Contents

1 Things you should not do

1.1 Use AOL, MSN, or any small ISP (assuming you're doing this from your home).
1.2 Make any operational changes to the compromised computer(s)
1.3 Leave a calling card
1.4 Use Proxies
1.5 Use automated exploit scanning tools
1.6 Tell anybody about what you're doing or have done
1.7 Attempt unrealistic methods of intrusion
1.8 Give yourself a user account
1.9 Do it from a public computer
1.10 Write things down or print things off
1.11 Respond to any odd communications you get regarding your target
1.12 Use mind altering drugs or hack when you've had a lack of food or sleep
2 Stuff you should do
2.1 Your Environment
2.2 Proxies - Revisited
2.3 Data Protection
2.4 Wireless
2.5 Using Exploits
2.6 Hacking Web Apps
2.7 Dealing with Logs
3 Hiding out on a Linux System
4 Hiding out on a Windows System
Things you should not do
There are some things that you should avoid doing at all costs if you don't want to get
caught. I think it's important to go over these first because there are a lot of common
myths and falsehoods that should probably be cleared up before I go on and explain good
ways to protect yourself. Keep in mind, these are things you _shouldn't_ do.

Use AOL, MSN, or any small ISP (assuming you're doing this from your home).
If you do stuff from home, or even just do research of some kind from home, you should
avoid MSN, AOL, and smaller "home-town" type ISP's. AOL and MSN watch their customers
very closely for any activity that might indicate you are involved in breaking into a system
and may call the cops, turn off your internet, or a multitude of other things. Smaller ISP's
tend to do the same kind of thing. Citation needed

Make any operational changes to the compromised computer(s)

When you compromise or probe a system you should not do anything that has a good
potential of negatively impacting the performance of that system. People will notice if
something stops working right or starts working slower than normal, and will investigate the
reason behind it.

Leave a calling card

Don't leave any sort of calling card that'll tip someone off to your presence. This includes
defaced web pages, deleted system logs, logs edited in ways that aren't believable, etc. This
is again, because it lets the target know that someone has been messing with things.

Use Proxies
This mostly applies to the proxies found on public proxy lists, but it should be held as a
general rule. Do not use proxies to try to mask where you are connecting from. Most
proxies keep logs of who uses them and for what. If your mark realizes something is going
on they can probably just get the party responsible for the proxy to release the relevant
logs. This isn't to say that proxies should never be used. They just should not be relied on.
Ideally, any proxy you use should be one you are sure does not log anything, or one which
you can access and delete log entries related to you.

Use automated exploit scanning tools

Don't use programs like X-Scan, Nessus, Saint, SuperScan, Languard, or anything else like
that to get info about targets. These programs tend to check for every possible thing which
could be wrong with a given system, which will generate a lot of error messages on your
target's system and fill their logs, which is a pretty good indication to them that someone is
attacking them. Such programs also tend to trigger intrusion detection systems like Snort.
Tell anybody about what you're doing or have done
The fewer people who know, the better, because then there are less people who can rat you
out or let it slip. Avoid working in groups if possible.

Attempt unrealistic methods of intrusion

Don't try to do stuff like use IIS exploits against Apache, or IA32 shellcode on a computer
with a PPC processor in it. These are sure-fire tip offs to someone that something is going
on, and will also trigger most IDS devices. Along with this, you should avoid using
automated password guessing programs because they'll cause you the same kind of trouble,
and you probably won't gain anything.

Give yourself a user account

Avoid giving yourself a user account on a target system. If you can, use an existing account
or access the system using a method that doesn't require authentication.

Do it from a public computer

Although it might be tempting, you shouldn't use public computers for any kind of hacking.
While it does grant you relative anonymity, you can't be sure that someone won't walk past
and see what you're doing, that there are no cameras around, or that the machine doesn't
log what you use it for.

Write things down or print things off

Keep stuff on computer where you can encrypt it and hide it from prying eyes. Don't write
stuff down or print it off because then someone might find it laying around. Plus, papers
found with you can be used as evidence while most text-based computer documents can't
be.

