🛡️ Cybersecurity & Ethical Hacking Masterclass
1️⃣ The CIA Triad & Ethical Hacking Phases
Definition: Cybersecurity digital systems, networks, devices aur data ko unauthorized access, exploitation ya malicious attacks se protect karne ki practice hai.
| Pillar | Meaning | Threat / Attack Example | Protective Control |
|---|---|---|---|
| Confidentiality | Data sirf authorized users ke liye readable hona chahiye. | Data breach, MITM sniffing, unauthorized database access. | AES-256 Encryption, RBAC, Multi-Factor Auth (MFA). |
| Integrity | Data transmission ya storage ke dauran alter ya tamper nahi hona chahiye. | SQL injection data updates, man-in-the-middle tampering. | Cryptographic Hashing (SHA-256), Digital Signatures. |
| Availability | Systems aur services authorized users ke liye hamesha operational rahni chahiye. | DDoS (Distributed Denial of Service) attack, Ransomware. | Cloudflare CDN, High-Availability clusters, automated backups. |
The 5 Phases of Ethical Hacking (Penetration Testing):
- Reconnaissance: Passive/Active information gathering (Footprinting).
- Scanning: Network ports, open services aur known vulnerabilities scan karna (Nmap, Nessus).
- Gaining Access: Vulnerabilities exploit karke system me unauthorized entry lena (Metasploit).
- Maintaining Access: Persistence create karna (Backdoors, Privilege Escalation).
- Covering Tracks & Reporting: Audit logs sanitize karna (Black Hat) ya detailed Remediations Report submit karna (Ethical Hacker).
2️⃣ Reconnaissance & Port Scanning with Nmap
Target infrastructure ke open network ports aur running services audit karne ke essential commands:
# 1. Stealth SYN Scan (-sS) on top 1000 ports
nmap -sS -T4 target-server.com
# 2. Service Version Detection (-sV) with Default NSE Scripts (-sC)
nmap -sC -sV -p 22,80,443,3306 192.168.1.100
# 3. Comprehensive Aggressive Scan with OS Detection (-A)
nmap -A -p- -T4 10.0.0.15
# 4. Check for known Web Vulnerabilities using Nmap Scripts
nmap --script http-vuln* -p 80,443 target-server.com3️⃣ Cryptography: Encryption vs Hashing vs Encoding
| Concept | Reversible? | Key Required? | Primary Purpose & Examples |
|---|---|---|---|
| Symmetric Encryption | Yes | Single Shared Secret Key | Bulk data encryption at rest (e.g. AES-GCM 256-bit). Fast & secure. |
| Asymmetric Encryption | Yes | Public & Private Key Pair | Secure key exchange & identity authentication (RSA, ECC, TLS Handshake). |
| Hashing | No (One-Way) | None (Mathematical digest) | Password verification & data integrity checks (bcrypt, Argon2, SHA-256). |
| Encoding | Yes (Trivial) | None (Public algorithm) | Data representation over binary-unsafe channels (Base64, URL encoding). Not security! |
4️⃣ OWASP Top 10: SQL Injection (SQLi)
Jab unvalidated user input ko direct backend SQL query string me concatenate kar diya jata hai, toh attacker SQL commands manipulate kar leta hai:
// ❌ VULNERABLE CODE (Direct String Concatenation)
String query = "SELECT * FROM users WHERE email = '" + userInput + "' AND pass = '" + pass + "'";
// Attacker enters: ' OR '1'='1' --
// Resolved Query:
SELECT * FROM users WHERE email = '' OR '1'='1' --' AND pass = '...'
// Result: 1=1 is ALWAYS TRUE. Authentication completely bypassed!// ✅ SECURE DEFENSE (Parameterized Queries / Prepared Statements)
PreparedStatement stmt = conn.prepareStatement("SELECT * FROM users WHERE email = ? AND pass = ?");
stmt.setString(1, userInput); // Safe: Treated purely as string literal, never as executable code
stmt.setString(2, hashedPassword);
ResultSet rs = stmt.executeQuery();
Live SQL Injection & Defensive Prepared Statement Sandbox
[Security Engine]: Ready. Backend endpoint: POST /api/v1/auth/login. Choose an attack/defense vector above...
5️⃣ Cross-Site Scripting (XSS)
Attacker victim ke browser me arbitrary JavaScript code inject karta hai session cookies aur sensitive tokens steal karne ke liye:
- Reflected XSS: Payload URL query param ke zariye server ko pass hota hai aur server response me immediately reflect ho jata hai.
- Stored (Persistent) XSS: Payload database me store ho jata hai (e.g. Forum comment). Har user jo us comment ko view karta hai, uske browser me script execute ho jati hai.
- DOM-based XSS: Vulnerability purely client-side JavaScript execution me hoti hai (e.g.
document.write()yaelement.innerHTML).
XSS Defense:
• Context-aware HTML Entity Encoding (e.g.
• Secure Cookie Flags:
• Content Security Policy (CSP): Browser headers me untrusted inline scripts execution restrict karna.
• Context-aware HTML Entity Encoding (e.g.
< ko < me convert karna).• Secure Cookie Flags:
Set-Cookie: session_id=xyz; Secure; HttpOnly; SameSite=Strict (HttpOnly JavaScript document.cookie access block karta hai).• Content Security Policy (CSP): Browser headers me untrusted inline scripts execution restrict karna.
6️⃣ Broken Access Control & IDOR
IDOR (Insecure Direct Object Reference): Jab server client-provided object identifier par authorization verify kiye bina resource serve karta hai:
# Attacker inspects their profile API call:
GET /api/v1/invoices/1042 → HTTP 200 (Attacker's invoice)
# Attacker changes ID to another user's invoice:
GET /api/v1/invoices/1043 → HTTP 200 (Victim's confidential invoice leaked!)
# ✅ REMEDIATION (Strict Authorization Check):
SELECT * FROM invoices WHERE id = :invoiceId AND user_id = :authenticatedUserId;
# If row count == 0 → Return HTTP 403 Forbidden!7️⃣ Defensive Hardening & Incident Response
| Layer | Defensive Control Measure |
|---|---|
| Perimeter / Edge | Web Application Firewall (WAF) (ModSecurity/Cloudflare) jo SQLi/XSS patterns inspect karta hai. |
| Transport Layer | Enforce TLS 1.3 only, HSTS (HTTP Strict Transport Security) header configuration. |
| Host / Server | SSH root login disable karna (PermitRootLogin no), Fail2ban rate limiting, SELinux enforcement. |
| Incident Response | Preparation → Detection & Analysis → Containment → Eradication → Recovery → Post-Incident Lessons Learned. |
