book

Hacking For Dummies®, 2nd Edition

Name: Hacking For Dummies®, 2nd Edition
Author: Kevin Beaver
ISBN: 9780470052358

by Kevin Beaver

October 2006

Beginner

408 pages

English

For Dummies

Read now

Unlock full access

Copyright
About the Author
Author's Acknowledgments
Publisher's Acknowledgments
Foreword
Introduction
Who Should Read This Book?About This BookHow to Use This BookWhat You Don't Need to ReadFoolish AssumptionsHow This Book Is OrganizedPart I: Building the Foundation for Ethical HackingPart II: Putting Ethical Hacking in MotionPart III: Hacking the NetworkPart IV: Hacking Operating SystemsPart V: Hacking ApplicationsPart VI: Ethical Hacking AftermathPart VII: The Part of TensIcons Used in This BookWhere to Go from Here
I. Building the Foundation for Ethical Hacking
1. Introduction to Ethical Hacking
1.1. Straightening Out the Terminology1.1.1. Defining hacker1.1.2. Defining rogue insider1.2. How Malicious Attackers Beget Ethical Hackers1.3. Understanding the Need to Hack Your Own Systems1.4. Understanding the Dangers Your Systems Face1.4.1. Nontechnical attacks1.4.2. Network infrastructure attacks1.4.3. Operating system attacks1.4.4. Application and other specialized attacks1.5. Obeying the Ethical Hacking Commandments1.5.1. Working ethically1.5.2. Respecting privacy1.5.3. Not crashing your systems1.6. The Ethical Hacking Process1.6.1. Formulating your plan1.6.2. Selecting tools1.6.3. Executing the plan1.6.4. Evaluating results1.6.5. Moving on
2. Cracking the Hacker Mindset
2.1. What You're Up Against2.2. Who Breaks into Computer Systems2.3. Why They Do It2.4. Planning and Performing Attacks2.5. Maintaining Anonymity
3. Developing Your Ethical Hacking Plan
3.1. Getting Your Plan Approved3.2. Establishing Your Goals3.3. Determining Which Systems to Hack3.4. Creating Testing Standards3.4.1. Timing3.4.2. Specific tests3.4.3. Blind versus knowledge assessments3.4.4. Location3.4.5. Reacting to major vulnerabilities that you find3.4.6. Silly assumptions3.5. Selecting Tools

