Hacking For Dummies,® 5th Edition

Hacking

5th Edition

by Kevin Beaver, CISSP

Foreword by Richard Stiennon

Chief Research Analyst, IT‐Harvest

Author of There Will Be Cyberwar

Hacking For Dummies,® 5th Edition

Published by: John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030‐5774, www.wiley.com

Copyright © 2016 by John Wiley & Sons, Inc., Hoboken, New Jersey

Published simultaneously in Canada

No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or

by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permit￾ted under Sections 107 or 108 of the 1976 United States Copyright Act, without the prior written permission

of the Publisher. Requests to the Publisher for permission should be addressed to the Permissions

Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748‐6011, fax (201)

748‐6008, or online at http://www.wiley.com/go/permissions.

Trademarks: Wiley, For Dummies, the Dummies Man logo, Dummies.com, Making Everything Easier, and

related trade dress are trademarks or registered trademarks of John Wiley & Sons, Inc. and may not be

used without written permission. All other trademarks are the property of their respective owners. John

Wiley & Sons, Inc. is not associated with any product or vendor mentioned in this book.

LIMIT OF LIABILITY/DISCLAIMER OF WARRANTY: THE PUBLISHER AND THE AUTHOR MAKE NO

REPRESENTATIONS OR WARRANTIES WITH RESPECT TO THE ACCURACY OR COMPLETENESS OF

THE CONTENTS OF THIS WORK AND SPECIFICALLY DISCLAIM ALL WARRANTIES, INCLUDING

WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE. NO WARRANTY

MAY BE CREATED OR EXTENDED BY SALES OR PROMOTIONAL MATERIALS. THE ADVICE AND

STRATEGIES CONTAINED HEREIN MAY NOT BE SUITABLE FOR EVERY SITUATION. THIS WORK IS

SOLD WITH THE UNDERSTANDING THAT THE PUBLISHER IS NOT ENGAGED IN RENDERING LEGAL,

ACCOUNTING, OR OTHER PROFESSIONAL SERVICES. IF PROFESSIONAL ASSISTANCE IS REQUIRED,

THE SERVICES OF A COMPETENT PROFESSIONAL PERSON SHOULD BE SOUGHT. NEITHER THE

PUBLISHER NOR THE AUTHOR SHALL BE LIABLE FOR DAMAGES ARISING HEREFROM. THE FACT

THAT AN ORGANIZATION OR WEBSITE IS REFERRED TO IN THIS WORK AS A CITATION AND/OR A

POTENTIAL SOURCE OF FURTHER INFORMATION DOES NOT MEAN THAT THE AUTHOR OR THE

PUBLISHER ENDORSES THE INFORMATION THE ORGANIZATION OR WEBSITE MAY PROVIDE OR

RECOMMENDATIONS IT MAY MAKE. FURTHER, READERS SHOULD BE AWARE THAT INTERNET

WEBSITES LISTED IN THIS WORK MAY HAVE CHANGED OR DISAPPEARED BETWEEN WHEN THIS

WORK WAS WRITTEN AND WHEN IT IS READ.

For general information on our other products and services, please contact our Customer Care Department

within the U.S. at 877‐762‐2974, outside the U.S. at 317‐572‐3993, or fax 317‐572‐4002. For technical support,

please visit www.wiley.com/techsupport.

Wiley publishes in a variety of print and electronic formats and by print‐on‐demand. Some material

included with standard print versions of this book may not be included in e‐books or in print‐on‐demand.

If this book refers to media such as a CD or DVD that is not included in the version you purchased, you

may download this material at http://booksupport.wiley.com. For more information about Wiley

products, visit www.wiley.com.

Library of Congress Control Number: 2015956627

ISBN 978‐1‐119‐15468‐6 (pbk); ISBN 978‐1‐119‐15469‐3 (ebk); ISBN 978‐1‐119‐15470‐9 (ebk)

Manufactured in the United States of America

10 9 8 7 6 5 4 3 2 1

Contents at a Glance

Foreword................................................................... XV

Introduction ................................................................ 1

Part I: Building the Foundation for Security Testing ....... 7

Chapter 1: Introduction to Ethical Hacking....................................................................9

Chapter 2: Cracking the Hacker Mindset......................................................................25

Chapter 3: Developing Your Ethical Hacking Plan.......................................................37

Chapter 4: Hacking Methodology ..................................................................................49

