OnionShare
8.6 c4ptur3-th3-fl4g
8.6.1 Translation and Shifting8.6.2 Spectrograms8.6.3 Steganography8.6.4 Security Through Obscurity
8.7 Practice Questions
9 Cracking Passwords
9.1 Hash Functions and Password Hashes
9.2 Kerberos
9.3 Salt and Pepper
9.4 hashcat
9.4.1 Brute Force9.4.2 Dictionary Attack9.4.3 Mask Attack9.4.4 Rule-Based Attack9.4.5 Combinator Attack9.4.6 HAITI
9.5 Attacks on Passwords
9.5.1 Analog Password Attacks9.5.2 Online Attacks9.5.3 Offline Attacks9.5.4 Cracking Secure Shell Access9.5.5 Cracking ZIP Files
9.6 Protection Against Password Attacks
9.7 CrackIT
9.7.1 Brute Force9.7.2 Dictionary Attack9.7.3 Mask Attack9.7.4 The HKAHacker’s Secret Password9.7.5 CVE-2023-327849.7.6 Cracking a ZIP Archive
9.8 Practice Questions
10 OWASP Top 10
10.1 A01:2021 Broken Access Control
10.2 A02:2021 Cryptographic Failures
10.3 A03:2021 Injection
10.4 A04:2021 Insecure Design
10.5 A05:2021 Security Misconfiguration
10.6 A06:2021 Vulnerable and Outdated Components
10.7 A07:2021 Identification and Authentication Failures
10.8 A08:2021 Software and Data Integrity Failures
10.8.1 Software Integrity Failures10.8.2 Data Integrity Failures
10.9 A09:2021 Security Logging and Monitoring Failures
10.10 A10:2021 Server-Side Request Forgery
10.11 Practice Questions
11 The OWASP Juice Shop
11.1 What Is the OWASP Juice Shop?
11.2 Installing the OWASP Juice Shop
11.3 Tasks in the OWASP Juice Shop
11.3.1 DOM XSS11.3.2 Burp Suite11.3.3 Zero Stars11.3.4 Login Admin11.3.5 Empty User Registration11.3.6 Login Bender or Login Jim11.3.7 Admin Registration
12 Cross-Site Scripting
12.1 Types of XSS12.1.1 Stored XSS12.1.2 Reflected XSS12.1.3 Document Object Model–Based XSS12.1.4 Blind XSS
12.2 Protection Against XSS
12.3 Google XSS Game
12.3.1 Level 1: Hello, World with XSS12.3.2 Level 2: Persistence Is Key12.3.3 Level 3: That Sinking Feeling...12.3.4 Level 4: Context Matters12.3.5 Level 5: Breaking Protocol12.3.6 Level 6: Hello, World of XSS12.3.7 Level 7: How Do You Hack the Google XSS Game?
12.4 Practice Questions
13 SQL Injection
13.1 SQL Basics
13.2 Types of SQL Injections
13.2.1 Inline SQL Injections13.2.2 Boolean-Based Blind SQL Injections13.2.3 Time-Based Blind SQL Injections13.2.4 Error-Based SQL Injections13.2.5 UNION-Based SQL Injections13.2.6 Out-of-Band SQL Injections
13.3 Protection Against SQL Injections
13.4 SQLMap
13.5 Practice Questions
14 Social Engineering
14.1 What Is Social Engineering?
14.2 Psychology of Social Engineering
14.3 Phases of a Social Engineering Attack
14.4 Social Engineering Techniques
14.4.1 Human-Based Social Engineering14.4.2 Computer-Based Social Engineering14.4.3 Phishing14.4.4 Mobile-Based Social Engineering
14.5 Insider Threats
14.5.1 Motives and Types14.5.2 Detecting Insider Attacks
14.6 Identity Impersonation and Identity Theft
14.6.1 Types of Identity Theft14.6.2 How Identity Theft Is Carried Out14.6.3 Recognizing Identity Theft
14.7 Threats Posed by Deepfakes
14.8 Measures Against Social Engineering
14.8.1 Protection Against Insider Threats14.8.2 Protection Against Identity Theft14.8.3 Train Employees
14.9 The Social Engineering Lab
14.9.1 Scenarios14.9.2 Phishing Email14.9.3 Phishing Email with Attachment14.9.4 Phishing Search Image14.9.5 Creating a Phishing Email
14.10 Practice Questions
15 Reverse Shells
15.1 What Is a Bind Shell and How Does It Work?
15.2 What Is a Reverse Shell and How Does It Work?
15.3 Examples of Reverse Shells
15.3.1 PHP15.3.2 Java15.3.3 PowerShell15.3.4 Python15.3.5 TTY Shells
