HACK PROOFING YOUR NETWORK
CONTENTS CHAPTER 1 HOW TO HACK INTRODUCTION WHAT WE MEAN BY “HACK” WHY HACK? KNOWING WHAT TO EXPECT IN THE REST OF THIS BOOK UNDERSTANDING THE CURRENT LEGAL CLIMATE SUMMARY FREQUENTLY ASKED QUESTIONS CHAPTER 2 THE LAWS OF SECURITY KNOWING THE LAWS OF SECURITY CLIENT-SIDE SECURITY DOESN’T WORK YOU CANNOT SECURELY EXCHANGE ENCRYPTION KEYS WITHOUT A SHARED PIECE OF INFORMATION MALICIOUS CODE CANNOT BE 100 PERCENT PROTECTED AGAINST ANY MALICIOUS CODE CAN BE COMPLETELY MORPHED TO BYPASS SIGNATURE DETECTION FIREWALLS CANNOT PROTECT YOU 100 PERCENT FROM ATTACK SOCIAL ENGINEERING ATTACKING EXPOSED SERVERS ATTACKING THE FIREWALL DIRECTLY CLIENT-SIDE HOLES ANY IDS CAN BE EVADED SECRET CRYPTOGRAPHIC ALGORITHMS ARE NOT SECURE IF A KEY IS NOT REQUIRED,YOU DO NOT HAVE ENCRYPTION—YOU HAVE ENCODING PASSWORDS CANNOT BE SECURELY STORED ON THE CLIENT UNLESS THERE IS ANOTHER PASSWORD TO PROTECT THEM IN ORDER FOR A SYSTEM TO BEGIN TO BE CONSIDERED SECURE, IT MUST UNDERGO AN INDEPENDENT SECURITY AUDIT SECURITY THROUGH OBSCURITY DOES NOT WORK SOLUTIONS FAST TRACK CHAPTER 3 CLASSES OF ATTACK IDENTIFYING AND UNDERSTANDING THE CLASSES OF ATTACK DENIAL OF SERVICE LOCAL VECTOR DENIAL OF SERVICE NETWORK VECTOR DENIAL OF SERVICE INFORMATION LEAKAGE SERVICE INFORMATION LEAKAGE PROTOCOL INFORMATION LEAKAGE LEAKY BY DESIGN LEAKY WEB SERVERS A HYPOTHETICAL SCENARIO WHY BE CONCERNED WITH INFORMATION LEAKAGE? REGULAR FILE ACCESS PERMISSIONS SYMBOLIC LINK ATTACKS MISINFORMATION STANDARD INTRUSION PROCEDURE SPECIAL FILE/DATABASE ACCESS ATTACKS AGAINST SPECIAL FILES ATTACKS AGAINST DATABASES REMOTE ARBITRARY CODE EXECUTION THE ATTACK CODE EXECUTION LIMITATIONS ELEVATION OF PRIVILEGES REMOTE PRIVILEGE ELEVATION IDENTIFYING METHODS OF TESTING FOR VULNERABILITIES PROOF OF CONCEPT EXPLOIT CODE AUTOMATED SECURITY TOOLS VERSIONING STANDARD RESEARCH TECHNIQUES WHOIS DOMAIN NAME SYSTEM NMAP WEB INDEXING CHAPTER 4 METHODOLOGY UNDERSTANDING VULNERABILITY RESEARCH METHODOLOGIES SOURCE CODE RESEARCH SEARCHING FOR ERROR-PRONE FUNCTIONS LINE-BY-LINE REVIEW DISCOVERY THROUGH DIFFERENCE BINARY RESEARCH TRACING BINARIES DEBUGGERS GUIDELINE-BASED AUDITING SNIFFERS THE IMPORTANCE OF SOURCE CODE REVIEWS SEARCHING ERROR-PRONE FUNCTIONS BUFFER OVERFLOWS INPUT VALIDATION BUGS RACE CONDITIONS REVERSE ENGINEERING