Hacking Exposed : Network Security Secrets and Solutions

by McClure, Stuart; Scambray, Joel; Kurtz, George

• ISBN13: 9780072193817
• ISBN10: 0072193816
• Edition: 3rd
• Format: Paperback
• Copyright: 2001-10-01
• Publisher: McGraw-Hill Osborne Media

Summary

The new edition of this powerful best-seller contains a CD-ROM with links to security tools mentioned in the book, key security tools for download from the CD, and a password database. Inside the book, you'll also get all-new security information on 802.11 (Wireless) hacking, Windows XP, Windows.NET Server (code named Whistler), and IIS 5--plus a whole lot more!

Table of Contents

Foreword	xvii
Commentary on the State of Network Security	xx
Acknowledgments	xxiii
Introduction	xxv
Part I Casing the Establishment
Case Study: Giving Up the Goods	2	(1)
Footprinting	3	(26)
What Is Footprinting?	4	(1)
Why Is Footprinting Necessary?	4	(1)
Internet Footprinting	4	(24)
Step 1. Determine the Scope of Your Activities	6	(4)
Step 2. Network Enumeration	10	(9)
Step 3. DNS Interrogation	19	(5)
Step 4. Network Reconnaissance	24	(4)
Summary	28	(1)
Scanning	29	(34)
Determining If the System Is Alive	30	(7)
Determining Which Services Are Running or Listening	37	(17)
Scan Types	38	(2)
Identifying TCP and UDP Services Running	40	(6)
Windows-Based Port Scanners	46	(4)
Port Scanning Breakdown	50	(4)
Detecting the Operating System	54	(6)
Active Stack Fingerprinting	54	(4)
Passive Stack Fingerprinting	58	(2)
The Whole Enchilada: Automated Discovery Tools	60	(1)
Summary	61	(2)
Enumeration	63	(52)
Windows NT/2000 Enumeration	64	(31)
NT/2000 Network Enumeration	68	(10)
NT/2000 Host Enumeration	78	(13)
NT/2000 Applications and Banner Enumeration	91	(4)
Novell Enumeration	95	(5)
Browsing the Network Neighborhood	95	(5)
UNIX Enumeration	100	(9)
BGP Route Enumeration	109	(3)
Summary	112	(2)
Part II System Hacking
Case Study: Stop and Smell the Roses on the Quest for Root	114	(1)
Hacking Windows 95/98, Me, and XP Home Edition	115	(26)
Win 9x Remote Exploits	117	(12)
Direct Connection to Win 9x Shared Resources	117	(6)
Win 9x Backdoor Servers and Trojans	123	(5)
Known Server Application Vulnerabilities	128	(1)
Win 9x Denial of Service	128	(1)
Win 9 x Local Exploits	129	(6)
Windows Millennium Edition (Me)	135	(2)
Win Me Remote Attacks	136	(1)
Win Me Local Attacks	136	(1)
Windows XP Home Edition	137	(2)
Internet Connection Firewall (ICF)	138	(1)
Integrated MS Passport Single Login for the Internet	139	(1)
Remote Control and Management	139	(1)
Summary	139	(2)
Hacking Windows NT	141	(78)
Overview	143	(1)
Where We're Headed	143	(1)
What About Windows 2000?	143	(1)
The Quest for Administrator	144	(31)
Remote Exploits: Denial of Service and Buffer Overflows	160	(4)
Privilege Escalation	164	(11)
Consolidation of Power	175	(36)
Exploiting Trust	185	(5)
Sniffers	190	(4)
Remote Control and Back Doors	194	(10)
Port Redirection	204	(3)
General Countermeasures to Privileged Compromise	207	(4)
Rootkit: The Ultimate Compromise	211	(2)
Covering Tracks	213	(3)
Disabling Auditing	214	(1)
Clearing the Event Log	214	(1)
Hiding Files	215	(1)
Summary	216	(3)
Hacking Windows 2000	219	(56)
Footprinting	220	(1)
Scanning	221	(5)
Enumeration	226	(2)
Penetration	228	(9)
NetBIOS-SMB Password Guessing	229	(1)
Eavesdropping on Password Hashes	229	(1)
SMBRelay	229	(8)
Attacks Against IIS 5	237	(1)
Remote Buffer Overflows	237	(1)
Denial of Service	237	(4)
Privilege Escalation	241	(5)
Pilfering	246	(12)
Grabbing the Windows 2000 Password Hashes	246	(5)
The Encrypting File System (EFS)	251	(6)
Exploiting Trust	257	(1)
Covering Tracks	258	(2)
Disabling Auditing	259	(1)
Clearing the Event Log	259	(1)
Hiding Files	259	(1)
Back Doors	260	(4)
Startup Manipulation	260	(2)
Remote Control	262	(2)
Keystroke Loggers	264	(1)
General Countermeasures: New Windows Security Tools	264	(5)
runas	267	(2)
The Future of Windows 2000	269	(1)
.NET Framework	269	(1)
Codename Whistler	269	(3)
Whistler Versions	269	(1)
Whistler Security Features	270	(2)
A Note on Raw Sockets and Other Unsubstantiated Claims	272	(1)
Summary	272	(3)
Novell NetWare Hacking	275	(38)
Attaching but Not Touching	276	(2)
