Introduction xix
Assessment Test xxvi
Chapter 1 Ethical Hacking 1
Overview of Ethics 2
Overview of Ethical Hacking 5
Methodologies 6
Cyber Kill Chain 6
Attack Lifecycle 8
Methodology of Ethical Hacking 10
Reconnaissance and Footprinting 10
Scanning and Enumeration 11
Gaining Access 11
Maintaining Access 12
Covering Tracks 12
Summary 13
Chapter 2 Networking Foundations 15
Communications Models 17
Open Systems Interconnection 18
TCP/IP Architecture 21
Topologies 22
Bus Network 22
Star Network 23
Ring Network 24
Mesh Network 25
Hybrid 26
Physical Networking 27
Addressing 27
Switching 28
IP 29
Headers 29
Addressing 31
Subnets 33
TCP 34
UDP 38
Internet Control Message Protocol 39
Network Architectures 40
Network Types 40
Isolation 41
Remote Access 43
Cloud Computing 44
Storage as a Service 45
Infrastructure as a Service 46
Platform as a Service 48
Software as a Service 49
Internet of Things 51
Summary 52
Review Questions 54
Chapter 3 Security Foundations 57
The Triad 59
Confidentiality 59
Integrity 61
Availability 62
Parkerian Hexad 63
Risk 64
Policies, Standards, and Procedures 66
Security Policies 66
Security Standards 67
Procedures 68
Guidelines 68
Organizing Your Protections 69
Security Technology 72
Firewalls 72
Intrusion Detection Systems 77
Intrusion Prevention Systems 80
Endpoint Detection and Response 81
Security Information and Event Management 83
Being Prepared 84
Defense in Depth 84
Defense in Breadth 86
Defensible Network Architecture 87
Logging 88
Auditing 90
Summary 92
Review Questions 93
Chapter 4 Footprinting and Reconnaissance 97
Open Source Intelligence 99
Companies 99
People 108
Social Networking 111
Domain Name System 124
Name Lookups 125
Zone Transfers 130
Passive DNS 133
Passive Reconnaissance 136
Website Intelligence 139
Technology Intelligence 144
Google Hacking 144
Internet of Things (IoT) 146
Summary 148
Review Questions 150
Chapter 5 Scanning Networks 155
Ping Sweeps 157
Using fping 157
Using MegaPing 159
Port Scanning 161
Nmap 162
masscan 176
MegaPing 178
Metasploit 180
Vulnerability Scanning 183
OpenVAS 184
Nessus 196
Looking for Vulnerabilities with Metasploit 202
Packet Crafting and Manipulation 203
hping 204
packETH 207
fragroute 209
Evasion Techniques 211
Protecting and Detecting 214
Summary 215
Review Questions 217
Chapter 6 Enumeration 221
Service Enumeration 223
Remote Procedure Calls 226
SunRPC 226
Remote Method Invocation 228
Server Message Block 232
Built-in Utilities 233
nmap Scripts 237
NetBIOS Enumerator 239
Metasploit 240
Other Utilities 242
Simple Network Management Protocol 245
Simple Mail Transfer Protocol 247
Web-Based Enumeration 250
Summary 257
Review Questions 259
Chapter 7 System Hacking 263
Searching for Exploits 265
System Compromise 269
Metasploit Modules 270
Exploit-DB 274
Gathering Passwords 276
Password Cracking 279
John the Ripper 280
Rainbow Tables 282
Kerberoasting 284
Client-Side Vulnerabilities 289
Living Off the Land 291
Fuzzing 292
Post Exploitation 295
Evasion 295
Privilege Escalation 296
Pivoting 301
Persistence 304
Covering Tracks 307
Summary 313
Review Questions 315
Chapter 8 Malware 319
Malware Types 321
Virus 321
Worm 323
Trojan 324
Botnet 324
Ransomware 326
Dropper 328
Malware Analysis 328
Static Analysis 329
Dynamic Analysis 340
Creating Malware 349
Writing Your Own 350
Using Metasploit 353
Obfuscating 356
Malware Infrastructure 357
Antivirus Solutions 359
Persistence 360
Summary 361
Review Questions 363
Chapter 9 Sniffing 367