Respond to any odd communications you get regarding your target

This might sound obvious, but don't respond to any communications you get from anyone
regarding your target. If someone contacts you about your target then cease all activity
right away.

Use mind altering drugs or hack when you've had a lack of food or sleep
All of these can cause you to make stupid, stupid mistakes.
Stuff you should do
Enough with things you should avoid doing, and on to things you should do. This section is
broken up into little segments about different topics.

Your Environment
Something that is a lot more important than you would think is the environment in which
you work. Make sure you are relaxed, have access to some place comfortable to sit, and are
not rushed. Avoid recurring distractions like the telephone, and turn off things like the TV or
the radio. Music is good, but don't listen to music that makes you feel particularly rushed,
excited, or tense. Turn off any messaging programs or anything like that.

The idea is to make it so you can completely focus on the task at hand without feeling
rushed or uncomfortable. If you maintain a relaxed state of mind and body you will make
less mistakes and will think through your actions more carefully. It's really easy to forget
what you're doing and then make a mistake later if you get pulled away from the computer
by the phone or something. Take frequent brakes and sit down and relax. Also, make sure
you have plently of sleep, food, and what not so you're brain is working well. Needless to
say, save the cannibus, alcohol. or whatever else for the victory dance, hehe.

Proxies - Revisited
Yeah, I said not to use proxies. That's because it's easier to tell someone not to do
something than to explain to them the right way to do it. So, this is the "right way". When it
comes to proxies your best source of them is yourself. You should use proxies you have set
up on other people's machines. There are many pieces of software available online which
will act as a SOCKS proxy if you install it on someone's computer.

Register an account with a free dynamic DNS service like dyndns.org and then install
proxies on home machines, and use the dynamic DNS services so you can always find the
machines you've made into proxies. The advantage of this approach is that individual home
users are a lot less likely to monitor their computers (many home PC's are part of a bot net
anyway), and you don't have to worry about logs.

It's best to use proxies which support encryption so the traffic sent between the proxy and
your machine can't be sniffed by anyone in between.

Also, on the topic of proxies, it should be noted that any program can be used through a
proxy if you take the correct measures. Two pieces of software you should look into are
tsocks and proxychains. Both of them can take all of the TCP I/O of a program and send it
through a chain of proxies. You can even use them to do anonymous portscanning and the
like. About the only thing they don't work well with is FTP, due to the way FTP connections
work.

If you have the time to do so you should check out the Tor project
(http://tor.eff.org/), which is a decentralized, encrypted network of proxies which anyone
can use to mask the source of a connection. It seems to work prety well, except that
connections over Tor have a higher latency than connections without it.

Data Protection
Protect the data on your computer(s) from prying eyes. Don't use some kind of stupid
method like a commercial crypto-disk software which probably has a backdoor in it. There
are better ways. One of the best ways I have seen is to use the cryptodisk function found in
the Linux kernel. Basically, you can make a image file which can be mounted as a file
system (with the correct password). When it's not mounted the data is encrypted using any
algorithm you like (anything from 3DES to AES or Twofish). There's a good tutorial on how
to set this up here: http://www.tldp.org/HOWTO/Cryptoloop-HOWTO/

If you're not able to take that route, using PGP/GPG is a good idea. GPG is an open source
encryption program that uses a public key architecture and is pretty much the de-facto
standard for encrypting documents. It's a good idea to encrypt any saved logs or data using
it. If you're using a system with it installed (any *NIX) open a command prompt, run gpg --
gen-key and follow the directions. It's a very useful piece of software.

As far as hiding and encrypting data it's a good idea to avoid any commercial software and
the methods of encryption used by programs like Winzip and Winrar. In short, don't use any
application-specific method of protecting your data. Don't rely on the password protection of
Word documents, for example.

Also, it's not a horrible idea to have some kind of plan in place to destroy all of your data
very quickly in the event of a raid or something like that. Granted, you probably won't ever
have to actually use the plan, but it's like hacking insurance. Better safe than sorry. It's
best to dispose of magnetic disks like floppies and hard drives using very strong magnets or
very high heat. Heat is best, since the media will warp and expand. One thing I used to do
was keep a coffee can with a magnet taped to the lid, and keep floppies in the can. That
way knocking over the can would erase the disks.

