ETHICAL HACKING: FUNDAMENTALS
INTRODUCTION 1 PART 1 BUILDING THE FOUNDATION FOR SECURITY TESTING 7 CHAPTER 1 INTRODUCTION TO VULNERABILITY AND PENETRATION TESTING 9 CHAPTER 2 CRACKING THE HACKER MINDSET 35 CHAPTER 3 DEVELOPING YOUR SECURITY TESTING PLAN 53 CHAPTER 4 HACKING METHODOLOGY 70 PART 2 PUTTING SECURITY TESTING IN MOTION 86 CHAPTER 5 INFORMATION GATHERING 88 CHAPTER 6 SOCIAL ENGINEERING 96 CHAPTER 7 PHYSICAL SECURITY 119 CHAPTER 8 PASSWORDS 133 PART 3 HACKING NETWORK HOSTS 171 CHAPTER 9 NETWORK INFRASTRUCTURE SYSTEMS 173 CHAPTER 10 WIRELESS NETWORKS 219 CHAPTER 11 MOBILE DEVICES 256 PART 4 HACKING OPERATING SYSTEMS 275 CHAPTER 12 WINDOWS 277 CHAPTER 13 LINUX AND MACOS 314 PART 5 HACKING APPLICATIONS 347 CHAPTER 14 COMMUNICATION AND MESSAGING SYSTEMS 349 CHAPTER 15 WEB APPLICATIONS AND MOBILE APPS 382 CHAPTER 16 DATABASES AND STORAGE SYSTEMS 418 CONTENTS INTRODUCTION WELCOME TO HACKING FOR DUMMIES 6TH EDITION THIS BOOK OUTLINES IN PLAIN ENGLISH COMPUTER HACKING TRICKS AND TECHNIQUES THAT YOU CAN USE TO ASSESS THE SECURITY OF YOUR INFORMATION SYSTEMS FIND THE VULNERABILITIES THAT MATTER AND FIX THE WEAKNESSES BEFORE CRIMINAL HACKERS AND MALICIOUS INSIDERS TAKE ADVANTAGE OF THEM THIS HACKING IS THE PROFESSIONAL ABOVEBOARD AND LEGAL TYPE OF SECURITY TESTING WHICH I REFER TO AS ETHICAL HACKING OR VULNERABILITY AND PENETRATION TESTING THROUGHOUT THE BOOK COMPUTER AND NETWORK SECURITY IS A COMPLEX SUBJECT AND AN EVER MOVING TARGET YOU MUST STAY ON TOP OF IT TO ENSURE THAT YOUR INFORMATION IS PROTECTED FROM THE BAD GUYS THE TECHNIQUES AND TOOLS OUTLINED IN THIS BOOK CAN HELP YOU COULD IMPLEMENT ALL THE SECURITY TECHNOLOGIES AND OTHER BEST PRACTICES POSSIBLE AND YOUR NETWORK ENVIRONMENT MIGHT BE SECURE AS FAR AS YOU KNOW BUT UNLESS AND UNTIL YOU UNDERSTAND HOW MALICIOUS ATTACKERS THINK APPLY THAT KNOWLEDGE AND USE THE RIGHT TOOLS TO ASSESS YOUR SYSTEMS FROM THEIR POINT OF VIEW IT S PRACTICALLY IMPOSSIBLE TO HAVE A TRUE SENSE OF HOW SECURE YOUR SYSTEMS AND INFORMATION REALLY ARE ETHICAL HACKING OR MORE SIMPLY SECURITY ASSESSMENTS WHICH ENCOMPASSES FORMAL AND METHODICAL VULNERABILITY AND PENETRATION TESTING IS NECESSARY TO FIND SECURITY FLAWS AND TO VALIDATE THAT YOUR INFORMATION SYSTEMS ARE TRULY SECURE ON AN ONGOING BASIS THIS BOOK PROVIDES YOU THE KNOWLEDGE YOU NEED TO SUCCESSFULLY IMPLEMENT A SECURITY ASSESSMENT PROGRAM PERFORM PROPER SECURITY CHECKS AND PUT THE PROPER COUNTERMEASURES IN PLACE TO KEEP EXTERNAL HACKERS AND MALICIOUS USERS IN CHECK 1 HACKING FOR DUMMIES ABOUT THIS BOOK HACKING FOR DUMMIES IS A REFERENCE GUIDE ON HACKING YOUR SYSTEMS TO IMPROVE SECURITY AND MINIMIZE BUSINESS RISKS THE SECURITY TESTING TECHNIQUES ARE BASED ON WRITTEN AND UNWRITTEN RULES OF COMPUTER SYSTEM PENETRATION TESTING VULNERABILITY TESTING AND INFORMATION SECURITY BEST PRACTICES THIS BOOK COVERS EVERYTHING FROM ESTABLISHING YOUR TESTING PLAN TO ASSESSING YOUR SYSTEMS TO PLUGGING THE HOLES AND MANAGING AN ONGOING SECURITY TESTING PROGRAM