Foreword |
|
xviii | |
Introduction |
|
xx | |
|
Chapter 1 Hacking A Business Case |
|
|
1 | (12) |
|
|
2 | (2) |
|
|
4 | (1) |
|
What's Stolen and Why It's Valuable |
|
|
4 | (1) |
|
The Internet of Vulnerable Things |
|
|
4 | (1) |
|
Blue, Red, and Purple Teams |
|
|
5 | (4) |
|
|
5 | (1) |
|
|
5 | (2) |
|
|
7 | (2) |
|
Hacking is Part of Your Company's Immune System |
|
|
9 | (2) |
|
|
11 | (1) |
|
|
12 | (1) |
|
Chapter 2 Hacking Ethically And Legally |
|
|
13 | (10) |
|
Laws That Affect Your Work |
|
|
14 | (1) |
|
|
15 | (1) |
|
|
15 | (1) |
|
|
16 | (1) |
|
Penetration Testing Methodologies |
|
|
17 | (1) |
|
|
18 | (1) |
|
|
19 | (1) |
|
|
20 | (1) |
|
|
21 | (1) |
|
Hacker House Code of Conduct |
|
|
22 | (1) |
|
|
22 | (1) |
|
Chapter 3 Building Your Hack Box |
|
|
23 | (32) |
|
|
24 | (2) |
|
|
26 | (1) |
|
|
27 | (2) |
|
|
27 | (1) |
|
|
28 | (1) |
|
|
28 | (1) |
|
|
28 | (1) |
|
|
29 | (1) |
|
|
29 | (2) |
|
|
31 | (2) |
|
|
33 | (3) |
|
|
34 | (1) |
|
|
35 | (1) |
|
|
36 | (1) |
|
|
36 | (15) |
|
|
37 | (1) |
|
Downloading and Installing VirtualBox |
|
|
37 | (1) |
|
|
37 | (3) |
|
|
40 | (2) |
|
Creating a Virtual Hard Disk |
|
|
42 | (1) |
|
|
43 | (1) |
|
|
44 | (4) |
|
|
48 | (3) |
|
|
51 | (1) |
|
Testing Your Virtual Environment |
|
|
52 | (1) |
|
Creating Vulnerable Servers |
|
|
53 | (1) |
|
|
54 | (1) |
|
Chapter 4 Open Source Intelligence Gathering |
|
|
55 | (32) |
|
Does Your Client Need an OSINT Review? |
|
|
56 | (1) |
|
What Are You Looking For? |
|
|
57 | (1) |
|
|
58 | (1) |
|
|
59 | (1) |
|
Grabbing Email Addresses from Google |
|
|
59 | (3) |
|
Google Dorking the Shadows |
|
|
62 | (1) |
|
A Brief Introduction to Passwd and Shadow Files |
|
|
62 | (3) |
|
The Google Hacking Database |
|
|
65 | (1) |
|
Have You Been "Pwned" Yet? |
|
|
66 | (1) |
|
|
67 | (7) |
|
|
74 | (1) |
|
|
75 | (1) |
|
|
76 | (4) |
|
|
80 | (1) |
|
|
81 | (2) |
|
|
83 | (2) |
|
|
85 | (1) |
|
|
86 | (1) |
|
Chapter 5 The Domain Name System |
|
|
87 | (48) |
|
The Implications of Hacking DNS |
|
|
87 | (1) |
|
|
88 | (1) |
|
|
88 | (1) |
|
|
89 | (3) |
|
|
92 | (1) |
|
|
92 | (3) |
|
|
95 | (3) |
|
|
98 | (1) |
|
|
98 | (4) |
|
|
98 | (2) |
|
Brute-Forcing Hosts with Recon-ng |
|
|
100 | (1) |
|
|
101 | (1) |
|
|
102 | (1) |
|
Hacking a Virtual Name Server |
|
|
103 | (1) |
|
|
104 | (2) |
|
|
106 | (2) |
|
Specifying Resource Records |
|
|
108 | (3) |
|
|
111 | (2) |
|
|
113 | (1) |
|
Information-Gathering Tools |
|
|
114 | (4) |
|
|
115 | (1) |
|
|
116 | (1) |
|
|
116 | (2) |
|