TECHNIQUES DISASSEMBLERS, DECOMPILERS, AND DEBUGGERS BLACK BOX TESTING CHIPS CHAPTER 5 DIFFING WHAT IS DIFFING? WHY DIFF? LOOKING TO THE SOURCE CODE GOING FOR THE GOLD:A GAMING EXAMPLE EXPLORING DIFF TOOLS USING FILE-COMPARISON TOOLS USING THE FC TOOL USING THE DIFF COMMAND WORKING WITH HEX EDITORS HACKMAN [N] CURSES HEXEDIT HEX WORKSHOP UTILIZING FILE SYSTEM MONITORING TOOLS DOING IT THE HARD WAY: MANUAL COMPARISON COMPARING FILE ATTRIBUTES USING THE ARCHIVE ATTRIBUTE EXAMINING CHECKSUMS AND HASHES FINDING OTHER TOOLS TROUBLESHOOTING PROBLEMS WITH CHECKSUMS AND HASHES PROBLEMS WITH COMPRESSION AND ENCRYPTION CHAPTER 6 CRYPTOGRAPHY UNDERSTANDING CRYPTOGRAPHY CONCEPTS HISTORY ENCRYPTION KEY TYPES LEARNING ABOUT STANDARD CRYPTOGRAPHIC ALGORITHMS UNDERSTANDING SYMMETRIC ALGORITHMS DES AES (RIJNDAEL) IDEA UNDERSTANDING ASYMMETRIC ALGORITHMS DIFFIE-HELLMAN RSA UNDERSTANDING BRUTE FORCE BRUTE FORCE BASICS USING BRUTE FORCE TO OBTAIN PASSWORDS L0PHTCRACK CRACK JOHN THE RIPPER KNOWING WHEN REAL ALGORITHMS ARE BEING USED IMPROPERLY BAD KEY EXCHANGES HASHING PIECES SEPARATELY USING A SHORT PASSWORD TO GENERATE A LONG KEY IMPROPERLY STORED PRIVATE OR SECRET KEYS UNDERSTANDING AMATEUR CRYPTOGRAPHY ATTEMPTS CLASSIFYING THE CIPHERTEXT FREQUENCY ANALYSIS CIPHERTEXT RELATIVE LENGTH ANALYSIS SIMILAR PLAINTEXT ANALYSIS MONOALPHABETIC CIPHERS OTHER WAYS TO HIDE INFORMATION XOR UUENCODE COMPRESSION CHAPTER 7 UNEXPECTED INPUT UNDERSTANDING WHY UNEXPECTED DATA IS DANGEROUS FINDING SITUATIONS INVOLVING UNEXPECTED DATA LOCAL APPLICATIONS AND UTILITIES HTTP/HTML UNEXPECTED DATA IN SQL QUERIES APPLICATION AUTHENTICATION DISGUISING THE OBVIOUS USING TECHNIQUES TO FIND AND ELIMINATE VULNERABILITIES BLACK-BOX TESTING DISCOVERING NETWORK AND SYSTEM PROBLEMS USE THE SOURCE UNTAINT DATA BY FILTERING IT ESCAPING CHARACTERS IS NOT ALWAYS ENOUGH PERL COLD FUSION/COLD FUSION MARKUP LANGUAGE (CFML) ASP PHP PROTECTING YOUR SQL QUERIES SILENTLY REMOVING VERSUS ALERTING ON BAD DATA INVALID INPUT FUNCTION TOKEN SUBSTITUTION UTILIZING THE AVAILABLE SAFETY FEATURES IN YOUR PROGRAMMING LANGUAGE COLDFUSION/COLDFUSION MARKUP LANGUAGE MYSQL USING TOOLS TO HANDLE UNEXPECTED DATA WEB SLEUTH CGIAUDIT RATS FLAWFINDER RETINA HAILSTORM PUDDING CHAPTER 8 BUFFER OVERFLOW UNDERSTANDING THE STACK THE CODE DISASSEMBLY THE