The Art of the Ethical Hack: A Q&A with Muhammad Taha Researcher at Riphah International University

1: How to start a career as an Ethical Hacker?

To start a career as CEH, learn the fundamentals of Networking and Operating Systems. Learn how Networks are designed, protocols and then the misconfigurations in network designs. Most of the hackers exploit the flaws left by software developers. Learn how to developed secure code and then the flaws in the coding. In this way, you can become a very good Ethical Hacker. There are lots of online websites to start Ethical Hacking. www.udemy.com and www.cybrary.it have lots of free and paid courses which are helpful for beginners. cybrary.it is one of my favorites sites to learn Ethical Hacking.

 

2: What it needs to be an ethical hacker in Pakistan?

Determination and Hard Work This is required for everything and same with Ethical Hacking. In the past, finding bugs was very easy but today it is very difficult to find new vulnerabilities. The way Hackers think has been changed. Technology is changing rapidly. To be an ethical hacker in Pakistan, a person needs to be updated with emerging technology. Using of tools is too much easy today. Communities are very helpful, what is difficult is the “brain behind the work”. Hacker more good strategies will surpass the one with old strategies.

 

3: What are the opportunities for Ethical Hackers?

There are lots of opportunities for Ethical Hackers. There are fewer opportunities in Pakistan as compared to rest of the world but in middle-east and west, Ethical Hackers are earning lots of money. Ethical Hacker can be promoted to senior management positions like CISO(Chief Information security officer) and CIO(Chief information officer). I know people working in banking sectors and telecom sectors who were once ethical hackers but now they are enjoying high ranks in reputed organizations.

 

4: What is Bug Bounty?

Bug Bounty or Bug Hunting is a program offered by the worlds reputed organizations like Facebook, Yahoo, Google, PayPal etc. They offer Ethical Hackers to hack their systems and report them; in return, those hackers are paid. In this way, Hackers hack into their system, find bugs, report them and get paid. There are lots of Hackers from Pakistan who have been awarded hall of fame and money. Rafay Baloch and Shahmir Amir are one of them who have the good name in infosec market.

 

5: How Ethical Hackers Earn?

Ethical Hackers earn by doing jobs as an Ethical Hacker, Cyber Security Analyst, Penetration Tester etc. The organizations hire them to find vulnerabilities in their products and services and write a report which is called Penetration Testing Report which includes the vulnerabilities present in their products and the recommended solutions to improve them.

Ethical Hackers also take part in Bug Bounty Programs as discussed above.

They are also hired by third parties for a contract based work. This is called External Penetration testing team which completes the project for a short period of time and get paid.

They also work as an instructor in different institutions, Universities and online courses like Udemy, Coursera, Pentester Academy etc.

 

6: What Skills Are Required to be an Ethical Hacker?

Good understanding of Networks, Servers, Web Applications, Operating Systems and at least one programming language preferably Python. Apart from these, the understanding of Digital Forensics is also important because it is mandatory for the hacker to know how they are traced back. After the understanding of Digital Forensics, ethical hacker can know that how footprints can be removed completely and become anonymous.

 

7: how to become CEH in Pakistan?

By reading books and have the understanding of ethical hacking tools and terminologies, having the understanding of how tools work and which tool to use in a particular scenario, a person can be prepared for CEH. The current version of CEH is CEH v9 and there are 18 domains in it. Most of the domains are easy, some need practical work. Read official EC-Council slides and books and follow the steps. As said earlier, websites like cybrary.it and udemy.com can help in this regard. Most of the people go to an institute to learn CEH. I think a person can do it himself and there is no need for an institution. There are already all the materials online.

 

8: what is the age requirement to become CEH?

Age requirement to become CEH is 18 years according to EC-Council policies.

 

9: What are the major certifications for ethical hackers?

CEH(Certified Ethical Hacker), OSCP(offensive security certified professional), ECSA(cybersecurity analyst), LPT(licensed penetration tester). These certifications are enough to have a good name in infosec market starting with CEH.

