PRACTICAL HACKING TECHNIQUES AND COUNTERMEASURES
CONTENTS PREPARATION INSTALLING VMWARE WORKSTATION CON?GURING VIRTUAL MACHINES INSTALLING A VIRTUAL WINDOWS 2000 WORKSTATION INSTALLING VMWARE TOOLS FOR WINDOWS 2000 VIRTUAL MACHINES INSTALLING A RED HAT VERSION 8 VIRTUAL MACHINE INSTALLING VMWARE TOOLS FOR RED HAT VIRTUAL MACHINES WHAT IS ON THE CD? RESTRICT ANONYMOUS TO RESTRICT ANONYMOUS IN WINDOWS NT FOR WINDOWS XP, 2003 FOR WINDOWS 2000 WHAT IS THE DIFFERENCE? BANNER IDENTI?CATION LAB 1: BANNER IDENTI?CATION LAB 2: BANNER IDENTI?CATION LAB 3: BANNER IDENTI?CATION LAB 4: OPERATING SYSTEM IDENTI?CATION LAB 5: BANNER IDENTI?CATION LAB 6: BANNER IDENTI?CATION LAB 7: PERSONAL SOCIAL ENGINEERING SOCIAL ENGINEERING TECHNIQUES: DUMPSTER DIVING/PERSONNEL TARGET ENUMERATION LAB 8: ESTABLISH A NULL SESSION ESTABLISH A NULL SESSION: NULL SESSION LAB 9: ENUMERATE TARGET MAC ADDRESS ENUMERATE MAC ADDRESS AND TOTAL NICS: GETMAC LAB 10: ENUMERATE SID FROM USER ID ENUMERATE THE SID FROM THE USERNAME: USER2SID LAB 11: ENUMERATE USER ID FROM SID ENUMERATE THE USERNAME FROM THE KNOWN SID: SID2USER LAB 12: ENUMERATE USER INFORMATION ENUMERATE USER INFORMATION FROM TARGET: USERDUMP LAB 13: ENUMERATE USER INFORMATION EXPLOIT DATA FROM TARGET COMPUTER: USERINFO LAB 14: ENUMERATE USER INFORMATION EXPLOIT USER INFORMATION FROM TARGET: DUMPSEC LAB 15: HOST/DOMAIN ENUMERATION ENUMERATE HOSTS AND DOMAINS OF LAN: NET COMMANDS LAB 16: TARGET CONNECTIVITY/ROUTE DETECT TARGET CONNECTIVITY: PINGG LAB 17: TARGET CONNECTIVITY/ROUTE CONNECTIVITY/ROUTING TEST: PATHPING LAB 18: OPERATING SYSTEM IDENTI?CATION IDENTIFY TARGET OPERATING SYSTEM: NMAP/NMAPFE LAB 19: OPERATING SYSTEM IDENTI?CATION IDENTIFY TARGET OPERATING SYSTEM: NMAPNT LAB 20: IP/HOSTNAME ENUMERATION ENUMERATE IP OR HOSTNAME: NSLOOKUP LAB 21: IP/HOSTNAME ENUMERATION ENUMERATE IP OR HOSTNAME: NMBLOOKUP LAB 22: RPC REPORTING REPORT THE RPC OF TARGET: RPCINFO LAB 23: LOCATION/REGISTRANT IDENTI?CATION GATHER REGISTRATION INFO/TRACE VISUAL ROUTE: VISUAL ROUTE LAB 24: REGISTRANT IDENTI?CATION GATHER IP OR HOSTNAME: SAM SPADE LAB 25: OPERATING SYSTEM IDENTI?CATION GATHER OS RUNTIME AND REGISTERED IPS: NETCRAFT LAB 26: OPERATING SYSTEM IDENTI?CATION SCAN OPEN PORTS OF TARGET: SPRINT LAB 27: DEFAULT SHARES DISABLE DEFAULT SHARES: WINDOWS OPERATING SYSTEM LAB 28: HOST ENUMERATION SCAN OPEN PORTS OF TARGET: WINFINGERPRINT SCANNING LAB 29: TARGET SCAN/SHARE ENUMERATION SCAN OPEN PORTS OF TARGET: ANGRY IP LAB 30: TARGET SCAN/PENETRATION SCAN OPEN PORTS/PENETRATION TESTING: LANGUARD LAB 31: TARGET SCAN THROUGH FIREWALL