Computer Security and Penetration Testing

393 Pages·2013·23.157 MB·English

by  Alfred Basta, Nadine Basta, Mary Brown

Computer Security
and Penetration Testing
Second Edition
Alfred Basta
Nadine Basta
Mary Brown
Australia(cid:129)Brazil(cid:129)Mexico(cid:129)Singapore(cid:129)UnitedKingdom(cid:129)UnitedStates
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
This is an electronic version of the print textbook. Due to electronic rights restrictions,
some third party content may be suppressed. Editorial review has deemed that any suppressed
content does not materially affect the overall learning experience. The publisher reserves the right
to remove content from this title at any time if subsequent rights restrictions require it. For
valuable information on pricing, previous editions, changes to current editions, and alternate
formats, please visit www.cengage.com/highered to search by ISBN#, author, title, or keyword for
materials in your areas of interest.
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
ComputerSecurityandPenetrationTesting, ©2014,2008CengageLearning
SecondEdition
ALLRIGHTSRESERVED.Nopartofthisworkcoveredbythecopyright
AlfredBasta,NadineBasta,andMaryBrown
hereinmaybereproduced,transmitted,stored,orusedinanyformorby
anymeansgraphic,electronic,ormechanical,includingbutnotlimitedto
VicePresident,Careers&Computing:DaveGarza photocopying,recording,scanning,digitizing,taping,webdistribution,
AcquisitionsEditor:NickLombardi informationnetworks,orinformationstorageandretrievalsystems,except
aspermittedunderSection107or108ofthe1976UnitedStatesCopyright
Director,Development—CareersandComputing: Act,withoutthepriorwrittenpermissionofthepublisher.
MarahBellegarde
ProductDevelopmentManager:LeighHefferon Forproductinformationandtechnologyassistance,contactusat
CengageLearningCustomer&SalesSupport,1-800-354-9706
SeniorProductManager:NataliePashoukos
Forpermissiontousematerialfromthistextorproduct,
DevelopmentalEditor:KentWilliams
submitallrequestsonlineatwww.cengage.com/permissions
TechnicalEditor:RobertZemelka
Furtherpermissionsquestionscanbeemailedto
EditorialAssistant:ToreySchantz [email protected]
VicePresident,Marketing:JenniferAnnBaker
MarketingDirector:DeborahYarnell LibraryofCongressControlNumber:2013939807
ProductionDirector:WendyA.Troeger ISBN-13:978-0-8400-2093-2
ProductionManager:AndrewCrouth ISBN-10:0-8400-2093-7
ContentProjectManager:BrookeBaker
ArtDirector:GEX CengageLearning
200FirstStamfordPlace,4thFloor
MediaEditor:WilliamOverocker Stamford,CT06902
CoverPhoto:©iStockphoto.com/pheonix3d USA
CengageLearningisaleadingproviderofcustomizedlearningsolutions
withofficelocationsaroundtheglobe,includingSingapore,theUnited
Kingdom,Australia,Mexico,Brazil,andJapan.Locateyourlocalofficeat
www.cengage.com/global.
CengageLearningproductsarerepresentedinCanadaby
NelsonEducation,Ltd.
TolearnmoreaboutCengageLearningSolutions,visitwww.cengage.com.
Purchaseanyofourproductsatyourlocalcollegestoreoratourpreferred
onlinestorewww.cengagebrain.com.
