Certified Ethical Hacker Study Guide

439 Pages·2010·6.68 MB·English

by  Kimberly Graves

spine=.864”
Prepare for CEH certifi cation
™
Covers all Exam Objectives for CEHv6
with this comprehensive guide FEATURED ON THE CD CEH
STUDY GUIDE
Learn how to identify security risks to networks and computers as you
prepare for the Certifi ed Ethical Hacker version 6 (CEHv6) exam. Includes Real-World Scenarios, Hands-On Exercises, and
This in-depth guide thoroughly covers all exam objectives and topics, Leading-Edge Exam Prep Software Featuring:
while showing you how Black Hat hackers think, helping you spot
• Custom Test Engine
vulnerabilities in systems, and preparing you to beat the bad guys at
their own game. Inside, you’ll fi nd: • Hundreds of Sample Questions
Full coverage of all exam objectives in a systematic approach, so you can • Electronic Flashcards
be confi dent you’re getting the instruction you need for the exam • Entire Book in PDF
Practical hands-on exercises to reinforce critical skills SYBEX TEST ENGINE
Test your knowledge with advanced
Real-world scenarios that put what you’ve learned in the context of actual
testing software. Includes all chapter
job roles review questions and practice exams.
Challenging review questions in each chapter to prepare you for exam day
™
Exam Essentials, a key feature in each chapter that identifi es critical areas
you must become profi cient in before taking the exam
A handy tear card that maps every offi cial exam objective to the corre-
sponding chapter in the book, so you can track your exam prep objective
by objective
CEH
Look inside for complete coverage
ELECTRONIC FLASHCARDS
of all exam objectives. Reinforce your understanding with
electronic fl ashcards.
w.sybex.com Also on the CD, you’l fi nd the entire Certifi ed
ABO U T T H E A U T H O R book in searchable and printable
PDF. Study anywhere, any time, and
approach the exam with confi dence.
Kimberly Graves, CEH, CWSP, CWNP, CWNA, has over 15 years of IT
experience. She is founder of Techsource Network Solutions, a network and security
consulting organization located in the Washington, DC area. She has served as subject Graves Ethical Hacker
matter expert for several certifi cation programs—including the Certifi ed Wireless
Network Professional (CWNP) and Intel Certifi ed Network Engineer programs—and
has developed course materials for the Department of Veteran Affairs, USAF, and C A T E G O R Y
the NSA. COMPUTERS/Certifi cation Guides
STUDY GUIDE
Exam 312-50
ISBN 978-0-470-52520-3 Exam EC0-350
Exam 312-50 Kimberly Graves
Exam EC0-350
$49.99 US
$59.99 CN SERIOUS SKILLS.
Certifi ed Ethical Hacker
CEH: Certifed Ethical Hacker Study Guide
CEH (312-50) Objectives
Objective Chapter
Ethics and Legality
Understand ethical hacking terminology 1
Define the job role of an ethical hacker 1
Understand the different phases involved in ethical hacking 1
Identify different types of hacking technologies 1
List the 5 stages of ethical hacking 1
What is hacktivism? 1
List different types of hacker classes 1
Define the skills required to become an ethical hacker 1
What is vulnerability research? 1
Describe the ways of conducting ethical hacking 1
Understand the legal implications of hacking 1
Understand 18 U.S.C. § 1030 US Federal Law 1
Footprinting
Define the term footprinting 2
Describe information gathering methodology 2
Describe competitive intelligence 2
Understand DNS enumeration 2
Understand Whois, ARIN lookup 2
Identify different types of DNS records 2
Understand how traceroute is used in footprinting 2
Understand how email tracking works 2
Understand how web spiders work 2
Scanning
Define the terms port scanning, network scanning, and vulnerability scanning 3
Understand the CEH scanning methodology 3
Understand Ping Sweep techniques 3
Understand nmap command switches 3
Understand SYN, Stealth, XMAS, NULL, IDLE, and FIN scans 3
List TCP communication flag types 3
Understand war dialing techniques 3
Understand banner grabbing and OF fingerprinting techniques 3
Understand how proxy servers are used in launching an attack 3
How do anonymizers work? 3
Understand HTTP tunneling techniques 3
Understand IP spoofing techniques 3
525203bperfcard.indd 1 3/17/10 6:16:01 PM
Objective Chapter
Enumeration
What is enumeration? 3
What is meant by null sessions? 3
What is SNMP enumeration? 3
What are the steps involved in performing enumeration? 3
System Hacking
Understanding password cracking techniques 4
Understanding different types of passwords 4
Identifying various password cracking tools 4
Understand escalating privileges 4
Understanding keyloggers and other spyware technologies 4
Understand how to hide files 4
Understanding rootkits 4
Understand steganography technologies 4
