Hacking For Dummies

411 Pages·2017·10.38 MB·English

by  Kevin Beaver

Hacking
5th Edition
by Kevin Beaver, CISSP
Foreword by Richard Stiennon
Chief Research Analyst, IT‐Harvest
Author of There Will Be Cyberwar
Hacking For Dummies,® 5th Edition
Published by: John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030‐5774, www.wiley.com
Copyright © 2016 by John Wiley & Sons, Inc., Hoboken, New Jersey
Published simultaneously in Canada
No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or
by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permit-
ted under Sections 107 or 108 of the 1976 United States Copyright Act, without the prior written permission
of the Publisher. Requests to the Publisher for permission should be addressed to the Permissions
Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748‐6011, fax (201)
748‐6008, or online at http://www.wiley.com/go/permissions.
Trademarks: Wiley, For Dummies, the Dummies Man logo, Dummies.com, Making Everything Easier, and
related trade dress are trademarks or registered trademarks of John Wiley & Sons, Inc. and may not be
used without written permission. All other trademarks are the property of their respective owners. John
Wiley & Sons, Inc. is not associated with any product or vendor mentioned in this book.
LIMIT OF LIABILITY/DISCLAIMER OF WARRANTY: THE PUBLISHER AND THE AUTHOR MAKE NO
REPRESENTATIONS OR WARRANTIES WITH RESPECT TO THE ACCURACY OR COMPLETENESS OF
THE CONTENTS OF THIS WORK AND SPECIFICALLY DISCLAIM ALL WARRANTIES, INCLUDING
WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE. NO WARRANTY
MAY BE CREATED OR EXTENDED BY SALES OR PROMOTIONAL MATERIALS. THE ADVICE AND
STRATEGIES CONTAINED HEREIN MAY NOT BE SUITABLE FOR EVERY SITUATION. THIS WORK IS
SOLD WITH THE UNDERSTANDING THAT THE PUBLISHER IS NOT ENGAGED IN RENDERING LEGAL,
ACCOUNTING, OR OTHER PROFESSIONAL SERVICES. IF PROFESSIONAL ASSISTANCE IS REQUIRED,
THE SERVICES OF A COMPETENT PROFESSIONAL PERSON SHOULD BE SOUGHT. NEITHER THE
PUBLISHER NOR THE AUTHOR SHALL BE LIABLE FOR DAMAGES ARISING HEREFROM. THE FACT
THAT AN ORGANIZATION OR WEBSITE IS REFERRED TO IN THIS WORK AS A CITATION AND/OR A
POTENTIAL SOURCE OF FURTHER INFORMATION DOES NOT MEAN THAT THE AUTHOR OR THE
PUBLISHER ENDORSES THE INFORMATION THE ORGANIZATION OR WEBSITE MAY PROVIDE OR
RECOMMENDATIONS IT MAY MAKE. FURTHER, READERS SHOULD BE AWARE THAT INTERNET
WEBSITES LISTED IN THIS WORK MAY HAVE CHANGED OR DISAPPEARED BETWEEN WHEN THIS
WORK WAS WRITTEN AND WHEN IT IS READ.
For general information on our other products and services, please contact our Customer Care Department
within the U.S. at 877‐762‐2974, outside the U.S. at 317‐572‐3993, or fax 317‐572‐4002. For technical support,
please visit www.wiley.com/techsupport.
Wiley publishes in a variety of print and electronic formats and by print‐on‐demand. Some material
included with standard print versions of this book may not be included in e‐books or in print‐on‐demand.
If this book refers to media such as a CD or DVD that is not included in the version you purchased, you
may download this material at http://booksupport.wiley.com. For more information about Wiley
products, visit www.wiley.com.
