Security Geeks Presentation Preparation

Questions “Main”:

What are ethical hacking tools?
Why do we use them?
Why is ethical hacking important?
Can the same tools be used for ethical and illegal hacking?
What types of ethical hacking tools are there?
How are vulnerabilities discovered?
What are the stages of an ethical hacking assessment?
Which tools are used at each stage? (with Kali demonstrations)
What makes an ethical hacker different from a cybercriminal?
What laws and ethical rules must ethical hackers follow?
Real-world success stories and lessons learned
Conclusion and Small Advice

What are ethical hacking tools?

Ethical hacking is the use of hacking techniques by friendly parties in an attempt to uncover, understand and fix security vulnerabilities in a network or computer system.

Ethical hackers have the same skills and use the same tools and tactics as malicious hackers, but their goal is always to improve network security without harming the network or its users.

In many ways, ethical hacking is like a rehearsal for real-world cyberattacks. Organizations hire ethical hackers to launch simulated attacks on their computer networks. During these attacks, the ethical hackers demonstrate how actual cyber criminals break into a network and the damage they could do once inside.

The organization’s security analysts can use this information to eliminate vulnerabilities, strengthen security systems and protect sensitive data.

The terms “ethical hacking” and ”penetration testing” are sometimes used interchangeably. However, penetration tests are only one of the methods that ethical hackers use. Ethical hackers can also conduct vulnerability assessments, malware analysis and other information security services.

Why do we use them?

Ethical hackers are using different tools and techniques to encounter malicious cyber-attacks generated by bad hackers. During the software development process, development teams typically bypass or ignore the security parameters of the software. Whereas, with the advent of online web-based software, security is an essential part of the software development process for implementing secure software. Security features cannot be added as additional at the end of the software deployment process, but they need to be paid attention throughout the SDLC. (The Software Development Life Cycle).

Why is ethical hacking important?

Ethical hacking is important because it finds hidden system weaknesses, stops expensive data leaks, and builds customer trust before bad hackers can use them. so companies and governments higher ethical hackers and pay money for ethical hacking research and development to benefits from it to test there software and security.

Ethical hacking offers numerous benefits for businesses of all sizes. By identifying vulnerabilities before they are exploited, businesses can minimise the risk of data breaches and cyber-attacks. This, in turn, can help protect sensitive information, customer data, and financial assets. Ethical hacking can also help businesses comply with regulations and standards related to information security.

Can the same tools be used for ethical and illegal hacking?

Yes, the same tools can be used for both ethical and illegal hacking, such as Nmap, Wireshark, and Metasploit. These programs are neutral software used to test networks, find weak spots, or break into systems Most tools are identical The difference is authorization and purpose.

From The Website “Do ethical hackers and black hat hackers have the same techniques and tools but the only difference is in their objectives?”

Response: ”Most, however some tools of blackhat hackers are destructive and ethical hackers will not use these unless they are testing a isolated system.”

What types of ethical hacking tools are there?

Ethical hacking tools include network scanners, vulnerability assessors, and exploitation frameworks. Key categories comprise reconnaissance tools, web application testers, and password crackers

Types of ethical hacking tools

Ethical hackers need a variety of tool types to achieve their goals, including:

Vulnerability scanners: These tools automate the process of scanning for vulnerabilities in your system or network. Examples include Snyk Code and Brakeman.
Penetration testing frameworks: These comprehensive frameworks give you guidance and methodology for penetration testing. PTES, NIST SP 800-115, and OSSTMM are some commonly used frameworks
Exploitation frameworks: These toolkits are like treasure chests filled with exploits for different systems and applications. Try frameworks such as Metasploit, Cobalt Strike, or Canvas.
Network mapping and reconnaissance tools: If you’re curious to explore and map a network and its devices, these tools are your go-to. Nmap, Netcat, and Wireshark are popular examples.
Password cracking tools: Need to crack some passwords or test their strength? Try out John the Ripper, Hashcat, and Hydra.
Web application testing tools: Finding and exploiting vulnerabilities in web apps is your thing? Burp Suite, OWASP ZAP, and Nikto are your trusty sidekicks on that mission.
Social engineering toolkits: Ready to play mind games? These toolkits simulate social engineering attacks like phishing or spear phishing. The Social Engineering Toolkit (SET) is a popular one among the hacking community.