REALISTICALLY FOR MOST NETWORKS OPERATING SYSTEMS AND APPLICATIONS THOUSANDS OF POSSIBLE VULNERABILITIES EXIST I DON T COVER THEM ALL BUT I DO COVER THE BIG ONES ON VARIOUS PLATFORMS AND SYSTEMS THAT I BELIEVE CONTRIBUTE TO MOST SECURITY PROBLEMS IN BUSINESS TODAY I COVER BASIC PARETO PRINCIPLE 80 20 RULE STUFF WITH THE GOAL OF HELPING YOU FIND THE 20 PERCENT OF THE ISSUES THAT CREATE 80 PERCENT OF YOUR SECURITY RISKS WHETHER YOU NEED TO ASSESS SECURITY VULNERABILITIES ON A SMALL HOME OFFICE NETWORK A MEDIUM SIZE CORPORATE NETWORK OR LARGE ENTERPRISE SYSTEMS HACKING FOR DUMMIES PROVIDES THE INFORMATION YOU NEED THIS BOOK INCLUDES THE FOLLOWING FEATURES VARIOUS TECHNICAL AND NONTECHNICAL TESTS AND THEIR DETAILED METHODOLOGIES SPECIFIC COUNTERMEASURES TO PROTECT AGAINST HACKING AND BREACHES BEFORE YOU START TESTING YOUR SYSTEMS FAMILIARIZE YOURSELF WITH THE INFORMATION IN PART 1 SO THAT YOU RE PREPARED FOR THE TASKS AT HAND THE ADAGE IF YOU FAIL TO PLAN YOU PLAN TO FAIL RINGS TRUE FOR THE SECURITY ASSESSMENT PROCESS YOU MUST HAVE A SOLID GAME PLAN IN PLACE IF YOU RE GOING TO BE SUCCESSFUL 2 HACKING FOR DUMMIES FOOLISH ASSUMPTIONS DISCLAIMER THIS BOOK IS INTENDED SOLELY FOR INFORMATION TECHNOLOGY IT AND SECURITY PROFESSIONALS TO TEST THE SECURITY OF THEIR OR THEIR CLIENTS SYSTEMS IN AN AUTHORIZED FASHION IF YOU CHOOSE TO USE THE INFORMATION IN THIS BOOK TO HACK OR BREAK INTO COMPUTER SYSTEMS MALICIOUSLY AND WITHOUT AUTHORIZATION YOU RE ON YOUR OWN NEITHER I THE AUTHOR NOR ANYONE ELSE ASSOCIATED WITH THIS BOOK SHALL BE LIABLE OR RESPONSIBLE FOR ANY UNETHICAL OR CRIMINAL CHOICES THAT YOU MIGHT MAKE AND EXECUTE USING THE METHODOLOGIES AND TOOLS THAT I DESCRIBE OKAY NOW THAT THAT S OUT OF THE WAY LET S GET TO THE GOOD STUFF THIS BOOK IS FOR YOU IF YOU RE A SYSTEMS ADMINISTRATOR INFORMATION SECURITY MANAGER SECURITY CONSULTANT SECURITY AUDITOR COMPLIANCE MANAGER OR OTHERWISE INTERESTED IN FINDING OUT MORE ABOUT EVALUATING COMPUTER SYSTEMS SOFTWARE AND IT OPERATIONS FOR SECURITY FLAWS AND OF COURSE MAKING LONG TERM IMPROVEMENTS I ALSO MAKE A FEW ASSUMPTIONS ABOUT YOU THE ASPIRING INFORMATION TECHNOLOGY IT OR SECURITY PROFESSIONAL YOU RE FAMILIAR WITH BASIC COMPUTER NETWORK AND INFORMATION SECURITY CONCEPTS AND TERMS YOU HAVE ACCESS TO A COMPUTER AND A NETWORK ON WHICH TO USE THESE TECHNIQUES AND TOOLS YOU HAVE THE GO AHEAD FROM YOUR EMPLOYER OR YOUR CLIENT TO PERFORM THE HACKING TECHNIQUES DESCRIBED IN THIS BOOK 3 HACKING FOR DUMMIES ICONS USED IN THIS BOOK THROUGHOUT THIS BOOK YOU LL SEE THE FOLLOWING ICONS IN THE MARGINS THIS ICON POINTS OUT INFORMATION THAT S WORTH COMMITTING TO MEMORY THIS ICON POINTS OUT INFORMATION THAT COULD HAVE A NEGATIVE EFFECT ON YOUR VULNERABILITY AND PENETRATION TESTING EFFORTS SO PLEASE READ IT THIS ICON REFERS TO ADVICE THAT CAN HIGHLIGHT OR CLARIFY AN IMPORTANT POINT THIS ICON POINTS OUT TECHNICAL INFORMATION THAT S INTERESTING BUT NOT VITAL TO YOUR UNDERSTANDING OF THE TOPIC BEING DISCUSSED 4 HACKING FOR DUMMIES