Network Security Assessment. Know Your Network Chris McNab

Spis treści książki

• Network Security Assessment
  • SPECIAL OFFER: Upgrade this ebook with OReilly
  • A Note Regarding Supplemental Files
  • Foreword
    • About Bob Ayers
  • Preface
    • Recognized Assessment Standards
      • NSA IAM
      • CESG CHECK
    • Hackers Defined
    • Organization
    • Audience
    • Mirror Site for Tools Mentioned in This Book
    • Using Code Examples
    • Conventions Used in This Book
    • Comments and Questions
    • Acknowledgments
  • 1. Network Security Assessment
    • 1.1. The Business Benefits
    • 1.2. IP: The Foundation of the Internet
    • 1.3. Classifying Internet-Based Attackers
    • 1.4. Assessment Service Definitions
    • 1.5. Network Security Assessment Methodology
      • 1.5.1. Internet Host and Network Enumeration
      • 1.5.2. Bulk Network Scanning and Probing
      • 1.5.3. Investigation of Vulnerabilities
      • 1.5.4. Exploitation of Vulnerabilities
    • 1.6. The Cyclic Assessment Approach
  • 2. The Tools Required
    • 2.1. The Operating Systems
      • 2.1.1. Windows NT Family Platforms
      • 2.1.2. Linux
      • 2.1.3. MacOS X
      • 2.1.4. VMware
    • 2.2. Free Network Scanning Tools
      • 2.2.1. nmap
      • 2.2.2. Nessus
      • 2.2.3. NSAT
      • 2.2.4. Foundstone SuperScan
    • 2.3. Commercial Network Scanning Tools
    • 2.4. Protocol-Dependent Assessment Tools
      • 2.4.1. Microsoft NetBIOS, SMB, and CIFS
        • 2.4.1.1. Enumeration and information gathering tools
        • 2.4.1.2. Brute-force password guessing tools
      • 2.4.2. DNS
      • 2.4.3. HTTP and HTTPS
  • 3. Internet Host and Network Enumeration
    • 3.1. Web Search Engines
      • 3.1.1. Google Advanced Search Functionality
        • 3.1.1.1. Enumerating CIA contact details with Google
        • 3.1.1.2. Effective search query strings
      • 3.1.2. Searching Newsgroups
    • 3.2. NIC Querying
      • 3.2.1. NIC Querying Tools and Examples
        • 3.2.1.1. Using the Sam Spade Windows client
        • 3.2.1.2. Using the Unix whois utility
        • 3.2.1.3. Directly querying ARIN
        • 3.2.1.4. Harvesting user details through WHOIS
    • 3.3. DNS Querying
      • 3.3.1. Forward DNS Querying
        • 3.3.1.1. Forward DNS querying through nslookup
        • 3.3.1.2. Forward DNS querying through host
        • 3.3.1.3. Forward DNS querying through dig
        • 3.3.1.4. Information retrieved through forward DNS querying
      • 3.3.2. DNS Zone Transfer Techniques
        • 3.3.2.1. Performing DNS zone transfers with nslookup
        • 3.3.2.2. Information retrieved through DNS zone transfer
        • 3.3.2.3. Performing DNS zone transfers using host and dig
        • 3.3.2.4. Further querying
        • 3.3.2.5. Mapping subdomains with host
        • 3.3.2.6. Example of a DNS zone transfer refusal
      • 3.3.3. Reverse DNS Sweeping
      • 3.3.4. SMTP Probing
    • 3.4. Enumeration Technique Recap
    • 3.5. Enumeration Countermeasures
  • 4. IP Network Scanning
    • 4.1. ICMP Probing
      • 4.1.1. SING
      • 4.1.2. nmap
      • 4.1.3. Gleaning Internal IP Addresses
      • 4.1.4. Identifying Subnet Broadcast Addresses
    • 4.2. TCP Port Scanning
