Introduction |
|
xxix | |
Chapter 1 Introduction to Ethical Hacking and Penetration Testing |
|
3 | (20) |
|
"Do I Know This Already?" Quiz |
|
|
3 | (4) |
|
|
7 | (1) |
|
Understanding Ethical Hacking and Penetration Testing |
|
|
7 | (2) |
|
Why Do We Need to Do Penetration Testing? |
|
|
8 | (1) |
|
|
8 | (1) |
|
Exploring Penetration Testing Methodologies |
|
|
9 | (6) |
|
Why Do We Need to Follow a Methodology for Penetration Testing? |
|
|
9 | (1) |
|
Environmental Considerations |
|
|
9 | (4) |
|
Surveying Different Standards and Methodologies |
|
|
13 | (2) |
|
|
15 | (5) |
|
Requirements and Guidelines for Penetration Testing Labs |
|
|
17 | (1) |
|
What Tools Should You Use in Your Lab? |
|
|
18 | (1) |
|
What if You Break Something? |
|
|
19 | (1) |
|
|
20 | (1) |
|
|
20 | (1) |
|
|
20 | (1) |
|
|
20 | (3) |
Chapter 2 Planning and Scoping a Penetration Testing Assessment |
|
23 | (32) |
|
"Do I Know This Already?" Quiz |
|
|
23 | (3) |
|
|
26 | (1) |
|
Comparing and Contrasting Governance, Risk, and Compliance Concepts |
|
|
26 | (13) |
|
Regulatory Compliance Considerations |
|
|
26 | (2) |
|
Regulations in the Financial Sector |
|
|
28 | (2) |
|
Regulations in the Healthcare Sector |
|
|
30 | (1) |
|
Payment Card Industry Data Security Standard (PCI DSS) |
|
|
31 | (3) |
|
Key Technical Elements in Regulations You Should Consider |
|
|
34 | (1) |
|
|
35 | (1) |
|
|
36 | (2) |
|
|
38 | (1) |
|
|
39 | (1) |
|
Explaining the Importance of Scoping and Organizational or Customer Requirements |
|
|
39 | (9) |
|
|
40 | (1) |
|
Target List and In-Scope Assets |
|
|
41 | (2) |
|
Validating the Scope of Engagement |
|
|
43 | (4) |
|
Strategy: Unknown vs. Known Environment Testing |
|
|
47 | (1) |
|
Demonstrating an Ethical Hacking Mindset by Maintaining Professionalism and Integrity |
|
|
48 | (2) |
|
|
50 | (1) |
|
|
50 | (1) |
|
|
51 | (1) |
|
|
51 | (4) |
Chapter 3 Information Gathering and Vulnerability Scanning |
|
55 | (90) |
|
"Do I Know This Already?" Quiz |
|
|
55 | (4) |
|
|
59 | (1) |
|
Performing Passive Reconnaissance |
|
|
59 | (34) |
|
Active Reconnaissance vs. Passive Reconnaissance |
|
|
59 | (1) |
|
|
60 | (4) |
|
Identification of Technical and Administrative Contacts |
|
|
64 | (4) |
|
Cloud vs. Self-Hosted Applications and Related Subdomains |
|
|
68 | (1) |
|
|
69 | (1) |
|
|
70 | (2) |
|
Company Reputation and Security Posture |
|
|
72 | (1) |
|
|
73 | (3) |
|
|
76 | (4) |
|
Strategic Search Engine Analysis/Enumeration |
|
|
80 | (2) |
|
Website Archiving/Caching |
|
|
82 | (1) |
|
Public Source Code Repositories |
|
|
83 | (1) |
|
Open-Source Intelligence (OSINT) Gathering |
|
|
84 | (1) |
|
Reconnaissance with Recon-ng |
|
|
84 | (7) |
|
|
91 | (2) |
|
Performing Active Reconnaissance |
|
|
93 | (32) |
|
|
94 | (1) |
|
|
95 | (1) |
|
|
96 | (2) |
|
|
98 | (1) |
|
Host Discovery Scan (-sn) |
|
|
99 | (2) |
|
|
101 | (1) |
|
|
101 | (1) |
|
|
102 | (1) |
|
|
102 | (2) |
|
|
104 | (1) |
|
Network Share Enumeration |
|
|
105 | (2) |
|
Additional SMB Enumeration Examples |
|
|
107 | (9) |
|
Web Page Enumeration/Web Application Enumeration |
|
|
116 | (3) |
|
|
119 | (1) |
|
Exploring Enumeration via Packet Crafting |
|
|
119 | (6) |
|
Packet Inspection and Eavesdropping |
|
|
125 | (1) |
|
Understanding the Art of Performing Vulnerability Scans |
|
|
125 | (11) |
|
How a Typical Automated Vulnerability Scanner Works |
|
|
125 | (1) |
|
Types of Vulnerability Scans |
|
|
126 | (1) |
|
|
127 | (1) |
|
|
127 | (2) |
|
|
129 | (1) |
|
|
130 | (2) |
|
|
132 | (1) |
|
|
132 | (1) |
|
Challenges to Consider When Running a Vulnerability Scan |
|
|
133 | (1) |
|
Considering the Best Time to Run a Scan |
|
|
134 | (1) |
|
Determining What Protocols Are in Use |
|
|
134 | (1) |
|
|
134 | (1) |
|
|
135 | (1) |
|
|
135 | (1) |
|
Fragile Systems/Nontraditional Assets |
|
|
135 | (1) |
|
Understanding How to Analyze Vulnerability Scan Results |
|
|
136 | (5) |
|
Sources for Further Investigation of Vulnerabilities |
|
|
137 | (1) |
|
|
137 | (1) |
|
The CERT Division of Carnegie Mellon University |
|
|
138 | (1) |
|
|
138 | (1) |
|
|
138 | (1) |
|
|
139 | (1) |
|
|
139 | (1) |
|
|
139 | (1) |
|
The Common Vulnerability Scoring System (CUSS) |
|
|
139 | (1) |
|
How to Deal with a Vulnerability |
|
|
140 | (1) |
|
|
141 | (1) |
|
|
142 | (1) |
|
|
142 | (1) |
|
|
143 | (2) |
Chapter 4 Social Engineering Attacks |
|
145 | (30) |
|
"Do I Know This Already?" Quiz |
|
|
145 | (4) |
|
|
149 | (1) |
|
Pretexting for an Approach and Impersonation |
|
|
149 | (2) |
|
Social Engineering Attacks |
|
|
151 | (4) |
|
|
152 | (1) |
|
|
152 | (1) |
|
|
153 | (1) |
|
|
153 | (1) |
|
Short Message Service (SMS) Phishing |
|
|
154 | (1) |
|
Universal Serial Bus (USB) Drop Key |
|
|
154 | (1) |
|
|
155 | (1) |
|
|
155 | (2) |
|
|
156 | (1) |
|
|
156 | (1) |
|
|
156 | (1) |
|
|
157 | (1) |
|
|
157 | (13) |
|
Social-Engineer Toolkit (SET) |
|
|
157 | (10) |
|
Browser Exploitation Framework (BeEF) |
|
|
167 | (2) |
|
|
169 | (1) |
|
|
170 | (1) |
|
|
171 | (1) |
|
|
171 | (1) |
|
|
172 | (1) |
|
|
172 | (3) |
Chapter 5 Exploiting Wired and Wireless Networks |
|
175 | (62) |
|
"Do I Know This Already?" Quiz |
|
|
175 | (5) |
|
|
180 | (1) |
|
Exploiting Network-Based Vulnerabilities |
|
|
180 | (36) |
|
Windows Name Resolution and SMB Attacks |
|
|
180 | (1) |
|
NetBIOS Name Service and LLMNR |
|
|
180 | (2) |
|
|
182 | (5) |
|
|
187 | (2) |
|
|
189 | (2) |
|
|
191 | (1) |
|
|
191 | (1) |
|
|
192 | (3) |
|
Known SMTP Server Exploits |
|
|
195 | (2) |
|
|
197 | (2) |
|
|
199 | (1) |
|
Kerberos and LDAP-Based Attacks |
|
|
200 | (4) |
|
|
204 | (1) |
|
|
204 | (1) |
|
ARP Spoofing and ARP Cache Poisoning |
|
|
204 | (2) |
|
|
206 | (1) |
|
Route Manipulation Attacks |
|
|
207 | (1) |
|
|
207 | (1) |
|
|
208 | (1) |
|
Reflected DoS and DDoS Attacks |
|
|
209 | (1) |
|
Amplification DDoS Attacks |
|
|
210 | (1) |
|
Network Access Control (NAC) Bypass |
|
|
211 | (2) |
|
|
213 | (2) |
|
DHCP Starvation Attacks and Rogue DHCP Servers |
|
|
215 | (1) |
|
Exploiting Wireless Vulnerabilities |
|
|
216 | (18) |
|
|
216 | (1) |
|
|
217 | (1) |
|
Disassociation (or Deauthentication) Attacks |
|
|
218 | (3) |
|
Preferred Network List Attacks |
|
|
221 | (1) |
|
Wireless Signal Jamming and Interference |
|
|
221 | (1) |
|
|
222 | (1) |
|
Initialization Vector (IV) Attacks and Unsecured Wireless Protocols |
|
|
222 | (1) |
|
|
222 | (2) |
|
|
224 | (4) |
|
|
228 | (1) |
|
|
229 | (1) |
|
Wi-Fi Protected Setup (WPS) PIN Attacks |
|
|
229 | (1) |
|
|
229 | (1) |
|
|
230 | (1) |
|
|
231 | (1) |
|
Bluejacking and Bluesnarfing |
|
|
231 | (1) |
|
Bluetooth Low Energy (BLE) Attacks |
|
|
232 | (1) |
|
Radio-Frequency Identification (RFID) Attacks |
|
|
232 | (1) |
|
|
233 | (1) |
|
|
233 | (1) |
|
|
234 | (1) |
|
|
234 | (1) |
|
|
235 | (1) |
|
|
235 | (2) |
Chapter 6 Exploiting Application-Based Vulnerabilities |
|
237 | (68) |
|
"Do I Know This Already?" Quiz |
|
|
237 | (7) |
|
|
244 | (1) |
|
Overview of Web Application-Based Attacks for Security Professionals and the OWASP Top 10 |
|
|
244 | (11) |
|
|
244 | (8) |
|
|
252 | (3) |
|
|
255 | (1) |
|
How to Build Your Own Web Application Lab |
|
|
255 | (1) |
|
Understanding Business Logic Flaws |
|
|
256 | (1) |
|
Understanding Injection-Based Vulnerabilities |
|
|
257 | (16) |
|
SQL Injection Vulnerabilities |
|
|
258 | (1) |
|
A Brief Introduction to SQL |
|
|
258 | (4) |
|
|
262 | (2) |
|
|
264 | (1) |
|
The UNION Exploitation Technique |
|
|
265 | (1) |
|
Boolean in SQL Injection Attacks |
|
|
266 | (1) |
|
|
267 | (1) |
|
|
268 | (1) |
|
The Time-Delay SQL Injection Technique |
|
|
269 | (1) |
|
Surveying a Stored Procedure SQL Injection |
|
|
269 | (1) |
|
SQL Injection Mitigations |
|
|
270 | (1) |
|
Command Injection Vulnerabilities |
|
|
271 | (1) |
|
Lightweight Directory Access Protocol (LDAP) Injection Vulnerabilities |
|
|
272 | (1) |
|
Exploiting Authentication-Based Vulnerabilities |
|
|
273 | (6) |
|
|
273 | (4) |
|
|
277 | (1) |
|
|
278 | (1) |
|
|
278 | (1) |
|
Exploiting Authorization-Based Vulnerabilities |
|
|
279 | (2) |
|
|
279 | (1) |
|
Insecure Direct Object Reference Vulnerabilities |
|
|
280 | (1) |
|
Understanding Cross-Site Scripting (XSS) Vulnerabilities |
|
|
281 | (7) |
|
|
282 | (1) |
|
|
283 | (2) |
|
|
285 | (1) |
|
|
286 | (2) |
|
Understanding Cross-Site Request Forgery (CSRF/XSRF) and Server-Side Request Forgery Attacks |
|
|
288 | (1) |
|
Understanding Clickjacking |
|
|
289 | (1) |
|
Exploiting Security Misconfigurations |
|
|
289 | (3) |
|
Exploiting Directory Traversal Vulnerabilities |
|
|
290 | (1) |
|
Cookie Manipulation Attacks |
|
|
291 | (1) |
|
Exploiting File Inclusion Vulnerabilities |
|
|
292 | (1) |
|
Local File Inclusion Vulnerabilities |
|
|
292 | (1) |
|
Remote File Inclusion Vulnerabilities |
|
|
292 | (1) |
|
Exploiting Insecure Code Practices |
|
|
293 | (8) |
|
|
293 | (1) |
|
Lack of Error Handling and Overly Verbose Error Handling |
|
|
294 | (1) |
|
|
294 | (1) |
|
|
294 | (1) |
|
|
295 | (3) |
|
|
298 | (1) |
|
|
298 | (1) |
|
Additional Web Application Hacking Tools |
|
|
298 | (3) |
|
|
301 | (1) |
|
|
301 | (1) |
|
|
302 | (1) |
|
|
303 | (2) |
Chapter 7 Cloud, Mobile, and loT Security |
|
305 | (36) |
|
"Do I Know This Already?" Quiz |
|
|
305 | (4) |
|
|
309 | (1) |
|
Researching Attack Vectors and Performing Attacks on Cloud Technologies |
|
|
309 | (15) |
|
|
311 | (6) |
|
|
317 | (1) |
|
|
318 | (1) |
|
|
319 | (1) |
|
Attacks Against Misconfigured Cloud Assets |
|
|
320 | (1) |
|
Resource Exhaustion and DoS Attacks |
|
|
321 | (2) |
|
Cloud Malware Injection Attacks |
|
|
323 | (1) |
|
|
323 | (1) |
|
Tools and Software Development Kits (SDKs) |
|
|
323 | (1) |
|
Explaining Common Attacks and Vulnerabilities Against Specialized Systems |
|
|
324 | (12) |
|
|
324 | (4) |
|
Attacking Internet of Things (IoT) Devices |
|
|
328 | (1) |
|
|
328 | (1) |
|
IoT Security Special Considerations |
|
|
329 | (1) |
|
Common IoT Vulnerabilities |
|
|
330 | (1) |
|
Data Storage System Vulnerabilities |
|
|
330 | (2) |
|
Management Interface Vulnerabilities |
|
|
332 | (1) |
|
Exploiting Virtual Machines |
|
|
332 | (2) |
|
Vulnerabilities Related to Containerized Workloads |
|
|
334 | (2) |
|
|
336 | (1) |
|
|
337 | (1) |
|
|
337 | (1) |
|
|
338 | (3) |
Chapter 8 Performing Post-Exploitation Techniques |
|
341 | (34) |
|
"Do I Know This Already?" Quiz |
|
|
341 | (4) |
|
|
345 | (1) |
|
Creating a Foothold and Maintaining Persistence After Compromising a System |
|
|
345 | (10) |
|
|
346 | (6) |
|
Command and Control (C2) Utilities |
|
|
352 | (2) |
|
|
354 | (1) |
|
Custom Daemons, Processes, and Additional Backdoors |
|
|
355 | (1) |
|
|
355 | (1) |
|
Understanding How to Perform Lateral Movement, Detection Avoidance, and Enumeration |
|
|
355 | (16) |
|
Post-Exploitation Scanning |
|
|
356 | (2) |
|
Legitimate Utilities and Living Off the Land |
|
|
358 | (1) |
|
PowerShell for Post-Exploitation Tasks |
|
|
359 | (1) |
|
|
360 | (4) |
|
|
364 | (1) |
|
Windows Management Instrumentation for Post-Exploitation Tasks |
|
|
364 | (1) |
|
|
364 | (2) |
|
Windows Remote Management (WinRM) for Post-Exploitation Tasks |
|
|
366 | (1) |
|
Post-Exploitation Privilege Escalation |
|
|
366 | (1) |
|
|
367 | (1) |
|
|
368 | (3) |
|
|
371 | (1) |
|
|
371 | (1) |
|
|
372 | (1) |
|
|
372 | (3) |
Chapter 9 Reporting and Communication |
|
375 | (24) |
|
"Do I Know This Already?" Quiz |
|
|
375 | (4) |
|
|
379 | (1) |
|
Comparing and Contrasting Important Components of Written Reports |
|
|
379 | (6) |
|
|
380 | (2) |
|
Storage Time for Report and Secure Distribution |
|
|
382 | (1) |
|
|
383 | (1) |
|
Common Themes/Root Causes |
|
|
384 | (1) |
|
Analyzing the Findings and Recommending the Appropriate Remediation Within a Report |
|
|
385 | (5) |
|
|
385 | (3) |
|
|
388 | (1) |
|
|
389 | (1) |
|
|
390 | (1) |
|
Explaining the Importance of Communication During the Penetration Testing Process |
|
|
390 | (3) |
|
|
391 | (1) |
|
Reasons for Communication |
|
|
391 | (1) |
|
Goal Reprioritization and Presentation of Findings |
