Introduction |
|
xxii | |
Chapter 1 An Introduction to Ethical Hacking |
|
3 | (42) |
|
"Do I Know This Already?" Quiz |
|
|
3 | (3) |
|
|
6 | (7) |
|
|
7 | (1) |
|
Risk, Assets, Threats, and Vulnerabilities |
|
|
8 | (2) |
|
Backing Up Data to Reduce Risk |
|
|
10 | (1) |
|
|
11 | (1) |
|
|
12 | (1) |
|
|
13 | (3) |
|
No-Knowledge Tests (Black Box) |
|
|
13 | (1) |
|
Full-Knowledge Testing (White Box) |
|
|
14 | (1) |
|
Partial-Knowledge Testing (Gray Box) |
|
|
14 | (1) |
|
|
14 | (2) |
|
Hacker and Cracker Descriptions |
|
|
16 | (3) |
|
|
18 | (1) |
|
|
19 | (5) |
|
Required Skills of an Ethical Hacker |
|
|
20 | (1) |
|
|
21 | (3) |
|
Test Plans-Keeping It Legal |
|
|
24 | (5) |
|
|
25 | (1) |
|
|
26 | (1) |
|
|
27 | (1) |
|
|
28 | (1) |
|
Vulnerability Research-Keeping Up with Changes |
|
|
29 | (1) |
|
|
29 | (6) |
|
Overview of U.S. Federal Laws |
|
|
30 | (3) |
|
|
33 | (1) |
|
Payment Card Industry Data Security Standard (PCI-DSS) |
|
|
34 | (1) |
|
|
35 | (1) |
|
|
36 | (1) |
|
|
36 | (1) |
|
|
36 | (1) |
|
1-1 Searching for Exposed Passwords |
|
|
37 | (1) |
|
1-2 Examining Security Policies |
|
|
37 | (1) |
|
|
37 | (5) |
|
Suggested Reading and Resources |
|
|
42 | (3) |
Chapter 2 The Technical Foundations of Hacking |
|
45 | (42) |
|
"Do I Know This Already?" Quiz |
|
|
45 | (3) |
|
|
48 | (4) |
|
Performing Reconnaissance and Footprinting |
|
|
48 | (1) |
|
|
49 | (1) |
|
|
50 | (1) |
|
|
51 | (1) |
|
|
51 | (1) |
|
Covering Tracks and Planting Backdoors |
|
|
51 | (1) |
|
The Ethical Hacker's Process |
|
|
52 | (2) |
|
|
53 | (1) |
|
Operationally Critical Threat, Asset, and Vulnerability Evaluation |
|
|
53 | (1) |
|
Open Source Security Testing Methodology Manual |
|
|
54 | (1) |
|
Information Security Systems and the Stack |
|
|
54 | (22) |
|
|
55 | (2) |
|
Anatomy of TCP/IP Protocols |
|
|
57 | (2) |
|
|
59 | (5) |
|
|
64 | (1) |
|
Transmission Control Protocol |
|
|
64 | (2) |
|
|
66 | (1) |
|
|
66 | (6) |
|
|
72 | (2) |
|
|
74 | (2) |
|
|
76 | (1) |
|
|
77 | (1) |
|
|
77 | (1) |
|
|
78 | (2) |
|
2.1 Install a Sniffer and Perform Packet Captures |
|
|
78 | (1) |
|
2.2 List the Protocols, Applications, and Services Found at Each Layer of the Stack |
|
|
79 | (1) |
|
2.3 Using Traceroute for Network Troubleshooting |
|
|
79 | (1) |
|
|
80 | (4) |
|
Suggested Reading and Resources |
|
|
84 | (3) |
Chapter 3 Footprinting and Scanning |
|
87 | (62) |
|
"Do I Know This Already?" Quiz |
|
|
87 | (3) |
|
Overview of the Seven-Step Information-Gathering Process |
|
|
90 | (1) |
|
|
90 | (22) |
|
|
91 | (1) |
|
The Organization's Website |
|
|
91 | (2) |
|
|
93 | (2) |
|
Employee and People Searches |
|
|
95 | (3) |
|
|
98 | (1) |
|
|
99 | (4) |
|
|
103 | (1) |
|
|
104 | (3) |
|
|
107 | (5) |
|
Determining the Network Range |
|
|
112 | (3) |
|
|
114 | (1) |
|
Identifying Active Machines |
|
|
115 | (1) |
|
Finding Open Ports and Access Points |
|
|
116 | (14) |
|
|
124 | (4) |
|
|
128 | (1) |
|
|
128 | (1) |
|
|
129 | (1) |
|
|
129 | (1) |
|
|
130 | (1) |