Part II: Putting Security Testing in Motion................... 59

Chapter 5: Information Gathering..................................................................................61

Chapter 6: Social Engineering ........................................................................................67

Chapter 7: Physical Security ..........................................................................................83

Chapter 8: Passwords......................................................................................................93

Part III: Hacking Network Hosts............................... 121

Chapter 9: Network Infrastructure Systems...............................................................123

Chapter 10: Wireless Networks....................................................................................159

Chapter 11: Mobile Devices..........................................................................................187

Part IV: Hacking Operating Systems ......................... 201

Chapter 12: Windows ....................................................................................................203

Chapter 13: Linux...........................................................................................................231

Part V: Hacking Applications ................................... 253

Chapter 14: Communication and Messaging Systems ..............................................255

Chapter 15: Web Applications and Mobile Apps .......................................................279

Chapter 16: Databases and Storage Systems .............................................................305

Part VI: Security Testing Aftermath........................... 317

Chapter 17: Reporting Your Results............................................................................319

Chapter 18: Plugging Security Holes ...........................................................................325

Chapter 19: Managing Security Processes..................................................................331

Part VII: The Part of Tens......................................... 339

Chapter 20: Ten Tips for Getting Security Buy-In......................................................341

Chapter 21: Ten Reasons Hacking Is the Only Effective Way to Test .....................347

Chapter 22: Ten Deadly Mistakes ................................................................................351

Appendix: Tools and Resources ..................................................................................355

Index ...................................................................... 373

Table of Contents

Foreword.................................................................... XV

Introduction ................................................................. 1

Who Should Read This Book? ........................................................................1

About This Book ..............................................................................................2

How to Use This Book.....................................................................................3

What You Don’t Need to Read .......................................................................3

Foolish Assumptions.......................................................................................3

How This Book Is Organized..........................................................................3

Part I: Building the Foundation for Security Testing.........................4

Part II: Putting Security Testing in Motion .........................................4

Part III: Hacking Network Hosts ...........................................................4

Part IV: Hacking Operating Systems....................................................4

Part V: Hacking Applications................................................................5

Part VI: Security Testing Aftermath.....................................................5

Part VII: The Part of Tens......................................................................5

Icons Used in This Book .................................................................................6

Where to Go from Here...................................................................................6

Part I: Building the Foundation for Security Testing........ 7

Chapter 1: Introduction to Ethical Hacking . . . . . . . . . . . . . . . . . . . . . . . 9

Straightening Out the Terminology...............................................................9

Defining hacker ....................................................................................10

Defining malicious user.......................................................................11

Recognizing How Malicious Attackers Beget Ethical Hackers.................11

Ethical hacking versus auditing .........................................................12

Policy considerations..........................................................................13

Compliance and regulatory concerns ...............................................13

Understanding the Need to Hack Your Own Systems ..............................13

Understanding the Dangers Your Systems Face .......................................15

Nontechnical attacks...........................................................................15

Network infrastructure attacks..........................................................16

Operating system attacks ...................................................................16

Application and other specialized attacks .......................................17

vi Hacking For Dummies

Obeying the Ethical Hacking Principles......................................................17

Working ethically.................................................................................18

Respecting privacy ..............................................................................18

Not crashing your systems.................................................................18

Using the Ethical Hacking Process ..............................................................19

Formulating your plan.........................................................................19

Selecting tools ......................................................................................21

Executing the plan ...............................................................................23

Evaluating results ................................................................................24

Moving on .............................................................................................24

Chapter 2: Cracking the Hacker Mindset . . . . . . . . . . . . . . . . . . . . . . . . 25

What You’re Up Against................................................................................25

Who Breaks into Computer Systems ..........................................................28

Why They Do It ..............................................................................................30

Planning and Performing Attacks ................................................................33

Maintaining Anonymity.................................................................................35

Chapter 3: Developing Your Ethical Hacking Plan . . . . . . . . . . . . . . . . 37

Establishing Your Goals................................................................................38

Determining Which Systems to Hack..........................................................40

Creating Testing Standards..........................................................................43

Timing....................................................................................................43

Running specific tests .........................................................................44

Blind versus knowledge assessments...............................................45

Picking your location...........................................................................46

Responding to vulnerabilities you find.............................................46

Making silly assumptions....................................................................46

