Table of Contents for
Network Security Assessment, 3rd Edition
Close
Version ebook
/
Retour
Network Security Assessment, 3rd Edition
by Chris McNab
Published by O'Reilly Media, Inc., 2016
nav
Cover
Network Security Assessment
Network Security Assessment
section
Preface
1. Introduction to Network Security Assessment
2. Assessment Workflow and Tools
3. Vulnerabilities and Adversaries
4. Internet Network Discovery
5. Local Network Discovery
6. IP Network Scanning
7. Assessing Common Network Services
8. Assessing Microsoft Services
9. Assessing Mail Services
10. Assessing VPN Services
11. Assessing TLS Services
12. Web Application Architecture
13. Assessing Web Servers
14. Assessing Web Application Frameworks
15. Assessing Data Stores
A. Common Ports and Message Types
B. Sources of Vulnerability Information
C. Unsafe TLS Cipher Suites
Glossary of Terms
Index
About the Author
Colophon
Preface
Overview
Audience
Organization
Use of RFC and CVE References
Vulnerabilities Covered in This Book
Recognized Assessment Standards
NIST SP 800-115
NSA IAM
CESG CHECK
CESG Recognized Qualifications
PCI DSS
PTES
Mirror Site for Tools Mentioned in This Book
Using Code Examples
Conventions Used in This Book
O’Reilly Safari
Comments and Questions
Acknowledgments
Technical Reviewers and Contributors
1. Introduction to Network Security Assessment
The State of the Art
Threats and Attack Surface
Attacking Client Software
Attacking Server Software
Attacking Web Applications
Exposed Logic
Assessment Flavors
Static Analysis
Dynamic Testing
What This Book Covers
2. Assessment Workflow and Tools
Network Security Assessment Methodology
Reconnaissance
Vulnerability Scanning
Investigation of Vulnerabilities
Exploitation of Vulnerabilities
An Iterative Assessment Approach
Your Testing Platform
Updating Kali Linux
Deploying a Vulnerable Server
3. Vulnerabilities and Adversaries
The Fundamental Hacking Concept
Why Software Is Vulnerable
Considering Attack Surface
A Taxonomy of Software Security Errors
Threat Modeling
System Components
Adversarial Goals
System Access and Execution Context
Attacker Economics
Attacking C/C++ Applications
Runtime Memory Layout
Processor Registers and Memory
Writing to Memory
Reading from Memory
Compiler and OS Security Features
Circumventing Common Safety Features
Logic Flaws and Other Bugs
Cryptographic Weaknesses
Vulnerabilities and Adversaries Recap
4. Internet Network Discovery
Querying Search Engines and Websites
Google Search
Querying Netcraft
Using Shodan
DomainTools
PGP Public Key Servers
Searching LinkedIn
Domain WHOIS
Manual WHOIS Querying
IP WHOIS
IP WHOIS Querying Tools and Examples
BGP Enumeration
DNS Querying
Forward DNS Querying
DNS Zone Transfer Techniques
Forward DNS Grinding
Reverse DNS Sweeping
IPv6 Host Enumeration
Cross-Referencing DNS Datasets
SMTP Probing
Automating Enumeration
Enumeration Technique Recap
Enumeration Countermeasures
5. Local Network Discovery
Data Link Protocols
802.3 Ethernet Testing
802.1Q VLAN
802.1X PNAC
CDP
802.1D STP
Local IP Protocols
DHCP
PXE
LLMNR, NBT-NS, and mDNS
WPAD
Internal Routing Protocols
IPv6 Network Discovery
Identifying Local Gateways
Local Network Discovery Recap
Local Network Attack Countermeasures
6. IP Network Scanning
Initial Network Scanning with Nmap
ICMP
TCP
UDP
SCTP
Bringing Everything Together
Low-Level IP Assessment
Crafting Arbitrary Packets
TCP/IP Stack Fingerprinting
IP ID Analysis
Manipulating TTL to Reverse Engineer ACLs
Revealing Internal IP Addresses
Vulnerability Scanning with NSE
Bulk Vulnerability Scanning
IDS and IPS Evasion
TTL Manipulation
Data Insertion and Scrambling with SniffJoke
Configuring and Running SniffJoke
Network Scanning Recap
Network Scanning Countermeasures
7. Assessing Common Network Services
FTP
Fingerprinting FTP Services
Known FTP Vulnerabilities
TFTP
Known TFTP Vulnerabilities
SSH
Fingerprinting
Enumerating Features
Default and Hardcoded Credentials
Insecurely Generated Host Keys
SSH Server Software Flaws
Telnet
Default Telnet Credentials
Telnet Server Software Flaws
IPMI
DNS
Fingerprinting
Testing for Recursion Support
Known DNS Server Flaws
Multicast DNS
NTP
SNMP
Exploiting SNMP
LDAP
LDAP Authentication
LDAP Operations
LDAP Directory Structure
Fingerprinting and Anonymous Binding
Brute-Force Password Grinding
Obtaining Sensitive Data
LDAP Server Implementation Flaws
Kerberos
