INTRODUCTION TO HACKING

By G. KARAL

TABLE OF CONTENTS INTRODUCTION WHO SHOULD READ THIS BOOK? ABOUT THIS BOOK HOW TO USE THIS BOOK WHAT YOU DON’T NEED TO READ FOOLISH ASSUMPTIONS HOW THIS BOOK IS ORGANIZED PART I: BUILDING THE FOUNDATION FOR ETHICAL HACKING PART II: PUTTING ETHICAL HACKING IN MOTION PART III: HACKING THE NETWORK PART IV: HACKING OPERATING SYSTEMS PART V: HACKING APPLICATIONS PART VI: ETHICAL HACKING AFTERMATH PART VII: THE PART OF TENS ICONS USED IN THIS BOOK WHERE TO GO FROM HERE STRAIGHTENING OUT THE TERMINOLOGY DEFINING HACKER DEFINING ROGUE INSIDER HOW MALICIOUS ATTACKERS BEGET ETHICAL HACKERS UNDERSTANDING THE NEED TO HACK YOUR OWN SYSTEMS UNDERSTANDING THE DANGERS YOUR SYSTEMS FACE NONTECHNICAL ATTACKS NETWORK INFRASTRUCTURE ATTACKS OPERATING SYSTEM ATTACKS APPLICATION AND OTHER SPECIALIZED ATTACKS OBEYING THE ETHICAL HACKING COMMANDMENTS WORKING ETHICALLY RESPECTING PRIVACY NOT CRASHING YOUR SYSTEMS THE ETHICAL HACKING PROCESS FORMULATING YOUR PLAN SELECTING TOOLS EXECUTING THE PLAN EVALUATING RESULTS MOVING ON WHAT YOU’RE UP AGAINST WHO BREAKS INTO COMPUTER SYSTEMS WHY THEY DO IT PLANNING AND PERFORMING ATTACKS MAINTAINING ANONYMITY GETTING YOUR PLAN APPROVED ESTABLISHING YOUR GOALS DETERMINING WHICH SYSTEMS TO HACK CREATING TESTING STANDARDS TIMING SPECIFIC TESTS BLIND VERSUS KNOWLEDGE ASSESSMENTS LOCATION REACTING TO MAJOR VULNERABILITIES THAT YOU FIND SILLY ASSUMPTIONS SETTING THE STAGE SEEING WHAT OTHERS SEE GATHERING PUBLIC INFORMATION MAPPING THE NETWORK SCANNING SYSTEMS HOSTS MODEMS AND OPEN PORTS DETERMINING WHAT’S RUNNING ON OPEN PORTS ASSESSING VULNERABILITIES PENETRATING THE SYSTEM SOCIAL ENGINEERING BEFORE YOU START WHY ATTACKERS USE SOCIAL ENGINEERING UNDERSTANDING THE IMPLICATIONS PERFORMING SOCIAL ENGINEERING ATTACKS FISHING FOR INFORMATION BUILDING TRUST EXPLOITING THE RELATIONSHIP SOCIAL ENGINEERING COUNTERMEASURES POLICIES USER AWARENESS AND TRAINING PHYSICAL SECURITY VULNERABILITIES WHAT TO LOOK FOR BUILDING INFRASTRUCTURE UTILITIES OFFICE LAYOUT AND USAGE NETWORK COMPONENTS AND COMPUTERS PASSWORD VULNERABILITIES ORGANIZATIONAL PASSWORD VULNERABILITIES TECHNICAL PASSWORD VULNERABILITIES CRACKING PASSWORDS CRACKING PASSWORDS THE OLD-FASHIONED WAY HIGH-TECH PASSWORD CRACKING PASSWORD-PROTECTED FILES OTHER WAYS TO CRACK PASSWORDS GENERAL PASSWORD-CRACKING COUNTERMEASURES STORING PASSWORDS POLICY CONSIDERATIONS OTHER CONSIDERATIONS SECURING OPERATING SYSTEMS WINDOWS LINUX AND UNIX MODEM SAFETY GENERAL TELEPHONE SYSTEM VULNERABILITIES ATTACKING SYSTEMS BY WAR DIALING GATHERING INFORMATION SELECTING WAR DIALING TOOLS DIALING IN FROM THE OUTSIDE USING TOOLS ROOTING THROUGH THE SYSTEMS WAR DIALING COUNTERMEASURES PHONE NUMBERS MODEM OPERATION INSTALLATION NETWORK INFRASTRUCTURE VULNERABILITIES CHOOSING TOOLS SCANNERS AND ANALYZERS VULNERABILITY ASSESSMENT SCANNING, POKING, AND PRODDING PORT SCANNERS SNMP SCANNING BANNER GRABBING FIREWALL RULES NETWORK ANALYZERS THE MAC-DADDY ATTACK DENIAL OF SERVICE GENERAL NETWORK DEFENSES UNDERSTANDING THE IMPLICATIONS OF WIRELESS NETWORK VULNERABILITIES CHOOSING YOUR TOOLS WIRELESS LAN DISCOVERY CHECKING FOR WORLDWIDE RECOGNITION SCANNING YOUR LOCAL AIRWAVES WIRELESS NETWORK ATTACKS ENCRYPTED TRAFFIC COUNTERMEASURES AGAINST ENCRYPTED TRAFFIC ATTACKS ROGUE WIRELESS DEVICES COUNTERMEASURES AGAINST ROGUE WIRELESS DEVICES MAC SPOOFING