The Five Stages of Ethical Hacking

Posted by Sharan R On 12:30 AM

Phases of hacking 

Phase 1—Reconnaissance
Phase 2—Scanning
Phase 3—Gaining Access
Phase 4—Maintaining Access
Phase 5—Covering Tracks

Phase 1: Passive and Active Reconnaissance
Passive reconnaissance involves gathering information regarding a potential target without
the targeted individual’s or company’s knowledge. Passive reconnaissance can be as simple as
watching a building to identify what time employees enter the building and when they leave.
However, it’s usually done using Internet searches or by Googling an individual or company
to gain information. This process is generally called information gathering. Social engineering and dumpster diving are also considered passive information-gathering methods.
Sniffing the network is another means of passive reconnaissance and can yield useful information
such as IP address ranges, naming conventions, hidden servers or networks, and other
available services on the system or network. Sniffing network traffic is similar to building
monitoring: A hacker watches the flow of data to see what time certain transactions take place
and where the traffic is going.

Active reconnaissance involves probing the network to discover individual hosts, IP addresses,
and services on the network. This usually involves more risk of detection than passive reconnaissance
and is sometimes called rattling the doorknobs. Active reconnaissance can give a hacker an
indication of security measures in place (is the front door locked?), but the process also increases
the chance of being caught or at least raising suspicion.

Both passive and active reconnaissance can lead to the discovery of useful information to
use in an attack. For example, it’s usually easy to find the type of web server and the operating
system (OS) version number that a company is using. This information may enable a hacker
to find a vulnerability in that OS version and exploit the vulnerability to gain more access.
Phase 2: Scanning
involves taking the information discovered during reconnaissance and using it to
examine the network. Tools that a hacker may employ during the scanning phase can include
dialers, port scanners, network mappers, sweepers, and vulnerability scanners. Hackers are
seeking any information that can help them perpetrate attack such as computer names, IP
addresses, and user accounts.

Phase 3: Gaining Access 
This is the phase where the real hacking takes place. Vulnerabilities discovered during the reconnaissance and scanning phase are now exploited to gain access. The method of connection the hacker uses for an exploit can be a local area network (LAN, either wired or wireless), local access to a PC, the Internet, or offline. Examples include stack-based buffer overflows, denial of service (DoS), and session hijacking. These topics will be discussed in later chapters. Gaining access is known in the hacker world as owning the system.

Phase 4: Maintaining Access
Once a hacker has gained access, they want to keep that access for future exploitation and
attacks. Sometimes, hackers harden the system from other hackers or security personnel by
securing their exclusive access with backdoors, rootkits, and Trojans. Once the hacker owns
the system, they can use it as a base to launch additional attacks. In this case, the owned system
is sometimes referred to as a zombie system.
Phase 5: Covering Tracks
Once hackers have been able to gain and maintain access, they cover their tracks to avoid
detection by security personnel, to continue to use the owned system, to remove evidence of
hacking, or to avoid legal action. Hackers try to remove all traces of the attack, such as log files
or intrusion detection system (IDS) alarms. Examples of activities during this phase of the
attack include steganography, the use of tunneling protocols, and altering log files.


  1. Priya Verma Said,

    Online Cisco Training, Online Linux Training, Online Ethical Hacking Training, Online CCNP Training, Online CCNA Training, Online MCSE Training, Online CCIE Training India, MCITP Training, Online VMware Training and more offered by Zoom Technologies by highly proficient CISCO certified experts - Hyderabad, India.

    Posted on April 23, 2014 at 10:43 AM

  2. Cindy Dy Said,

    This is really an interesting topic. I had a great time surfing and found some important tips and information from your blog. Keep it up.


    Posted on December 9, 2015 at 12:58 AM

  3. sarah lee Said,

    I really enjoyed reading your article. I found this as an informative and interesting post, so i think it is very useful and knowledgeable. I would like to thank you for the effort you have made in writing this article.

    Posted on January 12, 2016 at 6:46 PM

  4. Naveen Yadav Said,

    Ethical hacking Training very fruitful to Every Computer user for Security reasons. Nice blog and very well written.

    Posted on February 2, 2017 at 2:25 AM

  5. Thank you for sharing. If you can more read now visit
    Ethical Hacking Training in India
    EC-Council Certification Course in Delhi NCR

    Posted on March 27, 2017 at 2:01 AM

  6. Thanks for sharing.
    Learn how to hack.

    Posted on May 17, 2017 at 3:08 AM

  7. Priya Kannan Said,

    Pretty section of content. I simply stumbled upon your site and in accession capital to say that I get actually loved to account your blog posts.
    CCNA Training in Chennai

    Posted on June 28, 2017 at 12:04 AM

  8. Naveen Yadav Said,

    Very Nice blog . Thanks for sharing.

    CEH Training in Delhi NCR

    Posted on January 7, 2018 at 10:59 PM

  9. Shailendra Said,

    Hooray ! Blog is very helpful for me. I Like it, Thanks for Sharing great content.
    Ethical Hacking Training in Gurgaon
    Ethical Hacking Institute in Gurgaon
    Ethical Hacking Course in Gurgaon

    Posted on February 13, 2018 at 10:24 PM

  10. Mahesh Said,

    Thanks, Learned a lot of new things from your post! Good creation and HATS OFF to the creativity of your mind.
    Very interesting and useful blog!
    Ethical Hacking Course in Gurgaon

    Posted on February 17, 2018 at 1:42 AM