Kerberos Keys
Ticket Format
Kerberos Attack Surface
Local Attacks
Unauthenticated Remote Attacks
Kerberos Implementation Flaws
VNC
Attacking VNC Servers
Unix RPC Services
Manually Querying Exposed RPC Services
RPC Service Vulnerabilities
Common Network Service Assessment Recap
Service Hardening and Countermeasures
8. Assessing Microsoft Services
NetBIOS Name Service
SMB
Microsoft RPC Services
Attacking SMB and RPC
Mapping Network Attack Surface
Anonymous IPC Access via SMB
SMB Implementation Flaws
Identifying Exposed RPC Services
Brute-Force Password Grinding
Authenticating and Using Access
Remote Desktop Services
Brute-Force Password Grinding
Assessing Transport Security
RDP Implementation Flaws
Microsoft Services Testing Recap
Microsoft Services Countermeasures
9. Assessing Mail Services
Mail Protocols
SMTP
Service Fingerprinting
Mapping SMTP Architecture
Enumerating Supported Commands and Extensions
Remotely Exploitable Flaws
User Account Enumeration
Brute-Force Password Grinding
Content Checking Circumvention
Review of Mail Security Features
Phishing via SMTP
POP3
Service Fingerprinting
Brute-Force Password Grinding
IMAP
Service Fingerprinting
Brute-Force Password Grinding
Known IMAP Server Flaws
Mail Services Testing Recap
Mail Services Countermeasures
10. Assessing VPN Services
IPsec
Packet Format
ISAKMP, IKE, and IKEv2
IKE Assessment
Exploitable IPsec Weaknesses
PPTP
VPN Testing Recap
VPN Services Countermeasures
11. Assessing TLS Services
TLS Mechanics
Session Negotiation
Cipher Suites
Key Exchange and Authentication
TLS Authentication
Session Resumption
Session Renegotiation
Compression
STARTTLS
Understanding TLS Vulnerabilities
Exploitable Flaws
Mitigating TLS Exposures
Assessing TLS Endpoints
Identifying the TLS Library and Version
Enumerating Supported Protocols and Cipher Suites
Enumerating Supported Features and Extensions
Certificate Review
Stress Testing TLS Endpoints
Manually Accessing TLS-Wrapped Services
TLS Service Assessment Recap
TLS Hardening
Web Application Hardening
12. Web Application Architecture
Web Application Types
Web Application Tiers
The Presentation Tier
TLS
HTTP
CDNs
Load Balancers
Presentation-Tier Data Formats
The Application Tier
Application-Tier Data Formats
The Data Tier
13. Assessing Web Servers
Identifying Proxy Mechanisms
Enumerating Valid Hosts
Web Server Profiling
Analyzing Server Responses
HTTP Header Review
Crawling and Investigation of Content
Active Scanning
WAF Detection
Server and Application Framework Fingerprinting
Identifying Exposed Content
Qualifying Web Server Vulnerabilities
Reviewing Exposed Content
Brute-Force Password Grinding
Investigating Supported HTTP Methods
Known Microsoft IIS Vulnerabilities
Known Apache HTTP Server Flaws
Known Apache Coyote Weaknesses
Known Nginx Defects
Web Server Hardening
14. Assessing Web Application Frameworks
Framework and Data Store Profiling
Understanding Common Flaws
PHP
PHP Management Consoles
PHP CMS Packages
Apache Tomcat
The Manager Application
Known Tomcat Flaws
Attacking Apache JServ Protocol
JBoss Testing
Server Profiling via HTTP
Web Consoles and Invoker Servlets
Identifying MBeans
Exploiting MBeans
Exploiting the RMI Distributed Garbage Collector
Known JBoss Vulnerabilities
Automated JBoss Scanning
Apache Struts
Exploiting the DefaultActionMapper
JDWP
Adobe ColdFusion
ColdFusion Profiling
Exposed Management Interfaces
Known ColdFusion Software Defects
Apache Solr Vulnerabilities
Django
Rails
Using an Application’s Secret Token
Node.js
Microsoft ASP.NET
Application Framework Security Checklist
15. Assessing Data Stores
MySQL
Brute-Force Password Grinding
Authenticated MySQL Attacks
PostgreSQL
Brute-Force Password Grinding
Authenticated PostgreSQL Attacks
Microsoft SQL Server
Brute-Force Password Grinding
Authenticating and Evaluating Configuration
Oracle Database
Interacting with the TNS Listener
Oracle SID Grinding
Database Account Password Grinding
Authenticating with Oracle Database
Privilege Escalation and Pivoting
MongoDB
Redis
Known Weaknesses
Memcached
Apache Hadoop
NFS
Apple Filing Protocol
iSCSI
Data Store Countermeasures
A. Common Ports and Message Types
TCP Ports
UDP Ports
ICMP Message Types
B. Sources of Vulnerability Information
Twitter Accounts
Bug Trackers
Mailing Lists
Security Events and Conferences
C. Unsafe TLS Cipher Suites
Glossary of Terms
Index