How are vulnerabilities discovered?

Ethical hackers discover vulnerabilities using specialized tools through reconnaissance, automated scanning, and manual probing. These tools match system data against known weakness databases to pinpoint flaws before bad actors find them.

Real-World Examples of Vulnerabilities and Exploits

Several well-known vulnerabilities have led to massive cyberattacks. Here are a few examples:

EternalBlue and WannaCry

EternalBlue was a Windows Server Message Block (SMB) protocol vulnerability.

Attackers exploited it to spread the WannaCry ransomware, which infected computers worldwide in 2017. This attack was so damaging because many organizations failed to update their Windows systems.

Heartbleed

This was a vulnerability in OpenSSL, a widely used encryption library. Attackers could exploit Heartbleed to steal sensitive data from servers, including passwords and encryption keys.

BlueKeep

BlueKeep was a vulnerability in the Remote Desktop Protocol (RDP) that allowed attackers to take full control of a system remotely. If exploited, it could let malware spread across networks without user interaction.

What are the stages of an ethical hacking assessment?

The stages of an ethical hacking assessment are reconnaissance, scanning, and gaining access. These steps help security experts find and fix weak points before bad actors can use them.

The Five Main Phases

Reconnaissance: Gathering basic details about the target using public records, search tools, and social media. You can learn more about this initial step in the 5 Phases of Hacking Guide.
Scanning: Probing the network and systems for open ports, live hosts, and specific software flaws.
Gaining Access: Breaking into the system using exploits, password attacks, or tricking users.
Maintaining Access: Staying inside the network using backdoors to see how long a persistent threat could hide.
Covering Tracks: Removing logs and hidden files to leave the system as clean as it was before the test.

Which tools are used at each stage? (with Kali demonstrations)

Penetration testing stages and their primary Kali Linux tools include Reconnaissance using Nmap and theHarvester, Scanning with Nikto and WPScan, Exploitation via Metasploit, and Post-Exploitation using John the Ripper.

Reconnaissance (Information Gathering)

Objective: Collect target data, IP addresses, and employee details passively or actively.
Kali Tools: theHarvester (for emails/names), Nmap (for host discovery), and Maltego (for link analysis).

Scanning and Enumeration

Objective: Find open ports, running services, and specific software vulnerabilities.
Kali Tools: Nmap (port scanning and OS fingerprinting), Nikto (web server scanning), and WPScan (WordPress security auditing)

Exploitation

Objective: Breach the system by taking advantage of discovered software bugs or weak configurations.
Kali Tools: Metasploit Framework (exploit execution), Sqlmap (automated SQL injection), and Hydra (service login brute-forcing).

Post-Exploitation and Maintenance

Objective: Extract data, escalate user privileges, or crack password hashes to maintain access.
Kali Tools: John the Ripper (password hash cracking), Hashcat (advanced password recovery), and Wireshark (local network traffic sniffing).

What is the difference between an ethical hacker and a cyber criminal?

A hacker is superset of those two, meaning hacker can be a ethical hacker or can be a cyber criminal.

Difference between these two, below-

Ethical hacker is one who hacks, attacks, etc. with intension to protect the cyber criminals entering and stealing data, helding then for ransomware.eg. is you hack a portal and do not take down a portal or server like criminal , but doing it before some criminal does that, will add value and necessary protection can be enabled to block the intruders

Cyber criminal is the one whos motivation can be anything , for eg. Money, company reputation, many things which i cannot tell here in public forum..So he hacks, or attacks to spoil the servers, or person reputation or company reputation, money, etc.

What laws and ethical rules must ethical hackers follow?

