Ethical Hacking Syllabus

Well many one ask this as what to study as a curriculum for Ethical hacking..
hmm well i made dis generalized mannual fr u guys. may help a lot

• Security testing methodologies

• The Ethical Hacking Profession

• Passive Intelligence Gathering – 2007 Version

• Network Sweeps

• Stealthily Network Recon

• Passive traffic identification

• Identifying system vulnerabilities

• Abusing Domain Name System (DNS)

• Abusing Simple Network Management Protocol(SNMP)

• Introduction to Remote Exploits

• Engineering remote exploits

• Running shellcode in RAM vs. on disk

• Heap Buffer Overflows

• Compromising Windows 2003 Server Systems

• Compromising Solaris Unix and Linux Systems

• Attacking RDP (Remote Desktop Protocol) inWindows XP, 2003 & Vista

• Windows password weaknesses & Rainbow Tables

• Unix password weaknesses

• Attacking Cisco’s IOS password weaknesses

Trojan genres

• Windows, Unix and Linux Trojans

• Kernel Mode Windows Rootkits – System CallHijacking and Direct Kernel Object Modification

• Kernel Mode Linux Rootkits

• Covert communication channels

• Spoofing endpoints of communication tunnels

• Tunneling through IPSec VPNs by abusing ESP

• Steganographic Tunnels

• Remote command execution

• Sniffing and hijacking SSL encrypted sessions

• Installing sniffers on low privilege account inWindows 2003 Server

• Stealthy Remote keylogger installation

• Circumventing Antivirus

Modifying syslog entries

• Raw binary editing to prevent forensicinvestigations

• Editing the Windows Event Log

• Abusing Windows Named Pipes for DomainImpersonation

• Impersonation of other Users- Hijacking kerneltokens

• Disguising network connections

• Attacking Cisco IOS

• Attacking STP & BGP protocols

• Wireless Insecurity

• Breaking Wireless Security – WEP, WPA, WPA2

• Blinding IDS & IPS

• Attacking IDS & IPS

Malicious event log editing

• Binary filesystem modification for anti-forensics

• Named Pipe abuse

• Kernel Token Hijacking

• Attacking Border Gateway Protocol (BGP)

• Attack WEP

• Cracking WPA

• Cracking WPA2

• Cisco IOS Exploits

• Breaking into Cisco routers

• Blinding IPS

• Attacking IPS

Abusing Web Applications

• Attacking Java Applets

• Breaking web app authentication

• SQL Injection techniques

• Modifying form data

• Attacking session IDs

• Cookie stealing

• Cross Site Scripting

• Cross Site Request Forgery (CSRF) Attacks

Remote buffer overflow exploit lab

• Custom compiling Shellcode

• Running payloads in RAM

• Hiding exploit payloads in jpeg and gif imagefiles

• Attacking email vectors (Lotus Notes andMicrosoft Exchange, and Outlook Web Access)

• Registry manipulation

• Client side IE & Firefox exploits

• Using custom Trojans to circumvent Antivirus

• Remote kernel overflows

• RDP (Remote Desktop Protocol) Exploitation

• Cracking Windows Passwords

• Building Rainbow Tables

• Cracking Windows 2003 native mode passwords

• Brute forcing salted Unix passwords

• Attacking Kerberos Pre-Auth Hashes

• Cracking IOS and PIX passwords

• Compromise a DMZ setting with port redirection

• Circumvent firewall IP access list (ACL)

• Customizing Trojans to avoid Antivirus

• Deploying kernel mode rootkits on Windows 2003& Vista

• Installing LKM rootkits on Linux servers

• Hijacking MSN messenger traffic

• Running commands remotely

• Breaking wireless encryption – WEP, WPA, WPA2

• Installing sniffers in low privilege user accounts

• Sniffing remotely and retrieving results

• Remote keylogging

• Tunneling with cover channels through IPSec VPNs

• Hijack and capture SSL traffic

Network Sweeping

• Scanning from spoofed IP addresses

• Stealthy Recon

• Injecting p0f for passive OS fingerprinting

• Scanning through firewalls

• IPv6 Scanning

• Discover all subdomains owned by anorganization

• Inspect changes to whois record over last 3years

• Windows 2003 Server & Vista DNS CachePoisoning Attacks

• Pumping SNMP for data – OID Dissection

• Attacking SNMP