Understand how to cover your tracks and erase evidence 4
Trojans and Backdoors
What is a Trojan? 5
What is meant by overt and covert channels? 5
List the different types of Trojans 5
What are the indications of a Trojan attack? 5
Understand how “Netcat” Trojan works 5
What is meant by “wrapping”? 5
How do reverse connecting Trojans work? 5
What are the countermeasure techniques in preventing Trojans? 5
Understand Trojan evading techniques 5
Sniffers
Understand the protocol susceptible to sniffing 6
Understand active and passive sniffing 6
Understand ARP poisoning 6
Understand Ethereal capture and display filters 6
Understand MAC flooding 6
Understand DNS spoofing techniques 6
Describe sniffing countermeasures 6
Denial of Service
Understand the types of DoS Attacks 7
Understand how DDoS attack works 7
Understand how BOTs/BOTNETs work 7
What is a “Smurf” attack? 7
What is “SYN” flooding? 7
Describe the DoS/DDoS countermeasures 7
Exam specifcations and content are subject to change at any time without prior
notice and at the EC-Council’s sole discretion. Please visit EC-Council’s website
(www.eccouncil.org) for the most current information on their exam content.
525203bperfcard.indd 2 3/17/10 6:16:02 PM
Objective Chapter
Social Engineering
What is social engineering? 2
What are the common types of attacks? 2
Understand dumpster diving 2
Understand reverse social engineering 2
Understand insider attacks 2
Understand identity theft 2
Describe phishing attacks 2
Understand online scams 2
Understand URL obfuscation 2
Social engineering countermeasures 2
Session Hijacking
Understand spoofing vs. hijacking 7
List the types of session hijacking 7
Understand sequence prediction 7
What are the steps in performing session hijacking? 7
Describe how you would prevent session hijacking 7
Hacking Web Servers
List the types of web server vulnerabilities 8
Understand the attacks against web servers 8
Understand IIS Unicode exploits 8
Understand patch management techniques 8
Understand Web Application Scanner 8
What is the Metasploit Framework? 8
Describe web server hardening methods 8
Web Application Vulnerabilities
Understanding how a web application works 8
Objectives of web application hacking 8
Anatomy of an attack 8
Web application threats 8
Understand Google hacking 8
Understand web application countermeasures 8
Web-Based Password Cracking Techniques
List the authentication types 8
What is a password cracker? 8
How does a password cracker work? 8
Understand password attacks – classification 8
Understand password cracking countermeasures 8
SQL Injection
What is SQL injection? 9
Understand the steps to conduct SQL injection 9
Understand SQL Server vulnerabilities 9
Describe SQL injection countermeasures 9
525203bperfcard.indd 3 3/17/10 6:16:02 PM
Objective Chapter
Wireless Hacking
Overview of WEP, WPA authentication systems, and cracking techniques 10
Overview of wireless sniffers and SSID, MAC spoofing 10
Understand rogue access points 10
Understand wireless hacking techniques 10
Describe the methods of securing wireless networks 10
Virus and Worms
Understand the difference between a virus and a worm 5
Understand the types of viruses 5
How a virus spreads and infects the system 5
Understand antivirus evasion techniques 5
Understand virus detection methods 5
Physical Security
Physical security breach incidents 11
Understanding physical security 11
What is the need for physical security? 11
Who is accountable for physical security? 11
Factors affecting physical security 11
Linux Hacking
Understand how to compile a Linux kernel 12
Understand GCC compilation commands 12
Understand how to install LKM modules 12
Understand Linux hardening methods 12
Evading IDS, Honeypots, and Firewalls
List the types of intrusion detection systems and evasion techniques 13
List firewall and honeypot evasion techniques 13
Buffer Overfows
Overview of stack-based buffer overflows 9
Identify the different types of buffer overflows and methods of detection 9
Overview of buffer overflow mutation techniques 9
Cryptography
Overview of cryptography and encryption techniques 14
Describe how public and private keys are generated 14
Overview of MD5, SHA, RC4, RC5, Blowfish algorithms 14
Penetration Testing Methodologies
Overview of penetration testing methodologies 15
List the penetration testing steps 15
Overview of the pen-test legal framework 15
Overview of the pen-test deliverables 15
List the automated penetration testing tools 15
Exam specifcations and content are subject to change at any time without prior
notice and at the EC-Council’s sole discretion. Please visit EC-Council’s website
(www.eccouncil.org) for the most current information on their exam content.
