PUBLISHED BY Microsoft Press A Division of Microsoft Corporation One Microsoft Way Redmond, Washington 98052-6399 Copyright © 2004 by Ben Smith, David LeBlanc, Kevin Lam All rights reserved. No part of the contents of this book may be reproduced or transmitted in any form or by any means without the written permission of the publisher. Library of Congress Cataloging-in-Publication Data Lam, Kevin. Assessing Network Security/ Kevin Lam, David LeBlanc, Ben Smith. p. cm. Includes index. ISBN 0-7356-2033-4 1. Computer networks--Security measures. I. LeBlanc, David, 1960- II. Smith, Ben. III. Title. TK5105.59.L36 2004 005.8--dc22 2004049997 Printed and bound in the United States of America. 1 2 3 4 5 6 7 8 9 QWT 9 8 7 6 5 4 Distributed in Canada by H.B. Fenn and Company Ltd. A CIP catalogue record for this book is available from the British Library. Microsoft Press books are available through booksellers and distributors worldwide. For further information about international editions, contact your local Microsoft Corporation office or contact Microsoft Press International directly at fax (425) 936-7329. Visit our Web site at www.microsoft.com/learning/books/. Send comments to [email protected]. Active Directory, ActiveX, Encarta, FrontPage, Hotmail, InfoPath, Microsoft, Microsoft Press, MSDN, MSN, Outlook, Visual Basic, Win32, Windows, Windows NT, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Other product and company names mentioned herein may be the trademarks of their respective owners. The example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious. No association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should be inferred. This book expresses the author’s views and opinions. The information contained in this book is provided without any express, statutory, or implied warranties. Neither the authors, Microsoft Corporation, nor its resellers or distributors will be held liable for any damages caused or alleged to be caused either directly or indirectly by this book. Acquisitions Editor: Martin DelRe Project Editor: Karen Szall Technical Editor: Ramsey Dow Indexer: Bill Meyers Body Part No. X10-46140 To my mother, my “little” sister, Tiger and close friends—you amaze me with your love, support and your ability to tolerate me day in and day out. —Kevin In memory of Merlin who was a good friend for many years. Finishing this book was much harder without you. Merlin: 9/19/1992–1/16/2004. —David To Beth, for enduring another book; thank you for everything. —Ben Contents at a Glance Part I Planning and Performing Security Assessments 1 Introduction to Performing Security Assessments 3 2 Key Principles of Security 21 3 Using Vulnerability Scanning to Assess Network Security 37 4 Conducting a Penetration Test 57 5 Performing IT Security Audits 75 6 Reporting Your Findings 89 7 Building and Maintaining Your Security Assessment Skills 99 Part II Penetration Testing for Nonintrusive Attacks 8 Information Reconnaissance 117 9 Host Discovery Using DNS and NetBIOS 137 10 Network and Host Discovery 153 11 Port Scanning 167 12 Obtaining Information from a Host 179 13 War Dialing, War Driving, and Bluetooth Attacks 195 Part III Penetration Testing for Intrusive Attacks 14 Automated Vulnerability Detection 223 15 Password Attacks 239 16 Denial of Service Attacks 255 17 Application Attacks 269 18 Database Attacks 281 19 Network Sniffing 301 20 Spoofing 319 21 Session Hijacking 333 22 How Attackers Avoid Detection 355 23 Attackers Using Non-Network Methods to Gain Access 379 v vi Contents at a Glance Part IV Security Assessment Case Studies 24 Web Threats 399 25 E-Mail Threats 431 26 Domain Controller Threats 457 27 Extranet and VPN Threats 477 Part V Appendixes A Checklists 497 B References 515 Table of Contents Acknowledgments xxi Foreword xxiii Introduction xxvii Part I Planning and Performing Security Assessments 1 Introduction to Performing Security Assessments 3 Role of Security Assessments in Network Security 4 Why Does Network Security Fail? 5 Human Factors 6 Policy Factors 7 Misconfiguration 9 Poor Assumptions 11 Ignorance 12 Failure to Stay Up-to-Date 13 Types of Security Assessments 13 Vulnerability Scanning 14 Penetration Testing 16 IT Security Auditing 17 Frequently Asked Questions 18 2 Key Principles of Security 21 Making Security Easy 21 Keeping Services Running 22 Allowing the Right Users Access to the Right Information 22 Defending Every Layer as if It Were the Last Layer of Defense 22 Keeping a Record of Attempts to Access Information 23 Compartmentalizing and Isolating Resources 24 Avoiding the Mistakes Everyone Else Makes 25 Controlling the Cost of Meeting Security Objectives 26 