book

Gray Hat Hacking The Ethical Hacker's Handbook, Fourth Edition, 4th Edition

by Daniel Regalado, Shon Harris, Allen Harper, Chris Eagle, Jonathan Ness, Branko Spasojevic, Ryan Linn, Stephen Sims

January 2015

Intermediate to advanced

656 pages

18h 58m

English

McGraw-Hill

Read now

Unlock full access

Cover
Title Page
Copyright Page
Dedication
Contents
Preface
Acknowledgments
Introduction
Part I Crash Course: Preparing for the War
Chapter 1 Ethical Hacking and the Legal System
Why You Need to Understand Your Enemy’s TacticsRecognizing Trouble When It HappensThe Ethical Hacking ProcessThe Penetration Testing ProcessWhat Would an Unethical Hacker Do Differently?The Rise of CyberlawUnderstanding Individual CyberlawsThe Controversy of “Hacking” ToolsVulnerability DisclosureDifferent Teams and Points of ViewHow Did We Get Here?CERT’s Current ProcessOrganization for Internet SafetyConflicts Will Still Exist“No More Free Bugs”Bug Bounty ProgramsSummaryReferencesFor Further Reading

Chapter 2 Programming Survival Skills
C Programming LanguageBasic C Language ConstructsSample ProgramCompiling with gccComputer MemoryRandom Access Memory (RAM)EndianSegmentation of MemoryPrograms in MemoryBuffersStrings in MemoryPointersPutting the Pieces of Memory TogetherIntel ProcessorsRegistersAssembly Language BasicsMachine vs. Assembly vs. CAT&T vs. NASMAddressing ModesAssembly File StructureAssemblingDebugging with gdbgdb BasicsDisassembly with gdbPython Survival SkillsGetting PythonHello World in PythonPython ObjectsStringsNumbersListsDictionariesFiles with PythonSockets with PythonSummaryReferencesFor Further Reading
Chapter 3 Static Analysis
Ethical Reverse EngineeringWhy Bother with Reverse Engineering?Reverse Engineering ConsiderationsSource Code AnalysisSource Code Auditing ToolsThe Utility of Source Code Auditing ToolsManual Source Code AuditingAutomated Source Code AnalysisBinary AnalysisManual Auditing of Binary CodeAutomated Binary Analysis ToolsSummaryFor Further Reading
Chapter 4 Advanced Analysis with IDA Pro
Static Analysis ChallengesStripped BinariesStatically Linked Programs and FLAIRData Structure AnalysisQuirks of Compiled C++ CodeExtending IDA ProScripting in IDAPythonExample 4-1: Decrypting Strings in PlaceExecuting Python CodeSummaryFor Further Reading
Chapter 5 World of Fuzzing
Introduction to FuzzingChoosing a TargetInput TypesEase of AutomationComplexityTypes of FuzzersMutation FuzzersGeneration FuzzersGetting StartedFinding the Fuzzing TemplatesLab 5-1: Collecting Samples from the Internet ArchiveChoosing the Optimal Template Set with Code CoverageLab 5-2: Selecting the Best Samples for FuzzingPeach Fuzzing FrameworkPeach Fuzzing StrategiesSpeed Does MatterCrash AnalysisLab 5-3: Mutation Fuzzing with PeachOther Mutation FuzzersGeneration FuzzersSummaryFor Further Reading
Chapter 6 Shellcode Strategies
User Space ShellcodeSystem CallsBasic ShellcodePort Binding ShellcodeReverse ShellcodeFind Socket ShellcodeCommand Execution CodeFile Transfer CodeMultistage ShellcodeSystem Call Proxy ShellcodeProcess Injection ShellcodeOther Shellcode ConsiderationsShellcode EncodingSelf-Corrupting ShellcodeDisassembling ShellcodeKernel Space ShellcodeKernel Space ConsiderationsSummaryReferencesFor Further Reading
Chapter 7 Writing Linux Shellcode
Basic Linux ShellcodeSystem CallsSystem Calls by CSystem Calls by AssemblyExit System Callsetreuid System CallShell-Spawning Shellcode with execveImplementing Port-Binding ShellcodeLinux Socket ProgrammingAssembly Program to Establish a SocketTest the ShellcodeImplementing Reverse Connecting ShellcodeReverse Connecting C ProgramReverse Connecting Assembly ProgramEncoding ShellcodeSimple XOR EncodingStructure of Encoded ShellcodeJMP/CALL XOR Decoder ExampleFNSTENV XOR ExamplePutting the Code TogetherAutomating Shellcode Generation with MetasploitGenerating Shellcode with MetasploitEncoding Shellcode with MetasploitSummaryFor Further Study
Part II From Vulnerability to Exploit
Chapter 8 Spoofing-Based Attacks
What Is Spoofing?ARP SpoofingLab 8-1: ARP Spoofing with EttercapViewing Network TrafficModifying Network TrafficDNS SpoofingLab 8-2: DNS Spoofing with EttercapExecuting the AttackNetBIOS Name Spoofing and LLMNR SpoofingLab 8-3: Attacking NetBIOS and LLMNR with ResponderCracking NTLMv1 and NTLMv2 HashesSummaryFor Further Reading