Packet Capture 368
tcpdump 369
tshark 376
Wireshark 378
Berkeley Packet Filter 382
Port Mirroring/Spanning 384
Packet Analysis 385
Spoofing Attacks 390
ARP Spoofing 390
DNS Spoofing 394
sslstrip 397
Spoofing Detection 398
Summary 399
Review Questions 402
Chapter 10 Social Engineering 407
Social Engineering 408
Pretexting 410
Social Engineering Vectors 412
Physical Social Engineering 413
Badge Access 413
Man Traps 415
Biometrics 416
Phone Calls 417
Baiting 418
Phishing Attacks 418
Website Attacks 422
Cloning 423
Rogue Attacks 426
Wireless Social Engineering 427
Automating Social Engineering 430
Summary 433
Review Questions 435
Chapter 11 Wireless Security 439
Wi-Fi 440
Wi-Fi Network Types 442
Wi-Fi Authentication 445
Wi-Fi Encryption 446
Bring Your Own Device 450
Wi-Fi Attacks 451
Bluetooth 462
Scanning 463
Bluejacking 465
Bluesnarfing 466
Bluebugging 466
Mobile Devices 466
Mobile Device Attacks 467
Summary 472
Review Questions 474
Chapter 12 Attack and Defense 479
Web Application Attacks 480
XML External Entity Processing 482
Cross-Site
Scripting 483
SQL Injection 485
Command Injection 487
File Traversal 489
Web Application Protections 490
Denial-of-Service Attacks 492
Bandwidth Attacks 492
Slow Attacks 495
Legacy 497
Application Exploitation 497
Buffer Overflow 498
Heap Spraying 500
Application Protections and Evasions 501
Lateral Movement 502
Defense in Depth/Defense in Breadth 504
Defensible Network Architecture 506
Summary 508
Review Questions 510
Chapter 13 Cryptography 515
Basic Encryption 517
Substitution Ciphers 517
Diffie-Hellman 520
Symmetric Key Cryptography 521
Data Encryption Standard 522
Advanced Encryption Standard 523
Asymmetric Key Cryptography 524
Hybrid Cryptosystem 525
Nonrepudiation 525
Elliptic Curve Cryptography 526
Certificate Authorities and Key Management 528
Certificate Authority 528
Trusted Third Party 531
Self-Signed Certificates 532
Cryptographic Hashing 534
PGP and S/MIME 536
Disk and File Encryption 538
Summary 541
Review Questions 543
Chapter 14 Security Architecture and Design 547
Data Classification 548
Security Models 550
State Machine 550
Biba 551
Bell-LaPadula 552
Clark-Wilson Integrity Model 552
Application Architecture 553
n-tier Application Design 554
Service-Oriented Architecture 557
Cloud-Based Applications 559
Database Considerations 561
Security Architecture 563
Summary 567
Review Questions 569
Chapter 15 Cloud Computing and the Internet of Things 573
Cloud Computing Overview 574
Cloud Services 578
Shared Responsibility Model 583
Public vs. Private Cloud 585
Cloud Architectures and Deployment 586
Responsive Design 588
Cloud-Native
Design 589
Deployment 590
Dealing with REST 593
Common Cloud Threats 598
Access Management 598
Data Breach 600
Web Application Compromise 600
Credential Compromise 602
Insider Threat 604
Internet of Things 604
Operational Technology 610
Summary 612
Review Questions 614
Appendix Answers to Review Questions 617
Chapter 2: Networking Foundations 618
Chapter 3: Security Foundations 619
Chapter 4: Footprinting and Reconnaissance 622
Chapter 5: Scanning Networks 624
Chapter 6: Enumeration 627
Chapter 7: System Hacking 629
Chapter 8: Malware 632
Chapter 9: Sniffing 635
Chapter 10: Social Engineering 636
Chapter 11: Wireless Security 638
Chapter 12: Attack and Defense 641
Chapter 13: Cryptography 643
Chapter 14: Security Architecture and Design 645
Chapter 15: Cloud Computing and the Internet of Things 646
Index 649
