Like all good projects, ethical hacking too has a set of distinct phases. It Helps hackers to make a structured ethical hacking attack. 

And it is not necessary that a hacker has to follow these 5 steps in a sequential manner. It's a stepwise process and when followed yields a better result.

Different security training Manuals explain the process of Ethical Hacking in Different ways, But the entire process can be categorized into the following six phases.

  • Reconnaissance
  • Scanning
  • Gaining Access
  • Maintaining Access
  • Clearing Tracks
  • Reporting

1.Reconnaissance

This is the first Step of Hacking. Reconnaissance is also called as Footprinting and information gathering. This is the preparatory phase where attackers collect as much information as possible about the target. It may be active or passive means.
We usually collect information about three groups.
  • Host
  • Network
  • User connected
There are two types of Reconnaissance/ Footprinting

  • Active:- In active footprinting, the attacker directly interacting with the target to gather information about the target. Eg Using Nmap tools or google dorks.
  • Passive:-In passive footprinting the attacker trying to collect the information about the target without directly accessing the target. This involves collecting information from social media, public websites, etc.

2.Scanning

In this process, the attacker begins to actively probe a target machine or network for vulnerabilities that can be exploited.

Tools used in this process are:-
  • Nessus
  • Nmap
  • Nexpose

There are three types of scanning involved:
  • Port Scanning:-This phase involves scanning the target for information like open ports, live systems, various services running on the hosts.
  • Vulnerability Scanning:-Checking the target for weaknesses or vulnerabilities which can be exploited. Usually done with help of automated tools.
  • Network Mapping:-Finding the topology of the network, routers, firewalls servers if any, and host information and drawing a network diagram with the available information.

3.Gaining Access

This Phase is where an attacker breaks into the system and network using various tools or methods. After entering into a system, He has to increase his privilege to administrator level so he can install an application he needs or modify data or hide data.

The Primary Tool that is used in this process is Metasploit.

4.Maintaining Access

Hacker may just hack the system to show it was vulnerable or he can be so mischievous that he wants to maintain or persist the connection in the background without the knowledge of the user. This can be done using backdoors i.e trojans, Rootkits or other malicious files. The aim is to maintain access to the target until he finishes the tasks he planned to accomplish in that target.

5.Clearing Tracks

No thief wants to get caught. This Process is actually an unethical activity. An intelligent hacker always clears all evidence so that in the latter point of time, no one will find any traces leading to him. This involves modifying/corrupting/deleting the values of logs, uninstalling all applications he used, and deleting all folders he created.

6.Reporting

Reporting is the last step of finishing the ethical hacking process. Here the Ethical hacker complies a report with his findings and the job that was done such as the tools used, the success rate, vulnerabilities found, and the exploit processes.


Bonus Tip:-

The processes are not standard. You can adopt a set of different processes and tools according to the techniques that you are comfortable with. 

If you loved this post and found something informative Do share it with your friends.

Thanks for Reading......😃