book

Gray Hat Hacking The Ethical Hacker's Handbook, Fifth Edition, 5th Edition

Name: Gray Hat Hacking The Ethical Hacker's Handbook, Fifth Edition, 5th Edition
ISBN: 9781260108422

by Daniel Regalado, Shon Harris, Allen Harper, Chris Eagle, Jonathan Ness, Branko Spasojevic, Ryan Linn, Stephen Sims

April 2018

Intermediate to advanced

640 pages

17h 12m

English

McGraw-Hill

Read now

Unlock full access

Cover
Title Page
Copyright Page
Dedication
Contents
Preface
Acknowledgments
Introduction
Part I Preparation
Chapter 1 Why Gray Hat Hacking? Ethics and Law
Know Your EnemyThe Current Security LandscapeRecognizing an AttackThe Gray Hat WayEmulating the AttackFrequency and Focus of TestingEvolution of CyberlawUnderstanding Individual CyberlawsSummaryReferences

Chapter 2 Programming Survival Skills
C Programming LanguageBasic C Language ConstructsSample ProgramCompiling with gccComputer MemoryRandom Access MemoryEndianSegmentation of MemoryPrograms in MemoryBuffersStrings in MemoryPointersPutting the Pieces of Memory TogetherIntel ProcessorsRegistersAssembly Language BasicsMachine vs. Assembly vs. CAT&T vs. NASMAddressing ModesAssembly File StructureAssemblingDebugging with gdbgdb BasicsDisassembly with gdbPython Survival SkillsGetting Python“Hello, World!” in PythonPython ObjectsStringsNumbersListsDictionariesFiles with PythonSockets with PythonSummaryFor Further ReadingReferences
Chapter 3 Next-Generation Fuzzing
Introduction to FuzzingTypes of FuzzersMutation FuzzersGeneration FuzzersGenetic FuzzingMutation Fuzzing with PeachLab 3-1: Mutation Fuzzing with PeachGeneration Fuzzing with PeachCrash AnalysisLab 3-2: Generation Fuzzing with PeachGenetic or Evolutionary Fuzzing with AFLLab 3-3: Genetic Fuzzing with AFLSummaryFor Further Reading
Chapter 4 Next-Generation Reverse Engineering
Code AnnotationIDB Annotation with IDAscopeC++ Code AnalysisCollaborative AnalysisLeveraging Collaborative Knowledge Using FIRSTCollaboration with BinNaviDynamic AnalysisAutomated Dynamic Analysis with Cuckoo SandboxBridging the Static-Dynamic Tool Gap with LabelessSummaryFor Further ReadingReferences
Chapter 5 Software-Defined Radio
Getting Started with SDRWhat to BuyNot So Quick: Know the RulesLearn by ExampleSearchCaptureReplayAnalyzePreviewExecuteSummaryFor Further Reading
Part II Business of Hacking
Chapter 6 So You Want to Be a Pen Tester?
The Journey from Novice to ExpertPen Tester EthosPen Tester TaxonomyThe Future of HackingKnow the TechKnow What Good Looks LikePen Tester TrainingPracticeDegree ProgramsKnowledge TransferPen Tester TradecraftPersonal LiabilityBeing the Trusted AdvisorManaging a Pen TestSummaryFor Further Reading
Chapter 7 Red Teaming Operations
Red Team OperationsStrategic, Operational, and Tactical FocusAssessment ComparisonsRed Teaming ObjectivesWhat Can Go WrongLimited ScopeLimited TimeLimited AudienceOvercoming LimitationsCommunicationsPlanning MeetingsDefining Measurable EventsUnderstanding ThreatsAttack FrameworksTesting EnvironmentAdaptive TestingExternal AssessmentPhysical Security AssessmentSocial EngineeringInternal AssessmentLessons LearnedSummaryReferences
Chapter 8 Purple Teaming
Introduction to Purple TeamingBlue Team OperationsKnow Your EnemyKnow YourselfSecurity ProgramIncident Response ProgramCommon Blue Teaming ChallengesPurple Teaming OperationsDecision FrameworksDisrupting the Kill ChainKill Chain Countermeasure FrameworkCommunicationPurple Team OptimizationSummaryFor Further ReadingReferences
Chapter 9 Bug Bounty Programs
History of Vulnerability DisclosureFull Vendor DisclosureFull Public DisclosureResponsible DisclosureNo More Free BugsBug Bounty ProgramsTypes of Bug Bounty ProgramsIncentivesControversy Surrounding Bug Bounty ProgramsPopular Bug Bounty Program FacilitatorsBugcrowd in DepthProgram Owner Web InterfaceProgram Owner API ExampleResearcher Web InterfaceEarning a Living Finding BugsSelecting a TargetRegistering (If Required)Understanding the Rules of the GameFinding VulnerabilitiesReporting VulnerabilitiesCashing OutIncident ResponseCommunicationTriageRemediationDisclosure to UsersPublic RelationsSummaryFor Further ReadingReferences
