Table of Contents for
Gray Hat Hacking The Ethical Hacker's Handbook, Fourth Edition, 4th Edition
Gray Hat Hacking The Ethical Hacker's Handbook, Fourth Edition, 4th Edition
Published by
McGraw-Hill Osborne Media, 2015
- Cover
- Gray Hat Hacking The Ethical Hacker’s Handbook, Fourth Edition
- Title Page
- Copyright Page
- Dedication
- Gray Hat Hacking The Ethical Hacker’s Handbook, Fourth Edition
- Gray Hat Hacking The Ethical Hacker’s Handbook, Fourth Edition
- Gray Hat Hacking The Ethical Hacker’s Handbook, Fourth Edition
- Contents
- Preface
- Acknowledgments
- Introduction
- Part I Crash Course: Preparing for the War
- Chapter 1 Ethical Hacking and the Legal System
- Chapter 2 Programming Survival Skills
- Chapter 3 Static Analysis
- Chapter 4 Advanced Analysis with IDA Pro
- Chapter 5 World of Fuzzing
- Chapter 6 Shellcode Strategies
- Chapter 7 Writing Linux Shellcode
- Part II From Vulnerability to Exploit
- Chapter 8 Spoofing-Based Attacks
- Chapter 9 Exploiting Cisco Routers
- Chapter 10 Basic Linux Exploits
- Chapter 11 Advanced Linux Exploits
- Chapter 12 Windows Exploits
- Chapter 13 Bypassing Windows Memory Protections
- Chapter 14 Exploiting the Windows Access Control Model
- Chapter 15 Exploiting Web Applications
- Chapter 16 Exploiting IE: Smashing the Heap
- Chapter 17 Exploiting IE: Use-After-Free Technique
- Chapter 18 Advanced Client-Side Exploitation with BeEF
- Chapter 19 One-Day Exploitation with Patch Diffing
- Part III Advanced Malware Analysis
- Chapter 20 Dissecting Android Malware
- Chapter 21 Dissecting Ransomware
- Chapter 22 Analyzing 64-bit Malware
- Chapter 23 Next-Generation Reverse Engineering
- Appendix About the Download
- Index
- Gray Hat Hacking The Ethical Hacker’s Handbook, Fourth Edition
CONTENTS
Part I Crash Course: Preparing for the War
Chapter 1 Ethical Hacking and the Legal System
Why You Need to Understand Your Enemy’s Tactics
Recognizing Trouble When It Happens
The Penetration Testing Process
What Would an Unethical Hacker Do Differently?
Understanding Individual Cyberlaws
The Controversy of “Hacking” Tools
Different Teams and Points of View
Organization for Internet Safety
Chapter 2 Programming Survival Skills
Putting the Pieces of Memory Together
Why Bother with Reverse Engineering?
Reverse Engineering Considerations
The Utility of Source Code Auditing Tools
Automated Source Code Analysis
Manual Auditing of Binary Code
Automated Binary Analysis Tools
Chapter 4 Advanced Analysis with IDA Pro
Statically Linked Programs and FLAIR
Example 4-1: Decrypting Strings in Place
Lab 5-1: Collecting Samples from the Internet Archive
Choosing the Optimal Template Set with Code Coverage
Lab 5-2: Selecting the Best Samples for Fuzzing
Lab 5-3: Mutation Fuzzing with Peach
Chapter 6 Shellcode Strategies
Other Shellcode Considerations
Chapter 7 Writing Linux Shellcode
Shell-Spawning Shellcode with execve
Implementing Port-Binding Shellcode
Assembly Program to Establish a Socket
Implementing Reverse Connecting Shellcode
Reverse Connecting Assembly Program
Structure of Encoded Shellcode
Automating Shellcode Generation with Metasploit
Generating Shellcode with Metasploit
Encoding Shellcode with Metasploit
Part II From Vulnerability to Exploit
Chapter 8 Spoofing-Based Attacks
Lab 8-1: ARP Spoofing with Ettercap
Lab 8-2: DNS Spoofing with Ettercap
NetBIOS Name Spoofing and LLMNR Spoofing
Lab 8-3: Attacking NetBIOS and LLMNR with Responder
Cracking NTLMv1 and NTLMv2 Hashes
Chapter 9 Exploiting Cisco Routers
Attacking Community Strings and Passwords
Lab 9-1: Guessing Credentials with Ncrack and Metasploit
Lab 9-2: Guessing Community Strings with Onesixtyone and Metasploit
Lab 9-3: Downloading Configuration Files with Metasploit
Lab 9-4: Modifying Configurations with SNMP and TFTP
Attacking Cisco Type 7 Passwords
Lab 9-5: Cracking Type 7 Passwords with Cain
Lab 9-6: Cracking Type 7 Passwords with Metasploit
Attacking Cisco Type 5 Passwords
Lab 9-7: Attacking Cisco Type 5 Passwords with John the Ripper
Lab 9-8: Setting Up a GRE Tunnel
Lab 9-9: Routing Traffic over a GRE Tunnel
Maintaining Access on Cisco Devices