      • 4.2.1. Standard Scanning Methods
        • 4.2.1.1. Vanilla connect( ) scanning
          • 4.2.1.1.1. Tools that perform connect( ) TCP scanning
        • 4.2.1.2. Half-open SYN flag scanning
          • 4.2.1.2.1. Tools that perform half-open SYN scanning
      • 4.2.2. Stealth TCP Scanning Methods
        • 4.2.2.1. Inverse TCP flag scanning
          • 4.2.2.1.1. Tools that perform inverse TCP flag scanning
        • 4.2.2.2. ACK flag probe scanning
          • 4.2.2.2.1. Analysis of the TTL field of received packets
          • 4.2.2.2.2. Analysis of the WINDOW field of received packets
          • 4.2.2.2.3. Tools that perform ACK flag probe scanning
      • 4.2.3. Third-Party and Spoofed TCP Scanning Methods
        • 4.2.3.1. FTP bounce scanning
          • 4.2.3.1.1. Tools that perform FTP bounce port scanning
        • 4.2.3.2. Proxy bounce scanning
        • 4.2.3.3. Sniffer-based spoofed scanning
        • 4.2.3.4. IP ID header scanning
    • 4.3. UDP Port Scanning
      • 4.3.1. Tools That Perform UDP Port Scanning
    • 4.4. IDS Evasion and Filter Circumvention
      • 4.4.1. Fragmenting Probe Packets
        • 4.4.1.1. fragtest
        • 4.4.1.2. fragroute
          • 4.4.1.2.1. fragroute.conf
        • 4.4.1.3. nmap
      • 4.4.2. Emulating Multiple Attacking Hosts
      • 4.4.3. Source Routing
        • 4.4.3.1. Assessing source-routing vulnerabilities
          • 4.4.3.1.1. lsrscan
          • 4.4.3.1.2. lsrtunnel
      • 4.4.4. Using Specific TCP and UDP Source Ports
    • 4.5. Low-Level IP Assessment
      • 4.5.1. Analyzing Responses to TCP Probes
        • 4.5.1.1. hping2
        • 4.5.1.2. firewalk
      • 4.5.2. Passively Monitoring ICMP Responses
      • 4.5.3. IP Fingerprinting
      • 4.5.4. TCP Sequence and IP ID Incrementation
    • 4.6. Network Scanning Recap
    • 4.7. Network Scanning Countermeasures
  • 5. Assessing Remote Information Services
    • 5.1. Remote Information Services
    • 5.2. systat and netstat
    • 5.3. DNS
      • 5.3.1. Retrieving DNS Service Version Information
      • 5.3.2. DNS Zone Transfers
      • 5.3.3. DNS Information Leaks and Reverse Lookup Attacks
      • 5.3.4. BIND Vulnerabilities
        • 5.3.4.1. BIND TSIG overflow exploit
      • 5.3.5. Microsoft DNS Service Vulnerabilities
        • 5.3.5.1. Extracting Active Directory network service information
        • 5.3.5.2. Remote vulnerabilities in the Microsoft DNS server
    • 5.4. finger
      • 5.4.1. finger Information Leaks
      • 5.4.2. finger Redirection
      • 5.4.3. Directly Exploitable finger Bugs
    • 5.5. auth
      • 5.5.1. auth Process Manipulation Vulnerabilities
    • 5.6. SNMP
      • 5.6.1. ADMsnmp
      • 5.6.2. snmpwalk
      • 5.6.3. Default Community Strings
      • 5.6.4. Compromising Devices by Reading from SNMP
      • 5.6.5. Compromising Devices by Writing to SNMP
      • 5.6.6. SNMP Process-Manipulation Vulnerabilities
    • 5.7. LDAP
      • 5.7.1. Anonymous LDAP Access
      • 5.7.2. LDAP Brute Force
      • 5.7.3. Active Directory Global Catalog
      • 5.7.4. LDAP Process Manipulation Vulnerabilities
    • 5.8. rwho
    • 5.9. RPC rusers
    • 5.10. Remote Information Services Countermeasures
  • 6. Assessing Web Services