15.4 Obfuscation Techniques for Reverse Shells
15.5 Measures to Protect Against Reverse Shells
15.6 All in One: Reverse Shell
15.7 Practice Questions
16 Privilege Escalation
16.1 What Is Privilege Escalation?
16.2 GTFOBins
16.3 Techniques for Privilege Escalation
16.3.1 DLL Hijacking16.3.2 Dylib Hijacking16.3.3 Named Pipe Impersonation16.3.4 Pivoting and Relaying16.3.5 Manipulation of Boot and Logon Scripts16.3.6 sudo -l16.3.7 SUID Bit16.3.8 Protection Against Privilege Escalation
16.4 RootMe
16.5 Billing: Privilege Escalation
16.6 All in One: Privilege Escalation
16.7 Practice Questions
17 Malware
17.1 What Is Malware?17.1.1 A Brief History of Malware17.1.2 How Does Malware Get onto a System?17.1.3 What Does Malware Consist of?
17.2 Types of Malware
17.2.1 Keylogger17.2.2 Rootkits17.2.3 Trojan17.2.4 Ransomware17.2.5 Viruses and Worms17.2.6 Artificial Intelligence–Based Malware
17.3 Malware Analysis
17.4 Protection Against Malware
17.5 Practice Questions
18 Professional Pentesting
18.1 Pentest Procedure18.1.1 Defining the Scope18.1.2 Non-Disclosure Agreement18.1.3 Putting Together the Team18.1.4 Conducting the Pentest18.1.5 Report18.1.6 Presentation
18.2 Pentesting Standards and Frameworks
18.2.1 Penetration Testing Execution Standard18.2.2 Open Web Application Security Project Web Security Testing Guide18.2.3 NIST SP 800-115: Technical Guide to Information Security Testing and Assessment18.2.4 Open Source Security Testing Methodology Manual18.2.5 German Federal Office for Information Security Classification
18.3 Structure of Pentest Reports
18.3.1 Executive Summary18.3.2 Scope and Objectives18.3.3 Methodology18.3.4 Overview of Vulnerabilities Found18.3.5 Technical Vulnerability Details18.3.6 Recommendations and Measures18.3.7 Appendix
18.4 Writing Pentest Reports with Artificial Intelligence Support
18.5 Tips for Writing Pentest Reports
19 Final Challenge
19.1 The Hunt for Agent Dalvikov19.1.1 Challenge 1.119.1.2 Challenge 1.219.1.3 Challenge 1.3
19.2 The Secret Password Database
19.2.1 Challenge 2.119.2.2 Challenge 2.219.2.3 Challenge 2.3
19.3 Admin Cookie
19.3.1 Challenge 3.119.3.2 Challenge 3.2
19.4 The Secret ZIP Folder
19.5 Federal Bureau of Investigation–Style Criminal Database
19.6 Gaining Access
19.7 Privilege Escalation
The Author
Index
Service Pages
Legal Notes

Content preview from Ethical Hacking

15.6 All in One: Reverse Shell

In this chapter, you will solve the first part of the CTF challenge All in One on TryHackMe, in which you gain access to the target system using a reverse shell (see Figure 15.6). The difficulty level is rated as Easy and the estimated completion time is 45 minutes.

Figure 15.6 CTF Challenge All in One on TryHackMe (Source: https://tryhackme.com/room/allinonemj)

From now on, we assume that the target system is accessible at the IP address 10.10.49.245. To get an overview of which applications and services are running on the system, you can use the following Nmap command:

nmap -sS -sV 10.10.49.245

This will ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781808654053

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Ethical Hacking

by Rheinwerk Publishing, Inc, Florian Dalwigk

15.6 All in One: Reverse Shell

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

More than 5,000 organizations count on O’Reilly

Julian F.

Addison B.

Amir M.

Mark W.

You might also like

Ethical Hacking

Hands-On Ethical Hacking Tactics

Hacking and Security

Hands on Hacking

Publisher Resources