Chapter 10 Basic Linux Exploits
Ramifications of Buffer Overflows
Local Buffer Overflow Exploits
Lab 10-2: Components of the Exploit
Lab 10-3: Exploiting Stack Overflows from the Command Line
Lab 10-4: Exploiting Stack Overflows with Generic Exploit Code
Lab 10-5: Exploiting Small Buffers
Lab 10-6: Building Custom Exploits
Chapter 11 Advanced Linux Exploits
Lab 11-1: Reading from Arbitrary Memory
Lab 11-2: Writing to Arbitrary Memory
Lab 11-3: Changing Program Execution
Lab 11-4: Bypassing Stack Protection
Lab 11-5: Return to libc Exploits
Lab 11-6: Maintaining Privileges with ret2libc
Compiling and Debugging Windows Programs
Lab 12-1: Compiling on Windows
Debugging on Windows with Immunity Debugger
Lab 12-2: Crashing the Program
Exploit Development Process Review
Lab 12-3: Exploiting ProSSHD Server
Understanding Structured Exception Handling (SEH)
Chapter 13 Bypassing Windows Memory Protections
Understanding Windows Memory Protections (XP SP3, Vista, 7, 8, Server 2008, and Server 2012)
Stack-Based Buffer Overrun Detection (/GS)
Safe Structured Exception Handling (SafeSEH)
SEH Overwrite Protection (SEHOP)
Data Execution Prevention (DEP)
Address Space Layout Randomization (ASLR)
Enhanced Mitigation Experience Toolkit (EMET)
Bypassing Windows Memory Protections
Chapter 14 Exploiting the Windows Access Control Model
Why Access Control Is Interesting to a Hacker
Most People Don’t Understand Access Control
Vulnerabilities You Find Are Easy to Exploit
You’ll Find Tons of Security Vulnerabilities
How Windows Access Control Works
Tools for Analyzing Access Control Configurations
Dumping the Security Descriptor
Special SIDs, Special Access, and “Access Denied”
Analyzing Access Control for Elevation of Privilege
Attack Patterns for Each Interesting Object Type
Attacking Weak DACLs in the Windows Registry
Attacking Weak Directory DACLs
What Other Object Types Are Out There?
Enumerating Shared Memory Sections
Enumerating Other Named Kernel Objects (Semaphores, Mutexes, Events, and Devices)
Chapter 15 Exploiting Web Applications
Overview of the Top 10 Web Vulnerabilities
Understanding the Vulnerability
Lab 15-2: Leverage Multibyte Encoding
Hunting Cross-site Scripting (XSS)
Lab 15-3: Basic XSS Injection into a JavaScript Block
Unicode Normalization Forms Attack
Lab 15-4: Leveraging Unicode Normalization
Unicode Normalization Introduction
Preparing the Environment for Testing
XSS Testing via x5s the Plug-In
Chapter 16 Exploiting IE: Smashing the Heap
Attaching the Browser to WinDbg
Lab 16-1: Heap Spray via HTML5
DOM Element Property Spray (DEPS)
Lab 16-2: Heap Spray via DEPS Technique
Forcing New Allocations by Exhausting the Cache Blocks
Lab 16-4: Basic Heap Spray with Flash
Flash Spray with Integer Vectors
Lab 16-5: Heap Spray with Flash Vectors
Leveraging Low Fragmentation Heap (LFH)
Chapter 17 Exploiting IE: Use-After-Free Technique
Dissecting Use-After-Free (UAF)
Lab 17-1: Dissecting UAF, Step by Step
Leveraging the UAF Vulnerability
Example 17-1: Connecting the Dots
Chapter 18 Advanced Client-Side Exploitation with BeEF
Lab 18-2: Using the BeEF Console
Lab 18-4: Hooking Browsers with Site Spoofing
Lab 18-5: Automatically Injecting Hooks with Shank
Lab 18-6: Fingerprinting Browsers with BeEF
Lab 18-7: Fingerprinting Users with BeEF
Lab 18-8: Fingerprinting Computers with BeEF
Lab 18-9: Exploiting Browsers with BeEF and Java
Exploiting Browsers with BeEF and Metasploit
Chapter 19 One-Day Exploitation with Patch Diffing
Introduction to Binary Diffing
Lab 19-2: Obtaining and Extracting Microsoft Patches
Lab 19-3: Diffing MS14-006 with turbodiff
Lab 19-4: Kernel Debugging MS14-006
Part III Advanced Malware Analysis
Chapter 20 Dissecting Android Malware
Example 20-1: Running APK in Emulator
Example 20-2: Black-Box APK Monitoring with Droidbox
Chapter 21 Dissecting Ransomware
Example 21-1: Dynamic Analysis
Chapter 22 Analyzing 64-bit Malware
Overview of the AMD64 Architecture
Example 22-1: Decrypting C&C Domains
Chapter 23 Next-Generation Reverse Engineering
Honeypots and Sandboxes Using TrapX
A Free Tool for Dynamic Analysis