    • 6.1. Web Services
    • 6.2. Identifying the Web Service
      • 6.2.1. HTTP HEAD
      • 6.2.2. HTTP OPTIONS
        • 6.2.2.1. Common HTTP OPTIONS responses
      • 6.2.3. Automated Web Service Fingerprinting
        • 6.2.3.1. WebServerFP
        • 6.2.3.2. hmap
        • 6.2.3.3. 404print
      • 6.2.4. Identifying the Web Service Through an SSL Tunnel
    • 6.3. Identifying Subsystems and Components
      • 6.3.1. ASP.NET
      • 6.3.2. WebDAV
      • 6.3.3. Microsoft FrontPage
      • 6.3.4. Microsoft Outlook Web Access
        • 6.3.4.1. Exchange 5.5 OWA public folders information leak
      • 6.3.5. Default IIS ISAPI Extensions
      • 6.3.6. PHP
      • 6.3.7. OpenSSL
    • 6.4. Investigating Web Service Vulnerabilities
      • 6.4.1. The Tools
        • 6.4.1.1. nikto
        • 6.4.1.2. N-Stealth
      • 6.4.2. Security Web Sites and Mailing Lists
      • 6.4.3. Microsoft IIS Vulnerabilities
        • 6.4.3.1. IIS ASP sample scripts and tools
        • 6.4.3.2. HTR (ISM.DLL) extension exposures
          • 6.4.3.2.1. IIS HTR administrative scripts
          • 6.4.3.2.2. HTR process-manipulation vulnerabilities
          • 6.4.3.2.3. Reading sensitive files through HTR requests
        • 6.4.3.3. HTW (WEBHITS.DLL) extension exposures
        • 6.4.3.4. IIS Unicode exploit
          • 6.4.3.4.1. Unicode revisited
          • 6.4.3.4.2. Unicode limitations and tools
        • 6.4.3.5. PRINTER (MSW3PRT.DLL) extension overflow
        • 6.4.3.6. IDA (IDQ.DLL) extension overflow
        • 6.4.3.7. IIS WebDAV vulnerability
        • 6.4.3.8. Microsoft FrontPage exposures
        • 6.4.3.9. Poorly configured IIS permissions
      • 6.4.4. Apache Vulnerabilities
        • 6.4.4.1. Apache chunk-handling vulnerability
          • 6.4.4.1.1. Apache chunk handling BSD exploit
          • 6.4.4.1.2. Apache chunk handling Win32 exploit
        • 6.4.4.2. Other Apache exposures and vulnerabilities
      • 6.4.5. OpenSSL Vulnerabilities
        • 6.4.5.1. OpenSSL client key overflow
        • 6.4.5.2. Other OpenSSL exposures and vulnerabilities
      • 6.4.6. HTTP Proxy Component Exposures
        • 6.4.6.1. HTTP CONNECT
        • 6.4.6.2. HTTP POST
        • 6.4.6.3. HTTP GET
        • 6.4.6.4. Testing HTTP proxies
    • 6.5. Accessing Poorly Protected Information
      • 6.5.1. Brute-Forcing HTTP Authentication
    • 6.6. Assessing CGI Scripts and Custom ASP Pages
      • 6.6.1. Parameter Manipulation and Filter Evasion
        • 6.6.1.1. URL query-string manipulation
        • 6.6.1.2. User cookie manipulation
        • 6.6.1.3. Form field manipulation
        • 6.6.1.4. Filter evasion
      • 6.6.2. Error-Handling Problems
      • 6.6.3. Operating System Command Injection
        • 6.6.3.1. Run arbitrary system commands
        • 6.6.3.2. Modify parameters passed to system commands
        • 6.6.3.3. Execute additional commands
        • 6.6.3.4. Operating system command-injection countermeasures
      • 6.6.4. SQL Command Injection
        • 6.6.4.1. Basic testing methodology
        • 6.6.4.2. Calling stored procedures
          • 6.6.4.2.1. xp_cmdshell
          • 6.6.4.2.2. sp_makewebtask
          • 6.6.4.2.3. xp_regread
        • 6.6.4.3. Compromising data using SELECT and INSERT
