GRAY HAT HACKING: THE ETHICAL HACKER'S HANDBOOK
CONTENTS PART I INTRODUCTION TO ETHICAL DISCLOSURE CHAPTER 1 ETHICS OF ETHICAL HACKING HOW DOES THIS STUFF RELATE TO AN ETHICAL HACKING BOOK? THE CONTROVERSY OF HACKING BOOKS AND CLASSES THE DUAL NATURE OF TOOLS RECOGNIZING TROUBLE WHEN IT HAPPENS EMULATING THE ATTACK SECURITY DOES NOT LIKE COMPLEXITY CHAPTER 2 ETHICAL HACKING AND THE LEGAL SYSTEM ADDRESSING INDIVIDUAL LAWS 18 USC SECTION 1029: THE ACCESS DEVICE STATUTE 18 USC SECTION 1030 OF THE COMPUTER FRAUD AND ABUSE ACT STATE LAW ALTERNATIVES 18 USC SECTIONS 2510, ET SEQ AND 2701 DIGITAL MILLENNIUM COPYRIGHT ACT (DMCA) CYBER SECURITY ENHANCEMENT ACT OF 2002 CHAPTER 3 PROPER AND ETHICAL DISCLOSURE YOU WERE VULNERABLE FOR HOW LONG? DIFFERENT TEAMS AND POINTS OF VIEW HOW DID WE GET HERE? CERT’S CURRENT PROCESS FULL DISCLOSURE POLICY (RAINFOREST PUPPY POLICY) ORGANIZATION FOR INTERNET SAFETY (OIS) DISCOVERY NOTIFICATION VALIDATION RESOLUTION RELEASE CONFLICTS WILL STILL EXIST CASE STUDIES PROS AND CONS OF PROPER DISCLOSURE PROCESSES IDEFENSE ZERO DAY INITIATIVE VENDORS PAYING MORE ATTENTION SO WHAT SHOULD WE DO FROM HERE ON OUT? PART II PENETRATION TESTING AND TOOLS CHAPTER 4 USING METASPLOIT METASPLOIT: THE BIG PICTURE GETTING METASPLOIT USING THE METASPLOIT CONSOLE TO LAUNCH EXPLOITS EXPLOITING CLIENT-SIDE VULNERABILITIES WITH METASPLOIT USING THE METERPRETER USING METASPLOIT AS A MAN-IN-THE-MIDDLE PASSWORD STEALER WEAKNESS IN THE NTLM PROTOCOL CONFIGURING METASPLOIT AS A MALICIOUS SMB SERVER BRUTE-FORCE PASSWORD RETRIEVAL WITH THE LM HASHES + CHALLENGE BUILDING YOUR OWN RAINBOW TABLES DOWNLOADING RAINBOW TABLES PURCHASING RAINBOW TABLES CRACKING HASHES WITH RAINBOW TABLES USING METASPLOIT TO AUTO-ATTACK INSIDE METASPLOIT MODULES CHAPTER 5 USING THE BACKTRACK LIVECD LINUX DISTRIBUTION BACKTRACK: THE BIG PICTURE CREATING THE BACKTRACK CD BOOTING BACKTRACK EXPLORING THE BACKTRACK X-WINDOWS ENVIRONMENT WRITING BACKTRACK TO YOUR USB MEMORY STICK SAVING YOUR BACKTRACK CONFIGURATIONS CREATING A DIRECTORY-BASED OR FILE-BASED MODULE WITH DIR2LZM CREATING A MODULE FROM A SLAX PREBUILT MODULE WITH MO2LZM CREATING A MODULE FROM AN ENTIRE SESSION OF CHANGES USING DIR2LZM AUTOMATING THE CHANGE PRESERVATION FROM ONE SESSION TO THE NEXT CREATING A NEW BASE MODULE WITH ALL THE DESIRED DIRECTORY CONTENTS CHEAT CODES AND SELECTIVELY LOADING MODULES METASPLOIT DB_AUTOPWN TOOLS PART III EXPLOITS 101 CHAPTER 6 PROGRAMMING SURVIVAL SKILLS C PROGRAMMING LANGUAGE BASIC C LANGUAGE CONSTRUCTS SAMPLE PROGRAM COMPILING WITH GCC COMPUTER MEMORY RANDOM ACCESS MEMORY (RAM) ENDIAN SEGMENTATION OF MEMORY PROGRAMS IN MEMORY BUFFERS STRINGS IN MEMORY POINTERS PUTTING THE PIECES OF MEMORY TOGETHER INTEL PROCESSORS REGISTERS ASSEMBLY LANGUAGE BASICS MACHINE VS ASSEMBLY VS C AT&T VS NASM ADDRESSING MODES ASSEMBLY FILE STRUCTURE ASSEMBLING DEBUGGING WITH GDB GDB BASICS DISASSEMBLY WITH GDB PYTHON SURVIVAL SKILLS GETTING PYTHON HELLO WORLD IN PYTHON PYTHON OBJECTS STRINGS NUMBERS LISTS DICTIONARIES FILES WITH PYTHON SOCKETS WITH PYTHON CHAPTER 7 BASIC LINUX EXPLOITS STACK OPERATIONS FUNCTION CALLING PROCEDURE BUFFER OVERFLOWS OVERFLOW OF MEETC RAMIFICATIONS OF BUFFER OVERFLOWS LOCAL BUFFER OVERFLOW EXPLOITS COMPONENTS OF THE EXPLOIT EXPLOITING STACK OVERFLOWS BY COMMAND LINE EXPLOITING STACK OVERFLOWS WITH GENERIC EXPLOIT CODE EXPLOITING SMALL BUFFERS EXPLOIT DEVELOPMENT PROCESS REAL-WORLD EXAMPLE DETERMINE THE OFFSET(S) DETERMINE THE ATTACK VECTOR BUILD THE EXPLOIT SANDWICH TEST THE EXPLOIT CHAPTER 8 ADVANCED LINUX EXPLOITS FORMAT STRING EXPLOITS THE PROBLEM READING FROM ARBITRARY MEMORY WRITING TO ARBITRARY MEMORY TAKING DTORS TO ROOT HEAP OVERFLOW EXPLOITS EXAMPLE HEAP OVERFLOW IMPLICATIONS MEMORY PROTECTION SCHEMES COMPILER IMPROVEMENTS KERNEL PATCHES AND SCRIPTS RETURN TO LIBC EXPLOITS BOTTOM LINE CHAPTER 9 SHELLCODE STRATEGIES USER SPACE SHELLCODE SYSTEM CALLS BASIC SHELLCODE PORT BINDING SHELLCODE REVERSE SHELLCODE FIND SOCKET SHELLCODE COMMAND EXECUTION CODE FILE TRANSFER CODE MULTISTAGE SHELLCODE SYSTEM CALL PROXY SHELLCODE PROCESS INJECTION SHELLCODE OTHER SHELLCODE CONSIDERATIONS SHELLCODE ENCODING SELF-CORRUPTING SHELLCODE DISASSEMBLING SHELLCODE KERNEL SPACE SHELLCODE KERNEL SPACE CONSIDERATIONS CHAPTER 10 WRITING LINUX SHELLCODE BASIC LINUX SHELLCODE EXIT SYSTEM CALL SETREUID SYSTEM CALL SHELL-SPAWNING SHELLCODE WITH EXECVE IMPLEMENTING PORT-BINDING SHELLCODE LINUX SOCKET PROGRAMMING ASSEMBLY PROGRAM TO ESTABLISH A SOCKET TEST THE SHELLCODE IMPLEMENTING REVERSE CONNECTING SHELLCODE REVERSE CONNECTING C PROGRAM REVERSE CONNECTING ASSEMBLY PROGRAM ENCODING SHELLCODE SIMPLE XOR ENCODING STRUCTURE OF ENCODED SHELLCODE JMP/CALL XOR DECODER EXAMPLE FNSTENV XOR EXAMPLE PUTTING IT ALL TOGETHER AUTOMATING SHELLCODE GENERATION WITH METASPLOIT GENERATING SHELLCODE WITH METASPLOIT ENCODING SHELLCODE WITH METASPLOIT CHAPTER 11 BASIC WINDOWS EXPLOITS COMPILING AND DEBUGGING WINDOWS PROGRAMS COMPILING ON WINDOWS DEBUGGING ON WINDOWS WITH WINDOWS CONSOLE DEBUGGERS DEBUGGING ON WINDOWS WITH OLLYDBG WINDOWS EXPLOITS BUILDING A BASIC WINDOWS EXPLOIT REAL-WORLD WINDOWS EXPLOIT EXAMPLE PART IV VULNERABILITY ANALYSIS CHAPTER 12 PASSIVE ANALYSIS ETHICAL REVERSE ENGINEERING WHY REVERSE ENGINEERING? REVERSE ENGINEERING CONSIDERATIONS SOURCE CODE ANALYSIS SOURCE CODE AUDITING TOOLS THE UTILITY OF SOURCE CODE AUDITING TOOLS MANUAL SOURCE CODE AUDITING BINARY ANALYSIS MANUAL AUDITING OF BINARY CODE AUTOMATED BINARY ANALYSIS TOOLS CHAPTER 13 ADVANCED STATIC ANALYSIS WITH IDA PRO STATIC ANALYSIS CHALLENGES STRIPPED BINARIES STATICALLY LINKED PROGRAMS AND FLAIR DATA STRUCTURE ANALYSIS QUIRKS OF COMPILED C++ CODE EXTENDING IDA SCRIPTING WITH IDC IDA PRO PLUG-IN MODULES AND THE IDA SDK IDA PRO LOADERS AND PROCESSOR MODULES CHAPTER 14 ADVANCED REVERSE ENGINEERING WHY TRY TO BREAK SOFTWARE? THE SOFTWARE DEVELOPMENT PROCESS INSTRUMENTATION TOOLS DEBUGGERS CODE COVERAGE TOOLS PROFILING TOOLS FLOW ANALYSIS TOOLS MEMORY MONITORING TOOLS FUZZING INSTRUMENTED FUZZING TOOLS AND TECHNIQUES A SIMPLE URL FUZZER FUZZING UNKNOWN PROTOCOLS SPIKE SPIKE PROXY SHAREFUZZ CHAPTER 15 CLIENT-SIDE BROWSER EXPLOITS WHY CLIENT-SIDE VULNERABILITIES ARE INTERESTING CLIENT-SIDE VULNERABILITIES BYPASS FIREWALL PROTECTIONS CLIENT-SIDE APPLICATIONS ARE OFTEN RUNNING WITH ADMINISTRATIVE PRIVILEGES CLIENT-SIDE VULNERABILITIES CAN EASILY TARGET SPECIFIC PEOPLE OR ORGANIZATIONS INTERNET EXPLORER SECURITY CONCEPTS ACTIVEX CONTROLS INTERNET EXPLORER SECURITY ZONES HISTORY OF CLIENT-SIDE EXPLOITS AND LATEST TRENDS CLIENT-SIDE VULNERABILITIES RISE TO PROMINENCE NOTABLE VULNERABILITIES IN THE HISTORY OF CLIENT-SIDE ATTACKS FINDING NEW BROWSER-BASED VULNERABILITIES MANGLEME AXENUM AXFUZZ AXMAN HEAP SPRAY TO EXPLOIT INTERNETEXPLOITER PROTECTING YOURSELF FROM CLIENT-SIDE EXPLOITS KEEP UP-TO-DATE ON SECURITY PATCHES STAY INFORMED RUN INTERNET-FACING APPLICATIONS WITH REDUCED PRIVILEGES CHAPTER 16 EXPLOITING WINDOWS ACCESS CONTROL MODEL FOR LOCAL ELEVATION OF PRIVILEGE WHY ACCESS CONTROL IS INTERESTING TO A HACKER MOST PEOPLE DON’T UNDERSTAND ACCESS CONTROL VULNERABILITIES YOU FIND ARE EASY TO EXPLOIT YOU’LL FIND TONS OF SECURITY VULNERABILITIES HOW WINDOWS ACCESS CONTROL WORKS SECURITY IDENTIFIER (SID) ACCESS TOKEN SECURITY DESCRIPTOR (SD) THE ACCESS CHECK TOOLS FOR ANALYZING ACCESS CONTROL CONFIGURATIONS DUMPING THE PROCESS TOKEN DUMPING THE SECURITY DESCRIPTOR SPECIAL SIDS, SPECIAL ACCESS, AND “ACCESS DENIED” SPECIAL SIDS SPECIAL ACCESS INVESTIGATING “ACCESS DENIED” ANALYZING ACCESS CONTROL FOR ELEVATION OF PRIVILEGE ATTACK PATTERNS FOR EACH INTERESTING OBJECT TYPE ATTACKING SERVICES ATTACKING WEAK DACLS IN THE WINDOWS REGISTRY ATTACKING WEAK DIRECTORY DACLS ATTACKING WEAK FILE DACLS WHAT OTHER OBJECT TYPES ARE OUT THERE? ENUMERATING SHARED MEMORY SECTIONS ENUMERATING PROCESSES ENUMERATING OTHER NAMED KERNEL OBJECTS (SEMAPHORES, MUTEXES, EVENTS, DEVICES) CHAPTER 17 INTELLIGENT FUZZING WITH SULLEY PROTOCOL ANALYSIS SULLEY FUZZING FRAMEWORK INSTALLING SULLEY POWERFUL FUZZER BLOCKS SESSIONS MONITORING THE PROCESS FOR FAULTS MONITORING THE NETWORK TRAFFIC CONTROLLING VMWARE POSTMORTEM ANALYSIS OF CRASHES ANALYSIS OF NETWORK TRAFFIC WAY AHEAD CHAPTER 18 FROM VULNERABILITY TO EXPLOIT EXPLOITABILITY DEBUGGING FOR EXPLOITATION UNDERSTANDING THE PROBLEM PRECONDITIONS AND POSTCONDITIONS REPEATABILITY PAYLOAD CONSTRUCTION CONSIDERATIONS PAYLOAD PROTOCOL ELEMENTS BUFFER ORIENTATION PROBLEMS SELF-DESTRUCTIVE SHELLCODE DOCUMENTING THE PROBLEM BACKGROUND INFORMATION CIRCUMSTANCES RESEARCH RESULTS CHAPTER 19 CLOSING THE HOLES: MITIGATION MITIGATION ALTERNATIVES PORT KNOCKING MIGRATION PATCHING SOURCE CODE PATCHING CONSIDERATIONS BINARY PATCHING CONSIDERATIONS BINARY MUTATION THIRD-PARTY PATCHING INITIATIVES PART V MALWARE ANALYSIS CHAPTER 20 COLLECTING MALWARE AND INITIAL ANALYSIS MALWARE TYPES OF MALWARE MALWARE DEFENSIVE TECHNIQUES LATEST TRENDS IN HONEYNET TECHNOLOGY HONEYPOTS HONEYNETS WHY HONEYPOTS ARE USED LIMITATIONS LOW-INTERACTION HONEYPOTS HIGH-INTERACTION HONEYPOTS TYPES OF HONEYNETS THWARTING VMWARE DETECTION TECHNOLOGIES CATCHING MALWARE: SETTING THE TRAP VMWARE HOST SETUP VMWARE GUEST SETUP USING NEPENTHES TO CATCH A FLY INITIAL ANALYSIS OF MALWARE STATIC ANALYSIS LIVE ANALYSIS NORMAN SANDBOX TECHNOLOGY WHAT HAVE WE DISCOVERED? CHAPTER 21 HACKING MALWARE TRENDS IN MALWARE EMBEDDED COMPONENTS USE OF ENCRYPTION USER SPACE HIDING TECHNIQUES USE OF ROOTKIT TECHNOLOGY PERSISTENCE MEASURES PEELING BACK THE ONION—DE-OBFUSCATION PACKER BASICS UNPACKING BINARIES REVERSE ENGINEERING MALWARE MALWARE SETUP PHASE MALWARE OPERATION PHASE AUTOMATED MALWARE ANALYSIS