Copyrighted Material
Total Page：16
File Type：pdf, Size：1020Kb
Index Andrews, Chip (Special Ops Security), • Numerics • 305–306 anonymity, 34 802.11 encryption protocols, 161–162 Apache Web server, 209 802.11i encryption protocols, 165 APNIC, 51, 353 AppDetectivePro, 308, 352 application attacks, 16 Arcsight Logger, 331, 355 • A • ARIN, 51, 353 ARP (Address Resolution Protocol), 140 Absinthe, 363 ARP spoofi ng. See also network Abuse.net SMTP relay checker, 355 infrastructure attacks access control, 217 countermeasures, 144 access points (APs) defi ned, 140 MAC address of, 156 how it works, 140–141 network vulnerabilities and, 152 using Cain & Abel, 141–143 rogue wireless devices, 165 Arpwatch, 144, 356 account enumeration attacks, 257–260 Asleap, 164, 365 account lockout, 112 Asterisk, 68 Active Directory database, 93 Athena FirewallGrader, 133 Acunetix Web Vulnerability Scanner, 278, attack tree analysis, 39 288, 290, 296, 363 attacks Address Resolution Protocol (ARP), 140 account enumeration attacks, 257–259 Advanced Access Password Recovery, application attacks, 16 307, 352 ARP spoofi ng, 140–143 Advanced Archive Password Recovery, banner grabbing, 130–131, 255–257 102–103, 358 brute-force attacks, 95–96 Advanced Encryption Standard (AES), buffer overfl ows, 283–284 162, 165 code injection, 287–289 Advanced SQL Password Recovery, database attacks, 303–309 304, 306, 352 denial of service attacks, 145–147 AES (Advanced Encryption Standard), dictionary attacks, 94–95 162, 165 COPYRIGHTEDdirectory MATERIAL reversal attacks, 280–283 AfriNIC, 50, 353 dumpster diving, 15 Aircrack, 154, 161, 365 e-mail attacks, 252–267 AirMagnet Handheld Analyzer, 155 e-mail bombs, 252–255 AirMagnet WiFi Analyzer, 154, 166, e-mail header disclosures, 263 168–169, 365 e-mail traffi c capture, 264 Airodump, 161 encrypted traffi c, 160–165 AirSnort, 365 hidden fi eld manipulation, 285–286 Akin, Thomas (Southeast Cybercrime input fi ltering attacks, 283–291 Institute), 251 instant messaging, 267–270, 287–289 allintitle Google operator, 282 keystroke logging, 103–104 Amap, 215 368 Hacking For Dummies, 3rd Edition MAC address spoofi ng, 143–144, 170–175 BigFix Patch Management, 227, 325, 359 malware, 264 Bing search engine, 48, 353 network infrastructure attacks, 15 BIOS passwords, 107, 358 nontechnical, 14–15 BitLocker, 198 operating system attacks, 15 black hat hackers, 10 password cracking, 89–109 BlackKnightList, 95, 296 physical, 15 blank password, 101–102 rainbow attacks, 96 Blast tool, 146, 356 rconsole attacks, 233–236 Blaster worm, 181 reasons for, 31 blind assessment, 42, 47 SMTP attacks, 257–265 blind SQL injection, 287 SMTP relay attacks, 260–262 Blooover, 160 social engineering, 15 Bluejacking, 160, 351 SQL injection, 287–289 BlueScanner, 160, 351 storage system attacks, 309–313 Bluesnarfer, 160, 351 styles of, 32 BlueSniper rifl e, 160 timing, 33 Bluetooth, 160, 351 URL manipulation, 285 BorderManager resources, 356 voice over IP, 270–276 broadcast mode, 140 vulnerability and, 33 brute-force attacks, 95–96 auditing, security, 12 Brutus Auditory Professional, 269 brute-force testing with, 296 authenticated scans, 205–206 password cracking with, 93 authorization, 18 POP3 password cracking with, 265 automated assessment, 56 Web site, 355, 358, 363 Awareity MOAT, 362 BTScanner for XP, 160, 351 buffer overfl ows, 223–224, 283–284 building infrastructure, physical security, 78–79 • B • business phones, 68 background checks, 49 buy-in, management, 339 BackTrack ally and sponsor, 337 capturing e-mail traffi c address with, 258 benefi ts of ethical hacking, 339 fi rewall rulebase testing with, 133 establishing credibility, 340 Linux security testing with, 154, 209 fl exibility and adaptability, 341 network vulnerability testing with, 148 getting involved in business, 339–340 Web site, 355 practical advice, 337 banner grabbing. See also network speaking on management’s level, 340 infrastructure attacks value in efforts, 340–341 countermeasures, 131 what-if-scenarios, 338 defi ned, 130 overview, 130 telnet, 130–131 banners, 130, 255–257 • C • Bastille Linux Hardening Program, 361 Cain & Abel. See also software and testing Beaver, Kevin (Security On Wheels), 360 tools believability in social engineering, 69 ARP spoofi ng with, 141–143 Berkeley Software Distribution (BSD) r-commands, 218–220 Index 369 capturing and recording voice traffi c code injection, 287–289 with, 274–276 Common Vulnerabilities and Exposures, capturing e-mail traffi c with, 264 55, 363 cracking Oracle password hashes CommView with, 307 denial of service testing with, 146 network analysis with, 105, 121, 135 network analysis with, 106, 135 password cracking with, 92, 304 Web site, 357, 362 Web site, 356, 358, 362 CommView for Wi-Fi, 166–167, 365 Camasia Studio, 41 Computer Underground Digest, 354 