      • 6.6.5. Web Application Assessment Tools
        • 6.6.5.1. Achilles
    • 6.7. Web Services Countermeasures
  • 7. Assessing Remote Maintenance Services
    • 7.1. Remote Maintenance Services
    • 7.2. SSH
      • 7.2.1. SSH Fingerprinting
      • 7.2.2. SSH Brute-Force Password Grinding
      • 7.2.3. SSH Vulnerabilities
        • 7.2.3.1. SSH1 CRC32 compensation vulnerability
        • 7.2.3.2. SSH1 CRC32 compensation exploit
        • 7.2.3.3. OpenSSH challenge-response vulnerability
        • 7.2.3.4. OpenSSH challenge-response exploit
        • 7.2.3.5. Other remotely exploitable SSH flaws
    • 7.3. Telnet
      • 7.3.1. Telnet Service Fingerprinting
        • 7.3.1.1. telnetfp
        • 7.3.1.2. Manual telnet fingerprinting
      • 7.3.2. Telnet Brute-Force Password-Grinding
        • 7.3.2.1. Common device telnet passwords
        • 7.3.2.2. Dictionary files and word lists
      • 7.3.3. Telnet Vulnerabilities
        • 7.3.3.1. System V-derived /bin/login static overflow vulnerability
        • 7.3.3.2. Solaris /bin/login static overflow exploits
        • 7.3.3.3. BSD-derived telrcv( ) heap overflow vulnerability
        • 7.3.3.4. FreeBSD telrcv( ) heap overflow exploit
        • 7.3.3.5. Other remotely exploitable Telnet bugs
    • 7.4. R-Services
      • 7.4.1. Directly Accessing R-Services
        • 7.4.1.1. Unix ~/.rhosts and /etc/hosts.equiv files
      • 7.4.2. R-Services Brute Force
      • 7.4.3. Spoofing RSH Connections
      • 7.4.4. Known R-Services Vulnerabilities
    • 7.5. X Windows
      • 7.5.1. X Windows Authentication
        • 7.5.1.1. xhost
        • 7.5.1.2. xauth
      • 7.5.2. Assessing X Servers
        • 7.5.2.1. List open windows
        • 7.5.2.2. Take screenshots of specific open windows
        • 7.5.2.3. Capture keystrokes typed in specific windows
        • 7.5.2.4. Send keystrokes to specific windows
      • 7.5.3. Known X Window System Vulnerabilities
    • 7.6. Microsoft Remote Desktop Protocol
      • 7.6.1. RDP Brute-Force Password Grinding
      • 7.6.2. RDP Vulnerabilities
    • 7.7. VNC
      • 7.7.1. VNC Brute-Force Password Grinding
    • 7.8. Citrix
      • 7.8.1. Using The Citrix ICA Client
      • 7.8.2. Accessing Nonpublic Published Applications
      • 7.8.3. Citrix Vulnerabilities
    • 7.9. Remote Maintenance Services Countermeasures
  • 8. Assessing FTP and Database Services
    • 8.1. FTP
    • 8.2. FTP Banner Grabbing and Enumeration
      • 8.2.1. Analyzing FTP Banners
      • 8.2.2. Assessing FTP Permissions
    • 8.3. FTP Brute-Force Password Guessing
    • 8.4. FTP Bounce Attacks
      • 8.4.1. FTP Bounce Port Scanning
      • 8.4.2. FTP Bounce Exploit Payload Delivery
    • 8.5. Circumventing Stateful Filters Using FTP
      • 8.5.1. PORT and PASV
      • 8.5.2. PASV Abuse
    • 8.6. FTP Process Manipulation Attacks
      • 8.6.1. Solaris and BSD FTP Globbing Issues
      • 8.6.2. WU-FTPD Vulnerabilities
        • 8.6.2.1. Exploiting WU-FTPD 2.6.1 on Linux with 7350wurm
      • 8.6.3. ProFTPD Vulnerabilities
      • 8.6.4. Microsoft IIS FTP Server
    • 8.7. FTP Services Countermeasures
    • 8.8. Database Services
    • 8.9. Microsoft SQL Server
      • 8.9.1. SQL Server Enumeration
      • 8.9.2. SQL Server Brute Force
