| Introduction |
|
xvi | |
|
|
|
1 | (98) |
|
|
|
3 | (1) |
|
|
|
3 | (1) |
|
|
|
3 | (1) |
|
|
|
3 | (11) |
|
The Various Forms of IP Addresses |
|
|
6 | (1) |
|
Converting a DNS IP Address into a Normal IP Address |
|
|
7 | (1) |
|
Converting a Normal IP Address into Its DWORD Equivalent |
|
|
8 | (3) |
|
Converting a Normal IP Address into Its Binary and Octal Equivalents |
|
|
11 | (2) |
|
Converting a Normal IP Address into Its Hexadecimal Equivalent |
|
|
13 | (1) |
|
|
|
14 | (4) |
|
|
|
15 | (3) |
|
|
|
18 | (3) |
|
|
|
21 | (2) |
|
|
|
22 | (1) |
|
|
|
22 | (1) |
|
Dynamic/Private Port Numbers |
|
|
23 | (1) |
|
Enumerating Remote Systems |
|
|
23 | (5) |
|
Enumeration Through Instant Messaging Software |
|
|
24 | (1) |
|
|
|
24 | (1) |
|
|
|
25 | (2) |
|
|
|
27 | (1) |
|
Enumeration Through Web Sites |
|
|
28 | (13) |
|
|
|
35 | (3) |
|
|
|
38 | (1) |
|
Fadia's Hot Picks for Popular Anonymous Surfing Proxy Servers |
|
|
39 | (2) |
|
Enumeration Through E-mail Headers |
|
|
41 | (3) |
|
|
|
44 | (1) |
|
Enumeration Through Internet Relay Chat (IRC) |
|
|
44 | (3) |
|
|
|
45 | (1) |
|
|
|
45 | (1) |
|
|
|
46 | (1) |
|
|
|
47 | (8) |
|
|
|
49 | (2) |
|
|
|
51 | (1) |
|
|
|
52 | (1) |
|
|
|
53 | (1) |
|
|
|
54 | (1) |
|
|
|
55 | (1) |
|
Network Address Translation (NAT) Networks |
|
|
56 | (3) |
|
|
|
59 | (8) |
|
|
|
60 | (1) |
|
|
|
61 | (1) |
|
The Telnet Proxy Server (Port 23) |
|
|
61 | (2) |
|
The SOCKS Server (Port 1080) and IRC Server (Port 6667) |
|
|
63 | (1) |
|
|
|
63 | (1) |
|
|
|
63 | (1) |
|
Using Squid with a Transparent Proxy |
|
|
63 | (3) |
|
Fadia's Hot Picks for Proxy Servers |
|
|
66 | (1) |
|
|
|
66 | (1) |
|
|
|
67 | (19) |
|
Manual Trial and Error Method |
|
|
68 | (2) |
|
|
|
70 | (1) |
|
|
|
71 | (2) |
|
|
|
73 | (1) |
|
Fadia's Hot Picks for Popular Reverse DNS Lookup Tools |
|
|
74 | (1) |
|
|
|
75 | (5) |
|
|
|
80 | (1) |
|
|
|
80 | (1) |
|
|
|
81 | (2) |
|
|
|
83 | (1) |
|
|
|
83 | (1) |
|
|
|
83 | (1) |
|
Fadia's Hot Picks for Popular E-mail Threats Tools |
|
|
84 | (2) |
|
|
|
86 | (13) |
|
|
|
88 | (1) |
|
Raw Fun with Case Studies |
|
|
89 | (1) |
|
|
|
89 | (1) |
|
|
|
89 | (1) |
|
|
|
90 | (1) |
|
|
|
91 | (1) |
|
|
|
91 | (1) |
|
|
|
92 | (1) |
|
|
|
92 | (1) |
|
|
|
93 | (1) |
|
|
|
94 | (1) |
|
|
|
94 | (1) |
|
|
|
94 | (1) |
|
|
|
95 | (1) |
|
|
|
96 | (1) |
|
|
|
96 | (1) |
|
|
|
97 | (2) |
|
Gathering Information for the Attack |
|
|
99 | (124) |
|
|
|
101 | (8) |
|
|
|
101 | (1) |
|
Fadia's Hot Picks for Ping Sweeping Tools |
|
|
102 | (3) |
|
|
|
105 | (2) |
|
|
|
107 | (1) |
|
Fadia's Hot Picks for Countering Ping Sweeping |
|
|
108 | (1) |
|
|
|
109 | (13) |
|
Types of Traceroute Tools |
|
|
112 | (1) |
|
Text-Based Traceroute Tools |
|
|
112 | (1) |
|
|
|
113 | (1) |
|
|
|