|
|
130 | (4) |
|
Active Fingerprinting Tools |
|
|
132 | (2) |
|
|
134 | (2) |
|
Default Ports and Services |
|
|
134 | (1) |
|
|
134 | (2) |
|
Mapping the Network Attack Surface |
|
|
136 | (2) |
|
|
136 | (1) |
|
|
136 | (2) |
|
|
138 | (1) |
|
|
139 | (1) |
|
|
139 | (1) |
|
|
140 | (1) |
|
3.1 Performing Passive Reconnaissance |
|
|
140 | (1) |
|
3.2 Performing Active Reconnaissance |
|
|
141 | (1) |
|
|
141 | (5) |
|
Suggested Reading and Resources |
|
|
146 | (3) |
Chapter 4 Enumeration and System Hacking |
|
149 | (46) |
|
"Do I Know This Already?" Quiz |
|
|
149 | (3) |
|
|
152 | (11) |
|
|
152 | (2) |
|
|
154 | (1) |
|
NetBIOS and LDAP Enumeration |
|
|
155 | (2) |
|
NetBIOS Enumeration Tools |
|
|
157 | (3) |
|
|
160 | (1) |
|
|
161 | (1) |
|
|
162 | (1) |
|
|
162 | (1) |
|
IPsec and VoIP Enumeration |
|
|
162 | (1) |
|
|
163 | (1) |
|
|
163 | (23) |
|
Nontechnical Password Attacks |
|
|
164 | (1) |
|
Technical Password Attacks |
|
|
165 | (1) |
|
|
165 | (2) |
|
Automated Password Guessing |
|
|
167 | (1) |
|
|
167 | (1) |
|
|
168 | (1) |
|
Privilege Escalation and Exploiting Vulnerabilities |
|
|
169 | (1) |
|
Exploiting an Application |
|
|
170 | (1) |
|
Exploiting a Buffer Overflow |
|
|
171 | (2) |
|
|
173 | (1) |
|
Windows Authentication Types |
|
|
173 | (2) |
|
Cracking Windows Passwords |
|
|
175 | (3) |
|
Linux Authentication and Passwords |
|
|
178 | (2) |
|
|
180 | (1) |
|
Hiding Files and Covering Tracks |
|
|
181 | (1) |
|
|
182 | (3) |
|
|
185 | (1) |
|
|
186 | (1) |
|
|
187 | (1) |
|
|
187 | (1) |
|
|
188 | (1) |
|
|
188 | (1) |
|
|
189 | (4) |
|
Suggested Reading and Resources |
|
|
193 | (2) |
Chapter 5 Social Engineering, Malware Threats, and Vulnerability Analysis |
|
195 | (78) |
|
"Do I Know This Already?" Quiz |
|
|
195 | (4) |
|
|
199 | (14) |
|
|
200 | (1) |
|
|
200 | (1) |
|
|
201 | (1) |
|
|
202 | (7) |
|
|
209 | (1) |
|
|
210 | (1) |
|
|
210 | (1) |
|
Elicitation, Interrogation, and Impersonation (Pretexting) |
|
|
210 | (2) |
|
Social Engineering Motivation Techniques |
|
|
212 | (1) |
|
Shoulder Surfing and USB Key Drop |
|
|
212 | (1) |
|
|
213 | (40) |
|
|
213 | (1) |
|
Types and Transmission Methods of Viruses and Malware |
|
|
213 | (2) |
|
|
215 | (1) |
|
|
216 | (1) |
|
Well-Known Viruses and Worms |
|
|
217 | (2) |
|
|
219 | (1) |
|
|
220 | (1) |
|
|
220 | (1) |
|
Trojan Ports and Communication Methods |
|
|
221 | (1) |
|
|
222 | (1) |
|
Trojan Infection Mechanisms |
|
|
223 | (1) |
|
|
224 | (1) |
|
|
225 | (2) |
|
|
227 | (1) |
|
|
228 | (1) |
|
|
229 | (1) |
|
|
229 | (1) |
|
|
229 | (1) |
|
|
230 | (2) |
|
|
232 | (1) |
|
Tunneling via the Internet Layer |
|
|
233 | (3) |
|
Tunneling via the Transport Layer |
|
|
236 | (1) |
|
Tunneling via the Application Layer |
|
|
237 | (1) |
|
|
238 | (2) |
|
Keystroke Logging and Spyware |
|
|
240 | (1) |
|
|
241 | (1) |
|
|
241 | (1) |
|
|
242 | (1) |
|
|
243 | (1) |
|
|
243 | (3) |
|
|
246 | (3) |
|
|
249 | (1) |
|
|
250 | (1) |
|
|
251 | (2) |
|
|
253 | (7) |
|