Part III Exploiting Systems
Chapter 10 Getting Shells Without Exploits
Capturing Password HashesUnderstanding LLMNR and NBNSUnderstanding Windows NTLMv1 and NTLMv2 AuthenticationUsing ResponderLab 10-1: Getting Passwords with ResponderUsing WinexeLab 10-2: Using Winexe to Access Remote SystemsLab 10-3: Using Winexe to Gain Elevated PrivilegesUsing WMILab 10-4: Querying System Information with WMILab 10-5: Executing Commands with WMITaking Advantage of WinRMLab 10-6: Executing Commands with WinRMLab 10-7: Using WinRM to Run PowerShell RemotelySummaryFor Further ReadingReference
Chapter 11 Basic Linux Exploits
Stack Operations and Function-Calling ProceduresBuffer OverflowsLab 11-1: Overflowing meet.cRamifications of Buffer OverflowsLocal Buffer Overflow ExploitsLab 11-2: Components of the ExploitLab 11-3: Exploiting Stack Overflows from the Command LineLab 11-4: Exploiting Stack Overflows with Generic Exploit CodeLab 11-5: Exploiting Small BuffersExploit Development ProcessLab 11-6: Building Custom ExploitsSummaryFor Further Reading
Chapter 12 Advanced Linux Exploits
Format String ExploitsFormat StringsLab 12-1: Reading from Arbitrary MemoryLab 12-2: Writing to Arbitrary MemoryLab 12-3: Changing Program ExecutionMemory Protection SchemesCompiler ImprovementsLab 11-4: Bypassing Stack ProtectionKernel Patches and ScriptsLab 12-5: Return to libc ExploitsLab 12-6: Maintaining Privileges with ret2libcBottom LineSummaryFor Further ReadingReferences
Chapter 13 Windows Exploits
Compiling and Debugging Windows ProgramsLab 13-1: Compiling on WindowsWindows Compiler OptionsDebugging on Windows with Immunity DebuggerLab 13-2: Crashing the ProgramWriting Windows ExploitsExploit Development Process ReviewLab 13-3: Exploiting ProSSHD ServerUnderstanding Structured Exception Handling (SEH)Understanding and Bypassing Windows Memory ProtectionsSafe Structured Exception Handling (SafeSEH)Bypassing SafeSEHSEH Overwrite Protection (SEHOP)Bypassing SEHOPStack-Based Buffer Overrun Detection (/GS)Bypassing /GSHeap ProtectionsSummaryFor Further ReadingReferences
Chapter 14 Advanced Windows Exploitation
Data Execution Prevention (DEP)Address Space Layout Randomization (ASLR)Enhanced Mitigation Experience Toolkit (EMET) and Windows Defender Exploit GuardBypassing ASLRBypassing DEP and Avoiding ASLRVirtualProtectReturn-Oriented ProgrammingGadgetsBuilding the ROP ChainDefeating ASLR Through a Memory LeakTriggering the BugTracing the Memory LeakWeaponizing the Memory LeakBuilding the RVA ROP ChainSummaryFor Further ReadingReferences
Chapter 15 PowerShell Exploitation
Why PowerShellLiving Off the LandPowerShell LoggingPowerShell PortabilityLoading PowerShell ScriptsLab 15-1: The Failure ConditionLab 15-2: Passing Commands on the Command LineLab 15-3: Encoded CommandsLab 15-4: Bootstrapping via the WebExploitation and Post-Exploitation with PowerSploitLab 15-5: Setting Up PowerSploitLab 15-6: Running Mimikatz Through PowerShellLab 15-7: Creating a Persistent Meterpreter Using PowerSploitUsing PowerShell Empire for C2Lab 15-8: Setting Up EmpireLab 15-9: Staging an Empire C2Lab 15-10: Using Empire to Own the SystemSummaryFor Further ReadingReferences
Chapter 16 Next-Generation Web Application Exploitation
The Evolution of Cross-Site Scripting (XSS)Setting Up the EnvironmentLab 16-1: XSS RefresherLab 16-2: XSS Evasion from Internet WisdomLab 16-3: Changing Application Logic with XSSLab 16-4: Using the DOM for XSSFramework VulnerabilitiesSetting Up the EnvironmentLab 16-5: Exploiting CVE-2017-5638Lab 16-6: Exploiting CVE-2017-9805Padding Oracle AttacksLab 16-7: Changing Data with the Padding Oracle AttackSummaryFor Further ReadingReferences
Chapter 17 Next-Generation Patch Exploitation
Introduction to Binary DiffingApplication DiffingPatch DiffingBinary Diffing ToolsBinDiffturbodiffLab 17-1: Our First DiffPatch Management ProcessMicrosoft Patch TuesdayObtaining and Extracting Microsoft PatchesLab 17-2: Diffing MS17-010Patch Diffing for ExploitationDLL Side-Loading BugsLab 17-3: Diffing MS16-009SummaryFor Further ReadingReferences
Part IV Advanced Malware Analysis
Chapter 18 Dissecting Mobile Malware