Hiding your data somewhere no one will look is a good idea as well. Some HP network
printers use a version of DOS which will allow you to store files on the flash drive in the
printer, for example. Who is going to look for your stored files on a printer? All the better if
they're encrypted too.

Wireless
The spread of wireless internet access has made it a lot easier to hide one's identity on the
internet. If an attack is made from a network with an attached wireless AP, it's almost
impossible to know who did it. However, if you choose to go this route you need to take
special precautions.
Obviously, don't be suspicious, and don't get yourself on camera. Also don't use programs
like Net Stumbler to find networks. Use a passive tool like Kismet, or just put your card in
monitor mode and use Ethereal. Do NOT use a Windows computer for this. Windows loves
to broadcast all sorts of identifying data all over the place, and you don't want that on
someone else's wifi net. In fact, make sure any programs which automatically connect to
anything online are turned off so you don't make any more traffic than you have to. It's also
a good idea to change the MAC address of your wifi card using a program like macchanger
or travesty. You can change the reported MAC address in Linux easy enough with ifconfig.

If you can, you should get into the AP and delete logs related to your computer as well. That
way no one even knows anyone out of the ordinary was using the network. Otherwise you
might suddenly find that networks you frequent become closed.

Using Exploits
Probably one of the most effective ways into a system is to exploit a vulnerability in a piece
of software installed on that system. It could be an exploit for anything from an anti-virus
program, to a web server, to something as odd as a word processor. Such exploits are
plentiful, available all over the internet, and most systems have at least one piece of
software installed which is vulnerable to an exploit. All of this makes using known exploits
very attractive. Well, before you happily go and use someone else's exploit code there are
some precautions you should take.

First of all, most of the time when a vulnerability is discovered one to two pieces of code are
released for exploiting it. In most cases these pieces of code send some kind of
distinguishing data to the target, so such data is often added to the signature lists of IDS
software very quickly. Exploits which cause something to listen on a port are usually added
to IDS software pretty quickly too, because they tend to use the same port all the time. So,
if you just plan to use someone else's un-modified code, you probably shouldn't. The best
practice is usually to write your own code that exploits a known vulnerability in a fashion
that won't set off too many alarms. If you don't have that level of skill, you can always try
modifying someone else's code.

Most exploits have a section somewhere in them called the "payload" which is basically the
instructions the exploit has the target run. Most of the time "shellcode" is placed here,
which is a hashed and obfuscated list of command line instructions. Again, most of the time
the goal of shellcode is just to get the remote system to bind a command shell to a given
port. In many cases you can simply remove the shellcode in an existing exploit and replace
it with your own. Tools like the Metasploit Framework can help you generate code to your
specs.

Also, the best practice as far as exploits go is to use or find one that not many people know
about at all. If an exploit isn't public knowledge then most people will not know what to look
for, and most IDS devices won't flag the usage of it.

Hacking Web Apps

A common way into a server is to exploit something wrong with a web-based application
like forum or gallery software. This is actually a very good way into a server that carries a
lower risk than you might think. If you do this sort of thing it's best to do it during peak
hours because so much traffic will already being hitting your target that yours will probably
go unnoticed. Web server log files get very large and most people never read through them
unless they think something's messed up or not working right. Furthermore, most *NIX
based systems use logrotate to delete old log files, so chances are, your logs will be deleted
anyway after a little while. Some systems are even configured so that log files are "rotated"
once they reach a certain size.

However, you are still vulnerable to detection by intrusion detection software. Thus, you
should take two precautions. The first is to use a randomized chain of proxies so that your
requests don't all appear to be coming from the same IP. Multiproxy (for Windows) and
proxychains (for Linux/UNIX) can do this for you. The second is to use SSL (https://) if you
can. SSL encrypts all data between you and the web server to prevent people from
snooping. It also prevents IDS software from seeing the data you're sending the server.

