本文是计算机专业的留学生作业范例，题目是“Ethical Hacking And Attacking Computer Science Essay（道德黑客和攻击计算机科学论文）”，黑客行为是否道德是有争议的，随着时间的推移，“黑客”一词一直与破坏性活动联系在一起。这是一些在黑客语境中使用的术语，使其更加清晰。
黑客是出于防御目的而喜欢学习黑客技术的人;有道德的黑客是为了防御目的而锻炼自己技能的安全专业人员。“骇客”一词指的是利用自己的黑客技术达到破坏性目的的人。
Abstract 摘要
It is debatable, if hacking can be ethical or not, the term "Hacking" over time has been associated with destructive activity.These are some of the terms used in the context of hacking which provides better clarity, Hacker is somebody who enjoys learning hacking for a defensive purpose; an ethical hacker is the security professional who exercises his skills for a defensive purpose. The term Cracker refers to a person who uses his hacking skills for destructive purpose.
The ethical question here is in regard to the physical activity of hacking which is sometimes hard to differentiate from cracking. The main difference being, Ethical hacker just identifies vulnerabilities and does not exploit them unlike a cracker.Ethical hacking is the process adopted by ethical hackers to discover the vulnerabilities existing in information systems operating environments.
这里的道德问题是关于黑客的物理活动，这是很难区分的破解。主要的区别是，道德黑客只是识别漏洞，而不是利用他们不像一个骇客。道德黑客是道德黑客发现信息系统运行环境中存在的漏洞的过程。
1.Reconnaissance 侦查
Reconnaissance is the preparatory phase where an attacker gathers information about the target system prior to launching the attack. This phase might also involve network scanning either internal or external without any authorization.
侦察是攻击者在发动攻击之前收集目标系统信息的准备阶段。此阶段还可能涉及内部或外部的网络扫描，无需任何授权。
One of the ways for gathering information during this phase may involve "Social engineering". A social engineer is a person who smooth-talks and persuades people to reveal personal / sensitive information such as passwords, security policies etc. Social engineering is one of the easiest ways to hack as it requires no technical skills and one of the hardest forms of attack to defend against as humans are the weakest link in the security chain. All security measures taken care by the organization goes in vain when the employees get "social engineered". Detecting social engineering attacks are difficult, as there is no tool to detect such attempts, in most of the cases victim themselves are not aware having revealed sensitive information. "Rebecca" and "Jessica" are the common terms used, which refer to people who are easy target for social engineering attacks such as a receptionist or a support executive.
"Dumpster diving" is another way of gathering information. It is the process of looking for discarded sensitive information in an organization thrash. It is one of the effective ways of gathering information as it may provide attackers with even more sensitive information such as username, password, ATM slip, social security number, Bank statements.
It is important that an organization has appropriate policies in place to protect their assets and also provide proper guidance to employees on the same.
Reconnaissance technique can be classified into active and passive reconnaissance.
In passive reconnaissance, the attacker does not interact with the system directly but uses social engineering or dumpster diving as a mean to gather information. Where as in a active reconnaissance, the attacker makes use of tools for port scanning, network scanning to get the details of the application, operating system etc. Often reconnaissance phase overlaps with the scanning phase.
2.Scanning 扫描
Scanning precedes the actual attack and is one of the important phase of information gathering where in the attacker gathers information about the targets IP address , operating system , system architecture , services running in the system in order to find various ways to intrude into targets system. The strategy to launch the attack is based on the gathered information. The risk of an organization is considered high in the scanning phase as it enables access to the network.
扫描是攻击者在实际攻击之前进行的信息收集的重要阶段之一，攻击者在扫描过程中会收集目标的IP地址、操作系统、系统架构、系统中运行的服务等信息，从而找到入侵目标系统的各种方法。发动攻击的策略是基于收集到的信息。在扫描阶段，组织的风险被认为很高，因为它允许访问网络。
Different types of scanning are
Port Scanning: Procedure for identifying the open ports and the services running on the target system.
Network Scanning -Procedure for identifying IP addresses, active hosts on a network either to attack them or as a network security assessment.
Vulnerability Scanning -Automates method to identify the known vulnerabilities present in the system and the network.
Some of the important tools used during this phase are Nmap which is used for port scanning; it also offers a variety of advanced features such as remote OS detection.