Printed in the United States of America
1 2 3 4 5 6 7 17 16 15 14 13
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Brief Contents
INTRODUCTION . .. ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... . xv
CHAPTER 1
EthicsofHackingandCracking .. .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... .. 1
CHAPTER 2
Reconnaissance . .. ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... . 17
CHAPTER 3
ScanningTools.. .. ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... . 45
CHAPTER 4
Sniffers.. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... . 67
CHAPTER 5
TCP/IPVulnerabilities.. ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... . 95
CHAPTER 6
EncryptionandPassword Cracking.. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 115
CHAPTER 7
Spoofing ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 137
CHAPTER 8
SessionHijacking .. ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 157
CHAPTER 9
HackingNetworkDevices.. .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 175
CHAPTER 10
TrojanHorses... .. ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 195
CHAPTER 11
Denial-of-Service Attacks.. .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 211
CHAPTER 12
BufferOverflows.. ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 231
CHAPTER 13
ProgrammingExploits . ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 249
CHAPTER 14
MailVulnerabilities ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 265
CHAPTER 15
WebApplication Vulnerabilities.. .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 289
CHAPTER 16
WindowsVulnerabilities .. .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 311
CHAPTER 17
UNIX/LinuxVulnerabilities. .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 321
CHAPTER 18
IncidentHandling.. ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 335
GLOSSARY. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 359
INDEX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367
iii
Copyright 2013 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Copyright 2013 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Table of Contents
INTRODUCTION . .. ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... . xv
CHAPTER1
EthicsofHackingandCracking .. .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... .. 1
TheImpactofUnethicalHacking ......................................................... 2
HackerCommunities .................................................................. 3
HatCategories.................................................................... 3
HackerProfiling................................................................... 3
HackerMotivations................................................................ 5
EthicalHacking................................................................... 6
EvolutionofHacking............................................................... 7
Vendor-NeutralSecurityCertifications................................................... 8
Vendor-SpecificSecurityCertificates ................................................... 10
WhatNeedstoBeSecured .......................................................... 10
ChapterSummary ................................................................... 12
KeyTerms......................................................................... 13
ReviewQuestions.................................................................... 13
Hands-OnProject.................................................................... 15
References......................................................................... 15
CHAPTER2
Reconnaissance . .. ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... . 17
IntroductiontoReconnaissance.......................................................... 18
LegalReconnaissance.............................................................. 19
QuestionableReconnaissance ........................................................ 19
IllegalReconnaissance ............................................................. 20
ImpactofContextonReconnaissance .................................................. 20
SocialEngineering ................................................................... 20
SocialEngineeringTechniques........................................................ 21
PhysicalIntrusion................................................................. 23
CommunicationMedia............................................................. 24
CounteringSocialEngineering........................................................ 27
DumpsterDiving .................................................................... 27
ImportanceofProperDiscardingofRefuse .............................................. 27
PreventionofDumpsterDiving....................................................... 28
InternetFootprinting ................................................................. 28
SocialNetworking ................................................................ 29
WebSearching................................................................... 29
NetworkEnumeration ............................................................. 31
DomainNameSystem–BasedReconnaissance............................................. 33
Network-BasedReconnaissance....................................................... 36
ChapterSummary ................................................................... 39
KeyTerms......................................................................... 40
ReviewQuestions.................................................................... 41
Hands-OnProjects................................................................... 42
Reference.......................................................................... 43
v
Copyright 2013 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
vi TableofContents
CHAPTER3
Scanning Tools. .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... .. ... ... .. ... .. 45
Introduction........................................................................ 46
EvolutionofScanners................................................................. 46
HowScannersWork ................................................................. 48
TypesofScanning ................................................................... 48
TCPConnectScanning............................................................. 48
Half-OpenScanning............................................................... 49
UDPScanning................................................................... 49
IPProtocolScanning .............................................................. 49
PingScanning ................................................................... 49
StealthScanning.................................................................. 49
ReviewofScannerTechnology .......................................................... 50
Discovery ...................................................................... 51
Reconnaissance .................................................................. 53
VulnerabilityIdentification .......................................................... 56
Exploitation..................................................................... 61
ChapterSummary ................................................................... 64
KeyTerms......................................................................... 64
ReviewQuestions.................................................................... 65
Hands-OnProjects................................................................... 66
CHAPTER4
Sniffers.. .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... .. ... ... .. ... .. 67
SnifferTypes....................................................................... 68
BundledSniffers.................................................................. 68
CommercialSniffers............................................................... 69
FreeSniffers..................................................................... 69
SnifferOperation.................................................................... 69
SnifferComponents ............................................................... 70
PlacementofaSniffer.............................................................. 72
MACAddresses.................................................................. 74
DataTransferoveraNetwork ....................................................... 75
RoleofaSnifferonaNetwork....................................................... 77
SnifferPrograms..................................................................... 78
Wireshark(Ethereal)............................................................... 78
tcpdump/WinDump ............................................................... 80
Snort.......................................................................... 81
NetworkMonitor................................................................. 82