What do you think of this book? Microsoft is interested in hearing your feedback about this publication so we can continually improve our books and learning resources for you. To participate in a brief We want to hear from you! online survey, please visit: www.microsoft.com/learning/booksurvey/ viii Table of Contents Risk Management 27 Learning to Manage Risk 27 Risk Management Strategies 30 Immutable Laws 31 Frequently Asked Questions 35 3 Using Vulnerability Scanning to Assess Network Security 37 Setting a Scope for the Project 38 Defining the Target 38 Defining the Target Scope 43 Defining Types of Vulnerabilities 44 Determining Goals 45 Choosing a Technology 46 Tools and Managed vs. Unmanaged Targets 47 Checklist for Evaluating Tools 49 Creating a Process for Scanning for Vulnerabilities 51 Detecting Vulnerabilities 51 Assigning Risk Levels to Vulnerabilities 53 Identifying Vulnerabilities That Have not Been Remediated 53 Determining Improvement in Network Security Over Time 53 Creating a Process for Analyzing the Results 54 Frequently Asked Questions 54 4 Conducting a Penetration Test 57 What the Attacker Is Thinking About 58 Notoriety, Acceptance, and Ego 59 Financial Gain 59 Challenge 61 Activism 62 Revenge 62 Espionage 62 Information Warfare 63 Defining the Penetration Test Engagement 64 Setting the Goals 64 Setting the Scope 69 Performing the Penetration Test 69 Locating Areas of Weakness in Network or Application Defenses 70 Table of Contents ix Determining How Vulnerabilities Were Compromised 71 Locating Assets that Could be Accessed, Altered, or Destroyed 71 Determining Whether the Attack Was Detected 73 Identifying the Attack Footprint 73 Making Recommendations 74 Frequently Asked Questions 74 5 Performing IT Security Audits 75 Components of an IT Security Audit 75 Policy 76 Processes and Procedures 78 Operations 79 Preliminary Decisions 80 Legal Considerations 80 Regulatory Considerations 81 Operational Considerations 82 Organizational Considerations 82 Planning and Performing the Audit 83 Building Your Audit Framework 83 Setting the Scope and Timeline 86 Obtaining Legal and Management Approval 86 Completing the Audit 87 Analyzing and Reporting the Results 87 Frequently Asked Questions 88 6 Reporting Your Findings 89 Guidelines for Reporting Your Findings 89 Concise and Professional 90 Technically Accurate 91 Objective 91 Measurable 92 Framework for Reporting Your Findings 92 Define the Vulnerability 92 Document Mitigation Plans 95 Identify Where Changes Should Occur 96 Assign Responsibility for Implementing Approved Recommendations 97 Frequently Asked Questions 97 x Table of Contents 7 Building and Maintaining Your Security Assessment Skills 99 Building Core Skills 99 Improving Network, Operating System, and Application Skills 99 Developing Programming Skills 101 Practicing Security Assessments 103 Staying Up-to-Date 105 Finding a Course 106 Choosing a Conference 110 Internet-Based Resources 111 Internet Mailing Lists 111 Security Bulletins 112 Security Websites 112 Frequently Asked Questions 114 Part II Penetration Testing for Nonintrusive Attacks 8 Information Reconnaissance 117 Understanding Information Reconnaissance 118 Registrar Information 120 Determining Your Registrar Information 120 Countermeasures 122 IP Network Block Assignment 122 Determining Your Organization’s IP Network Block Assignment 123 Countermeasures 125 Web Pages 125 Reviewing Web Server Content 126 Countermeasures 129 Search Engines 129 Reviewing Your Website with Search Engines 129 Countermeasures 132 Public Discussion Forums 133 Taking a Snapshot of Your Organization’s Exposure 133 Countermeasures 134 Frequently Asked Questions 135 Table of Contents xi 9 Host Discovery Using DNS and NetBIOS 137 Using DNS 137 Common Record Types 138 Examining a Zone Transfer 146 Using NetBIOS 148 Using LDAP 151 Frequently Asked Questions 151 10 Network and Host Discovery 153 Network Sweeping Techniques 154 ICMP Sweeps 156 UDP Sweeps 158 TCP Sweeps 158 Broadcast Sweeps 159 Countermeasures 160 Network Topology Discovery 162 Trace Routing 163 Firewalking 164 Countermeasures 165 Frequently Asked Questions 165 11 Port Scanning 167 TCP Connect Scans 168 Custom TCP Scans 171 SYN Scans 172 FIN Scans 172 SYN/ACK and ACK Scans 173 XMAS Scans 173 Null Scans 173 Idle Scans 173 UDP Scans 174 FTP Bounce Scans 176 Port Scanning Tips and Tricks 176 Fragmentation and Port Scans 177 Port Scanning Countermeasures 178 Frequently Asked Questions 178 xii Table of Contents 12 Obtaining Information from a Host 179 Fingerprinting 179 IP and ICMP Fingerprinting 180 TCP Fingerprinting 182 Countermeasures 183 Application Fingerprinting 183 Countermeasures