HACKING EXPOSED: NETWORK SECURITY SECRETS & SOLUTIONS
CONTENTS PART I CASING THE ESTABLISHMENT CASE STUDY IAAAS—IT’S ALL ABOUT ANONYMITY, STUPID TOR-MENTING THE GOOD GUYS FOOTPRINTING WHAT IS FOOTPRINTING? WHY IS FOOTPRINTING NECESSARY? INTERNET FOOTPRINTING STEP 1: DETERMINE THE SCOPE OF YOUR ACTIVITIES STEP 2: GET PROPER AUTHORIZATION STEP 3: PUBLICLY AVAILABLE INFORMATION STEP 4: WHOIS & DNS ENUMERATION STEP 5: DNS INTERROGATION STEP 6: NETWORK RECONNAISSANCE SUMMARY SCANNING DETERMINING IF THE SYSTEM IS ALIVE ARP HOST DISCOVERY ICMP HOST DISCOVERY TCP/UDP HOST DISCOVERY DETERMINING WHICH SERVICES ARE RUNNING OR LISTENING SCAN TYPES IDENTIFYING TCP AND UDP SERVICES RUNNING DETECTING THE OPERATING SYSTEM MAKING GUESSES FROM AVAILABLE PORTS ACTIVE STACK FINGERPRINTING PASSIVE STACK FINGERPRINTING PROCESSING AND STORING SCAN DATA MANAGING SCAN DATA WITH METASPLOIT ENUMERATION SERVICE FINGERPRINTING VULNERABILITY SCANNERS BASIC BANNER GRABBING ENUMERATING COMMON NETWORK SERVICES PART II ENDPOINT AND SERVER HACKING CASE STUDY: INTERNATIONAL INTRIGUE HACKING WINDOWS OVERVIEW WHAT’S NOT COVERED UNAUTHENTICATED ATTACKS AUTHENTICATION SPOO? NG ATTACKS REMOTE UNAUTHENTICATED EXPLOITS AUTHENTICATED ATTACKS PRIVILEGE ESCALATION EXTRACTING AND CRACKING PASSWORDS REMOTE CONTROL AND BACK DOORS PORT REDIRECTION COVERING TRACKS GENERAL COUNTERMEASURES TO AUTHENTICATED COMPROMISE WINDOWS SECURITY FEATURES WINDOWS FIREWALL AUTOMATED UPDATES SECURITY CENTER SECURITY POLICY AND GROUP POLICY MICROSOFT SECURITY ESSENTIALS THE ENHANCED MITIGATION EXPERIENCE TOOLKIT BITLOCKER AND THE ENCRYPTING FILE SYSTEM WINDOWS RESOURCE PROTECTION INTEGRITY LEVELS, UAC, AND PMIE DATA EXECUTION PREVENTION (DEP) WINDOWS SERVICE HARDENING COMPILER-BASED ENHANCEMENTS CODA: THE BURDEN OF WINDOWS SECURITY HACKING UNIX THE QUEST FOR ROOT A BRIEF REVIEW VULNERABILITY MAPPING REMOTE ACCESS VS LOCAL ACCESS REMOTE ACCESS DATA-DRIVEN ATTACKS I WANT MY SHELL COMMON TYPES OF REMOTE ATTACKS LOCAL ACCESS AFTER HACKING ROOT ROOTKIT RECOVERY CYBERCRIME AND ADVANCED PERSISTENT THREATS WHAT IS AN APT? OPERATION AURORA ANONYMOUS RBN WHAT APTS ARE NOT? EXAMPLES OF POPULAR APT TOOLS AND TECHNIQUES COMMON APTS INDICATORS PART III INFRASTRUCTURE HACKING CASE STUDY: READ IT AND WEP REMOTE CONNECTIVITY AND VOIP HACKING PREPARING TO DIAL UP WARDIALING HARDWARE LEGAL ISSUES PERIPHERAL COSTS SOFTWARE BRUTE-FORCE SCRIPTING—THE HOMEGROWN WAY A FINAL NOTE ABOUT BRUTE-FORCE SCRIPTING PBX HACKING VOICEMAIL HACKING VIRTUAL PRIVATE NETWORK (VPN) HACKING BASICS OF IPSEC VPNS HACKING THE CITRIX VPN SOLUTION VOICE OVER IP ATTACKS ATTACKING VOIP WIRELESS HACKING BACKGROUND FREQUENCIES AND CHANNELS SESSION ESTABLISHMENT SECURITY MECHANISMS EQUIPMENT WIRELESS ADAPTERS OPERATING SYSTEMS MISCELLANEOUS GOODIES DISCOVERY AND MONITORING FINDING WIRELESS NETWORKS SNIF? NG WIRELESS TRAF? C DENIAL OF SERVICE ATTACKS ENCRYPTION ATTACKS WEP AUTHENTICATION ATTACKS WPA PRE-SHARED KEY WPA ENTERPRISE HACKING HARDWARE PHYSICAL ACCESS: GETTING IN THE DOOR HACKING DEVICES DEFAULT CON? GURATIONS OWNED OUT OF THE BOX STANDARD PASSWORDS BLUETOOTH REVERSE ENGINEERING HARDWARE MAPPING THE DEVICE SNIF? NG BUS DATA SNIF? NG THE WIRELESS INTERFACE FIRMWARE REVERSING ICE TOOLS PART IV APPLICATION AND DATA HACKING CASE STUDY WEB AND DATABASE HACKING WEB SERVER HACKING SAMPLE FILES SOURCE CODE DISCLOSURE CANONICALIZATION ATTACKS SERVER EXTENSIONS BUFFER OVER? OWS DENIAL OF SERVICE WEB SERVER VULNERABILITY SCANNERS WEB APPLICATION HACKING FINDING VULNERABLE WEB APPS WITH GOOGLE (GOOGLEDORKS) WEB CRAWLING WEB APPLICATION ASSESSMENT COMMON WEB APPLICATION VULNERABILITIES DATABASE HACKING DATABASE DISCOVERY DATABASE VULNERABILITIES OTHER CONSIDERATIONS MOBILE HACKING HACKING ANDROID ANDROID FUNDAMENTALS HACKING YOUR ANDROID HACKING OTHER ANDROIDS ANDROID AS A PORTABLE HACKING PLATFORM DEFENDING YOUR ANDROID IOS KNOW YOUR IPHONE HOW SECURE IS IOS? JAILBREAKING: UNLEASH THE FURY! HACKING OTHER IPHONES: FURY UNLEASHED! COUNTERMEASURES COOKBOOK GENERAL STRATEGIES (RE)MOVE THE ASSET SEPARATION OF DUTIES AUTHENTICATE, AUTHORIZE, AND AUDIT LAYERING ADAPTIVE ENHANCEMENT ORDERLY FAILURE POLICY AND TRAINING SIMPLE, CHEAP, AND EASY EXAMPLE SCENARIOS DESKTOP SCENARIOS SERVER SCENARIOS NETWORK SCENARIOS WEB APPLICATION AND DATABASE SCENARIOS MOBILE SCENARIOS