        • 8.9.2.1. SQLAT
      • 8.9.3. SQL Server Process Manipulation Vulnerabilities
    • 8.10. Oracle
      • 8.10.1. TNS Listener Enumeration and Information Leak Attacks
        • 8.10.1.1. Pinging the TNS Listener
        • 8.10.1.2. Retrieving Oracle version and platform information
        • 8.10.1.3. Other TNS Listener commands
        • 8.10.1.4. Retrieving the current status of the TNS Listener
        • 8.10.1.5. Executing an information leak attack
      • 8.10.2. TNS Listener Process-Manipulation Vulnerabilities
        • 8.10.2.1. TNS Listener COMMAND stack overflow (CVE-2001-0499) exploit
        • 8.10.2.2. Creating files using the TNS Listener (CVE-2000-0818)
      • 8.10.3. Oracle Brute-Force and Post-Authentication Issues
        • 8.10.3.1. OAT
        • 8.10.3.2. MetaCoretex
    • 8.11. MySQL
      • 8.11.1. MySQL Enumeration
      • 8.11.2. MySQL Brute Force
      • 8.11.3. MySQL Process-Manipulation Vulnerabilities
    • 8.12. Database Services Countermeasures
  • 9. Assessing Windows Networking Services
    • 9.1. Microsoft Windows Networking Services
      • 9.1.1. SMB, CIFS, and NetBIOS
    • 9.2. Microsoft RPC Services
      • 9.2.1. Enumerating System Information
        • 9.2.1.1. epdump
        • 9.2.1.2. Known IFID values
        • 9.2.1.3. rpdump and ifids
        • 9.2.1.4. RpcScan
      • 9.2.2. Gleaning User Details via SAMR and LSARPC Interfaces
        • 9.2.2.1. walksam
        • 9.2.2.2. rpcclient
      • 9.2.3. Brute-Forcing Administrator Passwords
      • 9.2.4. Executing Arbitrary Commands
      • 9.2.5. Exploiting RPC Services Directly
    • 9.3. The NetBIOS Name Service
      • 9.3.1. Enumerating System Details
      • 9.3.2. Attacking the NetBIOS Name Service
    • 9.4. The NetBIOS Datagram Service
    • 9.5. The NetBIOS Session Service
      • 9.5.1. Enumerating System Details
        • 9.5.1.1. enum
        • 9.5.1.2. winfo
        • 9.5.1.3. GetAcct
      • 9.5.2. Brute-Forcing User Passwords
      • 9.5.3. Authenticating with NetBIOS
      • 9.5.4. Executing Commands
      • 9.5.5. Accessing and Modifying Registry Keys
      • 9.5.6. Accessing The SAM Database
    • 9.6. The CIFS Service
      • 9.6.1. CIFS Enumeration
        • 9.6.1.1. User enumeration through smbdumpusers
      • 9.6.2. CIFS Brute Force
    • 9.7. Unix Samba Vulnerabilities
    • 9.8. Windows Networking Services Countermeasures
  • 10. Assessing Email Services
    • 10.1. Email Service Protocols
    • 10.2. SMTP
      • 10.2.1. SMTP Service Fingerprinting
      • 10.2.2. Sendmail
        • 10.2.2.1. Sendmail information leak exposures
          • 10.2.2.1.1. EXPN
          • 10.2.2.1.2. VRFY
          • 10.2.2.1.3. RCPT TO:
        • 10.2.2.2. Automating Sendmail user enumeration
        • 10.2.2.3. Sendmail process manipulation vulnerabilities
      • 10.2.3. Microsoft Exchange SMTP Service
      • 10.2.4. SMTP Open Relay Testing
      • 10.2.5. SMTP Relay and Anti-Virus Circumvention
    • 10.3. POP-2 and POP-3
      • 10.3.1. POP-3 Brute-Force Password-Grinding
      • 10.3.2. POP-3 Process Manipulation Attacks
        • 10.3.2.1. Qualcomm QPOP process-manipulation vulnerabilities
        • 10.3.2.2. Microsoft Exchange POP-3 process-manipulation vulnerabilities