114 | (1) |
|
Network Reconnaissance with Traceroute |
|
|
115 | (1) |
|
Determining Geographic Information |
|
|
115 | (1) |
|
Determining Network Topography |
|
|
116 | (1) |
|
|
|
117 | (1) |
|
Operating System (OS) Detection |
|
|
118 | (2) |
|
Traceroute Countermeasures |
|
|
120 | (2) |
|
|
|
122 | (36) |
|
|
|
122 | (2) |
|
TCP Port Scanning: Different Techniques |
|
|
124 | (1) |
|
|
|
125 | (6) |
|
TCP SYN Scanning (Half-Open Scanning) |
|
|
131 | (6) |
|
|
|
137 | (1) |
|
|
|
138 | (1) |
|
|
|
139 | (1) |
|
TCP Xmas Tree Scanning (Christmas Tree Scanning) |
|
|
140 | (1) |
|
|
|
140 | (1) |
|
Detecting UDP Port Scanning |
|
|
141 | (1) |
|
Coding Your Own UDP Port Scanner |
|
|
141 | (1) |
|
|
|
142 | (1) |
|
Coding Your Own FTP Bounce Attack Port Scanner |
|
|
142 | (3) |
|
Fadia's Hot Picks for Port-Scanning Tools |
|
|
145 | (9) |
|
Raw Fun with Case Studies |
|
|
154 | (3) |
|
General Countermeasures Against Port Scanning |
|
|
157 | (1) |
|
Fadia's Hot Picks for Port Scanning Countermeasures |
|
|
157 | (1) |
|
Daemon-Banner Grabbing and Port Enumeration |
|
|
158 | (18) |
|
Probing the FTP Service, Port 21 |
|
|
159 | (4) |
|
|
|
163 | (1) |
|
Raw Fun with Case Studies |
|
|
163 | (1) |
|
Probing the SMTP Service, Port 25 |
|
|
164 | (2) |
|
|
|
166 | (1) |
|
Raw Fun with Case Studies |
|
|
167 | (1) |
|
Probing the Finger Service, Port 79 |
|
|
167 | (1) |
|
|
|
167 | (1) |
|
Probing the HTTP Service, Port 80 |
|
|
168 | (3) |
|
Fadia's Hot Picks for HTTP Probing Tools |
|
|
171 | (3) |
|
|
|
174 | (1) |
|
Raw Fun with Case Studies |
|
|
174 | (1) |
|
Probing the Identification Protocol on Port 113 |
|
|
175 | (1) |
|
|
|
176 | (1) |
|
Probing the Microsoft RPC Endpoint Mapper on Port 135 |
|
|
176 | (1) |
|
|
|
176 | (1) |
|
Overall Countermeasures and Recommendations |
|
|
176 | (1) |
|
|
|
176 | (15) |
|
Different Types of Scanning Methods |
|
|
177 | (2) |
|
|
|
179 | (1) |
|
|
|
180 | (2) |
|
|
|
182 | (2) |
|
|
|
184 | (2) |
|
|
|
186 | (1) |
|
ICMP Error Message Quoting |
|
|
187 | (1) |
|
ICMP Error Message Quenching |
|
|
187 | (1) |
|
ICMP Error Message Echo Integrity |
|
|
187 | (1) |
|
|
|
187 | (3) |
|
|
|
190 | (1) |
|
Detecting Filtering Devices |
|
|
190 | (1) |
|
|
|
190 | (1) |
|
|
|
191 | (10) |
|
Active Fingerprinting OS Detection |
|
|
192 | (2) |
|
Fadia's Hot Picks for Active Fingerprinting OS Detection |
|
|
194 | (1) |
|
Passive Fingerprinting OS Detection |
|
|
195 | (3) |
|
Raw Fun with Case Studies |
|
|
198 | (1) |
|
|
|
199 | (2) |
|
|
|
201 | (9) |
|
Fadia's Hot_Picks for Sniffers and Detection |
|
|
203 | (1) |
|
Protocol Analysis: Studying and Analyzing Sniffed Packets |
|
|
204 | (1) |
|
|
|
204 | (1) |
|
|
|
205 | (1) |
|
|
|
206 | (1) |
|
Coding Your Own Sniffer in C |
|
|
207 | (2) |
|
|
|
209 | (1) |
|
Getting Information about a Remote System's Routing Tables |
|
|
210 | (9) |
|
|
|
211 | (1) |
|
Understanding the Structure of a UNIX Routing Table |
|
|
212 | (2) |
|
Dissecting a UNIX Routing Table Line by Line |
|
|
214 | (2) |
|
|
|
216 | (1) |
|
Understanding the Structure of a Windows Routing Table |
|
|
216 | (2) |
|
Dissecting a Windows Routing Table Line by Line |
|
|
218 | (1) |
|
|
|
219 | (4) |
|
|
|
223 | (104) |
|
|
|
224 | (28) |
|
|
|
225 | (1) |
|
|
|
226 | (1) |
|
|
|
226 | (1) |
|
|
|
227 | (1) |
|
|
|
227 | (1) |
|
|
|
227 | (2) |
|
Detecting a SYN-Flood Attack |
|
|
229 | (1) |
|
|
|
230 | (1) |
|
|
|
230 | (1) |
|
|
|
231 | (1) |
|
|
|
231 | (1) |
|
|
|
231 | (1) |
|
|
|
231 | (1) |
|
|
|
232 | (1) |
|
|
|
232 | (1) |
|
|
|
233 | (1) |
|
|
|
234 | (5) |
|
|
|
239 | (12) |
|
|
|
251 | (1) |
|
|
|
252 | (12) |
|
IP Spoofing: How It Works |
|
|
253 | (1) |
|
Problems with IP Spoofing |
|
|
254 | (1) |
|
|
|
255 | (1) |
|
|
|
255 | (1) |
|
Networking Basics Involved in IP Spoofing |
|
|
255 | (1) |
|
|
|
255 | (4) |
|
|
|
259 | (1) |
|
Spoofing Your IP Address to Exploit Trust Relationships |
|
|
260 | (1) |
|
Detecting a Trusted System |
|
|
260 | (1) |
|
Disabling the Trusted System |
|
|
261 | (1) |
|
Getting the ISN and Predicting Sequence Numbers |
|
|
261 | (1) |
|
Launching the Actual Attack |
|
|
262 | (1) |
|
Returning the Trusted System to Normal |
|
|
263 | (1) |
|
|
|
263 | (1) |
|
|
|
264 | (4) |
|
|
|
264 | (2) |
|
|
|
266 | (1) |
|
The Not-So-Secure Service-Providing System |
|
|
267 | (1) |
|
The Secure No-Service-Providing System |
|
|
268 | (1) |
|
Password Cracking Attacks |
|
|
268 | (8) |
|
Types of Password Cracking Attacks |
|
|
269 | (1) |
|
|
|
269 | (1) |
|
|
|
270 | (1) |
|
|
|
270 | (1) |
|
Brute Force Password Attacks |
|
|
271 | (1) |
|
Cracking Application Passwords |
|
|
271 | (1) |
|
Cracking Windows NT Passwords |
|
|
272 | (1) |
|
Getting the SAM from the Backup Directory |
|
|
273 | (1) |
|
Obtaining the SAM via Another Operating System |
|
|
274 | (1) |
|
Extracting Hashes from the SAM Hive |
|
|
275 | (1) |
|
|
|
276 | (1) |
|
|
|
277 | (7) |
|
Getting Root on a Linux Machine |
|
|
277 | (1) |
|
|
|
277 | (1) |
|
|
|
278 | (1) |
|
|
|
279 | (1) |
|
Changing the Existing Password |
|
|
279 | (1) |
|
|
|
279 | (1) |
|
|
|
280 | (4) |
|
|
|
284 | (6) |
|
Using Trojans for Spying Purposes |
|
|
286 | (2) |
|
|
|
288 | (1) |
|
|
|
288 | (1) |
|
Monitoring Outgoing Traffic |
|
|
288 | (1) |
|
|
|
288 | (1) |
|
|
|
288 | (1) |
|
|
|
289 | (1) |
|
|
|
290 | (5) |
|
|
|
290 | (1) |
|
|
|
291 | (1) |
|
|
|
291 | (1) |
|
Securing a Standalone Home System |
|
|
291 | (1) |
|
|
|
292 | (3) |
|
|
|
295 | (11) |
|
The Art of Input Validation Attacks |
|
|
296 | (1) |
|
|
|
297 | (1) |
|
Case Studies of Input Validation Loopholes |
|
|
298 | (1) |
|
|
|
298 | (1) |
|
|
|
299 | (1) |
|
|
|
300 | (1) |
|
|
|
300 | (1) |
|
|
|
301 | (2) |
|
Bypassing Security Features |
|
|
303 | (2) |
|
Fadia's Hot Pick for Popular Input Validation Attack Tools |
|
|
305 | (1) |
|
|
|
305 | (1) |
|
|
|
306 | (11) |
|
How Buffer Overflows Work |
|
|
306 | (1) |
|
Types of Buffer Overflows |
|
|
307 | (1) |
|
|
|
307 | (3) |
|
|
|
310 | (2) |
|
|
|
312 | (1) |
|
|
|
312 | (1) |
|
More Examples of Buffer Overflows |
|
|
313 | (1) |
|
|
|
313 | (1) |
|
Oversized Message Header MSN Buffer Overflow |
|
|
314 | (1) |
|
Format String Bug in wu-ftpd 2.6.0 |
|
|
315 | (1) |
|
|
|
315 | (1) |
|
|
|
315 | (1) |
|
Preventing Execution of Malicious Codes |
|
|
316 | (1) |
|
|
|
316 | (1) |
|
|
|
316 | (1) |
|
|
|
316 | (1) |
|
|
|
317 | (1) |
|
|
|
317 | (10) |
|
Removing Footprints from a UNIX System |
|
|
317 | (1) |
|
The Syslog Daemon and the syslog.conf File |
|
|
317 | (3) |
|
Removing Traces from the /etc/utmp File |
|
|
320 | (2) |
|
Removing Traces from the /var/adm/wtmp and /var/adm/lastlogin Files |
|
|
322 | (2) |
|
Removing Traces from the /var/secure,/var/Messages, and /var/xferno Files |
|
|
324 | (1) |
|
|
|
324 | (3) |
|
Secure Protocols, Encryption Algorithms, and File Security |
|
|
327 | (48) |
|
Secure Sockets Layer (SSL) Torn Apart |
|
|
328 | (6) |
|
Determining Whether Your Connection Is Secure |
|
|
329 | (1) |
|
|
|
330 | (3) |
|
|
|
333 | (1) |
|
|
|
334 | (8) |
|
|
|
336 | (2) |
|
Sample Kerberos TGS Session |
|
|
338 | (1) |
|
|
|
339 | (3) |
|
Encryption Algorithms Torn Apart |
|
|
342 | (20) |
|
The RSA Encryption Algorithm |
|
|
344 | (2) |
|
The Blowfish Encryption Algorithm |
|
|
346 | (1) |
|
Fadia's Hot Picks for Blowfish |
|
|
347 | (1) |
|
Data Encryption Standard (DES) Algorithm |
|
|
347 | (1) |
|
Using the DES Algorithm for Encryption |
|
|
348 | (5) |
|
Decrypting the DES Algorithm |
|
|
353 | (1) |
|
Fadia's Hot Picks for DES |
|
|
354 | (1) |
|
|
|
354 | (4) |
|
Fadia's Hot Picks for RC4 |
|
|
358 | (1) |
|
|
|
359 | (2) |
|
Fadia's Hot Picks for MD5 |
|
|
361 | (1) |
|
|
|
361 | (1) |
|
Base64 Encoding Torn Apart |
|
|
362 | (8) |
|
Base64 Encoding: How It Works |
|
|
363 | (3) |
|
|
|
366 | (3) |
|
Fadia's Hot Picks for Base64 Encoding |
|
|
369 | (1) |
|
Securing Files on Your Hard Disk |
|
|
370 | (5) |
|
|
|
370 | (1) |
|
|
|
371 | (1) |
|
Encryption for Masses (E4M) |
|
|
372 | (1) |
|
Securing Data by Encrypting NTFS Partitions |
|
|
372 | (3) |
| Appendix A Well-Known Port Numbers |
|
375 | (4) |
| Appendix B Country Codes |
|
379 | (6) |
| Appendix C Trojan Port Numbers |
|
385 | (8) |
| Appendix D Protocol Numbers List |
|
393 | (4) |
| Index |
|
397 | |