Enumerate Bindery and Trees	278	(6)
Opening the Unlocked Doors	284	(2)
Authenticated Enumeration	286	(5)
Gaining Admin	291	(3)
Application Vulnerabilities	294	(2)
Spoofing Attacks (Pandora)	296	(3)
Once You Have Admin on a Server	299	(2)
Owning the NDS Files	301	(5)
Log Doctoring	306	(5)
Console Logs	308	(3)
Summary	311	(2)
Hacking UNIX	313	(80)
The Quest for Root	314	(1)
A Brief Review	314	(1)
Vulnerability Mapping	315	(1)
Remote Access vs. Local Access	315	(1)
Remote Access	316	(38)
Data Driven Attacks	320	(7)
I Want My Shell	327	(5)
Common Types of Remote Attacks	332	(22)
Local Access	354	(18)
After Hacking Root	372	(13)
Rootkits	372	(12)
Rootkit Recovery	384	(1)
Summary	385	(5)
Part III Network Hacking
Case Study: Using All the Dirty Tricks to Get In	390	(3)
Dial-Up, PBX, Voicemail, and VPN Hacking	393	(48)
Preparing to Dial Up	394	(2)
Wardialing	396	(17)
Hardware	396	(1)
Legal Issues	397	(1)
Peripheral Costs	398	(1)
Software	398	(15)
Brute Force Scripting---The Home-Grown Way	413	(11)
PBX Hacking	424	(4)
Voicemail Hacking	428	(6)
Virtual Private Network (VPN) Hacking	434	(4)
Summary	438	(3)
Network Devices	441	(38)
Discovery	442	(10)
Detection	442	(7)
SNMP	449	(3)
Back Doors	452	(10)
Default Accounts	452	(3)
Lower the Gates (Vulnerabilities)	455	(7)
Shared vs. Switched	462	(12)
Detecting the Media You're On	463	(1)
Passwords on a Silver Platter: Dsniff	464	(2)
Sniffing on a Network Switch	466	(8)
Wireless Network Hacking	474	(4)
IEEE 802.11 Wireless LAN	475	(2)
WAP (Cellular Phone)	477	(1)
Summary	478	(1)
Firewalls	479	(24)
Firewall Landscape	480	(1)
Firewall Identification	480	(8)
Advanced Firewall Discovery	485	(3)
Scanning Through Firewalls	488	(5)
Packet Filtering	493	(3)
Application Proxy Vulnerabilities	496	(4)
WinGate Vulnerabilities	498	(2)
Summary	500	(3)
Denial of Service (DoS) Attacks	503	(26)
Motivation of DoS Attackers	504	(1)
Types of DoS Attacks	505	(3)
Bandwidth Consumption	505	(1)
Resource Starvation	506	(1)
Programming Flaws	506	(1)
Routing and DNS Attacks	506	(2)
Generic DoS Attacks	508	(5)
Sites Under Attack	510	(3)
UNIX and Windows NT DoS	513	(11)
Remote DoS Attacks	514	(4)
Distributed Denial of Service Attacks	518	(5)
Local DoS Attacks	523	(1)
Summary	524	(4)
Part IV Software Hacking
Case Study: Silent and Deadly	528	(1)
Remote Control Insecurities	529	(24)
Discovering Remote Control Software	530	(1)
Connecting	531	(1)
Weaknesses	532	(7)
Virtual Network Computing (VNC)	539	(4)
Microsoft Terminal Server and Citrix ICA	543	(8)
Server	543	(1)
Clients	543	(1)
Data Transmission	544	(1)
Finding Targets	544	(2)
Attacking Terminal Server	546	(3)
Additional Security Considerations	549	(1)
Resources	550	(1)
Summary	551	(2)
Advanced Techniques	553	(38)
Session Hijacking	554	(3)
Back Doors	557	(21)
Trojans	578	(3)
Cryptography	581	(3)
Terminology	581	(1)
Classes of Attacks	582	(1)
Secure Shell (SSH) Attacks	582	(2)
Subverting the System Environment: Rootkits and Imaging Tools	584	(3)
Social Engineering	587	(2)
Summary	589	(2)
Web Hacking	591	(44)
Web Pilfering	592	(4)
Finding Well-Known Vulnerabilities	596	(5)
Automated Scripts, for All Those ``Script Kiddies''	596	(2)
Automated Applications	598	(3)
Script Inadequacies: Input Validation Attacks	601	(19)
CGI Vulnerabilities	606	(2)
IIS and Active Server Pages (ASP) Vulnerabilities	608	(10)
Cold Fusion Vulnerabilities	618	(2)
Buffer Overflows	620	(8)
Poor Web Design	628	(3)
Web Hacking Tools	631	(3)
Summary	634	(1)
Hacking the Internet User	635	(68)
Malicious Mobile Code	637	(19)
Microsoft Active X	637	(10)
Java Security Holes	647	(4)
Beware the Cookie Monster	651	(3)
Internet Explorer HTML Frame Vulnerabilities	654	(2)
SSL Fraud	656	(1)
Email Hacking	657	(30)
Mail Hacking 101	658	(4)
Executing Arbitrary Code Through Email	662	(12)
Outlook Address Book Worms	674	(3)
File Attachment Attacks	677	(3)
Writing Attachments to Disk Without User Intervention	680	(5)
Invoking Outbound Client Connections	685	(2)
IRC Hacking	687	(2)
Napster Hacking with Wrapster	689	(1)
Global Countermeasures to Internet User Hacking	690	(1)
Summary	691	(4)
Part V Appendixes
A Ports	695	(6)
B Top 14 Security Vulnerabilities	701	(2)
Index	703