4. Hacking Methodology
4.1. Setting the Stage4.2. Seeing What Others See4.2.1. Gathering public information4.2.1.1. Web search4.2.1.2. Web crawling4.2.1.2.1. Web sites4.2.2. Mapping the network4.2.2.1. Whois4.2.2.2. Google groups4.2.2.3. Privacy policies4.3. Scanning Systems4.3.1. Hosts4.3.2. Modems and open ports4.4. Determining What's Running on Open Ports4.5. Assessing Vulnerabilities4.6. Penetrating the System
II. Putting Ethical Hacking in Motion
5. Social Engineering
5.1. Social Engineering 1015.2. Before You Start5.3. Why Attackers Use Social Engineering5.4. Understanding the Implications5.5. Performing Social Engineering Attacks5.5.1. Fishing for information5.5.1.1. Using the Internet5.5.1.2. Dumpster diving5.5.1.3. Phone systems5.5.2. Building trust5.5.3. Exploiting the relationship5.5.3.1. Deceit through words and actions5.5.3.2. Deceit through technology5.6. Social Engineering Countermeasures5.6.1. Policies5.6.2. User awareness and training
6. Physical Security
6.1. Physical Security Vulnerabilities6.2. What to Look For6.2.1. Building infrastructure6.2.1.1. Attack points6.2.1.2. Countermeasures6.2.2. Utilities6.2.2.1. Attack points6.2.2.2. Countermeasures6.2.3. Office layout and usage6.2.3.1. Attack points6.2.3.2. Countermeasures6.2.4. Network components and computers6.2.4.1. Attack points6.2.4.2. Countermeasures
7. Passwords
7.1. Password Vulnerabilities7.1.1. Organizational password vulnerabilities7.1.2. Technical password vulnerabilities7.2. Cracking Passwords7.2.1. Cracking passwords the old-fashioned way7.2.1.1. Social engineering7.2.1.1.1. Techniques7.2.1.1.2. Countermeasures7.2.1.2. Shoulder surfing7.2.1.2.1. Techniques7.2.1.2.2. Countermeasures7.2.1.3. Inference7.2.1.4. Weak authentication7.2.1.4.1. Bypassing authentication7.2.1.4.2. Countermeasures7.2.2. High-tech password cracking7.2.2.1. Password-cracking software7.2.2.2. Dictionary attacks7.2.2.3. Brute-force attacks7.2.2.4. Rainbow attacks7.2.2.5. Cracking Windows passwords with pwdump3 and John the Ripper7.2.2.6. Cracking UNIX passwords with John the Ripper7.2.2.7. Cracking Windows passwords using rainbow tables with ophcrack7.2.2.8. Cracking Windows passwords using RainbowCrack Online7.2.2.9. Checking for null passwords in NetWare7.2.3. Password-protected files7.2.3.1. Cracking files7.2.3.2. Countermeasures7.2.4. Other ways to crack passwords7.2.4.1. Keystroke logging7.2.4.1.1. Logging tools7.2.4.1.2. Countermeasures7.2.4.2. Weak password storage7.2.4.2.1. Searching7.2.4.2.2. Countermeasures7.2.4.3. Network analyzer7.2.4.3.1. Testing7.2.4.3.2. Countermeasures7.2.4.4. Weak BIOS passwords7.2.4.4.1. Countermeasures7.2.4.5. Weak passwords in limbo7.2.4.5.1. Weaknesses7.2.4.5.2. Countermeasures7.2.4.6. Password-reset programs7.2.4.6.1. Tools7.2.4.6.2. Countermeasures7.3. General Password-Cracking Countermeasures7.3.1. Storing passwords7.3.2. Policy considerations7.3.3. Other considerations7.4. Securing Operating Systems7.4.1. Windows7.4.2. Linux and UNIX
III. Hacking the Network
8. War Dialing
8.1. Modem Safety8.2. General Telephone System Vulnerabilities8.3. Attacking Systems by War Dialing8.3.1. Gathering information8.3.2. Selecting war dialing tools8.3.2.1. Software8.3.2.2. Modems8.3.3. Dialing in from the outside8.3.4. Using tools8.3.4.1. Configuration8.3.4.2. Testing8.3.5. Rooting through the systems8.4. War Dialing Countermeasures8.4.1. Phone numbers8.4.2. Modem operation8.4.3. Installation
9. Network Infrastructure