Dealing with Logs

How to deal with system log files is a hotly debated subject. Generally, you should never
just delete all the logs on a system. Missing log files are a huge tip off that something is
wrong. Also, you should always check to see if the logs on a system are being saved
somewhere other than the usual place. On a Linux or UNIX system you'll probably want to
take a look at /etc/syslog.conf and look to see if logs are being logged to any remote hosts.
Windows doesn't have a built in way of logging to a remote computer (at least, not that I
am aware of), so it's harder to tell if something like that is set up on a Windows box.

It is a good idea to edit logs. However, you have to be careful and pay attention to what
you're doing. You probably shouldn't just delete all evidence that you ever touched the
system. Rather, you should alter the evidence to make it look like someone else did. For
example, say you break into a server in a college. It wouldn't be a bad idea to alter and
change all instances of your IP to an IP somewhere on the same IP block as the student
dorms. A plausible explanation is always better than no explanation. People won't look as
hard for an answer if there's already an apparent, obvious one in front of them.

On *NIX systems there's a file called /var/log/lastlog which keeps track of the last time each
user logged in and from where. Generally, when a user logs in it will show them the last
time they logged in. Deleting lastlog is a bad idea, and there is no good way to edit it. One
good way to deal with it is to secure shell to localhost and log in again. Most people won't
really think anything of it if the server says the last time they logged in was from TTY1 or
something. Now, yeah, an admin will know something is up, but if the account you used
belongs to someone less experienced they'll just ignore it and assume the admins must
have been fixing something.
Hiding out on a Linux System
If you break into a Linux system there are some things you should check for before you
poke around too much. You should probably check to see what modules are loaded (lsmod)
and look for anything odd which might indicate you're inside a virtual machine (might be a
honeypot). Another good way to check for that is to cat /proc/cpuinfo. If it's vmware cpuinfo
will say so.

Also, you should see if process accounting is installed and enabled. Look for the executable
accton, which is typically located in /sbin. Look for any kind of integrity software as well,
including chkrootkit, rkhunter, tripwire, samhain, integcheck, etc. If you do find software
which will detect your presence you should not disable it. Rather, see if you can reconfigure
it to ignore you.

Generally, because of the way a Linux system logs actual log ins you'll probably want to
install some sort of rootkit or back door to let yourself in later. The best sort of rootkit for
this sort of thing is one that's not readily detectable. Good ideas are replacing ssh with a
patched version which does not log your logins, or replacing /sbin/login with a version that
doesn't log you. There are plenty of rootkits out there which you can get ideas and the like
from.

There are also a lot of more obscure ways of gaining access, including programs which send
command over ACK packets, ICMP, or HTTP. Such programs are very useful since a firewall
won't normally think anything of them. Also, of note here are netcat and the GNU version of
awk, both of which can be used to make a remote shell you can connect to. These are nice
because both of them are usually installed on most Linux systems.

Also, a final note on rootkits. Do not compile them on your own system and them upload
them, especially if they replace vital system files on the target system. If your system
happens to have different versions of a required library or something of that nature the
rootkit might cause the "patched" version of /sbin/login or some other program to not even
run, which that is a first class way to let someone know something is wrong.

Hiding out on a Windows System

Windows is a lot easier to hide on. There are plenty of good programs which will dodge
antivirus software and disable logging of your connections. Also, if the target system uses
NTFS you can use NTFS file streaming to hide files on the system (the book Hacking
Exposed talks about how to do this).

As far as backdoors and the like go, you should avoid using traditional trojan horses. They
are easy to detect and usually have a lot of functionality issues. Installing something like
tightvnc, turning on Remote Desktop/Terminal Services, or something like that is the way to
go. Most Windows servers do not have the logging facilities to notice a change like that, and
it's easy to hide such changes or software installs if you use a rootkit like the one that
comes on those CD's Sony is distributing right now (hides any file where the name starts
with $sys). People tend to expect a little oddness and quirkiness out of Windows, so you
have more leeway for installing backdoors.

Honestly though, there aren't many reasons to want to break into a Windows system. They
do make excellent members of a list of a proxies.