Passive vs. Active Assessments |
|
|
253 | (1) |
|
External vs. Internal Assessments |
|
|
254 | (1) |
|
Vulnerability Assessment Solutions |
|
|
254 | (1) |
|
Tree-based vs. Inference-based Assessments |
|
|
255 | (1) |
|
Vulnerability Scoring Systems |
|
|
255 | (4) |
|
Vulnerability Scanning Tools |
|
|
259 | (1) |
|
|
260 | (2) |
|
|
262 | (1) |
|
|
263 | (1) |
|
Command Reference to Check Your Memory |
|
|
263 | (1) |
|
|
264 | (2) |
|
5.1 Finding Malicious Programs |
|
|
264 | (1) |
|
5.2 Using Process Explorer |
|
|
265 | (1) |
|
|
266 | (5) |
|
Suggested Reading and Resources |
|
|
271 | (2) |
Chapter 6 Sniffers, Session Hijacking, and Denial of Service |
|
273 | (52) |
|
"Do I Know This Already?" Quiz |
|
|
273 | (3) |
|
|
276 | (15) |
|
|
277 | (1) |
|
|
277 | (1) |
|
Address Resolution Protocol |
|
|
278 | (1) |
|
ARP Poisoning and MAC Flooding |
|
|
279 | (7) |
|
|
286 | (1) |
|
|
286 | (3) |
|
|
289 | (1) |
|
Sniffing and Spoofing Countermeasures |
|
|
290 | (1) |
|
|
291 | (12) |
|
Transport Layer Hijacking |
|
|
292 | (3) |
|
Identify and Find an Active Session |
|
|
292 | (1) |
|
Predict the Sequence Number |
|
|
293 | (2) |
|
Take One of the Parties Offline |
|
|
295 | (1) |
|
Take Control of the Session |
|
|
295 | (1) |
|
Application Layer Hijacking |
|
|
295 | (4) |
|
|
295 | (1) |
|
Predictable Session Token ID |
|
|
296 | (1) |
|
Man-in-the-Middle Attacks |
|
|
296 | (1) |
|
|
297 | (2) |
|
Man-in-the-Browser Attacks |
|
|
299 | (1) |
|
|
299 | (1) |
|
|
299 | (1) |
|
|
299 | (3) |
|
Preventing Session Hijacking |
|
|
302 | (1) |
|
Denial of Service and Distributed Denial of Service |
|
|
303 | (12) |
|
|
305 | (1) |
|
|
305 | (1) |
|
|
306 | (1) |
|
|
306 | (1) |
|
|
307 | (1) |
|
Application-Level Attacks |
|
|
307 | (2) |
|
|
309 | (1) |
|
Distributed Denial of Service |
|
|
309 | (1) |
|
|
310 | (2) |
|
DoS and DDOS Countermeasures |
|
|
312 | (3) |
|
|
315 | (1) |
|
|
316 | (1) |
|
|
317 | (1) |
|
|
317 | (2) |
|
6.1 Scanning for DDoS Programs |
|
|
317 | (1) |
|
6.2 Using SMAC to Spoof Your MAC Address |
|
|
318 | (1) |
|
6.3 Using the KnowBe4 SMAC to Spoof Your MAC Address |
|
|
318 | (1) |
|
|
319 | (4) |
|
Suggested Reading and Resources |
|
|
323 | (2) |
Chapter 7 Web Server Hacking, Web Applications, and Database Attacks |
|
325 | (82) |
|
"Do I Know This Already?" Quiz |
|
|
325 | (3) |
|
|
328 | (33) |
|
|
328 | (8) |
|
|
336 | (1) |
|
Banner Grabbing and Enumeration |
|
|
337 | (5) |
|
Web Server Vulnerability Identification |
|
|
342 | (1) |
|
|
342 | (1) |
|
|
343 | (1) |
|
DNS Server Hijacking and DNS Amplification Attacks |
|
|
343 | (2) |
|
|
345 | (2) |
|
Man-in-the-Middle Attacks |
|
|
347 | (1) |
|
|
347 | (1) |
|
Web Server Misconfiguration |
|
|
347 | (1) |
|
|
348 | (1) |
|
Understanding Cookie Manipulation Attacks |
|
|
348 | (1) |
|
Web Server Password Cracking |
|
|
349 | (1) |
|
Web Server-Specific Vulnerabilities |
|
|
349 | (2) |
|
|
351 | (1) |
|
Lack of Error Handling and Overly Verbose Error Handling |
|
|
352 | (1) |
|
|
