SECURITY POWER TOOLS
TABLE OF CONTENTS PART I LEGAL AND ETHICS 1 LEGAL AND ETHICS ISSUES CORE ISSUES COMPUTER TRESPASS LAWS: NO “HACKING” ALLOWED REVERSE ENGINEERING VULNERABILITY REPORTING WHAT TO DO FROM NOW ON PART II RECONNAISSANCE 2 NETWORK SCANNING HOW SCANNERS WORK SUPERUSER PRIVILEGES THREE NETWORK SCANNERS TO CONSIDER HOST DISCOVERY PORT SCANNING SPECIFYING CUSTOM PORTS SPECIFYING TARGETS TO SCAN DIFFERENT SCAN TYPES TUNING THE SCAN SPEED APPLICATION FINGERPRINTING OPERATING SYSTEM DETECTION SAVING NMAP OUTPUT RESUMING NMAP SCANS AVOIDING DETECTION CONCLUSION 3 VULNERABILITY SCANNING NESSUS NIKTO WEBINSPECT 4 LAN RECONNAISSANCE MAPPING THE LAN USING ETTERCAP AND ARPSPOOF ON A SWITCHED NETWORK DEALING WITH STATIC ARP TABLES GETTING INFORMATION FROM THE LAN MANIPULATING PACKET DATA 5 WIRELESS RECONNAISSANCE GET THE RIGHT WARDRIVING GEAR 80211 NETWORK BASICS 80211 FRAMES HOW WIRELESS DISCOVERY TOOLS WORK NETSTUMBLER KISMET AT A GLANCE USING KISMET SORTING THE KISMET NETWORK LIST USING NETWORK GROUPS WITH KISMET USING KISMET TO FIND NETWORKS BY PROBE REQUESTS KISMET GPS SUPPORT USING GPSD LOOKING CLOSER AT TRAFFIC WITH KISMET CAPTURING PACKETS AND DECRYPTING TRAFFIC WITH KISMET WIRESHARK AT A GLANCE USING WIRESHARK AIRDEFENSE MOBILE AIRMAGNET ANALYZERS OTHER WARDRIVING TOOLS 6 CUSTOM PACKET GENERATION WHY CREATE CUSTOM PACKETS? HPING SCAPY PACKET-CRAFTING EXAMPLES WITH SCAPY PACKET MANGLING WITH NETFILTER REFERENCES PART III PENETRATION 7 METASPLOIT METASPLOIT INTERFACES UPDATING METASPLOIT CHOOSING AN EXPLOIT CHOOSING A PAYLOAD SETTING OPTIONS RUNNING AN EXPLOIT MANAGING SESSIONS AND JOBS THE METERPRETER SECURITY DEVICE EVASION SAMPLE EVASION OUTPUT EVASION USING NOPS AND ENCODERS IN CONCLUSION 8 WIRELESS PENETRATION WEP AND WPA ENCRYPTION AIRCRACK INSTALLING AIRCRACK-NG RUNNING AIRCRACK-NG AIRPWN BASIC AIRPWN USAGE AIRPWN CONFIGURATION FILES USING AIRPWN ON WEP-ENCRYPTED NETWORKS SCRIPTING WITH AIRPWN KARMA 9 EXPLOITATION FRAMEWORK APPLICATIONS TASK OVERVIEW CORE IMPACT OVERVIEW NETWORK RECONNAISSANCE WITH CORE IMPACT CORE IMPACT EXPLOIT SEARCH ENGINE RUNNING MACROS BOUNCING OFF AN INSTALLED AGENT ENABLING AN AGENT TO SURVIVE A REBOOT MASS SCALE EXPLOITATION WRITING MODULES FOR CORE IMPACT THE CANVAS EXPLOIT FRAMEWORK PORTING EXPLOITS WITHIN CANVAS USING CANVAS FROM THE COMMAND LINE DIGGING DEEPER WITH CANVAS ADVANCED EXPLOITATION WITH MOSDEF WRITING EXPLOITS FOR CANVAS EXPLOITING ALTERNATIVE TOOLS 10 CUSTOM EXPLOITATION UNDERSTANDING VULNERABILITIES ANALYZING SHELLCODE TESTING SHELLCODE CREATING SHELLCODE DISGUISING SHELLCODE EXECUTION FLOW HIJACKING PART IV CONTROL 11 BACKDOORS CHOOSING A BACKDOOR VNC CREATING AND PACKAGING A VNC BACKDOOR CONNECTING TO AND REMOVING THE VNC BACKDOOR BACK ORIFICE CONFIGURING A BO2K SERVER CONFIGURING A BO2K CLIENT ADDING NEW SERVERS TO THE BO2K WORKSPACE USING THE BO2K BACKDOOR 1110 BO2K POWERTOOLS 1111 ENCRYPTION FOR BO2K COMMUNICATIONS 1112 CONCEALING THE BO2K PROTOCOL 1113 REMOVING BO2K 1114 A FEW UNIX BACKDOORS 