Searching for Vulnerabilities and Exploits |
|
|
118 | (2) |
|
|
118 | (1) |
|
|
119 | (1) |
|
DNS Traffic Amplification |
|
|
120 | (1) |
|
|
121 | (4) |
|
Carrying Out a Denial-of-Service Attack |
|
|
125 | (1) |
|
DoS Attacks with Metasploit |
|
|
126 | (2) |
|
|
128 | (1) |
|
|
129 | (2) |
|
|
131 | (1) |
|
|
131 | (1) |
|
|
132 | (2) |
|
|
134 | (1) |
|
Chapter 6 Electronic Mail |
|
|
135 | (56) |
|
|
135 | (2) |
|
|
137 | (1) |
|
Delivery Status Notifications |
|
|
138 | (3) |
|
The Simple Mail Transfer Protocol |
|
|
141 | (2) |
|
|
143 | (2) |
|
|
145 | (13) |
|
Complete Nmap Scan Results (TCP) |
|
|
149 | (3) |
|
|
152 | (1) |
|
|
153 | (2) |
|
|
155 | (2) |
|
The Internet Message Access Protocol |
|
|
157 | (1) |
|
|
158 | (4) |
|
|
159 | (1) |
|
|
159 | (1) |
|
|
160 | (1) |
|
|
160 | (1) |
|
|
161 | (1) |
|
User Enumeration via Finger |
|
|
162 | (5) |
|
Brute-Forcing the Post Office |
|
|
167 | (2) |
|
The Nmap Scripting Engine |
|
|
169 | (3) |
|
CVE-2014-0160: The Heartbleed Bug |
|
|
172 | (8) |
|
|
180 | (5) |
|
|
183 | (1) |
|
|
184 | (1) |
|
|
185 | (3) |
|
|
188 | (3) |
|
Chapter 7 The World Wide Web Of Vulnerabilities |
|
|
191 | (60) |
|
|
192 | (1) |
|
The Hypertext Transfer Protocol |
|
|
193 | (7) |
|
|
195 | (1) |
|
|
196 | (2) |
|
|
198 | (1) |
|
|
198 | (2) |
|
Uniform Resource Identifiers |
|
|
200 | (1) |
|
LAMP: Linux, Apache, MySQL, and PHP |
|
|
201 | (5) |
|
|
202 | (1) |
|
|
203 | (1) |
|
Server-Side Scripting: PHP |
|
|
203 | (2) |
|
|
205 | (1) |
|
|
205 | (1) |
|
Creepy Crawlers and Spiders |
|
|
206 | (1) |
|
The Web Server Hacker's Toolkit |
|
|
206 | (1) |
|
Port Scanning a Web Server |
|
|
207 | (3) |
|
|
210 | (2) |
|
Web Vulnerability Scanning |
|
|
212 | (4) |
|
Guessing Hidden Web Content |
|
|
216 | (4) |
|
|
217 | (1) |
|
|
218 | (1) |
|
Directory Traversal Vulnerabilities |
|
|
219 | (1) |
|
|
220 | (3) |
|
|
220 | (2) |
|
|
222 | (1) |
|
|
223 | (2) |
|
|
225 | (1) |
|
|
226 | (6) |
|
Exploiting Shellshock Using Metasploit |
|
|
227 | (1) |
|
Exploiting Shellshock with cURL and Netcat |
|
|
228 | (4) |
|
|
232 | (6) |
|
Web Administration Interfaces |
|
|
238 | (4) |
|
|
238 | (2) |
|
|
240 | (1) |
|
|
241 | (1) |
|
|
242 | (1) |
|
|
243 | (2) |
|
|
245 | (1) |
|
Privilege Escalation Using DirtyCOW |
|
|
246 | (3) |
|
|
249 | (2) |
|
Chapter 8 Virtual Private Networks |
|
|
251 | (32) |
|
|
251 | (2) |
|
Internet Protocol Security |
|
|
253 | (1) |
|
|
253 | (1) |
|
Transport Layer Security and VPNs |
|
|
254 | (1) |
|
User Databases and Authentication |