    • 10.4. IMAP
      • 10.4.1. IMAP Brute Force
      • 10.4.2. IMAP Process Manipulation Attacks
    • 10.5. Email Services Countermeasures
  • 11. Assessing IP VPN Services
    • 11.1. IPsec VPNs
      • 11.1.1. ISAKMP and IKE
        • 11.1.1.1. Main mode IKE
        • 11.1.1.2. Aggressive mode IKE
    • 11.2. Attacking IPsec VPNs
      • 11.2.1. IPsec Enumeration
      • 11.2.2. Initial ISAKMP Service Probing
      • 11.2.3. Investigating Known ISAKMP and IKE Weaknesses
      • 11.2.4. Aggressive Mode IKE PSK Cracking
    • 11.3. Check Point VPN Security Issues
      • 11.3.1. Check Point IKE Username Enumeration
      • 11.3.2. Check Point Telnet Service Username Enumeration
      • 11.3.3. Check Point SecuRemote Information Leak Attacks
        • 11.3.3.1. Sniffing interface IP addresses
        • 11.3.3.2. Downloading SecuRemote network topology information
      • 11.3.4. Check Point RDP Firewall Bypass Vulnerability
    • 11.4. Microsoft PPTP
    • 11.5. VPN Services Countermeasures
  • 12. Assessing Unix RPC Services
    • 12.1. Enumerating Unix RPC Services
      • 12.1.1. Identifying RPC Services Without the Portmapper
    • 12.2. RPC Service Vulnerabilities
      • 12.2.1. Abusing rpc.mountd (100005)
        • 12.2.1.1. CVE-1999-0002
        • 12.2.1.2. CVE-2003-0252
        • 12.2.1.3. Listing and accessing exported directories through mountd and NFS
      • 12.2.2. Multiple Vendor rpc.statd (100024) Vulnerabilities
        • 12.2.2.1. CVE-1999-0018 and CVE-1999-0019
        • 12.2.2.2. CVE-1999-0493
        • 12.2.2.3. CVE-2000-0666
      • 12.2.3. Solaris rpc.sadmind (100232) Vulnerabilities
        • 12.2.3.1. CVE-1999-0977
        • 12.2.3.2. CVE-2003-0722
      • 12.2.4. Solaris rpc.cachefsd (100235) Vulnerability
      • 12.2.5. Solaris rpc.snmpXdmid (100249) Vulnerability
      • 12.2.6. Multiple Vendor rpc.cmsd (100068) Vulnerabilities
      • 12.2.7. Multiple Vendor rpc.ttdbserverd (100083) Vulnerability
        • 12.2.7.1. Solaris rpc.ttdbserverd exploit
        • 12.2.7.2. IRIX rpc.ttdbserverd exploit
    • 12.3. Unix RPC Services Countermeasures
  • 13. Application-Level Risks
    • 13.1. The Fundamental Hacking Concept
    • 13.2. The Reasons Why Software Is Vulnerable
    • 13.3. Network Service Vulnerabilities and Attacks
      • 13.3.1. Memory Manipulation Attacks
      • 13.3.2. Runtime Memory Organization
        • 13.3.2.1. The text segment
        • 13.3.2.2. The data and BSS segments
        • 13.3.2.3. The stack
        • 13.3.2.4. The heap
      • 13.3.3. Processor Registers and Memory
    • 13.4. Classic Buffer-Overflow Vulnerabilities
      • 13.4.1. Stack Overflows
      • 13.4.2. Stack Smash (Saved Instruction Pointer Overwrite)
        • 13.4.2.1. Causing a program crash
        • 13.4.2.2. Compromising the logical program flow
        • 13.4.2.3. Analyzing the program crash
        • 13.4.2.4. Creating and injecting shellcode
      • 13.4.3. Stack Off-by-One (Saved Frame Pointer Overwrite)
        • 13.4.3.1. Analyzing the program crash
        • 13.4.3.2. Exploiting an off-by-one bug to modify the instruction pointer
        • 13.4.3.3. Exploiting an off-by-one bug to modify data in the parent functions stack frame
