Anti-Hacker Tool Kit, Second Edition

by Shema, Mike; Johnson, Bradley C.

• ISBN13: 9780072230208
• ISBN10: 0072230207
• Edition: 2nd
• Format: Paperback
• Copyright: 2003-12-22
• Publisher: McGraw-Hill Osborne Media

Summary

The Anti-Hacker Tool Kit, Second Edition is an invaluable resource to any network professional looking to protect his/her system and a must-have companion to Hacking Exposed.

Author Biography

Mike Shema is the Director of Research for NT Objectives, Inc. Bradley C. Johnson is a network security specialist

Table of Contents

Acknowledgments	xxi
Introduction	xxiii
Part I Multifunctional and Miscellaneous Tools
Netcat and Cryptcat	3	(24)
Netcat	4	(21)
Implementation	4	(5)
Netcat's 101 Uses	9	(16)
Cryptcat	25	(2)
The X Window System	27	(10)
Choosing a Window Manager	28	(1)
A Client/Server Model	28	(1)
How Remote X Servers and Clients Communicate	28	(2)
Securing X, Part I: Using xhost and xauth	30	(3)
Xhost	30	(1)
Xauth	31	(2)
Securing X, Part II: Tunneling X Traffic Through SSH	33	(1)
The Other Important Players	34	(2)
Xdm	35	(1)
Xinit and Startx	35	(1)
Xserver	35	(1)
For More Information	36	(1)
Now You Know	36	(1)
Emulators	37	(26)
VMware	38	(12)
Download and Installation	38	(1)
Configuration	39	(8)
Implementation	47	(3)
Open-Source Alternatives	50	(1)
Cygwin	50	(13)
Download and Installation	50	(2)
Implementation	52	(3)
Directory Structure and File Permissions	55	(1)
Running Applications	56	(2)
XFree86 for Cygwin	58	(5)
Part II Tools for Auditing and Defending the Hosts
Port Scanners	63	(48)
Nmap	64	(21)
Implementation	64	(21)
THC-Amap	85	(5)
Implementation	85	(5)
NetScanTools	90	(4)
Implementation	90	(4)
SuperScan	94	(6)
Implementation	95	(5)
IPEye	100	(1)
Implementation	100	(1)
ScanLine	101	(5)
Implementation	101	(5)
WUPS	106	(1)
Implementation	107	(1)
Udp_scan	107	(4)
Installation	108	(1)
Implementation	108	(3)
Unix Enumeration Tools	111	(16)
Samba: Server Message Block Implementation for Unix	112	(3)
Smbclient	112	(2)
Rpcclient	114	(1)
Nmblookup	114	(1)
Automating the Process	115	(1)
Rpcinfo	115	(2)
Implementation	116	(1)
Problems with RPC	117	(1)
showmount	117	(1)
Implementation	117	(1)
R-Tools	118	(2)
Rlogin, Rsh, and Rcp	119	(1)
R-Tools Insecurity	119	(1)
Rwho	119	(1)
Rexec	120	(1)
Finger	120	(3)
Implementation	120	(1)
Why Run a Finger Daemon?	121	(2)
who, w, and last	123	(4)
who	123	(1)
w	124	(1)
last	124	(3)
Windows Enumeration Tools	127	(42)
Net Tools	129	(4)
Implementation	129	(4)
Nbtstat	133	(5)
Implementation	134	(3)
Retrieving a MAC Address	137	(1)
Winfingerprint	138	(2)
Implementation	138	(2)
Running a Development Build	140	(1)
GetUserInfo	140	(2)
Implementation	140	(2)
Enum	142	(4)
Implementation	142	(4)
PsTools	146	(19)
Implementation	147	(18)
HFNetChk	165	(4)
Implementation	165	(4)
Web Hacking Tools	169	(38)
Vulnerability Scanners	170	(14)
Nikto	170	(8)
Stealth	178	(6)
All-Purpose Tools	184	(10)
Curl	184	(3)
OpenSSL	187	(4)
Stunnel	191	(3)
Application Inspection	194	(13)
Achilles	195	(2)
WebSleuth	197	(2)
Paros Proxy	199	(4)
Wget	203	(4)
Password Cracking / Brute-Force Tools	207	(36)
PassFilt.dll and Windows Password Policies	208	(2)
Implementation	208	(2)
PAM and Unix Password Policies	210	(4)
Linux Implementation	211	(3)
OpenBSD login.conf	214	(2)
Implementation	214	(2)
John the Ripper	216	(12)
Implementation	217	(11)
L0phtCrack	228	(5)
Implementation	229	(4)
Grabbing Windows Password Hashes	233	(3)
Pwdump	234	(1)
