Skip the navigation

Notes From Security School

Do you want to look inside the world of hackers and learn some lessons about how to thwart their attacks on your network? The SANS Institute's professional training courses may be the best place to start.

By Dan Verton
January 17, 2005 12:00 PM ET

Computerworld - The underground world of the computer hacker may seem like a place where chaos rules, but the reality is there's a method to the hacker's perceived madness. And understanding that method is critical to knowing how best to respond to a skilled attacker.

Last fall, the SANS Institute offered three training courses that presented a step-by-step look at how criminal hackers operate and how organizations should respond.

While the bad news is that the hacker underground remains as cunning and capable as ever, the good news is that the security community continues to gain an understanding of how hackers operate.

I attended the SANS training and will pass along some of the crucial information provided. My notes from the sessions offer a look at how criminal hackers work. These lessons can give you the knowledge necessary to begin hardening your network against attacks.

Although no two hacker exploits are the same, most follow a series of predictable steps that are designed to increase the hacker's chances of success, says Ed Skoudis, founder and senior security consultant at Intelguardians LLC, a Washington-based information security consulting firm and the primary SANS instructor in hacker techniques, exploits and incident handling.

There are basic steps that "represent the flow of an attack," says Skoudis. They include conducting reconnaissance, scanning, exploiting systems and keeping access. And knowing what hackers do during each of these steps is critical to understanding how to defend your enterprise.


When a hacker conducts reconnaissance on a target, he is basically "casing the joint," says Skoudis. But it doesn't take much work because most organizations give away a lot more information than they realize. And that's why a hacker's recon operation almost always begins with publicly available information.

Ed Skoudis, founder and senior security consultant at Intelguardians LLC
Ed Skoudis, founder and senior security consultant at Intelguardians LLC

For example, corporate Web sites often give away contact names and phone numbers, information about software and hardware in use, and critical business data through U.S. Securities and Exchange Commission reports. All of this is prime fodder for social engineering, says Skoudis.

A Web-based recon of public information may also reveal disgruntled users or employees, as well as data about help desk requests. Likewise, it's possible to download a site's HTML code using a crawler, such as the one found on That would enable a hacker to search HTML and hidden fields and possibly uncover vulnerable scripts, Skoudis says.

The most common online method of reconnaissance, however, is conducting a "whois" search to gain domain registration data. Detailed searches can provide an attacker with the IP address of the organization's Domain Name System server. The attacker can then begin mapping the enterprise network in order to harvest additional IP addresses.

Our Commenting Policies
Internet of Things: Get the latest!
Internet of Things

Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!