COUNTERMEASURES AGAINST MAC SPOOFING QUEENSLAND DOS ATTACK COUNTERMEASURES AGAINST DOS ATTACKS PHYSICAL SECURITY PROBLEMS COUNTERMEASURES AGAINST PHYSICAL SECURITY PROBLEMS VULNERABLE WIRELESS WORKSTATIONS COUNTERMEASURES AGAINST VULNERABLE WIRELESS WORKSTATIONS DEFAULT CONFIGURATION SETTINGS COUNTERMEASURES AGAINST DEFAULT CONFIGURATION SETTINGS EXPLOITS WINDOWS VULNERABILITIES ESSENTIAL TOOLS FREE MICROSOFT TOOLS ALL-IN-ONE ASSESSMENT TOOLS TASK-SPECIFIC TOOLS INFORMATION GATHERING SYSTEM SCANNING NETBIOS RPC ENUMERATION COUNTERMEASURES AGAINST RPC ENUMERATION NULL SESSIONS HACKS COUNTERMEASURES AGAINST NULL SESSION HACKS SHARE PERMISSIONS WINDOWS DEFAULTS TESTING HARDCORE VULNERABILITY EXPLOITATION USING METASPLOIT USING CORE IMPACT COUNTERMEASURES AGAINST HARDCORE VULNERABILITY EXPLOITS AUTHENTICATED SCANS GENERAL OS VULNERABILITIES ROOTING OUT SENSITIVE TEXT IN NETWORK FILES LINUX VULNERABILITIES COUNTERMEASURES AGAINST SYSTEM SCANNING UNNEEDED SERVICES SEARCHES COUNTERMEASURES AGAINST ATTACKS ON UNNEEDED SERVICES RHOSTS AND HOSTSEQUIV FILES HACKS USING THE RHOSTS AND HOSTSEQUIV FILES COUNTERMEASURES AGAINST RHOSTS AND HOSTSEQUIV FILE ATTACKS NFS NFS HACKS COUNTERMEASURES AGAINST NFS ATTACKS FILE PERMISSIONS FILE PERMISSION HACKS COUNTERMEASURES AGAINST FILE PERMISSION ATTACKS BUFFER OVERFLOWS ATTACKS COUNTERMEASURES AGAINST BUFFER-OVERFLOW ATTACKS PHYSICAL SECURITY PHYSICAL SECURITY HACKS COUNTERMEASURES AGAINST PHYSICAL SECURITY ATTACKS GENERAL SECURITY TESTS PATCHING LINUX DISTRIBUTION UPDATES MULTIPLATFORM UPDATE MANAGERS NETWARE VULNERABILITIES GETTING STARTED SERVER ACCESS METHODS PORT SCANNING NCPQUERY COUNTERMEASURES AGAINST ENUMERATION AUTHENTICATION RCONSOLE SERVER-CONSOLE ACCESS INTRUDER DETECTION ROGUE NLMS CLEARTEXT PACKETS SOLID PRACTICES FOR MINIMIZING NETWARE SECURITY RISKS RENAME ADMIN DISABLE EDIRECTORY BROWSING REMOVE BINDERY CONTEXTS AUDIT THE SYSTEM TCP/IP PARAMETERS PATCH MESSAGING SYSTEM VULNERABILITIES E-MAIL ATTACKS E-MAIL BOMBS BANNERS SMTP ATTACKS GENERAL BEST PRACTICES FOR MINIMIZING E-MAIL SECURITY RISKS INSTANT MESSAGING IM VULNERABILITIES COUNTERMEASURES AGAINST IM VULNERABILITIES VOICE OVER IP VOIP VULNERABILITIES COUNTERMEASURES AGAINST VOIP VULNERABILITIES CHOOSING YOUR WEB APPLICATION TOOLS WEB APPLICATION VULNERABILITIES UNSECURED LOGIN MECHANISMS COUNTERMEASURES AGAINST UNSECURED LOGIN SYSTEMS DIRECTORY TRAVERSAL COUNTERMEASURES AGAINST DIRECTORY TRAVERSALS INPUT FILTERING ATTACKS COUNTERMEASURES AGAINST INPUT ATTACKS MEMORY ATTACKS COUNTERMEASURES AGAINST MEMORY ATTACKS DEFAULT SCRIPT ATTACKS COUNTERMEASURES AGAINST DEFAULT SCRIPT ATTACKS URL FILTER BYPASSING COUNTERMEASURES AGAINST URL FILTER BYPASSING GENERAL SECURITY SCANS FOR WEB APPLICATION VULNERABILITIES DATABASE VULNERABILITIES FINDING DATABASE SERVERS ON THE NETWORK CRACKING DATABASE SERVER PASSWORDS SCANNING DATABASES FOR VULNERABILITIES GENERAL BEST PRACTICES FOR MINIMIZING SECURITY RISKS OBSCURITY FIREWALLS PULLING THE RESULTS TOGETHER PRIORITIZING VULNERABILITIES REPORTING METHODS TURNING YOUR REPORTS INTO ACTION PATCHING FOR PERFECTION PATCH MANAGEMENT PATCH AUTOMATION HARDENING YOUR SYSTEMS ASSESSING YOUR SECURITY INFRASTRUCTURE AUTOMATING THE ETHICAL HACKING PROCESS MONITORING MALICIOUS USE OUTSOURCING ETHICAL HACKING INSTILLING A SECURITY-AWARE MINDSET KEEPING UP WITH OTHER SECURITY ISSUES