ABOUT THE AUTHORS |
|
IV | |
ACKNOWLEDGMENTS |
|
VI | |
BOOK INTRODUCTION |
|
XIII | |
SECTION 1 NETWORKING BASICS: HOW DO NETWORKS WORK? |
|
|
Chapter 1 WORKSTATION NETWORK CONFIGURATION AND CONNECTIVITY |
|
|
3 | (76) |
|
Lab 1: Network Workstation Client Configuration |
|
|
6 | (21) |
|
Lab 1a: Windows Client Configuration (ipconfig/ping/arp) |
|
|
8 | (7) |
|
Lab 1b: Linux Client Configuration (ifconfig/ping/arp) |
|
|
15 | (12) |
|
Lab 2: Computer Name Resolution |
|
|
27 | (16) |
|
Lab 2a: Windows (nslookup) |
|
|
28 | (6) |
|
|
34 | (9) |
|
Lab 3: Network Routing Basics (routing) |
|
|
43 | (15) |
|
Lab 3c: Network Routing Basics |
|
|
43 | (15) |
|
Lab 4: Network Communication Analysis |
|
|
58 | (21) |
|
Lab 4a: Windows Network Communication Analysis (Ethereal) |
|
|
59 | (7) |
|
Lab 4b: Linux Network Communication Analysis (Ethereal) |
|
|
66 | (13) |
|
|
79 | (32) |
|
|
80 | (18) |
|
Lab 5a: TCP Three-Way Handshake in Windows |
|
|
84 | (5) |
|
Lab 5b: TCP Three-Way Handshake in Linux |
|
|
89 | (9) |
|
|
98 | (13) |
|
Lab 6a: Windows UDP Basics |
|
|
100 | (3) |
|
|
103 | (8) |
|
Chapter 3 NETWORK APPLICATIONS |
|
|
111 | (84) |
|
Lab 7: FTP Communications |
|
|
114 | (18) |
|
Lab 7a: Windows FTP Communication (FTP-HTTP) |
|
|
115 | (6) |
|
Lab 7b: Linux FTP Communication (FTP-HTTP) |
|
|
121 | (11) |
|
Lab 8: Port Connection Status |
|
|
132 | (15) |
|
Lab 8a: Windows-Based Port Connection Status (netstat) |
|
|
133 | (5) |
|
Lab 8b: Linux-Based Port Connection Status (netstat) |
|
|
138 | (9) |
|
Lab 9: E-mail Protocols-SMTP and POP |
|
|
147 | (18) |
|
Lab 9b: Linux E-mail-SMTP and POP |
|
|
148 | (6) |
|
Lab 9c: Windows E-mail-SMTP and POP |
|
|
154 | (11) |
|
Lab 10: E-mail Client Software |
|
|
165 | (32) |
|
Lab 10b: Linux E-mail Client Software (Evolution) |
|
|
166 | (7) |
|
Lab 10c: Windows E-mail Client Software (Outlook Express) |
|
|
173 | (10) |
|
Lab 11a: Windows Network Management (Net Command) |
|
|
183 | (12) |
SECTION 2 VULNERABILITIES AND THREATS-HOW CAN NETWORKS BE COMPROMISED? |
|
195 | (204) |
|
Chapter 4 SCANNING AND ENUMERATING THE NETWORK FOR TARGETS |
|
|
197 | (56) |
|
Lab 12: IPAddress and Port Scanning, Service Identity Determination |
|
|
199 | (31) |
|
Lab 12a: Nmap-IP Scanning in Windows |
|
|
201 | (8) |
|
Lab 12b: Nmap-IP Scanning in Linux |
|
|
209 | (13) |
|
Lab 13d: Researching System Vulnerabilities |
|
|
222 | (8) |
|
Lab 14: GUI-Based Vulnerability Scanners |
|
|
230 | (23) |
|
Lab 14a: NeWT-Using a Vulnerability Scanner in Windows |
|
|
231 | (8) |
|
Lab 14b: Nessus-Using a Vulnerability Scanner in Linux |
|
|
239 | (14) |
|
Chapter 5 ATTACKS-WEB SERVER, E-MAIL, DOS, AND TROJAN ATTACKS |
|
|
253 | (74) |
|
Lab 15: Web Server Exploits |
|
|
255 | (11) |
|
Lab 15a: Web Server Exploits |
|
|
256 | (10) |
|
Lab 16: E-mail System Exploits |
|
|
266 | (22) |
|
Lab 16b: Exploiting E-mail Vulnerabilities in Linux |
|
|
268 | (7) |
|
Lab 16c: Exploiting E-mail Vulnerabilities in Windows |
|
|
275 | (13) |
|
Lab 17: Denial of Service Exploits |
|
|
288 | (17) |
|
Lab 17a: Windows Denial of Service SMBDie |
|
|
289 | (5) |
|
Lab 17b: Linux Denial of Service Syn Flood |
|
|
294 | (11) |
|
|
305 | (22) |
|
Lab 18a: Using the Netbus Trojan |
|
|
306 | (8) |
|
Lab 18a2: Using the SubSeven Trojan |
|
|
314 | (13) |
|
Chapter 6 ESCALATING PRIVILEGE-SNIFFING, KEYLOGGING, PASSWORD-CRACKING ATTACKS |
|
|
327 | (72) |
|