Lsadump2	235	(1)
Active Brute-Force Tools	236	(7)
THC-Hydra	237	(6)
Host Hardening	243	(10)
Titan	244	(3)
Download and Installation	244	(2)
Implementation	246	(1)
Msec	247	(6)
Implementation	247	(6)
Backdoors and Remote Access Tools	253	(36)
VNC	255	(6)
Implementation	255	(6)
Netbus	261	(4)
Implementation	261	(4)
Back Orifice	265	(5)
Implementation	265	(5)
SubSeven	270	(5)
Implementation	270	(5)
Loki	275	(4)
Implementation	278	(1)
Stcpshell	279	(3)
Implementation	280	(2)
Knark	282	(7)
Implementation	282	(7)
Simple Source Auditing Tools	289	(12)
Flawfinder	290	(5)
Implementation	290	(5)
RATS	295	(6)
Implementation	295	(6)
Combination System Auditing Tools	301	(62)
Nessus	302	(16)
Installation	303	(1)
Implementation	304	(14)
STAT	318	(9)
Implementation	318	(9)
Retina	327	(6)
Implementation	328	(5)
Internet Scanner	333	(9)
Implementation	333	(9)
Tripwire	342	(21)
Implementation: The Open-Source Edition	342	(9)
Implementation: The Commercial Edition	351	(6)
Securing Your Files with Tripwire	357	(6)
Part III Tools for Auditing and Defending Your Network
Firewalls	363	(48)
Firewalls and Packet Filters---the Basics	364	(9)
What Is a Firewall?	364	(1)
What's the Difference Between a Firewall and a Packet Filter?	365	(1)
How Do Firewalls Protect Networks?	365	(1)
What Type of Packet Characteristics Can You Filter in a Ruleset?	366	(1)
What's the Difference Between Stateless and Stateful Firewalls?	367	(1)
What Are Network Address Translation and Port Forwarding?	368	(3)
What Are Virtual Private Networks?	371	(1)
What About Demilitarized Zones?	371	(2)
When Do We Get to Talk About Actual Firewall Products?	373	(1)
Freeware Firewalls	373	(31)
Ipchains	374	(9)
Iptables (Netfilter)	383	(10)
IPFW	393	(10)
Still Others	403	(1)
Commercial Firewalls	404	(7)
Linksys SOHO Firewall Units	404	(1)
SonicWALL	405	(3)
CiscoPIX	408	(2)
Still Others	410	(1)
Network Reconnaissance Tools	411	(28)
whois/fwhois	412	(5)
Implementation	412	(5)
Host, Dig, and Nslookup	417	(3)
Implementation	417	(3)
Ping	420	(3)
Implementation	420	(3)
Fping	423	(3)
Implementation	424	(2)
Traceroute	426	(4)
Implementation	428	(2)
Hping	430	(9)
Implementation	430	(9)
Port Redirection	439	(14)
Datapipe	441	(3)
Implementation	441	(3)
FPipe	444	(8)
Implementation	444	(8)
WinRelay	452	(1)
Implementation	452	(1)
Sniffers	453	(60)
Sniffers Overview	454	(1)
BUTTSniffer	455	(10)
Implementation	456	(5)
Disk Dump Mode	461	(4)
Tcpdump and WinDump	465	(13)
Installation	465	(1)
Implementation	466	(12)
Ethereal	478	(11)
Implementation	478	(11)
Dsniff	489	(7)
Installation	489	(1)
Implementation: The Tools	489	(7)
Dangerous Tools	496	(1)
Ettercap	496	(3)
Installation	496	(1)
Implementation	496	(2)
Potential for Disaster	498	(1)
Snort: An Intrusion-Detection System	499	(14)
Installation and Implementation	500	(5)
Snort Plug-Ins	505	(1)
So Much More	505	(8)
Wireless Tools	513	(18)
NetStumbler	515	(3)
Implementation	515	(3)
AiroPeek	518	(2)
Implementation	518	(2)
Wellenreiter	520	(1)
Implementation	520	(1)
Kismet	521	(10)
Implementation	522	(6)
Expanding Kismet's Capabilities	528	(3)
War Dialers	531	(20)
ToneLoc	532	(10)
Implementation: Creating the tl.cfg file	532	(4)
Implementation: Running a Scan	536	(1)
Implementation: Navigating the ToneLoc Interface	537	(2)
.dat File Techniques	539	(3)
THC-Scan	542	(7)
Implementation: Configuring THC-Scan	543	(2)
Implementation: Running THC-Scan	545	(2)
Implementation: Navigating THC-Scan	547	(1)