CainandAbel................................................................... 83
Kismet......................................................................... 83
FlukeNetworksProtocolAnalyzers.................................................... 84
DetectingaSniffer ................................................................... 84
DNSTest ...................................................................... 85
NetworkLatencyTests............................................................. 85
PingTest....................................................................... 85
Source-RouteMethod.............................................................. 85
DecoyMethod................................................................... 86
Commands ..................................................................... 86
TimeDomainReflectometer(TDR)Method.............................................. 87
Copyright 2013 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
TableofContents vii
ProtectingAgainstaSniffer............................................................. 87
SecureSocketsLayer(SSL) .......................................................... 88
PrettyGoodPrivacy(PGP)andSecure/MultipurposeInternetMailExtensions(S/MIME).............. 88
SecureShell(SSH) ................................................................ 89
MoreProtection.................................................................. 89
ChapterSummary ................................................................... 89
KeyTerms......................................................................... 90
ReviewQuestions.................................................................... 91
Hands-OnProjects................................................................... 92
CHAPTER5
TCP/IPVulnerabilities.. ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... . 95
IntroductiontoTCP/IPVulnerabilities..................................................... 96
DataEncapsulation ............................................................... 97
IP(InternetProtocol) .............................................................. 97
TCP .......................................................................... 98
ConnectionSetupandRelease....................................................... 101
TCP/IPTimers.................................................................. 103
VulnerabilitiesinTCP/IP ............................................................. 103
IPSpoofing .................................................................... 103
SourceRouting ................................................................. 104
ConnectionHijacking............................................................. 104
ICMPAttacks .................................................................. 104
TCPSYNAttacks ............................................................... 105
RIPAttacks.................................................................... 105
SecuringTCP/IP ................................................................... 105
IPSecurityArchitecture(IPSec) ......................................................... 106
ChapterSummary .................................................................. 107
KeyTerms........................................................................ 108
ReviewQuestions................................................................... 109
Hands-OnProjects.................................................................. 110
CHAPTER6
EncryptionandPassword Cracking.. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 115
IntroductiontoEncryptionandPasswordCracking .......................................... 116
Cryptography .................................................................. 116
SymmetricandAsymmetricKeyEncryption................................................ 118
SymmetricKeyEncryption ......................................................... 118
AsymmetricKeyAlgorithms ........................................................ 120
Cryptanalysis................................................................... 120
DescriptionsofPopularCiphers ........................................................ 121
SymmetricKeyCiphers............................................................ 121
AsymmetricKeyCiphers........................................................... 122
CryptographicHashFunctions ...................................................... 123
AttacksonPasswords................................................................ 123
DictionaryAttacks............................................................... 124
Hybridization................................................................... 124
Brute-ForceAttacks .............................................................. 125
Observation.................................................................... 126
Keyloggers..................................................................... 126
Copyright 2013 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
viii TableofContents
SocialEngineering ............................................................... 126
SniffingMethods ................................................................ 126
PasswordFileStealing ............................................................ 127
PasswordCrackers.................................................................. 127
Aircrack ...................................................................... 127
Cain&Abel ................................................................... 127
JohntheRipper................................................................. 127
THCHydra.................................................................... 129
L0phtCrackandLc6 ............................................................. 129
ChapterSummary .................................................................. 129
KeyTerms........................................................................ 130
ReviewQuestions................................................................... 131
Hands-OnProjects.................................................................. 132
References........................................................................ 136
CHAPTER7
Spoofing .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... .. ... ... .. ... . 137
TheProcessofanIPSpoofingAttack .................................................... 139
CostsofSpoofing................................................................... 145
KindsofTangibleLoss............................................................ 145
TypesofSpoofing .................................................................. 146
BlindSpoofing.................................................................. 146
ActiveSpoofing ................................................................. 147
IPSpoofing .................................................................... 147
ARPSpoofing .................................................................. 147
WebSpoofing .................................................................. 147
DNSSpoofing .................................................................. 148
SpoofingTools .................................................................... 149
Mausezahn .................................................................... 149
Ettercap....................................................................... 149
Arpspoof...................................................................... 152
PreventionandMitigation............................................................. 152
ChapterSummary .................................................................. 153
KeyTerms........................................................................ 154
ReviewQuestions................................................................... 154
Hands-OnProjects.................................................................. 156
CHAPTER8
SessionHijacking . ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... .. ... ... .. ... . 157
TCPSessionHijacking............................................................... 158
SessionHijacking–Hacker’sPointofView............................................. 158
TCPSessionHijackingwithPacketBlocking ............................................ 161
Methods ...................................................................... 162
SessionHijackingTools .............................................................. 169
Hunt......................................................................... 169
UDPHijacking..................................................................... 169
PreventionandMitigation............................................................. 169
Encryption..................................................................... 169
StormWatching................................................................. 170
Copyright 2013 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.