Lab 19: Intercepting and Sniffing Network Traffic |
|
|
329 | (14) |
|
Lab 19b: Sniffing Network Traffic in Linux |
|
|
330 | (4) |
|
Lab 19c: Sniffing Network Traffic in Windows |
|
|
334 | (9) |
|
Lab 20: Keystroke Logging |
|
|
343 | (13) |
|
Lab 20a: Keystroke Logging in Windows |
|
|
344 | (4) |
|
Lab 20b: Keystroke Logging in Linux |
|
|
348 | (8) |
|
Lab 21: Password Cracking |
|
|
356 | (30) |
|
Lab 21a: Password Cracking in Windows |
|
|
358 | (5) |
|
Lab 21b: Password Cracking in Linux |
|
|
363 | (10) |
|
Lab 22c: Man-in-the-Middle Attack |
|
|
373 | (13) |
|
|
386 | (15) |
|
Lab 23a: Steganography in Windows |
|
|
387 | (12) |
SECTION 3 PREVENTION-HOW DO WE PREVENT HARM TO NETWORKS? |
|
399 | (196) |
|
Chapter 7 HARDENING THE HOST COMPUTER |
|
|
401 | (78) |
|
Lab 24: Hardening the Operating System |
|
|
403 | (37) |
|
Lab 24a: Hardening Windows 2000 |
|
|
406 | (11) |
|
|
417 | (10) |
|
Lab 25a: Windows XP Service Pack 2 |
|
|
427 | (13) |
|
Lab 26: Using Antivirus Applications |
|
|
440 | (20) |
|
Lab 26b: Antivirus in Linux |
|
|
441 | (7) |
|
Lab 26c: Antivirus in Windows |
|
|
448 | (12) |
|
|
460 | (19) |
|
Lab 27a: Personal Firewall in Windows |
|
|
461 | (8) |
|
Lab 27b: IPTables in Linux |
|
|
469 | (10) |
|
Chapter 8 SECURING NETWORK COMMUNICATIONS |
|
|
479 | (116) |
|
Lab 28: Using GPG to Encrypt and Sign E-mail |
|
|
481 | (35) |
|
Lab 28b: Using GPG in Linux |
|
|
483 | (14) |
|
Lab 28c: Using GPG in Windows |
|
|
497 | (19) |
|
Lab 29: Using Secure Shell (SSH) |
|
|
516 | (19) |
|
Lab 29b: Using Secure SHell in Linux |
|
|
518 | (6) |
|
Lab 29c: Using Secure SHell in Windows |
|
|
524 | (11) |
|
Lab 30: Using Secure Copy (SCP) |
|
|
535 | (19) |
|
Lab 30b: Using Secure Copy in Linux |
|
|
536 | (6) |
|
Lab 30c: Using Secure Copy in Windows |
|
|
542 | (12) |
|
Lab 31: Using Certificates and SSL |
|
|
554 | (26) |
|
Lab 31a: Using Certificates and SSL in Windows |
|
|
557 | (9) |
|
Lab 31b: Using Certificates and SSL in Linux |
|
|
566 | (14) |
|
|
580 | (17) |
|
Lab 32a: Using IPSec in Windows |
|
|
582 | (13) |
SECTION 4 DETECTION AND RESPONSE-HOW DO WE DETECT AND RESPOND TO ATTACKS? |
|
595 | (145) |
|
Chapter 9 PREPARING FOR AND DETECTING ATTACKS |
|
|
597 | (100) |
|
Lab 33: System Log File Analysis |
|
|
599 | (20) |
|
Lab 33a: Log Analysis in Windows |
|
|
600 | (8) |
|
Lab 33b: Log Analysis in Linux |
|
|
608 | (11) |
|
Lab 34: Intrusion Detection Systems |
|
|
619 | (27) |
|
Lab 34a: Using Intrusion Detection Systems in Windows (Snort) |
|
|
620 | (12) |
|
Lab 34b: Using Intrusion Detection Systems in Linux (Snort) |
|
|
632 | (14) |
|
|
646 | (15) |
|
Lab 35a: Using Honeypots in Windows |
|
|
647 | (14) |
|
Lab 36: Detecting Spyware |
|
|
661 | (14) |
|
Lab 36d: Spyware Detection and Removal in Windows |
|
|
662 | (13) |
|
Lab 37: Backing Up and Restoring |
|
|
675 | (22) |
|
Lab 37a: Backing up and Restoring in Windows |
|
|
677 | (10) |
|
Lab 37b: Backing up and Restoring in Linux |
|
|
687 | (10) |
|
Chapter 10 DIGITAL FORENSICS |
|
|
697 | (43) |
|
Lab 38: Initial Response-Incident Determination |
|
|
700 | (15) |
|
Lab 38a: Initial Response-Incident Determination |
|
|
701 | (14) |
|
Lab 39: Acquiring the Data |
|
|
715 | (13) |
|
Lab 39a: Acquiring the Data |
|
|
716 | (12) |
|
Lab 40: Forensic Analysis |
|
|
728 | (12) |
|
Lab 40a: Forensic Analysis |
|
|
730 | (10) |
Appendix LAB SETUP INSTRUCTIONS |
|
740 | |