525203bperfcard.indd 4 3/17/10 6:16:02 PM
™
CEH
Certified Ethical Hacker
Study Guide
525203ffirs.indd 1 3/18/10 6:47:27 AM
525203ffirs.indd 2 3/18/10 6:47:28 AM
™
CEH
Certified Ethical Hacker
Study Guide
Kimberly Graves
525203ffirs.indd 3 3/18/10 6:47:32 AM
Disclaimer: This eBook does not include ancillary media that was packaged with the
printed version of the book.
Acquisitions Editor: Jeff Kellum
Development Editor: Pete Gaughan
Technical Editors: Keith Parsons, Chris Carson
Production Editor: Angela Smith
Copy Editor: Liz Welch
Editorial Manager: Pete Gaughan
Production Manager: Tim Tate
Vice President and Executive Group Publisher: Richard Swadley
Vice President and Publisher: Neil Edde
Media Project Manager 1: Laura Moss-Hollister
Media Associate Producer: Josh Frank
Media Quality Assurance: Shawn Patrick
Book Designers: Judy Fung and Bill Gibson
Compositor: Craig Johnson, Happenstance Type-O-Rama
Proofreader: Publication Services, Inc.
Indexer: Ted Laux
Project Coordinator, Cover: Lynsey Stanford
Cover Designer: Ryan Sneed
Copyright © 2010 by Wiley Publishing, Inc., Indianapolis, Indiana
Published simultaneously in Canada
ISBN: 978-0-470-52520-3
No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means,
electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108
of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization
through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA
01923, [phone], fax [phone]. Requests to the Publisher for permission should be addressed to the Permis-
sions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, [phone], fax [phone],
or online at http://www.wiley.com/go/permissions.
Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect
to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without
limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional
materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the
understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If profes-
sional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor
the author shall be liable for damages arising herefrom. The fact that an organization or Web site is referred to in this work
as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the
information the organization or Web site may provide or recommendations it may make. Further, readers should be aware
that Internet Web sites listed in this work may have changed or disappeared between when this work was written and when
it is read.
For general information on our other products and services or to obtain technical support, please contact our Customer
Care Department within the U.S. at [phone], outside the U.S. at [phone] or fax [phone].
Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available
in electronic books.
Library of Congress Cataloging-in-Publication Data
Graves, Kimberly, 1974-
CEH : certified ethical hacker study guide / Kimberly Graves. — 1st ed.
p. cm.
Includes bibliographical references and index.
ISBN 978-0-470-52520-3 (paper/cd-rom : alk. paper)
1. Electronic data processing personnel—Certification. 2. Computer security—Examinations—Study guides.
3. Computer hackers—Examinations—Study guides. 4. Computer networks—Examinations—Study guides. I. Title.
QA76.3.G6875 2010
005.8—dc22
2010003135
TRADEMARKS: Wiley, the Wiley logo, and the Sybex logo are trademarks or registered trademarks of John Wiley &
Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission.
CEH Certified Ethical Hacker is a trademark of EC-Council. All other trademarks are the property of their respective
owners. Wiley Publishing, Inc., is not associated with any product or vendor mentioned in this book.
10 9 8 7 6 5 4 3 2 1
525203ffirs.indd 4 3/18/10 6:47:33 AM