STACK DUMP ODDITIES AND THE STACK UNDERSTANDING THE STACK FRAME INTRODUCTION TO THE STACK FRAME PASSING ARGUMENTS TO A FUNCTION: A SAMPLE PROGRAM THE DISASSEMBLY THE STACK DUMPS STACK FRAMES AND CALLING SYNTAXES LEARNING ABOUT BUFFER OVERFLOWS A SIMPLE UNCONTROLLED OVERFLOW: A SAMPLE PROGRAM CREATING YOUR FIRST OVERFLOW CREATING A PROGRAM WITH AN EXPLOITABLE OVERFLOW WRITING THE OVERFLOWABLE CODE DISASSEMBLING THE OVERFLOWABLE CODE STACK DUMP AFTER THE OVERFLOW PERFORMING THE EXPLOIT GENERAL EXPLOIT CONCEPTS BUFFER INJECTION TECHNIQUES METHODS TO EXECUTE PAYLOAD DESIGNING PAYLOAD PERFORMING THE EXPLOIT ON LINUX PERFORMING THE EXPLOIT ON WINDOWS NT LEARNING ADVANCED OVERFLOW TECHNIQUES INPUT FILTERING INCOMPLETE OVERFLOWS AND DATA CORRUPTION STACK BASED FUNCTION POINTER OVERWRITE HEAP OVERFLOWS CORRUPTING A FUNCTION POINTER TRESPASSING THE HEAP ADVANCED PAYLOAD DESIGN USING WHAT YOU ALREADY HAVE DYNAMIC LOADING NEW LIBRARIES EGGSHELL PAYLOADS CHAPTER 9 FORMAT STRINGS UNDERSTANDING FORMAT STRING VULNERABILITIES WHY AND WHERE DO FORMAT STRING VULNERABILITIES EXIST? HOW CAN THEY BE FIXED? HOW FORMAT STRING VULNERABILITIES ARE EXPLOITED READING MEMORY WRITING TO MEMORY HOW FORMAT STRING EXPLOITS WORK CONSTRUCTING VALUES WHAT TO OVERWRITE OVERWRITING RETURN ADDRESSES OVERWRITING GLOBAL OFFSET TABLE ENTRIES AND OTHER FUNCTION POINTERS EXAMINING A VULNERABLE PROGRAM TESTING WITH A RANDOM FORMAT STRING WRITING A FORMAT STRING EXPLOIT CHAPTER 10 SNIFFING WHAT IS SNIFFING? HOW DOES IT WORK? WHAT TO SNIFF? OBTAINING AUTHENTICATION INFORMATION MONITORING TELNET (PORT 23) MONITORING FTP (PORT 21) MONITORING POP (PORT 110) MONITORING IMAP (PORT 143) MONITORING NNTP (PORT 119) MONITORING REXEC (PORT 512) MONITORING RLOGIN (PORT 513) MONITORING X11 (PORT 6000+) MONITORING NFS FILE HANDLES CAPTURING WINDOWS NT AUTHENTICATION INFORMATION CAPTURING OTHER NETWORK TRAFFIC MONITORING SMTP (PORT 25) MONITORING HTTP (PORT 80) POPULAR SNIFFING SOFTWARE ETHEREAL NETWORK ASSOCIATES SNIFFER PRO NT NETWORK MONITOR WILDPACKETS TCPDUMP DSNIFF ETTERCAP ESNIFFC SNIFFIT CARNIVORE ADDITIONAL RESOURCES ADVANCED SNIFFING TECHNIQUES MAN-IN-THE-MIDDLE (MITM) ATTACKS CRACKING SWITCH TRICKS ARP SPOOFING MAC FLOODING ROUTING GAMES EXPLORING OPERATING SYSTEM APIS LINUX BSD LIBPCAP WINDOWS TAKING PROTECTIVE MEASURES