White hat hacking: Fighting fire with fire | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacker

Mention the word “hacker” and most people would think of a cybercriminal who’s adept at gaining unauthorised access to networks and computer systems.

But like many things in life, there are in fact two sides to the coin – not all hackers bat for the “dark side”.

Case in point? White hat hackers (skip to DEF CON SG to find out where they converge).

Yes, this group of people hack as well, but for a different reason – to identify and rectify vulnerabilities in computer systems. They do so in a legitimate fashion too – they only hack when given permission by system owners.

In other words, they hack to bolster cybersecurity.

Types of hackers

Generally speaking, there are three types of hackers out there.

A brief history of ethical hacking

A Frenchman named René Carmille is widely credited as one of the first people in history to perform ethical hacking. The hacking that he performed, however, had nothing to do with writing code. After all, this incident took place in 1940 during World War II, a time when only rudimentary punch card computers existed.

According to historical records, Carmille’s form of hacking involved deliberately mishandling punch cards, thus delaying the Nazis’ attempts to track Jews using the information stored in punch card computers.

In the 1960s, when computers became more advanced, the term “ethical hacking” was used to describe the act of optimising systems. Fast forward two decades, when personal computers – treasure troves of confidential records and personal information – became commonplace, the ethical hacking movement started gaining pace in tandem with the rise in numbers of black hat hackers looking to steal data.

As the world became increasingly digitalised, the fight between the white and black hat hackers naturally intensified. Today, ethical hacking is widely considered a cornerstone of modern cybersecurity.

Tools of the trade

So, how do hackers hack? Well, there is an extensive selection of tools for them to choose from.

Here are some of the many applications hackers use.

Purpose: Reconnaissance and information gathering
Nmap is used for network scanning and port discovery, Shodan is popular for finding internet-connected devices, while OSINT (Open Source Intelligence) frameworks such as Maltego help attackers map out target environments and gather preliminary information about potential victims.

Purpose: Vulnerability assessment
Scanners like Nessus, OpenVAS, and Nikto identify security weaknesses in systems, web applications, and network infrastructure. These tools automate the process of finding known vulnerabilities that could serve as entry points.

Purpose: Web application testing tools
Burp Suite and OWASP ZAP are commonly used for intercepting and manipulating web traffic, whilst tools like SQLmap automate SQL injection attacks.

Password attack tools
Hashcat and John the Ripper are commonly used for password cracking, while Hydra is used for brute force attacks against network services.

According to Jerry Tan, Acting Head of the Red Team, Tech Ops at HTX’s xCybersecurity, the tools employed by ethical and malicious hackers are essentially the same – the fundamental difference lies not in the tools but in their application.

“Ethical hackers operate with explicit permission, clearly defined scope, and professional accountability, while malicious actors face no such constraints. This is comparable to the distinction between a locksmith and a burglar,” he mused.

The growing spectre of hacking