9.1. Network Infrastructure Vulnerabilities9.2. Choosing Tools9.2.1. Scanners and analyzers9.2.2. Vulnerability assessment9.3. Scanning, Poking, and Prodding9.3.1. Port scanners9.3.1.1. Ping sweeping9.3.1.2. Using port scanning tools9.3.1.2.1. SuperScan9.3.1.2.2. Nmap9.3.1.2.3. Gathering network information9.3.1.3. Countermeasures against port scanning9.3.1.3.1. Traffic restriction9.3.1.3.2. Traffic denial9.3.2. SNMP scanning9.3.2.1. Vulnerabilities9.3.2.2. Countermeasures against SNMP attacks9.3.3. Banner grabbing9.3.3.1. telnet9.3.3.2. Netcat9.3.3.3. Countermeasures against banner-grabbing attacks9.3.4. Firewall rules9.3.4.1. Testing9.3.4.1.1. All-in-one tools9.3.4.1.2. Netcat9.3.4.2. Countermeasures against firewall attacks9.3.5. Network analyzers9.3.5.1. Network analyzer programs9.3.5.2. Countermeasures against network analyzer attacks9.3.5.2.1. Physical security9.3.5.2.2. Network analyzer detection9.3.6. The MAC-daddy attack9.3.6.1. ARP spoofing9.3.6.2. Using Cain and Abel for ARP poisoning9.3.6.3. MAC address spoofing9.3.6.3.1. UNIX-based systems9.3.6.3.2. Windows9.3.6.4. Countermeasures against ARP poisoning and MAC address spoofing attacks9.3.6.4.1. Prevention9.3.6.4.2. Detection9.3.7. Denial of service9.3.7.1. DoS attacks9.3.7.1.1. Individual attacks9.3.7.1.2. Distributed attacks9.3.7.1.3. Testing9.3.7.2. Countermeasures against DoS attacks9.4. General Network Defenses
10. Wireless LANs
10.1. Understanding the Implications of Wireless Network Vulnerabilities10.2. Choosing Your Tools10.3. Wireless LAN Discovery10.3.1. Checking for worldwide recognition10.3.2. Scanning your local airwaves10.4. Wireless Network Attacks10.4.1. Encrypted traffic10.4.2. Countermeasures against encrypted traffic attacks10.4.3. Rogue wireless devices10.4.4. Countermeasures against rogue wireless devices10.4.5. MAC spoofing10.4.6. Countermeasures against MAC spoofing10.4.7. Queensland DoS attack10.4.8. Countermeasures against DoS attacks10.4.9. Physical security problems10.4.10. Countermeasures against physical security problems10.4.11. Vulnerable wireless workstations10.4.12. Countermeasures against vulnerable wireless workstations10.4.13. Default configuration settings10.4.14. Countermeasures against default configuration settings exploits
IV. Hacking Operating Systems
11. Windows
11.1. Windows Vulnerabilities11.2. Choosing Tools11.2.1. Essential tools11.2.2. Free Microsoft tools11.2.3. All-in-one assessment tools11.2.4. Task-specific tools11.3. Information Gathering11.3.1. System scanning11.3.1.1. Testing11.3.1.2. Countermeasures against system scanning11.3.1.2.1. Information11.3.1.2.2. Fingerprinting11.3.2. NetBIOS11.3.2.1. Hacks11.3.2.1.1. Unauthenticated enumeration11.3.2.2. Shares11.3.2.3. Countermeasures against NetBIOS attacks11.3.2.3.1. Limit traffic11.3.2.3.2. Passwords11.4. RPC11.4.1. Enumeration11.4.2. Countermeasures against RPC enumeration11.5. Null Sessions11.5.1. Hacks11.5.1.1. Mapping11.5.1.2. Gleaning information11.5.1.2.1. net view11.5.1.3. Configuration and user information11.5.1.3.1. Walksam11.5.1.3.2. Network Users11.5.2. Countermeasures against null session hacks11.5.2.1. Secure versions11.5.2.2. Blocking NetBIOS11.5.2.3. Registry11.5.2.3.1. Windows 200011.5.2.3.2. Windows NT11.6. Share Permissions11.6.1. Windows defaults11.6.1.1. Windows 2000/NT11.6.1.2. Windows 2003 Server and XP11.6.2. Testing11.6.2.1. DumpSec11.6.2.2. LANguard Network Security Scanner11.7. Hardcore Vulnerability Exploitation11.7.1. Using Metasploit11.7.2. Using CORE IMPACT11.7.3. Countermeasures against hardcore vulnerability exploits11.8. Authenticated Scans11.8.1. General OS vulnerabilities11.8.2. Rooting out sensitive text in network files
12. Linux
12.1. Linux Vulnerabilities12.2. Choosing Tools12.3. Information Gathering12.3.1. System scanning12.3.2. Countermeasures against system scanning12.4. Unneeded Services12.4.1. Searches12.4.1.1. Vulnerabilities12.4.1.2. Tools12.4.2. Countermeasures against attacks on unneeded services12.4.2.1. Disabling unneeded services12.4.2.1.1. inetd.conf12.4.2.1.2. chkconfig12.4.2.2. Access control12.5. .rhosts and hosts.equiv Files12.5.1. Hacks using the .rhosts and hosts.equiv files12.5.1.1. hosts.equiv12.5.1.2. .rhosts12.5.2. Countermeasures against .rhosts and hosts.equiv file attacks12.5.2.1. Disabling commands12.5.2.2. Blocking access12.6. NFS12.6.1. NFS hacks12.6.2. Countermeasures against NFS attacks12.7. File Permissions12.7.1. File permission hacks12.7.2. Countermeasures against file permission attacks12.7.2.1. Manual testing12.7.2.2. Automatic testing12.8. Buffer Overflows12.8.1. Attacks12.8.2. Countermeasures against buffer-overflow attacks12.9. Physical Security12.9.1. Physical security hacks12.9.2. Countermeasures against physical security attacks12.10. General Security Tests12.11. Patching Linux12.11.1. Distribution updates12.11.1.1. Red Hat12.11.1.2. Debian12.11.1.3. Slackware12.11.1.4. SUSE12.11.2. Multiplatform update managers
