About the Author |
|
xv | |
About the Technical Reviewer |
|
xvii | |
Acknowledgments |
|
xix | |
Preface |
|
xxi | |
Chapter 1 Introduction |
|
1 | (10) |
|
Why Security Testing Is Important |
|
|
1 | (1) |
|
Vulnerabilities Are Everywhere |
|
|
2 | (1) |
|
Not Only Hackers Exploit Vulnerabilities |
|
|
2 | (1) |
|
|
2 | (1) |
|
The Inevitable Weakness of Any Security Test |
|
|
3 | (1) |
|
|
3 | (1) |
|
The World's First Security Test |
|
|
3 | (1) |
|
Who Are These Hackers Anyway? |
|
|
4 | (5) |
|
|
4 | (1) |
|
|
5 | (1) |
|
|
5 | (1) |
|
|
6 | (1) |
|
|
7 | (1) |
|
|
8 | (1) |
|
Threats and Threat Agents |
|
|
8 | (1) |
|
|
9 | (2) |
Chapter 2 Security Testing Basics |
|
11 | (14) |
|
|
11 | (3) |
|
The Knowledge Factor vs. The Guesswork Factor |
|
|
12 | (2) |
|
|
14 | (1) |
|
|
14 | (2) |
|
Uncovering Vulnerabilities |
|
|
16 | (1) |
|
The Vulnerability Wheel and the Heartbleed Bug |
|
|
17 | (1) |
|
The Vulnerability Wheel by Example |
|
|
17 | (1) |
|
|
18 | (1) |
|
How Vulnerabilities Are Scored and Rated |
|
|
18 | (1) |
|
A Real-World Example Using CVSS |
|
|
18 | (1) |
|
Software Development Life Cycle and Security Testing |
|
|
19 | (1) |
|
How Security Testing Can Be Applied to the SDLC |
|
|
20 | (1) |
|
|
20 | (1) |
|
|
21 | (1) |
|
Client-Side vs. Server-Side Testing |
|
|
22 | (1) |
|
|
22 | (3) |
Chapter 3 The Security Testing Process |
|
25 | (6) |
|
The Process of a Security Test |
|
|
25 | (1) |
|
|
26 | (1) |
|
|
26 | (2) |
|
Setting the Scope Using Old Reports |
|
|
27 | (1) |
|
Helping the Client to Set a Good Scope |
|
|
28 | (1) |
|
Pre Security Test System Q&A |
|
|
28 | (1) |
|
|
29 | (1) |
|
Statement of Work Example: Organization XYZ |
|
|
29 | (1) |
|
Get Out of Jail Free Card |
|
|
29 | (1) |
|
|
30 | (1) |
|
|
30 | (1) |
|
|
30 | (1) |
Chapter 4 Technical Preparations |
|
31 | (18) |
|
Collecting Network Traffic |
|
|
31 | (2) |
|
|
31 | (2) |
|
|
33 | (1) |
|
|
33 | (1) |
|
|
33 | (2) |
|
|
34 | (1) |
|
Software Versioning and Revision Control Systems |
|
|
34 | (1) |
|
|
34 | (1) |
|
|
35 | (1) |
|
Know Which System You're Testing |
|
|
35 | (1) |
|
The Habit of Saving Complex Commands |
|
|
36 | (1) |
|
|
36 | (1) |
|
Visually Recording Your Work |
|
|
36 | (1) |
|
|
37 | (1) |
|
The Worst Tools One Can Possibly Imagine |
|
|
37 | (1) |
|
|
38 | (1) |
|
|
38 | (1) |
|
The Security Tester's Software Setup |
|
|
39 | (1) |
|
Virtual Machines for Security Testing |
|
|
39 | (1) |
|
When to Use Hacker Distributions |
|
|
39 | (1) |
|
|
40 | (1) |
|
|
40 | (1) |
|
End-of-the-Day Checklists |
|
|
41 | (1) |
|
|
41 | (3) |
|
|
42 | (2) |
|
|
44 | (1) |
|
Automated Vulnerability Scanners (and When to Use Them) |
|
|
45 | (1) |
|
The Google Proxy Avoidance Service |
|
|
45 | (2) |
|
|
47 | (1) |
|
|
48 | (1) |
Chapter 5 Security Test Execution |
|
49 | (10) |
|
|
49 | (1) |
|
The Technical Security Test Process |
|
|
49 | (4) |
|
|
49 | (4) |
|
|
53 | (1) |
|
When to Use What Approach |
|
|
53 | (1) |
|
|
54 | (1) |
|
|
54 | (1) |
|
|
54 | (1) |
|
The Pre-Security Test System Q&A Taken with a Grain of Salt |
|
|
54 | (1) |
|
To Test Production Systems or to Not Test Productions |
|
|
|
Systems - That Is the Question |
|
|
55 | (1) |
|
Production Systems versus Pre-Production Systems |
|
|
55 | (1) |
|
The Goal Is to Eventually Fail |
|
|
56 | (1) |
|
|
56 | (1) |
|
|
57 | (1) |
|
|
57 | (2) |
Chapter 6 Identifying Vulnerabilities |
|
59 | (30) |
|
|
59 | (1) |
|
|
59 | (1) |
|
|
60 | (1) |
|
|
60 | (1) |
|
What a Network Scanner Is |
|
|
61 | (1) |
|
A Very Short Brush-Up on Ports |
|
|
61 | (8) |
|
|
62 | (1) |
|
|
63 | (1) |
|
Scanning for TCP Services |
|
|
64 | (1) |
|
Scanning for UDP Services |
|
|
65 | (1) |
|
Operating System Detection |
|
|
