Welcome to Hacking For Dummies, 6th Edition. This book outlines — in plain English — computer hacking tricks and techniques that you can use to assess the security of your information systems, find the vulnerabilities that matter, and fix the weaknesses before criminal hackers and malicious insiders take advantage of them. This hacking is the professional, aboveboard, and legal type of security testing — which I refer to as ethical hacking or vulnerability and penetration testing throughout the book.

Computer and network security is a complex subject and an ever-moving target. You must stay on top of it to ensure that your information is protected from the bad guys. The techniques and tools outlined in this book can help.

You could implement all the security technologies and other best practices possible, and your network environment might be secure — as far as you know. But unless and until you understand how malicious attackers think, apply that knowledge, and use the right tools to assess your systems from their point of view, it’s practically impossible to have a true sense of how secure your systems and information really are.

Ethical hacking (or, more simply, security assessments), which encompasses formal and methodical vulnerability and penetration testing, is necessary to find security flaws and to validate that your information systems are truly secure on an ongoing basis. This book provides you the knowledge you need to successfully implement a security assessment program, perform proper security checks, and put the proper countermeasures in place to keep external hackers and malicious users in check.

About This Book

Hacking For Dummies is a reference guide on hacking your systems to improve security and minimize business risks. The security testing techniques are based on written and unwritten rules of computer system penetration testing, vulnerability testing, and information security best practices. This book covers everything from establishing your testing plan to assessing your systems to plugging the holes and managing an ongoing security testing program.

Realistically, for most networks, operating systems, and applications, thousands of possible vulnerabilities exist. I don’t cover them all, but I do cover the big ones on various platforms and systems that I believe contribute to most security problems in business today. I cover basic Pareto principle (80/20 rule) stuff, with the goal of helping you find the 20 percent of the issues that create 80 percent of your security risks. Whether you need to assess security vulnerabilities on a small home-office network, a medium-size corporate network, or large enterprise systems, Hacking For Dummies provides the information you need.

This book includes the following features:

• Various technical and nontechnical tests and their detailed methodologies.
• Specific countermeasures to protect against hacking and breaches.

Before you start testing your systems, familiarize yourself with the information in Part 1 so that you’re prepared for the tasks at hand. The adage “If you fail to plan, you plan to fail” rings true for the security assessment process. You must have a solid game plan in place if you’re going to be successful.

Foolish Assumptions

Disclaimer: This book is intended solely for information technology (IT) and security professionals to test the security of their (or their clients’) systems in an authorized fashion. If you choose to use the information in this book to hack or break into computer systems maliciously and without authorization, you’re on your own. Neither I (the author) nor anyone else associated with this book shall be liable or responsible for any unethical or criminal choices that you might make and execute using the methodologies and tools that I describe.

Okay, now that that’s out of the way, let’s get to the good stuff! This book is for you if you’re a systems administrator, information security manager, security consultant, security auditor, compliance manager, or otherwise interested in finding out more about evaluating computer systems, software, and IT operations for security flaws and, of course, making long-term improvements.

I also make a few assumptions about you, the aspiring information technology (IT) or security professional:

• You’re familiar with basic computer, network, and information security concepts and terms.
• You have access to a computer and a network on which to use these techniques and tools.
• You have the go-ahead from your employer or your client to perform the hacking techniques described in this book.

Icons Used in This Book

Throughout this book, you’ll see the following icons in the margins.

This icon points out information that’s worth committing to memory.

This icon points out information that could have a negative effect on your vulnerability and penetration testing efforts — so please read it!

This icon refers to advice that can highlight or clarify an important point.

This icon points out technical information that’s interesting but not vital to your understanding of the topic being discussed.

Beyond the Book

First off, be sure to check out the Cheat Sheet associated with this book. You can access the Cheat Sheet by visiting dummies.com and searching for Hacking For Dummies. The Cheat Sheet is a great way to get you pointed in the right direction or get you back on track with your security testing program, if needed.

Also, be sure to check out my website www.principlelogic.com, especially the Resources page.

Where to Go from Here

The more you know about how external hackers and rogue insiders work and how your systems should be tested, the better you’re able to secure your computer and network systems. This book provides the foundation you need to develop and maintain a successful security assessment and vulnerability management program to minimize business risks.

Depending on your computer and network configurations, you may be able to skip certain chapters. For example, if you aren’t running Linux or wireless networks, you can skip those chapters. Just be careful. You may think you’re not running certain systems, but they could very well be on your network, somewhere, waiting to be exploited.

Keep in mind that the high-level concepts of security testing won’t change as often as the specific vulnerabilities you protect against. Vulnerability and penetration testing will always remain both an art and a science in a field that’s ever-changing. You must keep up with the latest hardware and software technologies, along with the various vulnerabilities that come about day after day and month after month.

You won’t find a single best way to hack your systems, so tweak this information to your heart’s content, and happy hacking!