Ethical hackers must follow written consent, strict testing scopes, and data privacy regulations. Key legal and ethical standards include obtaining documented authorization, staying within agreed boundaries, and maintaining full confidentiality. You can learn more about these parameters through the Securetain Guide or Craw Security

Legal Rules and Laws

Written Authorization: Must secure explicit, signed contracts or rules of engagement before touching any system.
Defined Scope: Strictly limit testing to approved IP ranges, applications, and assets to avoid illegal trespassing.
Cybercrime Statutes: Comply with national and local laws like the Computer Fraud and Abuse Act (CFAA) or regional IT acts to prevent unauthorized access charges.
Data Protection Compliance: Handle private user data or personal info under privacy frameworks like GDPR or HIPAA

Real-world success stories and lessons learned

Microsoft Paid Out $17 Million in Bug Bounties in Past Year

Microsoft on Tuesday announced that 344 security researchers in 59 countries received $17 million in rewards through its bug bounty programs over the past year.

This is the highest total bounty the Redmond-based tech giant has distributed in a single year since launching its bug bounty programs in 2018, and brings the total paid out to $92.5 million.

Last year, the company said it handed out $16.6 million in rewards between July 1, 2023, and June 30, 2024, and the amount was roughly $13 million every year between 2020 and 2023.

The $1.6 million it paid out during the Zero Day Quest qualifying research challenge was also included in the 2025 total. Microsoft received over 600 vulnerability submissions as part of the event.

This week, the company announced it is now accepting submissions for the 2026 research challenge, and that it is betting up to $5 million in rewards for bugs in Azure, Copilot, Dynamics 365 and Power Platform, Identity, and M365.

Over the past year, the tech giant has updated its bug bounty programs to expand coverage to more products and services, and to align the bounty initiatives with emerging threats and security challenges.

The Copilot bounty program now covers more consumer products and offers higher incentives to researchers. Additional APIs and domains that secure Enterprise accounts were added to the Identity bounty program, and Viva Glint, Learning, Pulse, and Feature Access Control are now in scope of the M365 program.

Microsoft also announced the inclusion of Defender for Identity (MDI), Defender for Office (MDO), and Defender for Cloud Applications (MDA) in the Defender bounty program. The company expanded the Dynamics 365 & Power Platform program with an AI category, and refreshed the attack scenario rewards in the Windows bounty program.

“Bounty awards are determined by the severity and potential impact of the reported vulnerability, as well as the clarity, accuracy, and completeness of the submission. We prioritize awards in areas that matter most to our customers, encouraging research that drives meaningful security improvements where it counts most,” Microsoft notes.

NASA Vulnerability Disclosure Policy

The NASA Mission is to drive advances in science, technology, aeronautics, and space exploration to enhance knowledge, education, innovation, economic vitality and stewardship of the Earth. A great deal of NASA work leverages information technology to capture, interpret, and appropriately share scientific knowledge to further its Missions and Programs. NASA is committed to protecting the confidentiality (where appropriate), integrity, and availability of its information and information systems.

NASA VDP Engagement on platform Bugcrowd

This policy applies to all NASA-managed systems that are accessible from the Internet. This includes the registered domain names that are provided above.

NASA internal-only services are not in scope and are not authorized for testing. Additionally, vulnerabilities found in non-federal systems from our vendors and contractors fall outside of this policy’s scope and should be reported directly to the vendor or contractor according to their disclosure policy (if any).

Non-public NASA data is not authorized to reside on public third-party services. Although the third-party services themselves are not in scope, please report these data issues to NASA. The following types of non-public data are particularly sensitive, and warrant immediate reporting:

Sensitive personally identifiable information (e.g., social security numbers)
Financial information (e.g., credit card or bank account numbers)
Proprietary information or trade secrets of companies of any party; and
Documents with sensitivity markings (e.g., “Top Secret” or “ITAR/EAR”)

Types of Testing

The following test types are not authorized:

Social engineering-based attacks (e.g., getting a user to click an attacker-controlled link)
Denial of Service, Rate Limiting, or Spamming issues (e.g., layer 7 DOS attacks, Slowloris, etc.)
Clickjacking on pages with no sensitive actions
Any reports with the endpoint /wp-json/wp/v2/users
Any reports with the endpoint xmlrpc.php
Attacks requiring physical access to a user’s device
Previously known vulnerable libraries without a working proof of concept.
Content spoofing or text injection
Reports from automated tools or scans without accompanying demonstration of exploitability
Software version disclosure without accompanying demonstration of exploitability
Use of a known-vulnerable library without evidence of exploitability
Missing best practices. (Missing security headers, missing captcha, insecure certs)
Insecure SSL or TLS issues (e.g., ciphers, certificates, etc.)
Missing security headers (e.g., HTTP Strict-Transport-Security (HSTS), Content Security Policy (CSP), etc.) that do not lead directly to a vulnerability.
Presence of the “autocomplete” attribute on web forms
Host header injections unless you can show how they can lead to stealing user data
Insecure cookie settings for non-sensitive cookies
Directory Listing
Vulnerabilities affecting users of outdated browsers or platforms
Issues related to descriptive or verbose error messages
Any other non-technical vulnerability testing

Guidelines

NASA requests that security researchers make every effort to:

Avoid impacting the availability of production systems. If a non‑production or public test environment is available, all testing must be performed exclusively in that environment. Example: Test in test.gcn.nasa.gov NOT in gcn.nasa.gov
Notify NASA via the methods described in the policy as soon as possible after the discovery of a potential security issue.
Keep all information about discovered vulnerabilities confidential until NASA approves the disclosure request.
Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction, modification, or exfiltration of NASA data.
Only use exploits to the extent necessary to confirm the presence of a vulnerability. Do not use an exploit to compromise or exfiltrate data, establish command line access and/or persistence, or leverage the exploit to “pivot” to other systems.
Once it is established that a vulnerability exists or any sensitive data is encountered (including personally identifiable information, financial information, proprietary information or trade secrets of any party), you must stop your test, NASA must be notified immediately, and details of the vulnerability or sensitive data shall not be disclosed to anyone else.

No compensation is available, other than NASA’s gratitude for your help in advancing the NASA Mission. By submitting a vulnerability report, you waive all claims to compensation.

Authorization

If a security researcher makes a good faith effort to comply with this policy during security research, NASA will consider that research to be authorized, and will work with them to understand and resolve the issue quickly. In addition, NASA will not recommend or pursue legal action related to the research. Should legal action be initiated by a third party against a security researcher for activities that were conducted in accordance with this policy, NASA will make this authorization known.

Reporting a vulnerability

This reporting mechanism is not intended for use by NASA employees, contractors, and others with authorized IT access at NASA. NASA personnel should use NASA-internal IT support and reporting mechanisms rather than this program.

Information submitted under this policy will be used for defensive purposes only – to mitigate or remediate vulnerabilities.

What NASA would like to see in a report

In order to help us triage and prioritize submissions, NASA recommends that vulnerability reports:

Describe the vulnerability, where it was discovered, and the potential impact of exploitation.
Offer a detailed description of the steps needed to reproduce the vulnerability (proof of concept scripts or screenshots are helpful).
Be in the English language, if possible.

Please do not use this mechanism to report trivial system faults, such as typos or user interface errors not resulting in a vulnerability. NASA believes that public disclosure in the absence of a readily available mitigation will increase risk to NASA Missions. As a result, NASA requests that researchers refrain from sharing vulnerability reports with others for 90 days following the submission of the initial report, unless otherwise coordinated with NASA.

What a security researcher can expect from NASA

When a security researcher chooses to share their contact information with NASA, NASA is committed to coordinating a response with you as openly and as quickly as possible.

Within three business days, NASA will acknowledge the receipt of a report.
To the best of our ability, we will confirm the existence of the vulnerability to you and be as transparent as possible about what steps we are taking during the remediation process, including issues or challenges that may delay resolution.
We will maintain an open dialogue to discuss issues.

Safe Harbor

When conducting vulnerability research according to this policy, we consider this research to be:

Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;
Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and
Lawful, helpful to the overall security of the Internet, and conducted in good faith.
You are expected, as always, to comply with all applicable laws.