352 | (1) |
|
|
352 | (1) |
|
|
353 | (3) |
|
|
356 | (1) |
|
|
356 | (1) |
|
|
356 | (2) |
|
|
358 | (1) |
|
|
358 | (1) |
|
|
359 | (1) |
|
Disable Unneeded Services |
|
|
359 | (1) |
|
Lock Down the File System |
|
|
360 | (1) |
|
|
360 | (1) |
|
Provide Ongoing Vulnerability Scans |
|
|
360 | (1) |
|
|
361 | (23) |
|
|
362 | (1) |
|
|
362 | (1) |
|
|
362 | (1) |
|
Understanding Cross-site Scripting (XSS) Vulnerabilities |
|
|
363 | (1) |
|
|
364 | (2) |
|
|
366 | (1) |
|
|
367 | (1) |
|
|
368 | (1) |
|
|
369 | (2) |
|
Understanding Cross-site Request Forgery Vulnerabilities and Related Attacks |
|
|
371 | (1) |
|
Understanding Clickjacking |
|
|
372 | (1) |
|
Other Web Application Attacks |
|
|
372 | (2) |
|
Exploiting Web-Based Cryptographic Vulnerabilities and Insecure Configurations |
|
|
374 | (1) |
|
Web-Based Password Cracking and Authentication Attacks |
|
|
375 | (2) |
|
Understanding What Cookies Are and Their Use |
|
|
377 | (1) |
|
|
378 | (2) |
|
|
380 | (1) |
|
Securing Web Applications |
|
|
381 | (2) |
|
|
383 | (1) |
|
|
384 | (13) |
|
A Brief Introduction to SQL and SQL Injection |
|
|
385 | (4) |
|
|
389 | (2) |
|
Fingerprinting the Database |
|
|
391 | (1) |
|
Surveying the UNION Exploitation Technique |
|
|
392 | (2) |
|
Using Boolean in SQL Injection Attacks |
|
|
394 | (1) |
|
Understanding Out-of-Band Exploitation |
|
|
394 | (2) |
|
Exploring the Time-Delay SQL Injection Technique |
|
|
396 | (1) |
|
Surveying Stored Procedure SQL Injection |
|
|
396 | (1) |
|
Understanding SQL Injection Mitigations |
|
|
396 | (1) |
|
SQL Injection Hacking Tools |
|
|
397 | (1) |
|
|
398 | (1) |
|
|
399 | (1) |
|
|
400 | (1) |
|
7.1 Complete the Exercises in WebGoat |
|
|
400 | (1) |
|
|
400 | (5) |
|
Suggested Reading and Resources |
|
|
405 | (2) |
Chapter 8 Wireless Technologies, Mobile Security, and Attacks |
|
407 | (48) |
|
"Do I Know This Already?" Quiz |
|
|
407 | (3) |
|
|
410 | (1) |
|
Mobile Device Operation and Security |
|
|
410 | (12) |
|
|
412 | (1) |
|
|
413 | (1) |
|
|
414 | (3) |
|
|
417 | (1) |
|
Windows Mobile Operating System |
|
|
417 | (1) |
|
|
418 | (1) |
|
Mobile Device Management and Protection |
|
|
418 | (1) |
|
|
419 | (3) |
|
Radio-frequency Identification (RFID) Attacks |
|
|
422 | (1) |
|
|
422 | (25) |
|
|
423 | (1) |
|
Wireless LAN Frequencies and Signaling |
|
|
424 | (1) |
|
|
425 | (8) |
|
Installing Rogue Access Points |
|
|
428 | (1) |
|
|
429 | (1) |
|
|
429 | (4) |
|
Attacking the Preferred Network Lists |
|
|
433 | (1) |
|
Jamming Wireless Signals and Causing Interference |
|
|
433 | (1) |
|
|
433 | (7) |
|
|
433 | (2) |
|
|
435 | (5) |
|
Wireless Networks Configured with Open Authentication |
|
|
440 | (3) |
|
|
440 | (1) |
|
Attacking Wi-Fi Protected Setup (WPS) |
|
|
441 | (1) |
|
|
441 | (1) |
|
|
441 | (2) |
|
Additional Wireless Hacking Tools |
|
|
443 | (1) |
|
|
443 | (1) |
|
Wireless Traffic Analysis |
|
|
443 | (1) |
|
|
444 | (1) |
|
Crack and Compromise the Wi-Fi Network |
|
|
444 | (1) |
|
Securing Wireless Networks |
