405 Active Exploits, 296 Active Sniffing, 227 Address Resolution Protocol
Total Page:16
File Type:pdf, Size:1020Kb
Index A Wireshark capturing traffic, 233–234 Active exploits, 296 protocol analyzer, 233 Active sniffing, 227 running traffic, 233 Address Resolution American Registry for Internet Protocol (ARP) poisoning Numbers (ARIN), 199 bit cryptic, 229 Application programming DoS attack, 229 interface (API), 302 icmp protocol, 240 Armitage, Windows XP, IP address, 228 380–381, 390 MAC address, 228 hacker directory, 391–392 Scapy kerberos credentials, 399–400 ICMP, 237–238 lower console panel, 384–387 interactive packet malicious link, 382–384 manipulation, 234 meterpreter shell, 401–403 packet layers, 238–239 mimicatz command pinging, 236 list, 394, 396–399 Python tuple, 237 mimicatz extension, 393–394 show() method, 237 new directory, 389–391 sniff/corrupt packet, 235 payload, 381–382 SniffJoke root directory, 389 iptcp-options.conf file, 232 session time, 387 ipwhitelist.conf file, 232 system information, 392–393 PHP script, 230 working directory, 387–388 sniffjoke-autotest Asia pacific network information command, 229 center (APNIC), 199 sniffjoke-service.conf file, 232 Assembly language su command, 229 programming, 117 TCP header, 231 © Sanjib Sinha 2018 405 S. Sinha, Beginning Ethical Hacking with Kali Linux, https://doi.org/10.1007/978-1-4842-3891-2 INDEX Asymmetric-key C cryptography, 353 Cipher text-only attacks, 354 Authentication, 3 Computer emergency Auxiliary modules, 294 readiness team (CERT), 1 Cryptographic key, 4 B Cryptography, 4, 323 Big-endian, 171 Browser exploitation D framework (BeEF), 123 Data integrity, 3 Brute-force attacks Deepmagic information gathering findmyhash tool, 253 tool (DMitry), 214 hash, breaking, 254–255 Defense Advanced Research MD5 hash Projects Agency (DARPA), 1 generator, 253–254 Denial-of-service (DoS) TCH-Hydra tool, 253, 256–257 attack, 14, 229 trial-and-error methods, 253 Distributed Component Object two-factor authentication, 253 Model (dcom), 311 username and password Domain suffixes, 158 combination, 256, 258 Buffer overflow, 241 Burp Suite E crawling web Eepsite, 25 application, 278–279 Encryption techniques free version features, 280–281 asymmetric-key initial mapping, 276 cryptography, 353–354 installation, 276–277 Caesar’s cipher, 352 login information, 279–280 certificate viewer manual proxy window, 348–349 configuration, 277–278 cipher text, 352 professional version, 276 cryptography, 348, 352 secret information, digital certificate, 348 spitting, 281–282 plain text, 352 Byte order, 170–171 private key, 351 406 INDEX public key, 350–351 I secret keys, 348, 352 Information assurance (IA) model SSL certificate, 351 asset protection, 284 symmetric-key authentication, 283, 288–290 cryptography, 353–354 availability, 283, 288, 290 third-party organizations, 352 cloak-and-dagger stuff, 286 types of attack, 355 confidentiality, 283, 288, 290 Windows 10, 350 data flows in/out, 289 Ethical hacking, 117 DOS attacks, 289 Expert Working Group (EWG), 151 integrity, 283, 288 Exploiting Linux, ifconfig limited utility, 289 command, 358–359 nonrepudiation, 283, 288, 290 Exploit modules, 294 process, 285–287 spoofing, 290 F technology, 286 Frame check system (FCS), 67 three key elements, 283–284, 286–287, 289 G training people, 285 Information gathering Garlic routing, 25 DMitry tool, 215–216 Google hacking techniques, 15–17 Kali Linux Python repository, 190 H Maltego tool, 217–219 Hashes pen/penetration testing digest, 327 phases, 220 hash() function, 324 Python virtual message, 327 environment, 190 one-way function, 324, 338 echo server, 193, 195–196 rainbow table tool, 327 Kali Linux Python ripemd160 algorithm, 324–327 repository, 191 two-way function, 326 listen() method, 195 hashtools, 112 network security Hypervisor, 19 programming, 195 407 INDEX Information gathering (cont.) Information security model, Nmap, 193 see Information assurance python-whois (IA) model package, 192–193 Integrated penetration test TCP and UDP sockets, 195 environment (IPE), 123 vim text editor, 194–195 Intelligence gathering, virtualenv see Information gathering command, 190–191 International organization for reconnaissance tools, 197 standardization (ISO), 65 curl command, 213–214 International telecommunication domain and union (ITU), 7 hostname, 198–200 Internet architecture board (IAB), 1 Domaintools, 199–200 Internet control message e-mail tracking, 197, 200–202 protocol (ICMP), 198, 240 hops, 198 Internet Corporation for Assigned IDS, 207 Names and Numbers Internet archive, 202–204 (ICANN), 151, 198 IP addresses, 208–210 Internet Engineering Task Force IP blocks, 208 (IETF), 1, 158 Netcraft, 201–202 Internet protocol (IP), 164 network scanning, 206–207 Internet registry information nmap.scanme.nmap.org service (IRIS), 142 command, 212–213 