13. Novell NetWare
13.1. NetWare Vulnerabilities13.2. Choosing Tools13.3. Getting Started13.3.1. Server access methods13.3.2. Port scanning13.3.3. NCPQuery13.3.4. Countermeasures against enumeration13.4. Authentication13.4.1. rconsole13.4.1.1. rconsole attacks13.4.1.2. Countermeasures against rconsole attacks13.4.2. Server-console access13.4.3. Intruder detection13.4.3.1. Testing for intruders13.4.3.2. Countermeasures against intruders13.4.4. Rogue NLMs13.4.4.1. Testing for rogue NLMs13.4.4.1.1. Modules command13.4.4.1.2. Tcpcon13.4.4.1.3. Admin utilities13.4.4.2. Countermeasures against rogue NLM attacks13.4.4.2.1. Documentation13.4.4.2.2. Unauthorized logins13.4.5. Cleartext packets13.4.5.1. Packet capture13.4.5.2. Countermeasures against packet capture13.5. Solid Practices for Minimizing NetWare Security Risks13.5.1. Rename admin13.5.2. Disable eDirectory browsing13.5.2.1. NetWare Administrator13.5.2.2. Novell ConsoleOne13.5.3. Remove bindery contexts13.5.4. Audit the system13.5.5. TCP/IP parameters13.5.6. Patch
V. Hacking Applications
14. Messaging Systems
14.1. Messaging System Vulnerabilities14.2. E-Mail Attacks14.2.1. E-mail bombs14.2.1.1. Attachments14.2.1.1.1. Attacks using e-mail attachments14.2.1.1.2. Countermeasures against e-mail attachment attacks14.2.1.2. Connections14.2.1.2.1. Attacks using floods of e-mails14.2.1.2.2. Countermeasures against connection attacks14.2.1.3. Automatic e-mail security14.2.1.3.1. Tarpitting14.2.1.3.2. E-mail firewalls14.2.1.3.3. Perimeter protection14.2.2. Banners14.2.2.1. Gathering information14.2.2.2. Countermeasures against banner attacks14.2.3. SMTP attacks14.2.3.1. Account enumeration14.2.3.1.1. Attacks using account enumeration14.2.3.1.2. Countermeasures against account enumeration14.2.3.2. Relay14.2.3.2.1. Automatic testing14.2.3.2.2. Manual testing14.2.3.2.3. Countermeasures against SMTP relay attacks14.2.3.3. E-mail header disclosures14.2.3.3.1. Testing14.2.3.3.2. Countermeasures against header disclosures14.2.3.4. Capturing traffic14.2.3.5. Malware14.2.3.5.1. Eicar test string14.2.3.5.2. GFI's Email Security Testing Zone14.2.4. General best practices for minimizing e-mail security risks14.2.4.1. Software solutions14.2.4.2. Operating guidelines14.3. Instant Messaging14.3.1. IM vulnerabilities14.3.1.1. Sharing network drives14.3.1.2. Log files14.3.2. Countermeasures against IM vulnerabilities14.3.2.1. Detecting IM traffic14.3.2.2. Maintenance and configuration14.4. Voice over IP14.4.1. VoIP vulnerabilities14.4.1.1. Scanning for vulnerabilities14.4.1.2. Capturing and recording voice traffic14.4.2. Countermeasures against VoIP vulnerabilities
15. Web Applications and Databases
15.1. Choosing Your Web Application Tools15.2. Web Application Vulnerabilities15.2.1. Unsecured login mechanisms15.2.2. Countermeasures against unsecured login systems15.2.3. Directory traversal15.2.3.1. robots.txt15.2.3.2. Filenames15.2.3.3. Crawlers15.2.3.4. Google15.2.4. Countermeasures against directory traversals15.2.5. Input filtering attacks15.2.5.1. Buffer overflows15.2.5.2. Automated input15.2.5.3. Code injection and SQL injection15.2.5.4. Hidden field manipulation15.2.5.5. Cross-site scripting15.2.6. Countermeasures against input attacks15.2.7. Memory attacks15.2.8. Countermeasures against memory attacks15.2.9. Default script attacks15.2.10. Countermeasures against default script attacks15.2.11. URL filter bypassing15.2.12. Countermeasures against URL filter bypassing15.2.13. General security scans for Web application vulnerabilities15.3. Database Vulnerabilities15.3.1. Finding database servers on the network15.3.2. Cracking database server passwords15.3.3. Scanning databases for vulnerabilities15.4. General Best Practices for Minimizing Security Risks15.4.1. Obscurity15.4.2. Firewalls