Chapter 9 Exploiting Cisco Routers
Attacking Community Strings and PasswordsLab 9-1: Guessing Credentials with Ncrack and MetasploitLab 9-2: Guessing Community Strings with Onesixtyone and MetasploitSNMP and TFTPLab 9-3: Downloading Configuration Files with MetasploitLab 9-4: Modifying Configurations with SNMP and TFTPAttacking Cisco PasswordsAttacking Cisco Type 7 PasswordsLab 9-5: Cracking Type 7 Passwords with CainLab 9-6: Cracking Type 7 Passwords with MetasploitAttacking Cisco Type 5 PasswordsLab 9-7: Attacking Cisco Type 5 Passwords with John the RipperMiddling Traffic with TunnelsLab 9-8: Setting Up a GRE TunnelLab 9-9: Routing Traffic over a GRE TunnelExploits and Other AttacksCisco ExploitsMaintaining Access on Cisco DevicesSummaryFor Further Reading
Chapter 10 Basic Linux Exploits
Stack OperationsFunction Calling ProcedureBuffer OverflowsLab 10-1: Overflow of meet.cRamifications of Buffer OverflowsLocal Buffer Overflow ExploitsLab 10-2: Components of the ExploitLab 10-3: Exploiting Stack Overflows from the Command LineLab 10-4: Exploiting Stack Overflows with Generic Exploit CodeLab 10-5: Exploiting Small BuffersExploit Development ProcessLab 10-6: Building Custom ExploitsSummaryFor Further Reading
Chapter 11 Advanced Linux Exploits
Format String ExploitsThe ProblemLab 11-1: Reading from Arbitrary MemoryLab 11-2: Writing to Arbitrary MemoryLab 11-3: Changing Program ExecutionMemory Protection SchemesCompiler ImprovementsLab 11-4: Bypassing Stack ProtectionKernel Patches and ScriptsLab 11-5: Return to libc ExploitsLab 11-6: Maintaining Privileges with ret2libcBottom LineSummaryReferencesFor Further Reading
Chapter 12 Windows Exploits
Compiling and Debugging Windows ProgramsLab 12-1: Compiling on WindowsDebugging on Windows with Immunity DebuggerLab 12-2: Crashing the ProgramWriting Windows ExploitsExploit Development Process ReviewLab 12-3: Exploiting ProSSHD ServerUnderstanding Structured Exception Handling (SEH)Implementation of SEHSummaryReferencesFor Further Reading
Chapter 13 Bypassing Windows Memory Protections
Understanding Windows Memory Protections (XP SP3, Vista, 7, 8, Server 2008, and Server 2012)Stack-Based Buffer Overrun Detection (/GS)Safe Structured Exception Handling (SafeSEH)SEH Overwrite Protection (SEHOP)Heap ProtectionsData Execution Prevention (DEP)Address Space Layout Randomization (ASLR)Enhanced Mitigation Experience Toolkit (EMET)Bypassing Windows Memory ProtectionsBypassing /GSBypassing SafeSEHBypassing ASLRBypassing DEPBypassing EMETBypassing SEHOPSummaryReferencesFor Further Reading
Chapter 14 Exploiting the Windows Access Control Model
Why Access Control Is Interesting to a HackerMost People Don’t Understand Access ControlVulnerabilities You Find Are Easy to ExploitYou’ll Find Tons of Security VulnerabilitiesHow Windows Access Control WorksSecurity IdentifierAccess TokenSecurity DescriptorThe Access CheckTools for Analyzing Access Control ConfigurationsDumping the Process TokenDumping the Security DescriptorSpecial SIDs, Special Access, and “Access Denied”Special SIDsSpecial AccessInvestigating “Access Denied”Analyzing Access Control for Elevation of PrivilegeAttack Patterns for Each Interesting Object TypeAttacking ServicesAttacking Weak DACLs in the Windows RegistryAttacking Weak Directory DACLsAttacking Weak File DACLsWhat Other Object Types Are Out There?Enumerating Shared Memory SectionsEnumerating Named PipesEnumerating ProcessesEnumerating Other Named Kernel Objects (Semaphores, Mutexes, Events, and Devices)SummaryFor Further Reading
Chapter 15 Exploiting Web Applications
Overview of the Top 10 Web VulnerabilitiesMD5 Hash InjectionLab 15-1: Injecting the HashMultibyte Encoding InjectionUnderstanding the VulnerabilityLab 15-2: Leverage Multibyte EncodingHunting Cross-site Scripting (XSS)Lab 15-3: Basic XSS Injection into a JavaScript BlockUnicode Normalization Forms AttackLab 15-4: Leveraging Unicode NormalizationUnicode Normalization IntroductionNormalization FormsPreparing the Environment for TestingXSS Testing via x5s the Plug-InLaunching the Attack ManuallyAdding Your Own Test CaseSummaryReferencesFor Further Reading