Nessus is a vulnerability scanner which detects the local flaws, uninstalled patches and weakness in network hosts. Nessus has a security vulnerability database which is updated on a daily basis. It carries out development of security checks for recent security holes.
3.Gaining Access 获得
This is one of the most important phases for an attack as this is where the actual attack is planted. Therefore the business risk is highest in this phase. Although not a mandatory phase as an attacker need not always gain access to cause damage like in denial of service attacks.
这是攻击最重要的阶段之一，因为这是真正的攻击发生的地方。因此，这一阶段的业务风险最高。虽然这不是一个强制阶段，因为攻击者并不总是需要获得访问权限来造成损害，就像拒绝服务攻击。
The main aim in this phase is to obtain elevated privileges such as system privilege to execute commands to access sensitive information.
4.Maintaining Access 维护访问
Once the attacker gains access into the system or the network, he tries to retain his "ownership" on the compromised system and periodically attack it. Typically in this phase the attacker tries to install Key loggers to capture the keyboard strokes, sniffers to capture network traffic, rootkits at the kernel level to gain super user access and Trojan horse to gain repeated backdoor access, also download the password files to access the system at a later time. Once the Trojans are in place, the attacker can assume to have gained total control of the system.
一旦攻击者获得了对系统或网络的访问权，他就会试图保留其对受损系统的“所有权”，并定期对其进行攻击。通常在这个阶段攻击者试图安装关键伐木者来捕获键盘敲击,嗅探器捕获网络流量,rootkit内核层面上获得超级用户访问和特洛伊木马后门重复获得,也下载密码文件访问系统在稍后的时间。一旦木马就位，攻击者就可以假定已经获得了对系统的完全控制。
During this phase the attackers might even harden the system against other attackers by fixing the vulnerability which allowed them to access the system or the network.
5.Clearing Tracks 清除痕迹
This is where the attacker tries to cover the evidence of his activities for various reasons like maintaining access or legal actions. During this phase the attacker deletes the system logs preventing the system administrator from monitoring the unusual activity, Rootkits are installed as they are effective in covering tracks and also because in some cases they disable logging.
这是攻击者出于各种原因(如维护访问权限或法律行为)试图掩盖其活动的证据的地方。在这个阶段，攻击者删除系统日志，防止系统管理员监控不寻常的活动，安装rootkit，因为他们是有效地掩盖跟踪，也因为在某些情况下，他们禁用日志。
Other techniques like Steganography which is used to hide the data in a image or a file, are made used by the attacker in order to cover tracks.
6.Google Hacking 谷歌黑客
Google Hacking is the art of creating complex search queries in order to gather information of the target system. Google is the primary tool used for Google hacking. Advanced Google operators are used to filter information.
谷歌黑客是为了收集目标系统的信息而创建复杂的搜索查询的艺术。谷歌是谷歌黑客使用的主要工具。高级的谷歌操作符用于过滤信息。
Google hacking database identifies files containing password, sensitive directories, vulnerable web pages, error messages containing sensitive information, pages containing firewall logs etc.
In recent times Web applications are the target of various forms of attacks. According to a Gartner report 70% of the security attacks are targeted on the web application. Competition is so high that enterprises can't ignore the risk associated with their vulnerable application. Loss incurred could vary from monetary losses to loss of credibility. In certain cases it could mean end of business. You cannot stop an attacker from hacking, the only thing you can do is make it harder to get in.Ethical hackers are the security professionals who use their hacking skills for defensive purpose. The process of ethical hacking would depend on, what is that organization is trying to protect, against whom and how much or resources the organization is ready to spend. The hacking tools are meant for research and educational purpose only and should not be used for destructive purpose.
最近，Web应用程序成为各种形式攻击的目标。根据Gartner的一份报告，70%的安全攻击是针对web应用程序的。竞争如此激烈，以至于企业不能忽视与他们脆弱的应用程序相关的风险。造成的损失可能从货币损失到信誉损失不等。在某些情况下，这可能意味着业务的结束。你无法阻止攻击者的入侵，你唯一能做的就是让它更难进入。有道德的黑客是使用他们的黑客技能来防御的安全专业人士。道德黑客的过程取决于，该组织试图保护的是什么，针对的是谁，以及该组织准备花费多少或资源。这些黑客工具只用于研究和教育目的，不应用于破坏性目的。
留学生作业相关专业范文素材资料，尽在本网，可以随时查阅参考。本站也提供多国留学生课程作业写作指导服务，如有需要可咨询本平台。