Selecting Security Assessment Tools..........................................................47

Chapter 4: Hacking Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Setting the Stage for Testing ........................................................................49

Seeing What Others See................................................................................51

Gathering public information.............................................................51

Scanning Systems ..........................................................................................52

Hosts......................................................................................................52

Open ports............................................................................................53

Determining What’s Running on Open Ports .............................................53

Assessing Vulnerabilities..............................................................................56

Penetrating the System.................................................................................57

Table of Contents vii

Part II: Putting Security Testing in Motion ................... 59

Chapter 5: Information Gathering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

Gathering Public Information.......................................................................61

Social media..........................................................................................61

Web search...........................................................................................62

Web crawling........................................................................................63

Websites................................................................................................64

Mapping the Network....................................................................................64

WHOIS....................................................................................................64

Privacy policies....................................................................................66

Chapter 6: Social Engineering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

Introducing Social Engineering....................................................................67

Starting Your Social Engineering Tests ......................................................68

Why Attackers Use Social Engineering .......................................................69

Understanding the Implications ..................................................................70

Building trust........................................................................................71

Exploiting the relationship .................................................................72

Performing Social Engineering Attacks.......................................................75

Seeking information.............................................................................75

Social Engineering Countermeasures .........................................................79

Policies ..................................................................................................79

User awareness and training..............................................................79

Chapter 7: Physical Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

Identifying Basic Physical Security Vulnerabilities...................................83

Pinpointing Physical Vulnerabilities in Your Office..................................85

Building infrastructure........................................................................85

Utilities ..................................................................................................86

Office layout and usage.......................................................................88

Network components and computers...............................................90

Chapter 8: Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

Understanding Password Vulnerabilities...................................................94

Organizational password vulnerabilities..........................................95

Technical password vulnerabilities ..................................................95

Cracking Passwords ......................................................................................96

Cracking passwords the old-fashioned way.....................................97

Cracking passwords with high-tech tools.........................................99

Cracking password-protected files..................................................107

Understanding other ways to crack passwords ............................109

viii Hacking For Dummies

General Password Cracking Countermeasures .......................................115

Storing passwords .............................................................................115

Creating password policies ..............................................................116

Taking other countermeasures........................................................117

Securing Operating Systems ......................................................................119

Windows..............................................................................................119

Linux and UNIX...................................................................................120

Part III: Hacking Network Hosts................................ 121

Chapter 9: Network Infrastructure Systems . . . . . . . . . . . . . . . . . . . . 123

Understanding Network Infrastructure Vulnerabilities..........................124

Choosing Tools ............................................................................................125

Scanners and analyzers.....................................................................126

Vulnerability assessment..................................................................126

Scanning, Poking, and Prodding the Network..........................................126

Scanning ports....................................................................................127

Scanning SNMP...................................................................................133

Grabbing banners ..............................................................................134

Testing firewall rules .........................................................................136

Analyzing network data.....................................................................138

The MAC-daddy attack......................................................................145

Testing denial of service attacks .....................................................150

Detecting Common Router, Switch, and Firewall Weaknesses..............153

Finding unsecured interfaces...........................................................153

Exploiting IKE weaknesses................................................................154

Uncovering issues with SSL and TLS...............................................155

Putting Up General Network Defenses......................................................156

Chapter 10: Wireless Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159

Understanding the Implications of Wireless Network Vulnerabilities .159

Choosing Your Tools...................................................................................160

Discovering Wireless Networks.................................................................162

Checking for worldwide recognition...............................................162

Scanning your local airwaves...........................................................163

Discovering Wireless Network Attacks and Taking

Countermeasures.....................................................................................164

Encrypted traffic ................................................................................165

Wi-Fi Protected Setup........................................................................172

Rogue wireless devices .....................................................................174

MAC spoofing .....................................................................................179

Physical security problems ..............................................................183

Vulnerable wireless workstations ...................................................183

Default configuration settings ..........................................................184

Table of Contents ix

Chapter 11: Mobile Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187

Sizing Up Mobile Vulnerabilities................................................................187

Cracking Laptop Passwords.......................................................................188

Choosing your tools ..........................................................................188

Countermeasures...............................................................................192

Cracking Phones and Tablets ....................................................................193

Cracking iOS passwords ...................................................................194

Countermeasures against password cracking ...............................199

Part IV: Hacking Operating Systems.......................... 201

Chapter 12: Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203

Introducing Windows Vulnerabilities .......................................................204

