ETHICAL HACKING
MODULE 1: WELCOME TO THE CLASS! GETTING ACQUAINTED WITH THE INSTRUCTOR WITH OTHERS IN THE CLASS GETTING THE MOST OUT OF THIS COURSE THE INSTRUCTOR’S ROLE YOUR ROLE ABOUT THIS COURSE COURSE OBJECTIVES USING THIS TRAINING GUIDE COURSE OUTLINE ABOUT INTERNET SECURITY SYSTEMS HOW ISS STARTED COMPANY GROWTH ISS PRODUCTS SECURITY MANAGEMENT SOLUTIONS THE ISS X-FORCE CONSULTING AND EDUCATIONAL SERVICES SECURITY ASSESSMENT SERVICES (SAS) ANSA - THE ADAPTIVE NETWORK SECURITY ALLIANCE CONTACT INFORMATION MODULE 2: LEGAL AND HR ISSUES ABOUT THIS MODULE PURPOSE OF THIS MODULE MODULE OBJECTIVES LEGAL AND HR ISSUES INTRODUCTION LEGAL ISSUES INTERNATIONAL CYBER CRIME COMPUTER FRAUD COMPUTER FORGERY DAMAGE TO COMPUTER DATA OR COMPUTER PROGRAMMES COMPUTER SABOTAGE UNAUTHORIZED ACCESS UNAUTHORIZED INTERCEPTION DATA PROTECTION HOW MUCH HACKING IS THERE? WHY SHOULD WE CARE? UK COMPUTER MISUSE ACT, 1990 1990 CHAPTER 18 OBJECTIVES REVIEW MODULE 3: WHY PERFORM ETHICAL HACKING? ABOUT THIS MODULE ETHICS THE HACKER ETHIC THE SECURITY ARGUMENTS THE IDLE SYSTEM ARGUMENT THE STUDENT HACKER ARGUMENT THE SOCIAL PROTECTOR ARGUMENT CONCLUSION OF ETHICS HACKING HACKER’S VIEW OF SECURITY ENHANCING IT STAFF SECURITY AWARENESS BETTER RESPONSE TO INTRUSIONS CONCLUSION OF HACKING TYPICAL SCENARIO TYPICALLY OVERLOOKED ISSUES MODULE 4: ATTACK TYPES AND VULNERABILITIES ABOUT THIS MODULE ATTACK TYPES AND VULNERABILITIES BUFFER OVERFLOW ATTACKS DENIAL OF SERVICE (DOS) ATTACKS DISTRIBUTED DENIAL OF SERVICE (DDOS) ATTACKS MISCONFIGURATIONS ABUSE OF TRUST BRUTE FORCE ATTACKS CGI AND WWW SERVICES BACKDOORS AND TROJANS CASE STUDY: THE DANGERS OF MOBILE CODE GENERAL JAVA JAVA SECURITY ACTIVEX ACTIVEX SECURITY SOLUTIONS CONCLUSION MODULE 5: SEARCHING FOR PUBLIC CORPORATE INFORMATION ABOUT THIS MODULE PASSIVE INFORMATION GATHERING WHAT IS PASSIVE INFORMATION GATHERING? ICANN SOURCES OF INFORMATION REGIONAL INTERNET REGISTRIES (RIR’S) WHOIS SEARCH EDGAR DATABASE STOCK EXCHANGE WEBSITES COMPANY HOMEPAGE NEWS SITES, NEWSGROUPS AND SEARCH ENGINES MODULE 6: SEARCHING FOR TECHNICAL INFORMATION ABOUT THIS MODULE GATHERING TECHNICAL INFORMATION ZONE TRANSFER DIFFERENCE BETWEEN A ZONE AND A DOMAIN ZONE ALLOCATION ALLOCATION BY CLASS ALLOCATION BY “CUTS” ZONE TRANSFERS SIGNIFICANT RESOURCE RECORDS (RR’S) START OF AUTHORITY RECORD (SOA) NAME SERVER RECORD (NS) ADDRESS RECORD (A) MAIL EXCHANGE RECORD (MX) FURTHER INFORMATION TOOLS USED TO QUERY NAME SERVERS NSLOOKUP DIG HOST SAM SPADE ZONE TRANSFER QUERY REFUSAL MODULE 7: NETWORK SCANNING ABOUT THIS MODULE NETWORK SCANNING STEALTH UNOBTRUSIVE NETWORK MAPPING FIREWALL AND GATEWAY DESIGN TRAITS NETWORK ADDRESS TRANSLATION (NAT) IP VISIBILITY RISK LEVEL PING SWEEPS PING, GPING AND FPING FPING TRACEROUTE TRACEROUTE VARIATIONS ROUTERS NETWORK MAPPING SMTP HEADERS ADVANCED TECHNIQUES PINGING FIREWALLED HOSTS ADVANCED TRACEROUTE TRACEROUTE THROUGH DNS LOCAL SCANNING AND SNIFFING NETWORK SNIFFERS COMMUNICATION ENCRYPTION L0PHT CRACK SNIFFING ON A SWITCHED NETWORK ADDRESS LEARNING REDIRECTING TRAFFIC UNC SHARE RISK MASTERCLASS: NETWORK DESIGN ISSUES NETWORK DESIGN CURRENT SECURITY AWARENESS BASTION HOSTS MULTI-HOMING THE APPLICATION PROXY FIREWALL LAYERING FIREWALLS MULTIPLE FIREWALL INTERFACES AVAILABILITY AND RELIABILITY IMPLEMENTATIONS OF AVAILABILITY AND RELIABILITY ELIMINATING SINGLE POINTS OF FAILURE (SPF’S) CORPORATE NETWORK EXAMPLE CONCLUSIONS MODULE 8: INTERPRETING NETWORK RESULTS ABOUT THIS MODULE INTERPRETING NETWORK RESULTS LIVE HOSTS MODULE 9: HOST SCANNING ABOUT THIS MODULE HOST SCANNING SOCIAL ENGINEERING ENUMERATION HOST AND OS IDENTIFICATION PORT SCANNING HPING FIREWALL RESPONSES VULNERABILITY SCANNING ISS INTERNET SCANNER RETINA NESSUS SECURITY SCANNER VETESCAN CERBERUS (CIS) REFERENCES MASTERCLASS: PORT SCANNING AND OS IDENTIFICATION PORT SCANNING PROTOCOLS TRANSMISSION CONTROL PROTOCOL (TCP) 3-WAY HANDSHAKE TCP SCANNING USER DATAGRAM PROTOCOL UDP SCANNING OPERATING SYSTEM IDIOSYNCRASIES STEALTHY SERVICES REMOTE OS IDENTIFICATION ACTIVE OPERATING SYSTEM IDENTIFICATION IP STACK BEHAVIOR NON-STANDARD TCP/IP 3-WAY HANDSHAKES PACKETS WITH NON-STANDARD IP OR TCP FLAGS VARIOUS ICMP PACKETS PASSIVE OPERATING SYSTEM IDENTIFICATION MODULE 10: INTERPRETING HOST RESULTS ABOUT THIS MODULE INTERPRETING HOST RESULTS WINDOWS NT SOLARIS TCP SYN SCANS OTHER TCP SCANS UDP SCAN VULNERABILITY SCANS NESSUS FIREWALK MASTERCLASS: GOOD FIREWALL DESIGN PACKET FILTERING FILTERING OF TCP FILTERING OF ICMP PACKET FILTERING LIMITATIONS PROXY SERVERS TRADE-OFF: PACKET FILTERS VS PROXY SERVERS NETWORK LEVEL FIREWALLS AND APPLICATION LEVEL FIREWALLS FIREWALL COMBINATIONS MODULE 11: VULNERABILITY AND EXPLOIT RESEARCH ABOUT THIS MODULE VULNERABILITY RESEARCH FIX ADVISORIES FULL DISCLOSURE ADVISORIES APPLICATION ERRORS AUTOMATED TOOLS MANUAL CHECKING BUFFER OVERFLOWS DETECTING BUFFER OVERFLOWS EXPLOIT CHAINS EXPLOIT RESEARCH WEB SERVERS AND FTP SITES IRC NEWS GROUPS RESEARCH RESOURCES USEFUL REFERENCES MODULE 12: THEORETICAL EXPLOITATION ABOUT THIS MODULE CASE STUDY: WEB SPOOFING WEB SPOOFING METHODOLOGY RESULT PERFECTING THE FALSE WEB CASE STUDY - DISTRIBUTED DENIAL-OF-SERVICE ATTACKS ATTACKS TRIBAL FLOOD NETWORK (TFN) TRIN00 TFN2K STACHELDRAHT TFN2K IN MORE DETAIL DEFENCE ATTACK SURVIVAL MOVING TARGET FILTERING HIGH BANDWIDTH RATE FILTERING ATTACK PREVENTION INGRESS FILTERING SENDING SPOOFED PACKETS INTEGRATE WITH EXISTING PROGRAM COMPARING USUAL ADDRESSES CONTROL CHANNEL FILTERING ACTIVE RESPONSE NETWORK SECURITY ASSESSMENT ATTACK FORENSICS DNS LOGS CONTROL CHANNEL DETECTION CORRELATION AND INTEGRATION MODULE 13: EXPLOITATION IN ACTION ABOUT THIS MODULE VULNERABILITY EXPLOITATION IN ACTION EXAMPLE 1: RDS EXPLOIT HISTORY OVERVIEW USE OF THE EXPLOIT EXAMPLE 2: EEYE EXAMPLE 3: FIREWALL-1 DOS/ JOLT2 C AND CPD C EXAMPLE 4: BACK ORIFICE CASE STUDY: BUFFER OVERFLOWS BUFFERS THE STACK STACK OPERATION CASE STUDY - TCP SESSION HIJACKING PASSIVE AND ACTIVE SNIFFING ATTACKS SESSION HIJACKING INITIATING A TELNET SESSION TELNET SESSION ESTABLISHED ACCEPTABLE PACKETS HIJACKING A SESSION MODULE 14: SUMMARY INTRODUCTION ACTIVE INFORMATION GATHERING FIREWALL AND ROUTER ASSESSMENT VULNERABILITY EXPLOITATION MITNICK VERSUS SHIMOMURA SETTING UP THE ATTACK COURSE REVIEW MODULE GETTING ACQUAINTED WITH THE INSTRUCTOR HERE AT ISS, WE BELIEVE THAT IT TAKES A TEAM TO ACHIEVE THE BEST RESULTS WITH WHATEVER WE DO IT’S IMPORTANT TO US THAT THE CLASSROOM ENVIRONMENT FOR EACH COURSE FOSTERS THAT TEAM SPIRIT AS WELL WE WANT YOU TO KNOW ABOUT YOUR INSTRUCTOR AND YOUR FELLOW TRAINEES THE INSTRUCTOR WILL TELL YOU ABOUT HIS/HER BACKGROUND USE THE SPACE BELOW TO TAKE ANY NOTES: WITH OTHERS IN THE CLASS WE’RE GLAD YOU’RE HERE AS YOU SPEND THE NEXT FOUR DAYS LEARNING ABOUT ETHICAL HACKING, WE ENCOURAGE YOU TO GET ACQUAINTED WITH YOUR FELLOW TRAINEES INTRODUCE YOURSELVES AND TELL THEM A BIT ABOUT YOUR BACKGROUND SHARE WHATEVER INFORMATION YOU FEEL COMFORTABLE WITH USE THE SPACE BELOW TO TAKE ANY NOTES GETTING THE MOST OUT OF THIS COURSE THE INSTRUCTOR’S ROLE THE ETHICAL HACKING COURSE INTRODUCES CONCEPTS, FRAMEWORKS, METHODOLOGIES, AND STRATEGIES THAT ARE EFFECTIVE THE INSTRUCTOR SERVES AS A GUIDE TO LEAD YOU THROUGH THE COURSE WITH LECTURES, DISCUSSIONS, AND HANDS-ON EXERCISES YOUR ROLE YOUR ACTIVE PARTICIPATION IS IMPORTANT TO US FEEL FREE TO SHARE YOUR EXPERIENCES WITH THE CLASS TAKE THIS CHANCE TO BUILD RELATIONSHIPS WITH OTHER PROFESSIONALS IN THE FIELD WE CAN ALL LEARN FROM EACH OTHER ASK QUESTIONS—BOTH OF THE INSTRUCTOR AND YOUR FELLOW TRAINEES IF THE INSTRUCTOR CANNOT IMMEDIATELY ANSWER YOUR QUESTION, THE INSTRUCTOR WILL WRITE THE QUESTION DOWN AND CONSULT OTHER RESOURCES AT ISS ABOUT THIS COURSE COURSE OBJECTIVES BY THE END OF THIS COURSE YOU WILL BE ABLE TO: DESCRIBE HOW HACKERS ARE ABLE TO DEFEAT SECURITY CONTROLS IN OPERATING SYSTEMS, NETWORKED ENVIRONMENTS AND GENERALLY CIRCUMVENT SECURITY MECHANISMS IDENTIFY HOW SECURITY CONTROLS CAN BE IMPROVED TO PREVENT HACKERS GAINING ACCESS TO OPERATING SYSTEMS AND NETWORKED ENVIRONMENTS THE COURSE IS SPLIT INTO FOUR SECTIONS: PASSIVE INFORMATION GATHERING ACTIVE INFORMATION GATHERING AND TARGET MAPPING VULNERABILITY MAPPING AND EXPLOITATION VULNERABILITY EXPLOITATION USING THIS TRAINING GUIDE THIS TRAINING GUIDE LEADS YOU THROUGH THE ETHICAL HACKING COURSE THIS GUIDE IS YOURS TO KEEP ON EACH PAGE, SPACE IS PROVIDED FOR YOUR NOTES TAKE NOTES AS YOU GO ALONG YOU CAN USE THIS GUIDE AS A RESOURCE WHEN YOU ARE BACK ON THE JOB COURSE OUTLINE ETHICAL HACKING IS A 4 DAY COURSE DAY 1: SESSION 1 AM INTRODUCTION AND OVERVIEW MODULE WELCOME MODULE LEGAL AND HR ISSUES MODULE WHY PERFORM AN ETHICAL HACK MODULE ATTACK TYPES AND VULNERABILITIES CASE STUDY -DANGERS OF MOBILE CODE SESSION 2 PM PASSIVE INFORMATION GATHERING MODULE SEARCHING FOR CORPORATE INFORMATION MODULE SEARCHING FOR TECHNICAL INFORMATION LAB PASSIVE INFORMATION GATHERING DAY 2: SESSION 3 AM ACTIVE INFORMATION GATHERING MODULE NETWORK SCANNING MASTERCLASS: GOOD NETWORK DESIGN MODULE INTERPRETING NETWORK RESULTS LAB NETWORK SCANNING TECHNIQUES SESSION 4 PM TARGET MAPPING MODULE HOST SCANNING MASTERCLASS: PORT SCANNING AND OS IDENTIFICATION MODULE INTERPRETING HOST RESULTS MASTERCLASS: GOOD FIREWALL DESIGN LAB HOST SCANNING TECHNIQUES DAY 3: SESSION 5 AM VULNERABILITY MAPPING MODULE VULNERABILITY AND EXPLOIT RESEARCH LAB VULNERABILITY MAPPING SESSION 6 PM VULNERABILITY EXPLOITATION MODULE EXPLOITATION CASE STUDIES MODULE EXPLOITATION THEORY AND DEMONSTRATIONS CASE STUDY - BUFFER OVERFLOW CASE STUDY - SESSION HIJACKING DAY 4: SESSION 7 AM VULNERABILITY EXPLOITATION PRACTICAL MODULE