SCAN OPEN PORTS OF TARGET: FSCAN LAB 32: PASSIVE NETWORK DISCOVERY PASSIVELY IDENTIFY TARGET INFORMATION ON THE LAN: PASSI?ST LAB 33: NETWORK DISCOVERY IDENTIFY TARGET INFORMATION: LANSPY LAB 34: OPEN PORTS/SERVICES SCAN OPEN PORTS/SERVICES OF TARGET: NETCAT LAB 35: PORT SCAN/SERVICE IDENTI?CATION SCAN OPEN PORTS OF TARGET: SUPERSCAN LAB 36: PORT SCANNER IDENTIFY PORTS OPEN: STROBE LAB 37: ANONYMOUS FTP LOCATOR LOCATE ANONYMOUS FTP SERVERS: FTPSCANNER LAB 38: CGI VULNERABILITY SCANNER IDENTIFY CGI VULNERABILITIES: TCS CGI SCANNER LAB 39: SHARED RESOURCES LOCATOR IDENTIFY OPEN SHARED RESOURCES: HYDRA LAB 40: LOCATE WINGATE PROXY SERVERS LOCATE WINGATE PROXY SERVERS: WGATESCAN/ADM GATES SNIF?NG TRAF?C LAB 41: PACKET CAPTURE — SNIFFER EXPLOIT DATA FROM NETWORK TRAF?C: ETHEREAL TO INSTALL ETHEREAL ON A RED HAT LINUX COMPUTER TO INSTALL ETHEREAL ON MICROSOFT WINDOWS LAB 42: PACKET CAPTURE — SNIFFER EXPLOIT DATA FROM NETWORK TRAF?C: NGREP FOR LINUX FOR WINDOWS LAB 43: PACKET CAPTURE — SNIFFER EXPLOIT DATA FROM NETWORK TRAF?C: TCPDUMP LAB 44: PACKET CAPTURE — SNIFFER EXPLOIT DATA FROM NETWORK TRAF?C: WINDUMP LAB 45: PACKET CAPTURE — SNIFFER FOR LINUX LAB 46: PASSWORD CAPTURE — SNIFFER EXPLOIT PASSWORDS AND SNIFF THE NETWORK: ZXSNIFFER LAB 47: EXPLOIT DATA FROM TARGET COMPUTER — SNIF?T SPOO?NG LAB 48: SPOO?NG IP ADDRESSES SEND PACKETS VIA FALSE IP ADDRESS: RAFALEX LAB 49: SPOO?NG MAC ADDRESSES SEND PACKETS VIA A FALSE MAC ADDRESS: SMAC LAB 50: SPOO?NG MAC ADDRESSES SEND PACKETS VIA A FALSE MAC ADDRESS: LINUX LAB 51: PACKET INJECTION/CAPTURE/TRACE SEND PACKETS VIA A FALSE IP/MAC ADDRESS: PACKIT LAB 52: SPOOF MAC ADDRESS ALTERING THE MAC ADDRESS: VMWARE WORKSTATION BRUTE FORCE LAB 53: BRUTE-FORCE FTP SERVER CRACK AN FTP PASSWORD: NETWOX/NETWAG LAB 54: RETRIEVE PASSWORD HASHES EXTRACT PASSWORD HASHES: FGDUMP LAB 55: CRACK PASSWORD HASHES LAB 56: OVERWRITE ADMINISTRATOR PASSWORD CHANGE THE ADMINISTRATOR PASSWORD: CHNTPW LAB 57: BRUTE-FORCE PASSWORDS BRUTE-FORCE PASSWORDS FOR A HASHED FILE: JOHN THE RIPPER LAB 58: BRUTE-FORCE FTP PASSWORD BRUTE-FORCE AN FTP PASSWORD CONNECTION: BRUTEFTP LAB 59: BRUTE-FORCE TERMINAL SERVER BRUTE-FORCE TERMINAL SERVER PASSWORDS: TSGRINDER II VULNERABILITY SCANNING LAB 60: VULNERABILITY SCANNER PERFORM VULNERABILITY ASSESSMENT: SAINT LAB 61: SNMP WALK EXPLOIT DATA VIA SNMP WALK: NETWOX/NETWAG LAB 62: BRUTE-FORCE COMMUNITY STRINGS EXPLOIT THE SNMP COMMUNITY STRINGS: SOLAR WINDS LAB 63: TARGET ASSESSMENT ASSESSMENT OF TARGET SECURITY: RETINA LAB 64: TARGET ASSESSMENT ASSESSMENT OF TARGET SECURITY: X-SCAN LAB 65: VULNERABILITY SCANNER PERFORM VULNERABILITY ASSESSMENT: SARA LAB 66: WEB SERVER TARGET ASSESSMENT ASSESSMENT OF WEB SERVER SECURITY: N-STEALTH LAB 67: VULNERABILITY SCANNER EXPLOIT DATA FROM TARGET COMPUTER: PLUTO LAB 68: VULNERABILITY ASSESSMENT PERFORM VULNERABILITY ASSESSMENT: METASPLOIT ON WINDOWS ON LINUX LAB 69: WEB SERVER TARGET ASSESSMENT ASSESSMENT OF WEB SERVER SECURITY: NIKTO LAB 70: VULNERABILITY SCANNER ASSESSMENT OF TARGET SECURITY: SHADOW SCANNER LAB 71: INTERNET VULNERABILITY SCANNER ASSESSMENT OF TARGET SECURITY: CERBERUS LAB 72: WHAX — AUTO EXPLOIT REVERSE SHELL AUTOMATICALLY EXPLOIT THE TARGET: AUTOSCAN LAB 73: UNIQUE FAKE LOCK SCREEN XP GRAB THE ADMINISTRATOR PASSWORD: FAKE LOCK SCREEN XP LAB 74: BYPASSING MICROSOFT SERIAL NUMBERS BYPASSING SERIAL NUMBER PROTECTION: ROCKXP/CUSTOM SCRIPT LAB 75: VULNERABILITY EXPLOIT ASSESSMENT OF TARGET SECURITY: WEB HACK CONTROL CENTER WIRELESS LAB 76: LOCATE UNSECURED WIRELESS LOCATE UNSECURED WIRELESS: NETSTUMBLER/MINI-STUMBLER LAB 77: TROJAN UNAUTHORIZED ACCESS AND CONTROL: BACK ORI?CE ON THE TARGET COMPUTER ON THE ATTACKER’S COMPUTER LAB 78: TROJAN UNAUTHORIZED ACCESS AND CONTROL: NETBUS ON THE TARGET (SERVER) LAB 79: ICMP TUNNEL BACKDOOR BIDIRECTIONAL SPOOFED ICMP TUNNEL: SNEAKY-SNEAKY ON THE TARGET (SERVER) ON THE ATTACKER’S MACHINE LAB 80: HIDING TOOLS ON THE TARGET HIDING FILES ON THE TARGET: CP SCENARIO: HIDING NETCAT INSIDE THE CALCULATOR APPLICATION TO VERIFY LAB 81: CAPTURING SWITCHED NETWORK TRAF?C INTERCEPT/EXPLOIT TRAF?C: ETTERCAP LAB 82: PASSWORD CAPTURE CAPTURE PASSWORDS TRAVERSING THE NETWORK: DSNIFF LAB 83: DATA MANIPULATION MANIPULATE THE LIVE DATA STREAM: ACHILLES LAB 84: COVERT REVERSE TELNET SESSION CREATE A REVERSE TELNET SESSION: NETCAT LAB 85: COVERT CHANNEL — REVERSE SHELL EXPLOIT DATA FROM TARGET COMPUTER: REVERSE SHELL 10 REDIRECTION LAB 86: PORTMAPPER TRAF?C REDIRECTION: PORTMAPPER LAB 87: EXECUTING APPLICATIONS — ELITEWRAP EXECUTING HIDDEN APPLICATIONS: ELITEWRAP LAB 88: TCP RELAY — BYPASS FIREWALLS TRAF?C REDIRECTION: FPIPE LAB 89: REMOTE EXECUTION REMOTE EXECUTION ON TARGET: PSEXEC LAB 90: TCP RELAY — BYPASS FIREWALLS TRAF?C REDIRECTION: NETWOX/NETWAG 11 DENIAL-OF-SERVICE (DOS) LAB 91: DENIAL-OF-SERVICE — LAND ATTACK DOS LAND ATTACK: LAND ATTACK LAB 92: DENIAL-OF-SERVICE — SMURF ATTACK DOS SMURF ATTACK: SMURF ATTACK LAB 93: DENIAL-OF-SERVICE — SYN ATTACK DOS LAND ATTACK: SYN ATTACK LAB 94: DENIAL-OF-SERVICE — UDP FLOOD DOS UDP FLOOD ATTACK: UDP FLOOD ATTACK LAB 95: DENIAL-OF-SERVICE — TRASH2 C CREATE DENIAL-OF-SERVICE TRAF?C: TRASH2 C CHAPTER