Choosing Tools ............................................................................................205

Free Microsoft tools ..........................................................................205

All-in-one assessment tools ..............................................................206

Task-specific tools .............................................................................206

Gathering Information About Your Windows Vulnerabilities................207

System scanning ................................................................................207

NetBIOS ...............................................................................................210

Detecting Null Sessions...............................................................................213

Mapping ..............................................................................................213

Gleaning information.........................................................................214

Countermeasures against null session hacks ................................217

Checking Share Permissions ......................................................................218

Windows defaults...............................................................................218

Testing.................................................................................................219

Exploiting Missing Patches.........................................................................220

Using Metasploit ................................................................................222

Countermeasures against missing patch vulnerability exploits..227

Running Authenticated Scans ....................................................................227

Chapter 13: Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231

Understanding Linux Vulnerabilities ........................................................232

Choosing Tools ............................................................................................233

Gathering Information About Your Linux Vulnerabilities ......................233

System scanning ................................................................................234

Countermeasures against system scanning ...................................237

Finding Unneeded and Unsecured Services.............................................238

Searches..............................................................................................238

Countermeasures against attacks on unneeded services ............240

Securing the .rhosts and hosts.equiv Files ..............................................242

Hacks using the hosts.equiv and .rhosts files................................242

Countermeasures against .rhosts and hosts.equiv file attacks ...243

x Hacking For Dummies

Assessing the Security of NFS....................................................................245

NFS hacks............................................................................................245

Countermeasures against NFS attacks............................................245

Checking File Permissions..........................................................................246

File permission hacks........................................................................246

Countermeasures against file permission attacks.........................246

Finding Buffer Overflow Vulnerabilities ...................................................247

Attacks.................................................................................................248

Countermeasures against buffer overflow attacks........................248

Checking Physical Security ........................................................................249

Physical security hacks.....................................................................249

Countermeasures against physical security attacks.....................249

Performing General Security Tests ...........................................................250

Patching Linux .............................................................................................251

Distribution updates..........................................................................252

Multi-platform update managers .....................................................252

Part V: Hacking Applications.................................... 253

Chapter 14: Communication and Messaging Systems . . . . . . . . . . . 255

Introducing Messaging System Vulnerabilities........................................255

Recognizing and Countering E-Mail Attacks ............................................256

E-mail bombs......................................................................................257

Banners ...............................................................................................260

SMTP attacks......................................................................................262

General best practices for minimizing e-mail security risks ........270

Understanding Voice over IP .....................................................................272

VoIP vulnerabilities ...........................................................................272

Countermeasures against VoIP vulnerabilities..............................277

Chapter 15: Web Applications and Mobile Apps . . . . . . . . . . . . . . . . 279

Choosing Your Web Security Testing Tools ............................................280

Seeking Out Web Vulnerabilities ...............................................................281

Directory traversal ............................................................................282

Countermeasures against directory traversals .............................284

Input-filtering attacks ........................................................................285

Countermeasures against input attacks .........................................293

Default script attacks ........................................................................294

Countermeasures against default script attacks ...........................294

Unsecured login mechanisms ..........................................................295

Countermeasures against unsecured login systems.....................298

Performing general security scans for web application

vulnerabilities.................................................................................299

Table of Contents xi

Minimizing Web Security Risks..................................................................300

Practicing security by obscurity......................................................300

Putting up firewalls............................................................................301

Analyzing source code ......................................................................301

Uncovering Mobile App Flaws ...................................................................304

Chapter 16: Databases and Storage Systems . . . . . . . . . . . . . . . . . . . 305

Diving Into Databases .................................................................................305

Choosing tools....................................................................................306

Finding databases on the network...................................................306

Cracking database passwords..........................................................307

Scanning databases for vulnerabilities ...........................................308

Following Best Practices for Minimizing Database Security Risks........309

Opening Up About Storage Systems .........................................................310

Choosing tools....................................................................................311

Finding storage systems on the network........................................311

Rooting out sensitive text in network files .....................................312

Following Best Practices for Minimizing Storage Security Risks...........314

Part VI: Security Testing Aftermath ........................... 317

Chapter 17: Reporting Your Results . . . . . . . . . . . . . . . . . . . . . . . . . . . 319

Pulling the Results Together......................................................................319