Canary Wireless, 155 contingency plan, 18 cantenna, 155, 365 COPS, 223 CAPTCHA, 255, 297 copy rooms, 81 Car Whisperer, 160, 351 Counter Mode with Cipher Block Chaining Carrier Sense Multiple Access/Collision Message Authentication Code Avoidance (CSMA/CA) protocol, 175 (CCMP), 162 case studies countermeasures database hacking, 305–306 account enumeration attacks, 257–260 e-mail attacks, 251 ARP poisoning, 144 messaging-system attacks, 251 ARP spoofi ng, 144 network infrastructure attacks, 118 banner attacks, 257 password cracking, 87 banner grabbing, 131 physical security, 77 buffer overfl ows, 223–224 social engineering, 63 database attacks, 308–309 Web application attacks, 279 default confi guration settings exploits, wireless network attack, 153 177–178 CCTV security camera, 27 default script attacks, 294 Center for Internet Security, 113, 321, denial of service attacks, 146–147, 176 326, 361 directory reversal attacks, 282–283 certifi cations, 352 e-mail attachment attacks, 253 Certifi ed Ethical Hacker (CEH), 12 e-mail attacks, 266–267 .cgi extension, 299 e-mail bombs, 253–254 CHAP Password Tester, 310, 361 e-mail connection attacks, 253 Chappell, Laura, 118 e-mail header disclosures, 263 Character Generator pot (NetWare), 232 encrypted traffi c attacks, 164–165 chargen, 123 fi le permission attacks, 222–223 Checkmarx, 300, 361 fi rewalls, 133–134 CheckPoint, 300 hosts.equiv fi le attacks, 219–220 chkconfig, 217 input fi ltering attacks, 291 chknull (password-cracking software), 92 instant messaging vulnerabilities, 268–269 ChoicePoint, 49 MAC address spoofi ng, 144, 175 Chronology of Data Breaches, 338, 363 missing patch exploitation, 205 CIFShareBF, 310, 361 NetBIOS, 190 CipherTrust IronMail, 255 Netware intruders, 238 Cisco Global Exploiter, 148–149 NetWare Loadable Module, 241 civil liberties, 32 network analyzers, 139–140 Clear Channel Assessment attack, 175–176 network infrastructure attacks, 135 cleartext packets, 242 NFS attacks, 221 client notifi cation, 37 null sessions, 194–195 closed-circuit television (CCTV), 81 packet capture, 242 370 Hacking For Dummies, 3rd Edition countermeasures (continued) daytime, 123 password cracking, 109–114 .db fi le, 311 physical security attacks, 224–225 .dbf fi le, 311 physical security problems, 176–177 Debian Linux Security Alerts, 359 port scanning, 127–128 Debian Package System, 227 .rhost fi le attacks, 219–220 Deep Freeze, 104, 361 rogue NLM attack, 241 defaced Web pages, 31, 364 rogue wireless devices, 170 default confi guration settings, 178 SMTP relay attacks, 263 default script attacks, 292–293 SNMP scanning, 130 deliverables, 19 social engineering, 72–74 denial of service (DoS) attacks. storage system attacks, 313 See also network infrastructure attacks system scans, 212 countermeasures, 146–147 unneeded services, 216–217 defi ned, 145 unsecured login mechanisms, 297 distributed, 145 Voice over IP, 276 Ping of Death, 145 vulnerable wireless workstations, Queensland, 175–176 177–178 SYN fl oods, 145 wireless network attacks, 158–159 testing, 146 Counterpane, 331 WinNuke, 145 Crack, 358 dictionary attacks, 94–95 crackers, 10 dictionary fi les, 358 cracking tools, 20 Digital Hotspotter, 155, 168, 365 cracklib, 114 directional antenna, 155 crashing system during tests, 17 directory reversal attacks criminal hackers, 10, 28 countermeasures, 282–283 cross-site scripting (XSS), 290 crawlers, 280–281 CWE/SANS Top 25 Most Dangerous defi ned, 280 Programming Errors, 363 Google, 281–282 CxAudit, 300 distributed denial of service (DDoS) CxDeveloper, 300–301 attacks, 145 cyberterrorists, 29 D-Link DWL-650 wireless NIC, 175 DNS (Domain Name System), 123 DNSstuff.com, 50, 353 dnstools.com, 353 • D • .doc fi le, 311 daemons, 209 .docx fi le, 311 Data Thief tool, 305 Dogwood Management Partners Security database attacks. See also storage system Posters, 362 attacks Domain Name System (DNS), 123 best practices for minimizing risks, doors, 79–80 308–309 Draper, John (Captain Crunch), 27 case study, 305–306 drop ceilings, 80 fi nding databases on network, 304–306 dsniff program, 140, 357 overview, 303 dsrepair (NetWare Loadable Module), 239 password cracking, 306–307 DumpSec utility, 55, 192, 364 scanning for vulnerabilities, 307–308 dumpster diving, 15, 67 testing tools, 303–304 tools, 352 Index 371 encryption protocols, 161–162 • E • overview, 161–162 eBlaster (keystroke-logging software), 104 tools, 162–164 echo, 123 enumeration utility, 55, 185–186 Echo port (NetWare), 232 error-based SQL injection, 287 Ecora Patch Manager, 326, 359 errors and omission insurance, 35 eDirectory, 229 Essential NetTools, 120, 357 Effective File Search, 310, 361 ethical hackers, 10 EICAR Anti-Virus test fi le, 356 ethical hacking EICAR test string, 265 assessing vulnerabilities, 55–57 Elcomsoft Advanced Archive Password