Chapter 16 Exploiting IE: Smashing the Heap
Setting Up the EnvironmentWinDbg ConfigurationAttaching the Browser to WinDbgIntroduction to Heap SpraySpraying with HTML5Lab 16-1: Heap Spray via HTML5DOM Element Property Spray (DEPS)Lab 16-2: Heap Spray via DEPS TechniqueHeapLib2 TechniqueForcing New Allocations by Exhausting the Cache BlocksLab 16-3: HeapLib2 SprayingFlash Spray with Byte ArraysLab 16-4: Basic Heap Spray with FlashFlash Spray with Integer VectorsLab 16-5: Heap Spray with Flash VectorsLeveraging Low Fragmentation Heap (LFH)SummaryReferencesFor Further Reading
Chapter 17 Exploiting IE: Use-After-Free Technique
Use-After-Free OverviewDebugging JavaScriptDissecting Use-After-Free (UAF)Lab 17-1: Dissecting UAF, Step by StepLeveraging the UAF VulnerabilityExample 17-1: Connecting the DotsSummaryReferencesFor Further Reading
Chapter 18 Advanced Client-Side Exploitation with BeEF
BeEF BasicsLab 18-1: Setting Up BeefLab 18-2: Using the BeEF ConsoleHooking BrowsersLab 18-3: The Basic XSS HookLab 18-4: Hooking Browsers with Site SpoofingLab 18-5: Automatically Injecting Hooks with ShankFingerprinting with BeEFLab 18-6: Fingerprinting Browsers with BeEFLab 18-7: Fingerprinting Users with BeEFLab 18-8: Fingerprinting Computers with BeEFBrowser ExploitationLab 18-9: Exploiting Browsers with BeEF and JavaExploiting Browsers with BeEF and MetasploitAutomating AttacksSummaryFor Further Reading
Chapter 19 One-Day Exploitation with Patch Diffing
Introduction to Binary DiffingApplication DiffingPatch DiffingBinary Diffing ToolsBinDiffturbodiffLab 19-1: Our First DiffPatch Management ProcessMicrosoft Patch TuesdayLab 19-2: Obtaining and Extracting Microsoft PatchesExamining the PatchLab 19-3: Diffing MS14-006 with turbodiffKernel DebuggingLab 19-4: Kernel Debugging MS14-006SummaryReferencesFor Further Reading
Part III Advanced Malware Analysis
Chapter 20 Dissecting Android Malware
The Android PlatformAndroid Application PackageApplication ManifestAnalyzing DEXJava DecompilationDEX DecompilationDEX DisassemblingExample 20-1: Running APK in EmulatorMalware AnalysisMalware Analysis PrimerExample 20-2: Black-Box APK Monitoring with DroidboxSummaryFor Further Reading
Chapter 21 Dissecting Ransomware
History of RansomwareOptions for Paying the RansomDissecting RansomlockExample 21-1: Dynamic AnalysisExample 21-2: Static AnalysisCryptoLockerSummaryFor Further Reading
Chapter 22 Analyzing 64-bit Malware
Overview of the AMD64 ArchitectureAMD64 Calling ConventionsDecrypting C&C DomainsExample 22-1: Decrypting C&C DomainsSummaryFor Further Reading
Chapter 23 Next-Generation Reverse Engineering
Notable IDA Plug-insIDAscopeIDA ToolbagCollaborationHoneypots and Sandboxes Using TrapXA Free Tool for Dynamic AnalysisA Commercial Alternative: TrapX Malware TrapSummaryReferencesFor Further Reading
Appendix About the Download
Index

Content preview from Gray Hat Hacking The Ethical Hacker's Handbook, Fourth Edition, 4th Edition

CHAPTER 10 Basic Linux Exploits

Why study exploits? Ethical hackers should study exploits to understand whether vulnerabilities are exploitable. Sometimes security professionals mistakenly believe and publish the statement, “The vulnerability isn’t exploitable.” Black hat hackers know otherwise. One person’s inability to find an exploit for the vulnerability doesn’t mean someone else can’t. It’s a matter of time and skill level. Therefore, ethical hackers must understand how to exploit vulnerabilities and check for themselves. In the process, they may need to produce proof-of-concept code to demonstrate to the vendor that the vulnerability is exploitable and needs to be fixed.

In this chapter, we cover the following topics:

...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Gray Hat Hacking: The Ethical Hacker's Handbook, Sixth Edition, 6th Edition

Publisher Resources

ISBN: 9780071832380

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Gray Hat Hacking The Ethical Hacker's Handbook, Fourth Edition, 4th Edition

by Daniel Regalado, Shon Harris, Allen Harper, Chris Eagle, Jonathan Ness, Branko Spasojevic, Ryan Linn, Stephen Sims

CHAPTER 10

Basic Linux Exploits

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.