        • 13.4.3.4. Off-by-one effectiveness against different processor architectures
    • 13.5. Heap Overflows
      • 13.5.1. Overflowing the Heap to Compromise Program Flow
      • 13.5.2. Other Heap Corruption Attacks
        • 13.5.2.1. Heap off-by-one and off-by-five bugs
        • 13.5.2.2. Double-free bugs
        • 13.5.2.3. Recommended further reading
    • 13.6. Integer Overflows
      • 13.6.1. Heap Wrap-Around Attacks
      • 13.6.2. Negative-Size Bugs
    • 13.7. Format String Bugs
      • 13.7.1. Reading Adjacent Items on the Stack
      • 13.7.2. Reading Data From any Address on the Stack
      • 13.7.3. Overwriting Any Word in Memory
      • 13.7.4. Recommended Format String Bug Reading
    • 13.8. Memory Manipulation Attacks Recap
    • 13.9. Mitigating Process Manipulation Risks
      • 13.9.1. Nonexecutable Stack and Heap Implementation
      • 13.9.2. Use of Canary Values in Memory
      • 13.9.3. Running Unusual Server Architecture
      • 13.9.4. Compiling Applications From Source
      • 13.9.5. Active System Call Monitoring
    • 13.10. Recommended Secure Development Reading
  • 14. Example Assessment Methodology
    • 14.1. Network Scanning
      • 14.1.1. Initial Network Scanning
      • 14.1.2. Full Network Scanning
      • 14.1.3. Low-Level Network Testing
        • 14.1.3.1. TCP ISN sequence generation
        • 14.1.3.2. IP ID sequence generation
        • 14.1.3.3. Source routing testing
        • 14.1.3.4. Other tests
    • 14.2. Accessible Network Service Identification
      • 14.2.1. Initial Telnet Service Assessment
      • 14.2.2. Initial SSH Service Assessment
      • 14.2.3. Initial SMTP Service Assessment
      • 14.2.4. Initial Web Service Assessment
        • 14.2.4.1. ASP.NET investigation
        • 14.2.4.2. ISAPI extension enumeration
        • 14.2.4.3. Automated scanning for FrontPage and OWA components
        • 14.2.4.4. SSL web service investigation
    • 14.3. Investigation of Known Vulnerabilities
      • 14.3.1. Cisco IOS Accessible Service Vulnerabilities
      • 14.3.2. Solaris 8 Accessible Service Vulnerabilities
      • 14.3.3. Windows 2000 Accessible Service Vulnerabilities
    • 14.4. Network Service Testing
      • 14.4.1. Cisco IOS Router (192.168.10.1)
      • 14.4.2. Solaris Mail Server (192.168.10.10)
      • 14.4.3. Windows 2000 Web Server (192.168.10.25)
    • 14.5. Methodology Flow Diagram
    • 14.6. Recommendations
      • 14.6.1. Quick Win Recommendations
        • 14.6.1.1. Cisco IOS router
        • 14.6.1.2. Solaris mail server
        • 14.6.1.3. Windows 2000 web server
          • 14.6.1.3.1. Disable unnecessary ISAPI extensions
          • 14.6.1.3.2. Install URLScan to block HTTP methods and filter requests
      • 14.6.2. Long-Term Recommendations
    • 14.7. Closing Comments
  • A. TCP, UDP Ports, and ICMP Message Types
    • A.1. TCP Ports
    • A.2. UDP Ports
    • A.3. ICMP Message Types
  • B. Sources of Vulnerability Information
    • B.1. Security Mailing Lists
    • B.2. Vulnerability Databases and Lists
    • B.3. Underground Web Sites
    • B.4. Security Events and Conferences
  • Index
  • Colophon
  • SPECIAL OFFER: Upgrade this ebook with OReilly

pokaż cały spis treści

ukryj recenzje