PROVIDING ENCRYPTION SECURE SHELL (SSH) SECURE SOCKETS LAYERS (SSL) PGP AND S/MIME SWITCHING EMPLOYING DETECTION TECHNIQUES LOCAL DETECTION NETWORK DETECTION DNS LOOKUPS LATENCY DRIVER BUGS ANTISNIFF NETWORK MONITOR CHAPTER 11 SESSION HIJACKING UNDERSTANDING SESSION HIJACKING TCP SESSION HIJACKING TCP SESSION HIJACKING WITH PACKET BLOCKING ROUTE TABLE MODIFICATION ARP ATTACKS UDP HIJACKING EXAMINING THE AVAILABLE TOOLS JUGGERNAUT HUNT SMBRELAY STORM WATCHERS ACK STORMS PLAYING MITM FOR ENCRYPTED COMMUNICATIONS MAN-IN-THE-MIDDLE ATTACKS OTHER HIJACKING CHAPTER 12 SPOOFING: ATTACKS ON TRUSTED IDENTITY WHAT IT MEANS TO SPOOF SPOOFING IS IDENTITY FORGERY SPOOFING IS AN ACTIVE ATTACK AGAINST IDENTITY CHECKING PROCEDURES SPOOFING IS POSSIBLE AT ALL LAYERS OF COMMUNICATION SPOOFING IS ALWAYS INTENTIONAL SPOOFING MAY BE BLIND OR INFORMED, BUT USUALLY INVOLVES ONLY PARTIAL CREDENTIALS SPOOFING IS NOT THE SAME THING AS BETRAYAL SPOOFING IS NOT NECESSARILY MALICIOUS SPOOFING IS NOTHING NEW BACKGROUND THEORY THE IMPORTANCE OF IDENTITY THE EVOLUTION OF TRUST ASYMMETRIC SIGNATURES BETWEEN HUMAN BEINGS ESTABLISHING IDENTITY WITHIN COMPUTER NETWORKS RETURN TO SENDER IN THE BEGINNING,THERE WAS… A TRANSMISSION CAPABILITY CHALLENGES ABILITY TO TRANSMIT:“CAN IT TALK TO ME?” ABILITY TO RESPOND:“CAN IT RESPOND TO ME?” ABILITY TO ENCODE:“CAN IT SPEAK MY LANGUAGE?” ABILITY TO PROVE A SHARED SECRET: “DOES IT SHARE A SECRET WITH ME?” ABILITY TO PROVE A PRIVATE KEYPAIR: “CAN I RECOGNIZE YOUR VOICE?” ABILITY TO PROVE AN IDENTITY KEYPAIR: “IS ITS IDENTITY INDEPENDENTLY REPRESENTED IN MY KEYPAIR?” CONFIGURATION METHODOLOGIES: BUILDING A TRUSTED CAPABILITY INDEX LOCAL CONFIGURATIONS VS CENTRAL CONFIGURATIONS DESKTOP SPOOFS THE PLAGUE OF AUTO-UPDATING APPLICATIONS IMPACTS OF SPOOFS SUBTLE SPOOFS AND ECONOMIC SABOTAGE FLATTERY WILL GET YOU NOWHERE SUBTLETY WILL GET YOU EVERYWHERE SELECTIVE FAILURE FOR SELECTING RECOVERY BAIT AND SWITCH: SPOOFING THE PRESENCE OF SSL ITSELF DOWN AND DIRTY: ENGINEERING SPOOFING SYSTEMS SPITTING INTO THE WIND: BUILDING A SKELETON ROUTER IN USERSPACE DESIGNING THE NONEXISTENT:THE NETWORK CARD THAT DIDN’T EXIST BUT RESPONDED ANYWAY IMPLEMENTATION: DOXROUTE, SECTION BY SECTION BRING OUT THE HALON: SPOOFING CONNECTIVITY THROUGH ASYMMETRIC FIREWALLS SYMMETRIC OUTGOING TCP: A HIGHLY