VI. Ethical Hacking Aftermath
16. Reporting Your Results
16.1. Pulling the Results Together16.2. Prioritizing Vulnerabilities16.3. Reporting Methods
17. Plugging Security Holes
17.1. Turning Your Reports into Action17.2. Patching for Perfection17.2.1. Patch management17.2.2. Patch automation17.2.2.1. Commercial tools17.2.2.2. Free tools17.3. Hardening Your Systems17.4. Assessing Your Security Infrastructure
18. Managing Security Changes
18.1. Automating the Ethical Hacking Process18.2. Monitoring Malicious Use18.3. Outsourcing Ethical Hacking18.4. Instilling a Security-Aware Mindset18.5. Keeping Up with Other Security Issues
VII. The Part of Tens
19. Ten Tips for Getting Upper Management Buy-In
19.1. Cultivate an Ally and Sponsor19.2. Don't Be a FUDdy Duddy19.3. Demonstrate How the Organization Can't Afford to Be Hacked19.4. Outline the General Benefits of Ethical Hacking19.5. Show How Ethical Hacking Specifically Helps the Organization19.6. Get Involved in the Business19.7. Establish Your Credibility19.8. Speak on Their Level19.9. Show Value in Your Efforts19.10. Be Flexible and Adaptable
20. Ten Deadly Mistakes
20.1. Not Getting Prior Approval in Writing20.2. Assuming that You Can Find All Vulnerabilities during Your Tests20.3. Assuming That You Can Eliminate All Security Vulnerabilities20.4. Performing Tests Only Once20.5. Thinking That You Know It All20.6. Running Your Tests without Looking at Things from a Hacker's Viewpoint20.7. Not Testing the Right Systems20.8. Not Using the Right Tools20.9. Pounding Production Systems at the Wrong Time20.10. Outsourcing Testing and Not Staying Involved
A. Tools and Resources
A.1. Awareness and TrainingA.2. BluetoothA.3. CertificationsA.4. Dictionary Files and Word ListsA.5. Exploit ToolsA.6. General Research ToolsA.7. Hacker StuffA.8. LinuxA.9. Log AnalysisA.10. MalwareA.11. MessagingA.12. NetWareA.13. NetworksA.14. Password CrackingA.15. Patch ManagementA.16. Source Code AnalysisA.17. Security StandardsA.18. Security EducationA.19. StorageA.20. Risk Analysis and Threat ModelingA.21. Voice over IPA.22. War DialingA.23. Web Applications and DatabasesA.24. WindowsA.25. Wireless Networks

Overview

Are you worried about external hackers and rogue insiders breaking into your systems? Whether it's social engineering, network infrastructure attacks, or application hacking, security breaches in your systems can devastate your business or personal life. In order to counter these cyber bad guys, you must become a hacker yourself—an ethical hacker.

Hacking for Dummies shows you just how vulnerable your systems are to attackers. It shows you how to find your weak spots and perform penetration and other security tests. With the information found in this handy, straightforward book, you will be able to develop a plan to keep your information safe and sound. You'll discover how to:

Work ethically, respect privacy, and save your system from crashing
Develop a hacking plan
Treat social engineers and preserve their honesty
Counter war dialing and scan infrastructures
Understand the vulnerabilities of Windows, Linux, and Novell NetWare
Prevent breaches in messaging systems, web applications, and databases
Report your results and managing security changes
Avoid deadly mistakes
Get management involved with defending your systems

As we enter into the digital era, protecting your systems and your company has never been more important. Don't let skepticism delay your decisions and put your security at risk. With Hacking For Dummies, you can strengthen your defenses and prevent attacks from every angle!

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9780470052358Purchase book

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills