[eBook Code] Hands on Hacking (eBook Code, 1st)

· 제목 : [eBook Code] Hands on Hacking (eBook Code, 1st) (Become an Expert at Next Gen Penetration Testing and Purple Teaming)
· 분류 : 외국도서 > 컴퓨터 > 네트워킹 > 보안
· ISBN : 9781119561514
· 쪽수 : 608쪽
· 출판일 : 2020-08-20

Foreword xviii

Introduction xx

Chapter 1 Hacking a Business Case 1

All Computers are Broken 2

The Stakes 4

What’s Stolen and Why It’s Valuable 4

The Internet of Vulnerable Things 4

Blue, Red, and Purple Teams 5

Blue Teams 5

Red Teams 5

Purple Teams 7

Hacking is Part of Your Company’s Immune System 9

Summary 11

Notes 12

Chapter 2 Hacking Ethically and Legally 13

Laws That Affect Your Work 14

Criminal Hacking 15

Hacking Neighborly 15

Legally Gray 16

Penetration Testing Methodologies 17

Authorization 18

Responsible Disclosure 19

Bug Bounty Programs 20

Legal Advice and Support 21

Hacker House Code of Conduct 22

Summary 22

Chapter 3 Building Your Hack Box 23

Hardware for Hacking 24

Linux or BSD? 26

Host Operating Systems 27

Gentoo Linux 27

Arch Linux 28

Debian 28

Ubuntu 28

Kali Linux 29

Verifying Downloads 29

Disk Encryption 31

Essential Software 33

Firewall 34

Password Manager 35

Email 36

Setting Up VirtualBox 36

Virtualization Settings 37

Downloading and Installing VirtualBox 37

Host-Only Networking 37

Creating a Kali Linux VM 40

Creating a Virtual Hard Disk 42

Inserting a Virtual CD 43

Virtual Network Adapters 44

Labs 48

Guest Additions 51

Testing Your Virtual Environment 52

Creating Vulnerable Servers 53

Summary 54

Chapter 4 Open Source Intelligence Gathering 55

Does Your Client Need an OSINT Review? 56

What are You Looking For? 57

Where Do You Find It? 58

OSINT Tools 59

Grabbing Email Addresses from Google 59

Google Dorking the Shadows 62

A Brief Introduction to Passwd and Shadow Files 62

The Google Hacking Database 65

Have You Been “Pwned” Yet? 66

OSINT Framework Recon-ng 67

Recon-ng Under the Hood 74

Harvesting the Web 75

Document Metadata 76

Maltego 80

Social Media Networks 81

Shodan 83

Protecting Against OSINT 85

Summary 86

Chapter 5 The Domain Name System 87

The Implications of Hacking DNS 87

A Brief History of DNS 88

The DNS Hierarchy 88

A Basic DNS Query 89

Authority and Zones 92

DNS Resource Records 92

BIND9 95

DNS Hacking Toolkit 98

Finding Hosts 98

WHOIS 98

Brute-Forcing Hosts with Recon-ng 100

Host 101

Finding the SOA with Dig 102

Hacking a Virtual Name Server 103

Port Scanning with Nmap 104

Digging for Information 106

Specifying Resource Records 108

Information Leak CHAOS 111

Zone Transfer Requests 113

Information-Gathering Tools 114

Fierce 115

Dnsrecon 116

Dnsenum 116

Searching for Vulnerabilities and Exploits 118

Searchsploit 118

Other Sources 119

DNS Traffic Amplification 120

Metasploit 121

Carrying Out a Denial-of-Service Attack 125

DoS Attacks with Metasploit 126

DNS Spoofi ng 128

DNS Cache Poisoning 129

DNS Cache Snooping 131

DNSSEC 131

Fuzzing 132

Summary 134

Chapter 6 Electronic Mail 135

The Email Chain 135

Message Headers 137

Delivery Status Notifications 138

The Simple Mail Transfer Protocol 141

Sender Policy Framework 143

Scanning a Mail Server 145

Complete Nmap Scan Results (TCP) 149

Probing the SMTP Service 152

Open Relays 153

The Post Office Protocol 155

The Internet Message Access Protocol 157

Mail Software 158

Exim 159

Sendmail 159

Cyrus 160

PHP Mail 160

Webmail 161

User Enumeration via Finger 162

Brute-Forcing the Post Office 167

The Nmap Scripting Engine 169

CVE-2014-0160: The Heartbleed Bug 172

Exploiting CVE-2010-4345 180

Got Root? 183

Upgrading Your Shell 184

Exploiting CVE-2017-7692 185

Summary 188

Chapter 7 The World Wide Web of Vulnerabilities 191

The World Wide Web 192

The Hypertext Transfer Protocol 193

HTTP Methods and Verbs 195

HTTP Response Codes 196

Stateless 198

Cookies 198

Uniform Resource Identifiers 200

LAMP: Linux, Apache, MySQL, and PHP 201

Web Server: Apache 202

Database: MySQL 203

Server-Side Scripting: PHP 203

Nginx 205

Microsoft IIS 205

Creepy Crawlers and Spiders 206

The Web Server Hacker’s Toolkit 206

Port Scanning a Web Server 207

Manual HTTP Requests 210

Web Vulnerability Scanning 212

Guessing Hidden Web Content 216

Nmap 217

Directory Busting 218

Directory Traversal Vulnerabilities 219

Uploading Files 220

WebDAV 220

Web Shell with Weevely 222

HTTP Authentication 223

Common Gateway Interface 225

Shellshock 226

Exploiting Shellshock Using Metasploit 227

Exploiting Shellshock with cURL and Netcat 228

SSL, TLS, and Heartbleed 232

Web Administration Interfaces 238

Apache Tomcat 238

Webmin 240

phpMyAdmin 241

Web Proxies 242

Proxychains 243

Privilege Escalation 245

Privilege Escalation Using DirtyCOW 246

Summary 249

Chapter 8 Virtual Private Networks 251

What is a VPN? 251

Internet Protocol Security 253

Internet Key Exchange 253

Transport Layer Security and VPNs 254

User Databases and Authentication 255

SQL Database 255

RADIUS 255

LDAP 256

PAM 256

TACACS+ 256

The NSA and VPNs 257

The VPN Hacker’s Toolkit 257

VPN Hacking Methodology 257

Port Scanning a VPN Server 258

Hping3 259

UDP Scanning with Nmap 261

IKE-scan 262

Identifying Security Association Options 263

Aggressive Mode 265

OpenVPN 267

LDAP 275

OpenVPN and Shellshock 277

Exploiting CVE-2017-5618 278

Summary 281

Chapter 9 Files and File Sharing 283

What is Network-Attached Storage? 284

File Permissions 284

NAS Hacking Toolkit 287

Port Scanning a File Server 288

The File Transfer Protocol 289

The Trivial File Transfer Protocol 291

Remote Procedure Calls 292

RPCinfo 294

Server Message Block 295

NetBIOS and NBT 296

Samba Setup 298

Enum4Linux 299

SambaCry (CVE-2017-7494) 303

Rsync 306

Network File System 308

NFS Privilege Escalation 309

Searching for Useful Files 311

Summary 312

Chapter 10 UNIX 315

UNIX System Administration 316

Solaris 316

UNIX Hacking Toolbox 318

Port Scanning Solaris 319

Telnet 320

Secure Shell 324

RPC 326

CVE-2010-4435 329

CVE-1999-0209 329

CVE-2017-3623 330

Hacker’s Holy Grail EBBSHAVE 331

EBBSHAVE Version 4 332

EBBSHAVE Version 5 335

Debugging EBBSHAVE 335

R-services 338

The Simple Network Management Protocol 339

Ewok 341

The Common UNIX Printing System 341

The X Window System 343

Cron and Local Files 347

The Common Desktop Environment 351

EXTREMEPARR 351

Summary 353

Chapter 11 Databases 355

Types of Databases 356

Flat-File Databases 356

Relational Databases 356

Nonrelational Databases 358