The Android PlatformAndroid Application PackageApplication ManifestAnalyzing DEXJava DecompilationDEX DecompilationDEX DisassemblingExample 18-1: Running APK in EmulatorMalware AnalysisThe iOS PlatformiOS SecurityiOS ApplicationsSummaryFor Further ReadingReferences
Chapter 19 Dissecting Ransomware
The Beginnings of RansomwareOptions for Paying the RansomDissecting RansomlockExample 19-1: Dynamic AnalysisExample 19-2: Static AnalysisWannacryExample 19-3: Analyzing Wannacry RansomwareSummaryFor Further Reading
Chapter 20 ATM Malware
ATM OverviewXFS OverviewXFS ArchitectureXFS ManagerATM Malware AnalysisTypes of ATM MalwareTechniques for Installing Malware on ATMsTechniques for Dissecting the MalwareATM Malware CountermeasuresSummaryFor Further ReadingReferences
Chapter 21 Deception: Next-Generation Honeypots
Brief History of DeceptionHoneypots as a Form of DeceptionDeployment ConsiderationsSetting Up a Virtual MachineOpen Source HoneypotsLab 21-1: DionaeaLab 21-2: ConPotLab 21-3: CowrieLab 21-4: T-PotCommercial Alternative: TrapXSummaryFor Further ReadingReferences
Part V Internet of Things
Chapter 22 Internet of Things to Be Hacked
Internet of Things (IoT)Types of Connected ThingsWireless ProtocolsCommunication ProtocolsSecurity ConcernsShodan IoT Search EngineWeb InterfaceShodan Command-Line InterfaceLab 22-1: Using the Shodan Command LineShodan APILab 22-2: Testing the Shodan APILab 22-3: Playing with MQTTImplications of This Unauthenticated Access to MQTTIoT Worms: It Was a Matter of TimeLab 22-4: Mirai LivesPreventionSummaryFor Further ReadingReferences
Chapter 23 Dissecting Embedded Devices
CPUMicroprocessorMicrocontrollersSystem on Chip (SoC)Common Processor ArchitecturesSerial InterfacesUARTSPII2CDebug InterfacesJTAGSWD (Serial Wire Debug)SoftwareBootloaderNo Operating SystemReal-Time Operating SystemGeneral Operating SystemSummaryFor Further ReadingReferences
Chapter 24 Exploiting Embedded Devices
Static Analysis of Vulnerabilities in Embedded DevicesLab 24-1: Analyzing the Update PackageLab 24-2: Performing Vulnerability AnalysisDynamic Analysis with HardwareThe Test Environment SetupEttercapDynamic Analysis with EmulationFIRMADYNELab 24-3: Setting Up FIRMADYNELab 24-4: Emulating FirmwareLab 24-5: Exploiting FirmwareSummaryFurther ReadingReferences
Chapter 25 Fighting IoT Malware
Physical Access to the DeviceRS-232 OverviewRS-232 PinoutExercise 25-1: Troubleshooting a Medical Device’s RS-232 PortSetting Up the Threat LabARM and MIPS OverviewLab 25-1: Setting Up Systems with QEMUDynamic Analysis of IoT MalwareLab 25-2: IoT Malware Dynamic AnalysisPlatform for Architecture-Neutral Dynamic Analysis (PANDA)BeagleBone Black BoardReverse Engineering IoT MalwareCrash-Course ARM/MIPS Instruction SetLab 25-3: IDA Pro Remote Debugging and ReversingIoT Malware Reversing ExerciseSummaryFor Further Reading
Index

Content preview from Gray Hat Hacking The Ethical Hacker's Handbook, Fifth Edition, 5th Edition

CHAPTER 12 Advanced Linux Exploits

Now that you have the basics under your belt from reading Chapter 11, you are ready to study more advanced Linux exploits. The field is advancing constantly, with new techniques always being discovered by hackers and countermeasures being implemented by developers. No matter how you approach the problem, you need to move beyond the basics. That said, we can only go so far in this book—your journey is only beginning. The “For Further Reading” section at the end of this chapter will give you more destinations to explore.

In this chapter, we discuss the following topics:

• Format string exploits

• Memory protection schemes

Format String Exploits

Format string exploits became public in late 2000. Unlike buffer ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Gray Hat Hacking The Ethical Hacker's Handbook, Fourth Edition, 4th Edition

Publisher Resources

ISBN: 9781260108422

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Gray Hat Hacking The Ethical Hacker's Handbook, Fifth Edition, 5th Edition

by Daniel Regalado, Shon Harris, Allen Harper, Chris Eagle, Jonathan Ness, Branko Spasojevic, Ryan Linn, Stephen Sims

CHAPTER 12