|
|
445 | (1) |
|
|
445 | (13) |
|
Robust Wireless Authentication |
|
|
446 | (1) |
|
|
447 | (1) |
|
|
447 | (1) |
|
|
448 | (1) |
|
|
448 | (1) |
|
|
449 | (3) |
|
Suggested Reading and Resources |
|
|
452 | (3) |
Chapter 9 IDS, Firewalls, and Honeypots |
|
455 | (48) |
|
"Do I Know This Already?" Quiz |
|
|
455 | (3) |
|
Intrusion Detection and Prevention Systems |
|
|
458 | (16) |
|
|
458 | (3) |
|
|
461 | (2) |
|
|
463 | (1) |
|
|
463 | (1) |
|
|
464 | (1) |
|
Global Threat Correlation Capabilities |
|
|
465 | (1) |
|
|
465 | (5) |
|
|
470 | (1) |
|
|
470 | (1) |
|
|
470 | (1) |
|
|
471 | (1) |
|
|
471 | (1) |
|
Other IDS Evasion Techniques |
|
|
472 | (1) |
|
|
473 | (1) |
|
|
474 | (16) |
|
|
475 | (1) |
|
Network Address Translation |
|
|
475 | (1) |
|
|
476 | (2) |
|
Application and Circuit-Level Gateways |
|
|
478 | (1) |
|
|
479 | (1) |
|
|
480 | (4) |
|
|
484 | (6) |
|
|
490 | (4) |
|
|
492 | (1) |
|
|
493 | (1) |
|
|
494 | (1) |
|
|
494 | (1) |
|
|
495 | (1) |
|
|
495 | (5) |
|
Suggested Reading and Resources |
|
|
500 | (3) |
Chapter 10 Cryptographic Attacks and Defenses |
|
503 | (44) |
|
"Do I Know This Already?" Quiz |
|
|
503 | (3) |
|
Functions of Cryptography |
|
|
506 | (1) |
|
|
507 | (2) |
|
|
509 | (16) |
|
|
510 | (1) |
|
Data Encryption Standard (DES) |
|
|
511 | (3) |
|
Advanced Encryption Standard (AES) |
|
|
514 | (1) |
|
|
514 | (1) |
|
Asymmetric Encryption (Public Key Encryption) |
|
|
514 | (2) |
|
|
516 | (1) |
|
|
516 | (1) |
|
|
516 | (1) |
|
Elliptic Curve Cryptography (ECC) |
|
|
516 | (1) |
|
|
517 | (1) |
|
|
518 | (1) |
|
|
519 | (1) |
|
|
520 | (1) |
|
|
521 | (3) |
|
|
524 | (1) |
|
|
524 | (1) |
|
Public Key Infrastructure |
|
|
525 | (4) |
|
|
527 | (1) |
|
|
527 | (1) |
|
|
527 | (1) |
|
|
528 | (1) |
|
Protocols, Applications, and Attacks |
|
|
529 | (7) |
|
Encryption Cracking and Tools |
|
|
531 | (3) |
|
|
534 | (2) |
|
Encryption-Cracking Tools |
|
|
536 | (1) |
|
|
536 | (1) |
|
|
537 | (1) |
|
|
538 | (1) |
|
|
538 | (2) |
|
10.1 Examining an SSL Certificate |
|
|
538 | (1) |
|
|
539 | (1) |
|
10.3 Using a Steganographic Tool to Hide a Message |
|
|
540 | (1) |
|
|
540 | (5) |
|
Suggested Reading and Resources |
|
|
545 | (2) |
Chapter 11 Cloud Computing, loT, and Botnets |
|
547 | (26) |
|
"Do I Know This Already?" Quiz |
|
|
547 | (3) |
|
|
550 | (6) |
|
Cloud Computing Issues and Concerns |
|
|
552 | (2) |
|
|
554 | (1) |
|
|
555 | (1) |
|
|
556 | (4) |
|
|
558 | (2) |
|
Hacking IoT Implementations |
|
|
560 | (1) |
|
|
560 | (6) |
|
|
563 | (3) |
|
|
566 | (1) |
|
|
566 | (1) |
|
|
567 | (1) |
|
|
567 | (1) |
|
11.1 Scanning for DDoS Programs |
|
|
567 | (1) |
|
|
568 | (2) |
|
Suggested Reading and Resources |
|
|
570 | (3) |
Chapter 12 Final Preparation |
|
573 | (4) |
|
|
573 | (1) |
|
Suggested Plan for Final Review and Study |
|
|
574 | (1) |
|
|
575 | (2) |
Glossary |
|
577 | (26) |
Appendix A Answers to the "Do I Know This Already?" Quizzes and Review Questions |
|
603 | (36) |
Index |
|
639 | |