2KKUU7ita

44
Part I: Building the Foundation for Ethical Hacking
Having said this, if you discover a major hole, I recommend contacting the
right people as soon as possible so that they can begin fixing the issue right
away. The right people may be software developers, product or project managers,
or even CIOs. If you wait a few days or weeks, someone might exploit
the vulnerability and cause damage that could’ve been prevented.
Making silly assumptions
You’ve heard about what you make of yourself when you assume things. Even
so, you make assumptions when you hack a system. Here are some examples
of those assumptions:
✓ Computers, networks, and people are available when you’re testing.
✓ You have all the proper testing tools.
✓ The testing tools you use will minimize the chances of crashing the systems
you test.
✓ You understand the likelihood that existing vulnerabilities were not
found or that you used your testing tools improperly.
✓ You know the risks of your tests.
Document all assumptions and have management or your client sign off on
them as part of your overall approval process.
Selecting Security Assessment Tools
Which security assessment tools you need depend on the tests you’re going
to run. You can perform some ethical hacking tests with a pair of sneakers, a
telephone, and a basic workstation on the network, but comprehensive testing
is easier with hacking tools.
The tools in this book are not malware. The tools and even their websites
may be flagged as such by certain anti-malware and web-filtering software
but they’re not. The tools I cover are legitimate tools that can be used for
legitimate purposes. If you experience trouble downloading, installing, or running
the tools I cover in this book, you may consider configuring your system
to allow them through or otherwise trust their execution. Keep in mind that
I can’t make any promises. Use checksums where possible by comparing
the original MD5 or SHA checksum with the one you get using a tool such as
CheckSum Tool (http://sourceforge.net/projects/checksumtool).
A criminal could always inject malicious code into the actual tools, so there’s
no guarantee of security. You knew that anyway, right?