Library of Congress Control Number: 2015956627
ISBN 978‐1‐119‐15468‐6 (pbk); ISBN 978‐1‐119‐15469‐3 (ebk); ISBN 978‐1‐119‐15470‐9 (ebk)
Manufactured in the United States of America
10 9 8 7 6 5 4 3 2 1
Contents at a Glance
Foreword ................................................................... XV
Introduction ................................................................ 1
Part I: Building the Foundation for Security Testing ....... 7
Chapter 1: Introduction to Ethical Hacking ....................................................................9
Chapter 2: Cracking the Hacker Mindset ......................................................................25
Chapter 3: Developing Your Ethical Hacking Plan .......................................................37
Chapter 4: Hacking Methodology ..................................................................................49
Part II: Putting Security Testing in Motion................... 59
Chapter 5: Information Gathering ..................................................................................61
Chapter 6: Social Engineering ........................................................................................67
Chapter 7: Physical Security ..........................................................................................83
Chapter 8: Passwords ......................................................................................................93
Part III: Hacking Network Hosts ............................... 121
Chapter 9: Network Infrastructure Systems ...............................................................123
Chapter 10: Wireless Networks ....................................................................................159
Chapter 11: Mobile Devices ..........................................................................................187
Part IV: Hacking Operating Systems ......................... 201
Chapter 12: Windows ....................................................................................................203
Chapter 13: Linux ...........................................................................................................231
Part V: Hacking Applications ................................... 253
Chapter 14: Communication and Messaging Systems ..............................................255
Chapter 15: Web Applications and Mobile Apps .......................................................279
Chapter 16: Databases and Storage Systems .............................................................305
Part VI: Security Testing Aftermath........................... 317
Chapter 17: Reporting Your Results ............................................................................319
Chapter 18: Plugging Security Holes ...........................................................................325
Chapter 19: Managing Security Processes ..................................................................331
Part VII: The Part of Tens ......................................... 339
Chapter 20: Ten Tips for Getting Security Buy-In ......................................................341
Chapter 21: Ten Reasons Hacking Is the Only Effective Way to Test .....................347
Chapter 22: Ten Deadly Mistakes ................................................................................351
Appendix: Tools and Resources ..................................................................................355
Index ...................................................................... 373
Table of Contents
Foreword .................................................................... XV
Introduction ................................................................. 1
Who Should Read This Book? ........................................................................1
About This Book ..............................................................................................2
How to Use This Book .....................................................................................3
What You Don’t Need to Read .......................................................................3
Foolish Assumptions .......................................................................................3
How This Book Is Organized ..........................................................................3
Part I: Building the Foundation for Security Testing .........................4
Part II: Putting Security Testing in Motion .........................................4
Part III: Hacking Network Hosts ...........................................................4
Part IV: Hacking Operating Systems ....................................................4
Part V: Hacking Applications ................................................................5
Part VI: Security Testing Aftermath .....................................................5
Part VII: The Part of Tens ......................................................................5
Icons Used in This Book .................................................................................6
Where to Go from Here ...................................................................................6
Part I: Building the Foundation for Security Testing ........ 7
Chapter 1: Introduction to Ethical Hacking . . . . . . . . . . . . . . . . . . . . . . . . 9
Straightening Out the Terminology ...............................................................9
Defining hacker ....................................................................................10
Defining malicious user .......................................................................11
Recognizing How Malicious Attackers Beget Ethical Hackers .................11
Ethical hacking versus auditing .........................................................12
Policy considerations ..........................................................................13
Compliance and regulatory concerns ...............................................13
Understanding the Need to Hack Your Own Systems ..............................13
Understanding the Dangers Your Systems Face .......................................15
Nontechnical attacks ...........................................................................15
Network infrastructure attacks ..........................................................16
Operating system attacks ...................................................................16
Application and other specialized attacks .......................................17
vi
Hacking For Dummies
Obeying the Ethical Hacking Principles ......................................................17
Working ethically .................................................................................18
Respecting privacy ..............................................................................18
Not crashing your systems .................................................................18
Using the Ethical Hacking Process ..............................................................19
Formulating your plan .........................................................................19
Selecting tools ......................................................................................21
Executing the plan ...............................................................................23
Evaluating results ................................................................................24
Moving on .............................................................................................24
Chapter 2: Cracking the Hacker Mindset . . . . . . . . . . . . . . . . . . . . . . . . . 25
What You’re Up Against ................................................................................25
Who Breaks into Computer Systems ..........................................................28
Why They Do It ..............................................................................................30
Planning and Performing Attacks ................................................................33
Maintaining Anonymity .................................................................................35
Chapter 3: Developing Your Ethical Hacking Plan . . . . . . . . . . . . . . . . . 37
Establishing Your Goals ................................................................................38
Determining Which Systems to Hack ..........................................................40
Creating Testing Standards ..........................................................................43
Timing....................................................................................................43
Running specific tests .........................................................................44