66 | (1) |
|
Common TCP and UDP-Based Services |
|
|
67 | (1) |
|
|
68 | (1) |
|
|
69 | (1) |
|
On the Job: On Poor Documentation |
|
|
70 | (1) |
|
|
71 | (1) |
|
|
71 | (1) |
|
|
72 | (2) |
|
|
74 | (1) |
|
|
74 | (1) |
|
Getting Geographical IP Info Using Pollock |
|
|
75 | (2) |
|
Harvesting E-Mail Addresses with the Harvester |
|
|
77 | (1) |
|
|
77 | (2) |
|
|
78 | (1) |
|
Enumerating Web Presence Using Netcraft |
|
|
79 | (1) |
|
American Registry for Internet Numbers (AKIN) |
|
|
80 | (2) |
|
Searching for IP Addresses |
|
|
82 | (1) |
|
The Downside of Manual Domain Name and IP Address Searching |
|
|
83 | (1) |
|
|
83 | (2) |
|
Where to Find Raw Data from Hacked Websites |
|
|
84 | (1) |
|
|
84 | (1) |
|
|
85 | (1) |
|
|
86 | (1) |
|
Checking Password Reset Functionality |
|
|
87 | (1) |
|
|
87 | (2) |
Chapter 7 Exploiting Vulnerabilities |
|
89 | (64) |
|
|
89 | (1) |
|
|
90 | (25) |
|
The Password Is Dead — Long Live the Password |
|
|
90 | (1) |
|
Brute Force Password Guessing |
|
|
90 | (1) |
|
Online vs. Offline Password Attacks |
|
|
91 | (1) |
|
|
91 | (1) |
|
|
92 | (13) |
|
|
105 | (1) |
|
The Most Common Reason Why Online Password Attacks Fail |
|
|
106 | (3) |
|
|
109 | (1) |
|
|
110 | (1) |
|
|
110 | (1) |
|
Too Much Salt Can Make Any Rainbow Fade |
|
|
111 | (1) |
|
|
112 | (1) |
|
Creating a Custom Online Cracking Platform |
|
|
113 | (1) |
|
Default Accounts and Their Passwords |
|
|
114 | (1) |
|
|
115 | (23) |
|
OWASP Top Ten Training Ground |
|
|
138 | (1) |
|
|
139 | (13) |
|
|
142 | (4) |
|
A Very Short Brush-Up on Fuzzing |
|
|
146 | (2) |
|
|
148 | (2) |
|
|
150 | (1) |
|
All the Hacker Needs Is a Web Browser |
|
|
150 | (2) |
|
|
152 | (1) |
Chapter 8 Reporting Vulnerabilities |
|
153 | (12) |
|
Why the Final Report Is So Important |
|
|
153 | (1) |
|
|
153 | (1) |
|
Report Everything or Just the Bad Stuff |
|
|
154 | (1) |
|
Deliver the Final Report Securely |
|
|
154 | (1) |
|
|
155 | (1) |
|
|
155 | (1) |
|
|
155 | (1) |
|
Putting It All Together with ALE |
|
|
155 | (1) |
|
Why the ALE Value Is Important |
|
|
156 | (1) |
|
The Importance of an Understandable Presentation |
|
|
156 | (2) |
|
|
156 | (2) |
|
|
158 | (1) |
|
|
159 | (1) |
|
|
159 | (1) |
|
|
159 | (1) |
|
|
159 | (1) |
|
Risk Choices Applied to the Heartbleed Bug |
|
|
159 | (1) |
|
Be Constructive When Presenting Your Findings |
|
|
159 | (1) |
|
(Almost) Always Suggest Patching |
|
|
160 | (1) |
|
Learn to Argue over the Seriousness of Your Findings |
|
|
160 | (1) |
|
Put Lengthy Raw Data in an Appendix |
|
|
161 | (1) |
|
Make a Slide Presentation |
|
|
162 | (1) |
|
On the Job: Password Cracking |
|
|
162 | (1) |
|
Practice Your Presentation |
|
|
162 | (1) |
|
Post-Security Test Cleanup |
|
|
163 | (1) |
|
|
163 | (2) |
Chapter 9 Example Reports |
|
165 | (16) |
|
Security Test Report ZUKUNFT GMBH |
|
|
165 | (9) |
|
|
165 | (1) |
|
|
165 | (1) |
|
|
166 | (1) |
|
|
166 | (1) |
|
|
166 | (1) |
|
|
167 | (2) |
|
|
169 | (2) |
|
|
171 | (3) |
|
|
174 | (1) |
|
|
175 | (1) |
|
|
175 | (5) |
|
|
176 | (1) |
|
|
176 | (1) |
|
|
176 | (1) |
|
SQL Injection Vulnerabilities |
|
|
176 | (1) |
|
Persistent Code Injection |
|
|
177 | (1) |
|
Insecure Direct Object References |
|
|
178 | (2) |
|
|
180 | (1) |
Chapter 10 Ten Tips to Become a Better Security Tester |
|
181 | (6) |
|
|
181 | (1) |
|
|
182 | (1) |
|
Read the Boy Who Cried Wolf |
|
|
183 | (1) |
|
Read Read Read Write Write Write |
|
|
183 | (1) |
|
Learn to Spot the Shape that Breaks the Pattern |
|
|
183 | (1) |
|
Put Your Money where Your Mouth is (Most of the Time) |
|
|
184 | (1) |
|
|
184 | (1) |
|
|
185 | (1) |
|
Know that Old Vulnerabilities Never Get Old |
|
|
185 | (1) |
|
|
185 | (1) |
|
|
186 | (1) |
Index |
|
187 | |