|
|
392 | (1) |
|
Explaining Post-Report Delivery Activities |
|
|
393 | (2) |
|
|
393 | (1) |
|
Additional Post-Report Delivery Activities |
|
|
394 | (1) |
|
|
395 | (1) |
|
|
395 | (1) |
|
|
395 | (1) |
|
|
396 | (3) |
Chapter 10 Tools and Code Analysis |
|
399 | (114) |
|
"Do I Know This Already?" Quiz |
|
|
399 | (4) |
|
|
403 | (1) |
|
Understanding the Basic Concepts of Scripting and Software Development |
|
|
403 | (6) |
|
|
403 | (1) |
|
|
404 | (1) |
|
|
405 | (1) |
|
|
405 | (1) |
|
|
405 | (1) |
|
|
406 | (1) |
|
Analysis of Scripts and Code Samples for Use in Penetration Testing |
|
|
406 | (1) |
|
|
406 | (1) |
|
Resources to Learn Python |
|
|
407 | (1) |
|
|
407 | (1) |
|
Resources to Learn PowerShell |
|
|
408 | (1) |
|
|
408 | (1) |
|
Resources to Learn JavaScript |
|
|
408 | (1) |
|
Understanding the Different Use Cases of Penetration Testing Tools and Analyzing Exploit Code |
|
|
409 | (96) |
|
Penetration Testing-Focused Linux Distributions |
|
|
409 | (1) |
|
|
410 | (1) |
|
|
411 | (1) |
|
|
411 | (2) |
|
Common Tools for Reconnaissance and Enumeration |
|
|
413 | (1) |
|
Tools for Passive Reconnaissance |
|
|
413 | (20) |
|
Tools for Active Reconnaissance |
|
|
433 | (10) |
|
Common Tools for Vulnerability Scanning |
|
|
443 | (20) |
|
Common Tools for Credential Attacks |
|
|
463 | (1) |
|
|
464 | (4) |
|
|
468 | (1) |
|
|
469 | (2) |
|
|
471 | (2) |
|
|
473 | (1) |
|
|
474 | (1) |
|
|
474 | (1) |
|
|
475 | (1) |
|
|
476 | (1) |
|
Common Tools for Persistence |
|
|
477 | (1) |
|
|
478 | (1) |
|
|
478 | (4) |
|
|
482 | (1) |
|
|
483 | (1) |
|
|
483 | (1) |
|
Encapsulation and Tunneling Using DNS and Protocols Such as NTP |
|
|
484 | (2) |
|
|
486 | (1) |
|
|
486 | (7) |
|
|
493 | (1) |
|
Common Decompilation, Disassembly, and Debugging Tools |
|
|
494 | (1) |
|
The GNU Project Debugger (GDB) |
|
|
494 | (2) |
|
|
496 | (1) |
|
|
496 | (1) |
|
|
497 | (1) |
|
|
498 | (1) |
|
|
498 | (2) |
|
|
500 | (1) |
|
Common Tools for Forensics |
|
|
501 | (1) |
|
Common Tools for Software Assurance |
|
|
502 | (1) |
|
SpotBugs, Findsecbugs, and SonarQube |
|
|
502 | (1) |
|
|
503 | (1) |
|
|
503 | (1) |
|
|
503 | (1) |
|
|
503 | (1) |
|
|
504 | (1) |
|
|
504 | (1) |
|
|
505 | (1) |
|
|
505 | (3) |
|
|
506 | (2) |
|
|
508 | (1) |
|
|
508 | (5) |
Chapter 11 Final Preparation |
|
513 | (6) |
|
Tools for Final Preparation |
|
|
513 | (4) |
|
Pearson Test Prep Practice Test Engine |
|
|
513 | (1) |
|
Accessing the Pearson Test Prep Software Online |
|
|
514 | (1) |
|
Accessing the Pearson Test Prep Software Offline |
|
|
514 | (1) |
|
|
515 | (1) |
|
|
516 | (1) |
|
|
516 | (1) |
|
Chapter-Ending Review Tools |
|
|
517 | (1) |
|
Suggested Plan for Final Review/Study |
|
|
517 | (1) |
|
|
518 | (1) |
Glossary of Key Terms |
|
519 | (18) |
Appendix A Answers to the "Do I Know This Already?" Quizzes and Q&A Sections |
|
537 | (22) |
Appendix B CompTIA® PenTest+ PTO-002 Cert Guide Exam Updates |
|
559 | (2) |
Index |
|
561 | |
Online Elements: |
|
|
|
|
|