12 ROOTKITS WINDOWS ROOTKIT: HACKER DEFENDER LINUX ROOTKIT: ADORE-NG DETECTING ROOTKITS TECHNIQUES WINDOWS ROOTKIT DETECTORS LINUX ROOTKIT DETECTORS CLEANING AN INFECTED SYSTEM THE FUTURE OF ROOTKITS PART V DEFENSE 13 PROACTIVE DEFENSE: FIREWALLS FIREWALL BASICS NETWORK ADDRESS TRANSLATION SECURING BSD SYSTEMS WITH IPFW/NATD SECURING GNU/LINUX SYSTEMS WITH NETFILTER/IPTABLES SECURING WINDOWS SYSTEMS WITH WINDOWS FIREWALL/INTERNET CONNECTION SHARING VERIFYING YOUR COVERAGE 14 HOST HARDENING CONTROLLING SERVICES TURNING OFF WHAT YOU DO NOT NEED LIMITING ACCESS LIMITING DAMAGE BASTILLE LINUX SELINUX PASSWORD CRACKING CHROOTING SANDBOXING WITH OS VIRTUALIZATION 15 SECURING COMMUNICATIONS THE SSH-2 PROTOCOL SSH CONFIGURATION SSH AUTHENTICATION SSH SHORTCOMINGS SSH TROUBLESHOOTING REMOTE FILE ACCESS WITH SSH SSH ADVANCED USE USING SSH UNDER WINDOWS FILE AND EMAIL SIGNING AND ENCRYPTION 1510 GPG 1511 CREATE YOUR GPG KEYS 1512 ENCRYPTION AND SIGNATURE WITH GPG 1513 PGP VERSUS GPG COMPATIBILITY 1514 ENCRYPTION AND SIGNATURE WITH S/MIME 1515 STUNNEL 1516 DISK ENCRYPTION 1517 WINDOWS FILESYSTEM ENCRYPTION WITH PGP DISK 1518 LINUX FILESYSTEM ENCRYPTION WITH LUKS 1519 CONCLUSION 16 EMAIL SECURITY AND ANTI-SPAM NORTON ANTIVIRUS THE CLAMAV PROJECT CLAMWIN FRESHCLAM CLAMSCAN CLAMD AND CLAMDSCAN CLAMAV VIRUS SIGNATURES PROCMAIL BASIC PROCMAIL RULES 1610 ADVANCED PROCMAIL RULES 1611 CLAMAV WITH PROCMAIL 1612 UNSOLICITED EMAIL 1613 SPAM FILTERING WITH BAYESIAN FILTERS 1614 SPAMASSASSIN 1615 SPAMASSASSIN RULES 1616 PLUG-INS FOR SPAMASSASSIN 1617 SPAMASSASSIN WITH PROCMAIL 1618 ANTI-PHISHING TOOLS 1619 CONCLUSION 17 DEVICE SECURITY TESTING REPLAY TRAFFIC WITH TCPREPLAY TRAFFIC IQ PRO ISIC SUITE PROTOS PART VI MONITORING 18 NETWORK CAPTURE TCPDUMP ETHEREAL/WIRESHARK PCAP UTILITIES: TCPFLOW AND NETDUDE PYTHON/SCAPY SCRIPT FIXES CHECKSUMS 19 NETWORK MONITORING SNORT IMPLEMENTING SNORT HONEYPOT MONITORING GLUING THE STUFF TOGETHER 20 HOST MONITORING USING FILE INTEGRITY CHECKERS FILE INTEGRITY HASHING THE DO-IT-YOURSELF WAY WITH RPMVERIFY COMPARING FILE INTEGRITY CHECKERS PREPPING THE ENVIRONMENT FOR SAMHAIN AND TRIPWIRE DATABASE INITIALIZATION WITH SAMHAIN AND TRIPWIRE SECURING THE BASELINE STORAGE WITH SAMHAIN AND TRIPWIRE RUNNING FILESYSTEM CHECKS WITH SAMHAIN AND TRIPWIRE MANAGING FILE CHANGES AND UPDATING STORAGE DATABASE WITH SAMHAIN AND TRIPWIRE 2010 RECOGNIZING MALICIOUS ACTIVITY WITH SAMHAIN AND TRIPWIRE 2011 LOG MONITORING WITH LOGWATCH 2012 IMPROVING LOGWATCH’S FILTERS 2013 HOST MONITORING IN LARGE ENVIRONMENTS WITH PRELUDE-IDS 2014 CONCLUSION PART VII DISCOVERY 21 FORENSICS NETSTAT THE FORENSIC TOOLKIT SYSINTERNALS 22 APPLICATION FUZZING WHICH FUZZER TO USE DIFFERENT TYPES OF FUZZERS FOR DIFFERENT TASKS WRITING A FUZZER WITH SPIKE THE SPIKE API FILE-FUZZING APPS FUZZING WEB APPLICATIONS CONFIGURING WEBPROXY AUTOMATIC FUZZING WITH WEBINSPECT NEXT-GENERATION FUZZING 2210 FUZZING OR NOT FUZZING 23 BINARY REVERSE ENGINEERING INTERACTIVE DISASSEMBLER OLLYDBG OTHER TOOLS