|
|
255 | (2) |
|
|
255 | (1) |
|
|
255 | (1) |
|
|
256 | (1) |
|
|
256 | (1) |
|
|
256 | (1) |
|
|
257 | (1) |
|
|
257 | (1) |
|
|
257 | (1) |
|
Port Scanning a VPN Server |
|
|
258 | (4) |
|
|
259 | (2) |
|
|
261 | (1) |
|
|
262 | (5) |
|
Identifying Security Association Options |
|
|
263 | (2) |
|
|
265 | (2) |
|
|
267 | (8) |
|
|
275 | (2) |
|
|
277 | (1) |
|
|
278 | (3) |
|
|
281 | (2) |
|
Chapter 9 Files And File Sharing |
|
|
283 | (32) |
|
What Is Network-Attached Storage? |
|
|
284 | (1) |
|
|
284 | (3) |
|
|
287 | (1) |
|
Port Scanning a File Server |
|
|
288 | (1) |
|
The File Transfer Protocol |
|
|
289 | (2) |
|
The Trivial File Transfer Protocol |
|
|
291 | (1) |
|
|
292 | (2) |
|
|
294 | (1) |
|
|
295 | (11) |
|
|
296 | (2) |
|
|
298 | (1) |
|
|
299 | (4) |
|
|
303 | (3) |
|
|
306 | (2) |
|
|
308 | (1) |
|
|
309 | (2) |
|
Searching for Useful Files |
|
|
311 | (1) |
|
|
312 | (3) |
|
|
315 | (40) |
|
UNIX System Administration |
|
|
316 | (1) |
|
|
316 | (2) |
|
|
318 | (1) |
|
|
319 | (1) |
|
|
320 | (4) |
|
|
324 | (2) |
|
|
326 | (12) |
|
|
329 | (1) |
|
|
329 | (1) |
|
|
330 | (1) |
|
Hacker's Holy Grail EBBSHAVE |
|
|
331 | (1) |
|
|
332 | (3) |
|
|
335 | (1) |
|
|
335 | (3) |
|
|
338 | (1) |
|
The Simple Network Management Protocol |
|
|
339 | (2) |
|
|
341 | (1) |
|
The Common UNIX Printing System |
|
|
341 | (2) |
|
|
343 | (4) |
|
|
347 | (4) |
|
The Common Desktop Environment |
|
|
351 | (1) |
|
|
351 | (2) |
|
|
353 | (2) |
|
|
355 | (40) |
|
|
356 | (2) |
|
|
356 | (1) |
|
|
356 | (2) |
|
|
358 | (1) |
|
Structured Query Language |
|
|
358 | (1) |
|
|
359 | (1) |
|
The Database Hacker's Toolbox |
|
|
360 | (1) |
|
Common Database Exploitation |
|
|
360 | (1) |
|
Port Scanning a Database Server |
|
|
361 | (1) |
|
|
362 | (12) |
|
Exploring a MySQL Database |
|
|
362 | (11) |
|
|
373 | (1) |
|
|
374 | (3) |
|
Escaping Database Software |
|
|
377 | (1) |
|
|
378 | (3) |
|
|
381 | (1) |
|
|
381 | (3) |
|
Privilege Escalation via Databases |
|
|
384 | (8) |
|
|
392 | (3) |
|
Chapter 12 Web Applications |
|
|
395 | (62) |
|
|
396 | (1) |
|
The Web Application Hacker's Toolkit |
|
|
397 | (1) |
|
Port Scanning a Web Application Server |
|
|
397 | (1) |
|
Using an Intercepting Proxy |
|
|
398 | (14) |
|
Setting Up Burp Suite Community Edition |
|
|
399 | (8) |
|
Using Burp Suite Over HTTPS |
|
|
407 | (5) |
|
Manual Browsing and Mapping |
|
|
412 | (3) |
|
|
415 | (3) |
|
|
418 | (1) |
|
Web Vulnerability Scanners |
|
|
418 | (3) |
|
|
419 | (1) |
|
|