Blind versus knowledge assessments ...............................................45
Picking your location ...........................................................................46
Responding to vulnerabilities you find .............................................46
Making silly assumptions ....................................................................46
Selecting Security Assessment Tools ..........................................................47
Chapter 4: Hacking Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Setting the Stage for Testing ........................................................................49
Seeing What Others See ................................................................................51
Gathering public information .............................................................51
Scanning Systems ..........................................................................................52
Hosts ......................................................................................................52
Open ports ............................................................................................53
Determining What’s Running on Open Ports .............................................53
Assessing Vulnerabilities ..............................................................................56
Penetrating the System .................................................................................57
vii
Table of Contents
Part II: Putting Security Testing in Motion ................... 59
Chapter 5: Information Gathering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Gathering Public Information .......................................................................61
Social media ..........................................................................................61
Web search ...........................................................................................62
Web crawling ........................................................................................63
Websites ................................................................................................64
Mapping the Network ....................................................................................64
WHOIS....................................................................................................64
Privacy policies ....................................................................................66
Chapter 6: Social Engineering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Introducing Social Engineering ....................................................................67
Starting Your Social Engineering Tests ......................................................68
Why Attackers Use Social Engineering .......................................................69
Understanding the Implications ..................................................................70
Building trust ........................................................................................71
Exploiting the relationship .................................................................72
Performing Social Engineering Attacks .......................................................75
Seeking information .............................................................................75
Social Engineering Countermeasures .........................................................79
Policies ..................................................................................................79
User awareness and training ..............................................................79
Chapter 7: Physical Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
Identifying Basic Physical Security Vulnerabilities ...................................83
Pinpointing Physical Vulnerabilities in Your Office ..................................85
Building infrastructure ........................................................................85
Utilities ..................................................................................................86
Office layout and usage .......................................................................88
Network components and computers ...............................................90
Chapter 8: Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Understanding Password Vulnerabilities ...................................................94
Organizational password vulnerabilities ..........................................95
Technical password vulnerabilities ..................................................95
Cracking Passwords ......................................................................................96
Cracking passwords the old-fashioned way .....................................97
Cracking passwords with high-tech tools.........................................99
Cracking password-protected files ..................................................107
Understanding other ways to crack passwords ............................109
viii
Hacking For Dummies
General Password Cracking Countermeasures .......................................115
Storing passwords .............................................................................115
Creating password policies ..............................................................116
Taking other countermeasures ........................................................117
Securing Operating Systems ......................................................................119
Windows..............................................................................................119
Linux and UNIX ...................................................................................120
Part III: Hacking Network Hosts ................................ 121
Chapter 9: Network Infrastructure Systems . . . . . . . . . . . . . . . . . . . . . 123
Understanding Network Infrastructure Vulnerabilities ..........................124
Choosing Tools ............................................................................................125
Scanners and analyzers.....................................................................126
Vulnerability assessment ..................................................................126
Scanning, Poking, and Prodding the Network ..........................................126
Scanning ports....................................................................................127
Scanning SNMP ...................................................................................133
Grabbing banners ..............................................................................134
Testing firewall rules .........................................................................136
Analyzing network data.....................................................................138
The MAC-daddy attack ......................................................................145
Testing denial of service attacks .....................................................150
Detecting Common Router, Switch, and Firewall Weaknesses ..............153
Finding unsecured interfaces ...........................................................153
Exploiting IKE weaknesses................................................................154
Uncovering issues with SSL and TLS ...............................................155
Putting Up General Network Defenses ......................................................156
Chapter 10: Wireless Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
Understanding the Implications of Wireless Network Vulnerabilities .159
Choosing Your Tools ...................................................................................160
Discovering Wireless Networks .................................................................162
Checking for worldwide recognition ...............................................162
Scanning your local airwaves ...........................................................163
Discovering Wireless Network Attacks and Taking
Countermeasures .....................................................................................164
Encrypted traffic ................................................................................165
Wi-Fi Protected Setup ........................................................................172
Rogue wireless devices .....................................................................174
MAC spoofing .....................................................................................179
Physical security problems ..............................................................183
Vulnerable wireless workstations ...................................................183
Default configuration settings ..........................................................184