EXPERIMENTAL FRAMEWORK FOR HANDSHAKE-ONLY TCP CONNECTION BROKERING SOLUTION FAST TRACK CHAPTER 13 TUNNELING STRATEGIC CONSTRAINTS OF TUNNEL DESIGN PRIVACY:“WHERE IS MY TRAFFIC GOING?” ROUTABILITY:“WHERE CAN THIS GO THROUGH?” DEPLOYABILITY:“HOW PAINFUL IS THIS TO GET UP AND RUNNING?” FLEXIBILITY:“WHAT CAN WE USE THIS FOR,ANYWAY?” QUALITY:“HOW PAINFUL WILL THIS SYSTEM BE TO MAINTAIN?” DESIGNING END-TO-END TUNNELING SYSTEMS DRILLING TUNNELS USING SSH SETTING UP OPENSSH OPEN SESAME:AUTHENTICATION BASIC ACCESS:AUTHENTICATION BY PASSWORD TRANSPARENT ACCESS:AUTHENTICATION BY PRIVATE KEY SERVER TO CLIENT AUTHENTICATION CLIENT TO SERVER AUTHENTICATION COMMAND FORWARDING: DIRECT EXECUTION FOR SCRIPTS AND PIPES PORT FORWARDING:ACCESSING RESOURCES ON REMOTE NETWORKS LOCAL PORT FORWARDS DYNAMIC PORT FORWARDS INTERNET EXPLORER 6: MAKING THE WEB SAFE FOR WORK SPEAK FREELY: INSTANT MESSAGING OVER SSH THAT’S A WRAP: ENCAPSULATING ARBITRARY WIN32 APPS WITHIN THE DYNAMIC FORWARDER SUMMONING VIRGIL: USING DANTE’S SOCKSIFY TO WRAP UNIX APPLICATIONS REMOTE PORT FORWARDS WHEN IN ROME:TRAVERSING THE RECALCITRANT NETWORK CROSSING THE BRIDGE:ACCESSING PROXIES THROUGH PROXYCOMMANDS NO HABLA HTTP? PERMUTING THY TRAFFIC SHOW YOUR BADGE: RESTRICTED BASTION AUTHENTICATION BRINGING THE MOUNTAIN: EXPORTING SSHD ACCESS ECHOES IN A FOREIGN TONGUE: CROSS-CONNECTING MUTUALLY FIREWALLED HOSTS NOT IN DENVER, NOT DEAD: NOW WHAT? STANDARD FILE TRANSFER OVER SSH INCREMENTAL FILE TRANSFER OVER SSH CD BURNING OVER SSH ACOUSTIC TUBING:AUDIO DISTRIBUTION OVER TCP AND SSH CHAPTER 14 HARDWARE HACKING UNDERSTANDING HARDWARE HACKING OPENING THE DEVICE: HOUSING AND MECHANICAL ATTACKS TYPES OF TAMPER MECHANISMS TAMPER RESISTANCE TAMPER EVIDENCE TAMPER DETECTION TAMPER RESPONSE EXTERNAL INTERFACES PROTOCOL ANALYSIS ELECTROMAGNETIC INTERFERENCE AND ELECTROSTATIC DISCHARGE ANALYZING THE PRODUCT INTERNALS: ELECTRICAL CIRCUIT ATTACKS REVERSE-ENGINEERING THE DEVICE BASIC TECHNIQUES: COMMON ATTACKS DEVICE PACKAGING MEMORY RETRIEVAL TIMING ATTACKS ADVANCED TECHNIQUES: EPOXY REMOVAL AND IC DELIDDING SILICON DIE ANALYSIS CRYPTANALYSIS AND OBFUSCATION METHODS WHAT TOOLS DO I NEED? STARTER KIT ADVANCED KIT EXAMPLE: HACKING THE IBUTTON AUTHENTICATION TOKEN EXPERIMENTING WITH THE DEVICE REVERSE-ENGINEERING THE “RANDOM” RESPONSE EXAMPLE: HACKING THE NETSTRUCTURE E-COMMERCE ACCELERATOR OPENING THE DEVICE RETRIEVING THE FILESYSTEM REVERSE-ENGINEERING THE PASSWORD GENERATOR CHAPTER 15 VIRUSES, TROJAN HORSES, AND WORMS HOW DO VIRUSES,TROJANS HORSES, AND WORMS DIFFER? VIRUSES WORMS MACRO VIRUS TROJAN HORSES HOAXES ANATOMY OF A VIRUS PROPAGATION PAYLOAD OTHER TRICKS OF THE TRADE DEALING WITH CROSS-PLATFORM ISSUES JAVA MACRO VIRUSES RECOMPILATION SHOCKWAVE FLASH PROOF THAT WE NEED TO WORRY THE MORRIS WORM ADMW0RM MELISSA AND I LOVE YOU SADMIND WORM CODE RED WORMS NIMDA WORM CREATING YOUR OWN MALWARE NEW DELIVERY METHODS FASTER PROPAGATION METHODS OTHER THOUGHTS ON CREATING NEW MALWARE HOW TO SECURE AGAINST MALICIOUS SOFTWARE ANTI-VIRUS SOFTWARE UPDATES AND PATCHES WEB BROWSER SECURITY ANTI-VIRUS RESEARCH CHAPTER 16 IDS EVASION UNDERSTANDING HOW SIGNATURE-BASED IDSS WORK JUDGING FALSE POSITIVES AND NEGATIVES ALERT FLOODING USING PACKET LEVEL EVASION IP OPTIONS TIME-TO-LIVE ATTACKS IP FRAGMENTATION TCP HEADER TCP SYNCHRONIZATION TCB CREATION STREAM REASSEMBLY TCB TEARDOWN USING FRAGROUTER AND CONGESTANT COUNTERMEASURES USING APPLICATION PROTOCOL LEVEL EVASION SECURITY AS AN AFTERTHOUGHT EVADING A MATCH ALTERNATE DATA ENCODINGS WEB ATTACK TECHNIQUES METHOD MATCHING DIRECTORY AND FILE REFERENCING USING CODE MORPHING EVASION CHAPTER 17 AUTOMATED SECURITY REVIEW AND ATTACK TOOLS LEARNING ABOUT AUTOMATED TOOLS EXPLORING THE COMMERCIAL TOOLS CYBERCOP SCANNER INTERNET SECURITY SYSTEMS (ISS) INTERNET SCANNER BINDVIEW’S BV-CONTROL FOR INTERNET SECURITY EEYE RETINA OTHER PRODUCTS EXPLORING THE FREE TOOLS NESSUS SECURITY ADMINISTRATORS INTEGRATED NETWORK TOOL (SAINT) SECURITY ADMINISTRATORS RESEARCH ASSISTANT (SARA) SHADOWSCAN NMAP AND NMAPNT WHISKER VLAD THE SCANNER OTHER RESOURCES USING AUTOMATED TOOLS FOR PENETRATION TESTING TESTING WITH THE COMMERCIAL TOOLS TESTING THE FREE TOOLS KNOWING WHEN TOOLS ARE NOT ENOUGH THE NEW FACE OF VULNERABILITY TESTING CHAPTER 18 REPORTING SECURITY PROBLEMS UNDERSTANDING WHY SECURITY PROBLEMS NEED TO BE REPORTED FULL DISCLOSURE DETERMINING WHEN AND TO WHOM TO REPORT THE PROBLEM WHOM TO REPORT SECURITY PROBLEMS TO? HOW TO REPORT A SECURITY PROBLEM TO A VENDOR DECIDING HOW MUCH DETAIL TO PUBLISH PUBLISHING EXPLOIT CODE PROBLEMS REPERCUSSIONS FROM VENDORS REPORTING ERRORS RISK TO THE PUBLIC