Internet Relay Chat (irc), 371 nslookup command, 209–210 search irc modules, 371, 373–375 packet tracking, 198 set the host, 376–379 passive information, 204–205 Internetworking models port scanning, 206 OSI model (see Open scanme.nmap.org, 210–211 systems interconnection scanning methodology, 208 (OSI) model) traceroute, 198 TCP/IP model, 68–69 vulnerability Interprocess communication scanning, 206–208 (IPC), 76 web spiders, 197, 205–206 Intrusion detection Whois lookup, 209 system (IDS), 207 408 INDEX J bits/byte, 115 buffer, 115 John, Ripper tool pointer, 115 advantages, 339 RAM, 115 cracked password, 341–342 segmentation, 115 Johnny GUI for, 339, 341 reverse engineering, 113 root password, 340 security auditing, 106 security-related tasks, 106 K single root user, 106 sniffing and spoofing, 112 Kali Linux anonymous, 106 SSH (see Secure shell (SSH)) terminal, 159 exploitation tools, 111 text editors forensic tools, 111 cat command, 119 hacking tools cd command, 120 applications menu, 121 power setting, 120 Armitage, 123 vim/nano, 117–119 BeEF, 123 vulnerability analysis, 108 Burp Suite, 123 web application, 109–110 Faraday IDE, 123–124 wireless attacks, 109 Maltego, 123 WPScan, 109–110 Metasploit, 121–122 WPS tools, 110 penetration testing, 122 security auditing, 122 hardware hacking, 114 L hash types, 113 Linux command information gathering, 107–108 --help, 48 machine language, 114 | (pipe), 49 maintaining access, 113 cat, 48–49, 51 memory, 116 cd, 44, 47 nbtscan, 107–108 command-line tool, 43 password attacks, 112–113 cp, 47–48 penetration testing, 106 echo, 51 registers file system navigation 409 INDEX Linux command (cont.) ls-la, 55–56 --help, 48 nano text editor, 56 copy, 47 read, 54 downloads directory, 44, 47 r-x code, 55 ls, 44 superuser, 55 ls–r/ls-R, 46 write, 54 ls–s/ls-S, 46 src, 51 ls–X, 46 su, 52 move, 48 sudo, 52 root directory, 44 text files, 48–49 view hidden files, 46 touch, 53 virtual machine, 45 working with directories, 52–53 grep, 49, 51 Little-endian, 171 hacking tools, 43 Local exploit, 357–358 installation, 41 Local host (LHOST), 300 Kali terminal, 42–43 Local networks (LANs), 162 ls, 44, 46, 48, 53–54 mkdir, 52 M mv, 48 MAC spoofing, 102 pwd, 44, 46 Man-in-the-middle (MITM) redirect (>), 51 attacks, 112, 124 rf, 53 Media access control (MAC), 67 rm, 53 Message digest, 338 searching files, 49, 51 Metasploit setting file permissions architecture, 292–293 change the owner, 58 console/interface chmod, 57 ? command, 304 chown, 58 command-line interface, 304 ethical hacking, 59 database status, 305 execute, 54 db_nmap command, 305 file owner, 55 hosts command, 307–308 group permission, 55 host status, 305 Linux security nmap command, 306–307 programming, 57 Nmap scanning, 305 410 INDEX developer documentation, 292 penetration testing, 291 exploits and payloads Ruby, 291, 293–294, 302–303 active exploits, 308 Metasploitable dcom, 311 irc (see Internet Relay Chat (irc)) -i command, 308 Samba (see Samba) -j command, 308 Metasploit architecture, 294 LHOST, set, 320–321 msf module, 311, 315 new directory, 315 N passive exploits, 308 Network show exploits command, definition, 62 309, 310 ethical hackers, 61 show options command, interface, 61 316–317, 319–320 layers, 61 show payloads command, switch, 62 313–314, 317, 319 wireless adapter, 62 show targets command, 317 Network interface card (NIC), 228 upgrade, 322 Network news transfer vulnerable protocol (NNTP), 14 corruptions, 311–312 Network sniffers and spoofing, 112 libraries, 293 Nikto mixins and plugins, 302–303 info.php file, 270 modules phpinfo() function, 270 auxiliary, 296 scanning, 268–269 exploits, 296, 298–300 web application host machine, 300 analysis category, 268 hosts command, 302 XSS attacks, 270 interfaces, 295 Nmap Encoders, 296 port scanning Nmap scanning, 297–298, 302 crafted packets, 175 nops, 297 DNS services, 188 ping command, 301–302 finding IP address, 180–182 post, 297 hacking activities, workspace, 295–296 175–176, 178 411 INDEX Nmap (cont.) Open systems interconnection Linux and Unix services, 187 (OSI) model, 6, 165 LUA programming application layer, 65–66 language, 183 bits and bytes, 66 Microsoft directory data link layer, 65, 67 services, 188 network layer, 65, 67 module, 175, 178 packet filtering, 68 network scanner, 183 packet switching, 68 os module, 182 path selecting, 68 port Scan, 180 physical layer, 65, 67 Python library, 182–183 presentation layer, 65–66 python-nmap session layer, 65–66 command, 179 switches, 68 Python script, 184–185 transport layer, 65, 67 reconnaissance, 175 OpenVas scanme.nmap.org, 174 active and open scans, 116 connections report, 267 scripting, 182–183 dashboard, 263–264 service detections, 180 installation, 260–261 SSH, 188 Kali Firefox browser, 263 test.py code, 186–187 login page, 263 test.py script, 179 scan report, 265–266 Tor browser,