 

10: what ethical hackers must do to enhance their skills?

With the enhancement of technology, an Ethical Hacker should always be up to date. As it is being said that ipv6 and now IOT is going to change the world. With the emerging technologies, Black-Hat Hackers are polishing their skills, So should the Ethical Hacker. Because Ethical Hacker has to defend the organization from being hacked. A Black Hat Hackers needs just one weak point to break the system but an ethical hacker should check for all the weak points in the system through which hacker can attack. Therefore, an ethical hacker should always be one step ahead of Black Hat Hacker. Engage with the Ethical Hackers community, attend conferences both locally and internationally, read all the latest news, test for new vulnerabilities to stay up to date.

 

11: What is Foot-printing in ethical hacking? What are the techniques used for Footprinting?

Footprinting is the first step in the process of Ethical Hacking or simply Hacking. Footprinting means finding all the information about Network, Applications, and Servers i.e anything in the organization connected to the internet.

There are two types of Footprinting

1) Active: in which activities performed to get information can be detected by the other end. e.g. by using Nmap to check open ports and services

2) Passive: in which activities performed to get information about the organization are never detected e.g. information from social media and the websites are analyzed for possible bugs/vulnerabilities.

 

12: Explain what is Brute Force Hack?

Brute Force is the technique used to crack the input fields e.g passwords, cryptography keys, hashes etc. In this technique, all the possible keywords are tried on hit and trial basis to crack the password. It is guaranteed that the attack will be successful but it may take thousands of years depending on processing speed and the strength of the password. The other technique is Dictionary attack which checks for the word list maintained in the file. In this attack, there is no guarantee that keyword will match the desired input but it is efficient/fast as compared to Brute Force Attack.

 

14: Explain what is DOS (Denial of service) attack? What are the common forms of DOS attack?

DOS attack is the attack on the availability of the service. There are three basic features of security i.e. CIA (Confidentiality, Integrity, and Availability). In DOS, the heavy traffic is sent to the server so that the legitimate users cannot use the service because the server is busy with the fake traffic generated by the attacker. There are different types of DOS attack. TCP syn flood attack, DDOS attack, ping of death attack, ICMP flood attack etc.

 

15: How bots attack website to get the website down?

Bots are the zombies generated by the attacker to play a role on someone else behalf. Attacker compromises numbers of systems or creates his own virtual machines to attack a website. A website cannot take so many fake requests and become idle. This is a very common method used by Hackers to make the website down. The solution is to have good backups of the website to tackle such situation.

 

16: What is one tool you use for ethical hacking?

Metasploit

 

17: Types of password cracking techniques?

1) Brute Force

2) Dictionary Attack

3) Rainbow Attack.

The other ways are using social engineering and phishing techniques but it does not come under cracking.

 

18: Cybercrime in Pakistan?

Oh Yes. People are unaware of their rights. There are lots of people spying on our devices. Most people make mistakes by sharing all their personal information on public forums and social media and the bad guys exploit them. There are tons of cybercrime cases in Pakistan but they are not reported to the authorities as it is said that technology is in wrong hands. They are exploiting our culture but people are not aware what they should do to protect their personal information.

 

19: How to a complaint against Blackhat or unethical websites Facebook Fake Profile in Pakistan?

There is a dedicated center for cyber crimes in Pakistan i.e. National Response Centre for Cyber Crime (NR3C). It is our hard luck that the first cybercrime bill came so late in Pakistan i.e. 2016. But there is now a cybercrime bill. People can visit the bill and should be aware of the rights. If they think that some activity has been performed which is against their honor, they can complain by going to nr3c.gov.pk and navigate to register cybercrime TAB & register a complaint. The authorities will look at it and take further action.

 

Muhammad Taha Siddiqui

Connect With Muhammad Taha Via Facebook