COA37 ETHICAL HACKING 3 0 0 3

Prerequisite NIL

Course The course on Ethical Hackingaims to provide the students with the following:
Objectives
1. To understand and analyse Information security threats & countermeasures
2. To perform security auditing & testing
3. To understand issues relating to ethical hacking
4. To study & employ network defense measures
5. To understand penetration and security testing issues
Course On successful completion of the course, the student will be able to:
Outcomes 1. Understand vulnerabilities, mechanisms to identify
vulnerabilities/threats/attacks
2. Perform penetration & security testing
3. Become a professional ethical hacker
4. Critically evaluate the potential countermeasures to advanced hacking
techniques.
5. Analyze and critically evaluate techniques used to break into an insecure
web application and identify relevant countermeasures.

UNIT I ETHICAL HACKING OVERVIEW & VULNERABILITIES

Understanding the importance of security, Concept of ethical hacking and essential Terminologies-
Threat, Attack, Vulnerabilities, Target of Evaluation, Exploit. Phases involved in hacking, Foot printing,
Scanning, System Hacking, Session Hijacking. Buffer Overflows: Significance of Buffer Overflow
Vulnerability, Why Programs/Applications are vulnerable. Reasons for Buffer Overflow Attacks. Methods of
ensuring that buffer overflows are trapped.

UNIT II SNIFFERS & SQL INJECTION

Sniffers: Active and passive sniffing. ARP poisoning and counter measures. Man in the middle
attacks, Spoofing and Sniffing attacks. Sniffing counter measures. SQL Injection: Attacking SQL Servers,
Sniffing, Brute Forcing and finding Application Configuration Files, Input validation attacks. Preventive
Measures.

UNIT III WEB APPLICATION

Web Application Threats, Web Application Hacking, Cross Site Scripting / XSS Flaws /
Countermeasures Correct Web Application Set-up. Web Application Security: Core Defence Mechanisms.
Handling User Access, Authentication, Session Management, Access Control. Web Application Technologies:
HTTP Protocol, Requests, Responses and Methods. Encoding schemes. Server side functionality technologies
(Java, ASP, PHP).

UNIT IV ATTACKING AUTHENTICATION

Attacking Authentication: Attacking Session Management, Design Flaws in Authentication

Mechanisms Attacking Forgotten Password Functionality, attacking Password change functions.
Countermeasures to authentication attacks. Attacking other users: Reflected XSS Vulnerabilities, Stored XSS

M.E. Computer Science and Engineering _Curriculum_R2019 Page

1
Vulnerabilities, DOM-Based XSS Vulnerabilities, HTTP Header Injection. Counter measures to XSS.

UNIT V HACKING WIRELESS NETWORKS

Introduction to 802.11, Role of WEP, Cracking WEP Keys, Sniffing Traffic, Wireless DOS attacks,
WLANScanners, WLANSniffers, HackingTools, Securing Wireless Networks.

Text books:

1. Patrick Engebretson, The Basics of Hacking and Penetration Testing, Elsevier, 2013.
2. RajatKhare, “Network Security and Ethical Hacking”, Luniver Press, 2006.

REFERENCES
1. Kenneth C.Brancik, “Insider Computer Fraud”, Auerbach Publications Taylor & Francis, Group 2008.
2. AnkitFadia, “Ethical Hacking”, Second Edition Macmillan India Ltd, 2006.
3. Kimberly Graves, "Certified Ethical Hacker", Wiley India Pvt Ltd, 2010
4. Michael T. Simpson, "Hands-on Ethical Hacking & Network Defense", Course Technology, 2010 3
5. Ramachandran V, BackTrack 5 Wireless Penetration Testing Beginner’s Guide (3rd ed.). Packt
Publishing, 2011
6. Thomas Mathew, "Ethical Hacking", OSB publishers, 2003

M.E. Computer Science and Engineering _Curriculum_R2019 Page

2