Structured Query Language 358

User-Defined Functions 359

The Database Hacker’s Toolbox 360

Common Database Exploitation 360

Port Scanning a Database Server 361

MySQL 362

Exploring a MySQL Database 362

MySQL Authentication 373

PostgreSQL 374

Escaping Database Software 377

Oracle Database 378

MongoDB 381

Redis 381

Privilege Escalation via Databases 384

Summary 392

Chapter 12 Web Applications 395

The OWASP Top 10 396

The Web Application Hacker’s Toolkit 397

Port Scanning a Web Application Server 397

Using an Intercepting Proxy 398

Setting Up Burp Suite Community Edition 399

Using Burp Suite Over HTTPS 407

Manual Browsing and Mapping 412

Spidering 415

Identifying Entry Points 418

Web Vulnerability Scanners 418

Zed Attack Proxy 419

Burp Suite Professional 420

Skipfish 421

Finding Vulnerabilities 421

Injection 421

SQL Injection 422

SQLmap 427

Drupageddon 433

Protecting Against SQL Injection 433

Other Injection Flaws 434

Broken Authentication 434

Sensitive Data Exposure 436

XML External Entities 437

CVE-2014-3660 437

Broken Access Controls 439

Directory Traversal 440

Security Misconfiguration 441

Error Pages and Stack Traces 442

Cross-Site Scripting 442

The Browser Exploitation Framework 445

More about XSS Flaws 450

XSS Filter Evasion 450

Insecure Deserialization 452

Known Vulnerabilities 453

Insufficient Logging and Monitoring 453

Privilege Escalation 454

Summary 455

Chapter 13 Microsoft Windows 457

Hacking Windows vs. Linux 458

Domains, Trees, and Forests 458

Users, Groups, and Permissions 461

Password Hashes 461

Antivirus Software 462

Bypassing User Account Control 463

Setting Up a Windows VM 464

A Windows Hacking Toolkit 466

Windows and the NSA 467

Port Scanning Windows Server 467

Microsoft DNS 469

Internet Information Services 470

Kerberos 471

Golden Tickets 472

NetBIOS 473

LDAP 474

Server Message Block 474

ETERNALBLUE 476

Enumerating Users 479

Microsoft RPC 489

Task Scheduler 497

Remote Desktop 497

The Windows Shell 498

PowerShell 501

Privilege Escalation with PowerShell 502

PowerSploit and AMSI 503

Meterpreter 504

Hash Dumping 505

Passing the Hash 506

Privilege Escalation 507

Getting SYSTEM 508

Alternative Payload Delivery Methods 509

Bypassing Windows Defender 512

Summary 514

Chapter 14 Passwords 517

Hashing 517

The Password Cracker’s Toolbox 519

Cracking 519

Hash Tables and Rainbow Tables 523

Adding Salt 525

Into the /etc/shadow 526

Different Hash Types 530

MD5 530

SHA-1 531

SHA-2 531

SHA256 531

SHA512 531

bcrypt 531

CRC16/CRC32 532

PBKDF2 532

Collisions 533

Pseudo-hashing 533

Microsoft Hashes 535

Guessing Passwords 537

The Art of Cracking 538

Random Number Generators 539

Summary 540

Chapter 15 Writing Reports 543

What is a Penetration Test Report? 544

Common Vulnerabilities Scoring System 545

Attack Vector 545

Attack Complexity 546

Privileges Required 546

User Interaction 547

Scope 547

Confidentiality, Integrity, and Availability Impact 547

Report Writing as a Skill 549

What Should a Report Include? 549

Executive Summary 550

Technical Summary 551

Assessment Results 551

Supporting Information 552

Taking Notes 553

Dradis Community Edition 553

Proofreading 557

Delivery 558

Summary 559

Index 561