Prioritizing Vulnerabilities .........................................................................321

Creating Reports..........................................................................................322

Chapter 18: Plugging Security Holes . . . . . . . . . . . . . . . . . . . . . . . . . . 325

Turning Your Reports into Action.............................................................325

Patching for Perfection...............................................................................326

Patch management............................................................................327

Patch automation...............................................................................327

Hardening Your Systems ............................................................................328

Assessing Your Security Infrastructure....................................................329

Chapter 19: Managing Security Processes . . . . . . . . . . . . . . . . . . . . . 331

Automating the Ethical Hacking Process .................................................331

Monitoring Malicious Use...........................................................................332

Outsourcing Security Assessments...........................................................334

Instilling a Security-Aware Mindset...........................................................336

Keeping Up with Other Security Efforts ...................................................337

xii Hacking For Dummies

Part VII: The Part of Tens.......................................... 339

Chapter 20: Ten Tips for Getting Security Buy-In . . . . . . . . . . . . . . . . 341

Cultivate an Ally and a Sponsor.................................................................341

Don’t Be a FUDdy Duddy ............................................................................341

Demonstrate How the Organization Can’t Afford to Be Hacked............342

Outline the General Benefits of Security Testing ....................................343

Show How Security Testing Specifically Helps the Organization..........343

Get Involved in the Business......................................................................344

Establish Your Credibility ..........................................................................344

Speak on Management’s Level...................................................................344

Show Value in Your Efforts.........................................................................345

Be Flexible and Adaptable..........................................................................345

Chapter 21: Ten Reasons Hacking Is the Only Effective

Way to Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 347

The Bad Guys Think Bad Thoughts, Use Good Tools,

and Develop New Methods.....................................................................347

IT Governance and Compliance Are More than High-Level

Checklist Audits .......................................................................................347

Hacking Complements Audits and Security Evaluations........................348

Customers and Partners Will Ask, ‘How Secure

Are Your Systems?’..................................................................................348

The Law of Averages Works Against Businesses ....................................348

Security Assessments Improve the Understanding

of Business Threats .................................................................................349

If a Breach Occurs, You Have Something to Fall Back On......................349

In-Depth Testing Brings Out the Worst in Your Systems .......................349

Combining the Best of Penetration Testing and Vulnerability

Assessments Is What You Need.............................................................350

Proper Testing Can Uncover Weaknesses That Might Go

Overlooked for Years ..............................................................................350

Chapter 22: Ten Deadly Mistakes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351

Not Getting Prior Approval ........................................................................351

Assuming You Can Find All Vulnerabilities During Your Tests.............351

Assuming You Can Eliminate All Security Vulnerabilities......................352

Performing Tests Only Once......................................................................352

Thinking You Know It All............................................................................352

Running Your Tests Without Looking at Things from a Hacker’s

Viewpoint..................................................................................................353

Not Testing the Right Systems...................................................................353

Not Using the Right Tools...........................................................................353

Pounding Production Systems at the Wrong Time .................................354

Outsourcing Testing and Not Staying Involved.......................................354

Table of Contents xiii

Appendix: Tools and Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355

Advanced Malware......................................................................................355

Bluetooth......................................................................................................355

Certifications................................................................................................356

Databases .....................................................................................................356

Denial of Service Protection.......................................................................357

Exploits .........................................................................................................357

General Research Tools..............................................................................357

Hacker Stuff ..................................................................................................358

Keyloggers ....................................................................................................359

Laws and Regulations .................................................................................359

Linux..............................................................................................................359

Live Toolkits.................................................................................................360

Log Analysis .................................................................................................360

Messaging .....................................................................................................360

Miscellaneous ..............................................................................................361

Mobile ...........................................................................................................361

Networks.......................................................................................................362

Password Cracking......................................................................................363

Patch Management......................................................................................365

Security Education and Learning Resources ...........................................366

Security Methods and Models ...................................................................366

Social Enginering and Phishing..................................................................366

Source Code Analysis..................................................................................367

Statistics .......................................................................................................367

Storage ..........................................................................................................367

System Hardening........................................................................................367

User Awareness and Training ....................................................................368

Voice over IP ................................................................................................368

Vulnerability Databases..............................................................................369

Websites and Applications.........................................................................369

Windows .......................................................................................................371

Wireless Networks.......................................................................................371

Index....................................................................... 373