420 | (1) |
|
|
421 | (1) |
|
|
421 | (1) |
|
|
421 | (13) |
|
|
422 | (5) |
|
|
427 | (6) |
|
|
433 | (1) |
|
Protecting Against SQL Injection |
|
|
433 | (1) |
|
|
434 | (1) |
|
|
434 | (2) |
|
|
436 | (1) |
|
|
437 | (2) |
|
|
437 | (2) |
|
|
439 | (1) |
|
|
440 | (1) |
|
Security Misconfiguration |
|
|
441 | (1) |
|
Error Pages and Stack Traces |
|
|
442 | (1) |
|
|
442 | (10) |
|
The Browser Exploitation Framework |
|
|
445 | (5) |
|
|
450 | (1) |
|
|
450 | (2) |
|
|
452 | (1) |
|
|
453 | (1) |
|
Insufficient Logging and Monitoring |
|
|
453 | (1) |
|
|
454 | (1) |
|
|
455 | (2) |
|
Chapter 13 Microsoft Windows |
|
|
457 | (60) |
|
Hacking Windows vs. Linux |
|
|
458 | (6) |
|
Domains, Trees, and Forests |
|
|
458 | (3) |
|
Users, Groups, and Permissions |
|
|
461 | (1) |
|
|
461 | (1) |
|
|
462 | (1) |
|
Bypassing User Account Control |
|
|
463 | (1) |
|
|
464 | (2) |
|
A Windows Hacking Toolkit |
|
|
466 | (1) |
|
|
467 | (1) |
|
Port Scanning Windows Server |
|
|
467 | (2) |
|
|
469 | (1) |
|
Internet Information Services |
|
|
470 | (1) |
|
|
471 | (1) |
|
|
472 | (1) |
|
|
473 | (1) |
|
|
474 | (1) |
|
|
474 | (2) |
|
|
476 | (3) |
|
|
479 | (10) |
|
|
489 | (8) |
|
|
497 | (1) |
|
|
497 | (1) |
|
|
498 | (3) |
|
|
501 | (3) |
|
Privilege Escalation with PowerShell |
|
|
502 | (1) |
|
|
503 | (1) |
|
|
504 | (1) |
|
|
505 | (1) |
|
|
506 | (1) |
|
|
507 | (1) |
|
|
508 | (1) |
|
Alternative Payload Delivery Methods |
|
|
509 | (3) |
|
Bypassing Windows Defender |
|
|
512 | (2) |
|
|
514 | (3) |
|
|
517 | (26) |
|
|
517 | (2) |
|
The Password Cracker's Toolbox |
|
|
519 | (1) |
|
|
519 | (4) |
|
Hash Tables and Rainbow Tables |
|
|
523 | (2) |
|
|
525 | (1) |
|
|
526 | (4) |
|
|
530 | (3) |
|
|
530 | (1) |
|
|
531 | (1) |
|
|
531 | (1) |
|
|
531 | (1) |
|
|
531 | (1) |
|
|
531 | (1) |
|
|
532 | (1) |
|
|
532 | (1) |
|
|
533 | (1) |
|
|
533 | (2) |
|
|
535 | (2) |
|
|
537 | (1) |
|
|
538 | (1) |
|
|
539 | (1) |
|
|
540 | (3) |
|
Chapter 15 Writing Reports |
|
|
543 | (18) |
|
What Is a Penetration Test Report? |
|
|
544 | (1) |
|
Common Vulnerabilities Scoring System |
|
|
545 | (4) |
|
|
545 | (1) |
|
|
546 | (1) |
|
|
546 | (1) |
|
|
547 | (1) |
|
|
547 | (1) |
|
Confidentiality, Integrity, and Availability Impact |
|
|
547 | (2) |
|
Report Writing as a Skill |
|
|
549 | (1) |
|
What Should a Report Include? |
|
|
549 | (1) |
|
|
550 | (1) |
|
|
551 | (1) |
|
|
551 | (1) |
|
|
552 | (1) |
|
|
553 | (1) |
|
|
553 | (4) |
|
|
557 | (1) |
|
|
558 | (1) |
|
|
559 | (2) |
Index |
|
561 | |