Implementation: Manipulating THC-Scan .dat Files	547	(2)
Beyond the Connect String	549	(2)
TCP/IP Stack Tools	551	(20)
ISIC: IP Stack Integrity Checker	552	(7)
Implementation	552	(5)
Tips and Tricks	557	(2)
Iptest	559	(3)
Implementation	559	(3)
Nemesis: Packet-Weaving 101	562	(6)
Implementation	562	(6)
Beyond the Command Line	568	(3)
Part IV Tools for Computer Forensics and Incident Response
Creating a Bootable Environment and Live Response Tool Kit	571	(44)
Trinux	572	(5)
Implementation	572	(5)
Windows Live Response Tool Kit	577	(22)
cmd.exe	578	(1)
Fport	578	(2)
Netstat	580	(3)
Nbtstat	583	(1)
ARP	583	(1)
Pslist	584	(2)
kill	586	(1)
dir	586	(2)
Auditpol	588	(1)
Loggedon	589	(1)
NTLast	590	(1)
Dump Event Log (dumpel)	590	(2)
Regdmp	592	(2)
SFind	594	(1)
Md5sum	594	(5)
Unix Live Response Tool Kit	599	(16)
bash	600	(1)
netstat	600	(2)
ARP	602	(1)
Is	602	(2)
w	604	(1)
last and lastb	605	(1)
Lsof	605	(2)
ps	607	(4)
kill	611	(1)
Md5sum	611	(1)
Carbonite	612	(3)
Commercial Forensic Duplication Tool Kits	615	(36)
EnCase	616	(9)
Implementation	616	(9)
Format: Creating a Trusted Boot Disk	625	(1)
Implementation	625	(1)
PDBLOCK: Write Blocking Your Source Drives	626	(1)
Implementation	626	(1)
Safeback	627	(10)
Implementation	627	(10)
SnapBack	637	(4)
Implementation	637	(4)
Ghost	641	(10)
Implementation	642	(9)
Open-Source Forensic Duplication Tool Kits	651	(20)
dd: A Forensic Duplication Tool	653	(6)
Implementation	653	(6)
dd: A Hard Drive Cleansing Tool	659	(1)
Implementation	659	(1)
Losetup: Transforming a Regular File into a Device on Linux	660	(1)
Implementation	660	(1)
The Enhanced Linux Loopback Device	661	(3)
Implementation	662	(2)
Vnode: Transforming a Regular File into a Device on FreeBSD	664	(2)
Implementation	664	(2)
Md5sum and md5: Validating the Evidence Collected	666	(5)
Implementation	666	(5)
Tool Kits to Aid in Forensic Analysis	671	(40)
The Forensic Toolkit	672	(12)
Implementation	672	(12)
EnCase	684	(14)
Implementation	684	(14)
The Coroner's Toolkit	698	(13)
Implementation	698	(13)
Tools to Aid in Internet Activity Reconstruction	711	(32)
Outlook Express	712	(2)
Implementation	712	(2)
Outlook	714	(1)
Implementation	714	(1)
Netscape Navigator/Communicator	715	(5)
Implementation	716	(4)
America Online Client	720	(4)
Implementation	720	(4)
Unix Mailboxes	724	(2)
Implementation	724	(2)
Paraben's E-mail Examiner	726	(4)
Implementation	726	(4)
IE History	730	(3)
Implementation	730	(3)
X-Ways Trace	733	(10)
Implementation	733	(10)
Generalized Editors and Viewers	743	(52)
The file Command	744	(1)
Implementation	744	(1)
Hexdump	745	(4)
Implementation	745	(4)
Hexedit	749	(4)
Implementation	750	(3)
Vi	753	(4)
Implementation	753	(4)
Frhed	757	(3)
Implementation	757	(3)
Xvi32	760	(1)
Implementation	760	(1)
WinHex	761	(4)
Implementation	761	(4)
Quick View Plus	765	(4)
Implementation	766	(3)
Midnight Commander	769	(10)
Implementation	769	(10)
Part V Appendixes
A Useful Charts and Diagrams	779	(12)
Protocol Headers	780	(1)
Ethernet Headers	780	(1)
Address Resolution Protocol (ARP) Headers	781	(1)
Internet Protocol (IP) Headers	781	(1)
Transmission Control Protocol (TCP) Headers	782	(1)
User Datagram Protocol (UDP) Headers	782	(1)
Internet Control Message Protocol Headers	782	(3)
ASCII Table	785	(6)
B About the CD-ROM	791	(4)
How to Use the CD-ROM	792	(1)
Security Tools on the CD	792	(1)
Links to More Tools	793	(1)
Problems with the CD	793	(2)
Index	795