Amazon no longer offers textbook rentals. We do!

Gray Hat Hacking : The Ethical Hacker's Handbook

by: HARRIS SHON

Gray Hat Hacking : The Ethical Hacker's Handbook

by: HARRIS SHON

ISBN 13:
9780072257090
ISBN 10:
0072257091
Edition: 1st
Format: Paperback
Copyright: 11/09/2004
Publisher: MCGRAW-HILL PROFESSIONAL
Newer Edition

Rent

Sorry, this item is currently unavailable.

Note: Supplemental materials are not guaranteed with Rental or Used book purchases.

Extend or Purchase Your Rental at Any Time

Need to keep your rental past your due date? At any time before your due date you can extend or purchase your rental through your account.

Summary

Analyze your company's vulnerability to hacks with expert guidance from Gray Hat Hacking: The Ethical Hacker's Handbook. Discover advanced security tools and techniques such as fuzzing, reverse engineering, and binary scanning. Test systems using both passive and active vulnerability analysis. Learn to benefit from your role as a gray hat. Review ethical and legal issues and case studies. This unique resource provides leading-edge technical information being utilized by the top network engineers, security auditors, programmers, and vulnerability assessors. Plus, the book offers in-depth coverage of ethical disclosure and provides a practical course of action for those who find themselves in a "disclosure decision" position.

Foreward

xvii

Introduction

ixx

Part I Introduction to Ethical Disclosure

(70)

Ethics of Ethical Hacking

(20)

References

(1)

How Does This Stuff Relate to an Ethical Hacking Book?

(3)

Vulnerability Assessment

(1)

Penetration Testing

(1)

References

(1)

The Controversy of Hacking Books and Classes

(5)

The Dual Nature of Tools

(2)

References

(1)

Recognizing Trouble When It Happens

(1)

Emulating the Attack

(1)

Where Do Attackers Have Most of Their Fun?

(2)

Security Does Not Like Complexity

(1)

References

(1)

Summary

(5)

Questions

(2)

Answers

(3)

Ethical Hacking and the Legal System

(22)

References

(1)

Addressing Individual Laws

(15)

18 USC Section 1029

(3)

References

(1)

18 USC Section 1030

(5)

References

(1)

A State Law Alternative

(2)

References

(1)

18 USC Sections 2510 and 2701

(2)

References

(1)

Digital Millennium Copyright Act

(1)

References

(1)

Cyber Security Enhancement Act of 2002

(1)

Summary

(6)

Questions

(2)

Answers

(3)

Proper and Ethical Disclosure

(26)

Different Teams and Points of View

(2)

How Did We Get Here?

(1)

CERT's Current Process

(2)

Full Disclosure Policy (RainForest Puppy Policy)

(1)

Organization for Internet Safety (OIS)

(8)

Discovery

(1)

Notification

(2)

Validation

(3)

Resolution

(1)

Release

(1)

Conflicts Will Still Exist

(1)

Case Studies

(5)

Pros and Cons of Proper Disclosure Processes

(4)

Vendors Paying More Attention

(1)

So What Should We Do from Here on Out?

(6)

iDefense

(1)

References

(1)

Summary

(1)

Questions

(2)

Answers

(2)

Part II Penetration Testing and Tools

(110)

Pen-Testing Process

(22)

Types of Tests

(2)

References

(1)

Ramping Up

(3)

Building a Team

(1)

Building a Lab

(1)

Contracts, Safety, and Staying Out of Jail

(1)

Assessment Process

(12)

Assessment Planning

(1)

On-Site Meeting with the Customer to Kick Off Assessment

(1)

Penetration Test Process

(2)

References

(1)

Red Teaming Process

(3)

System Test Process

(2)

Footprinting with Isof

(3)

References

(1)

Reporting Out

(1)

Summary

(5)

Questions

(1)

Answers

(3)

Beyond Hacking Exposed: Advanced Tools for Today's Hacker

(58)

Scanning in the ``Good Old Days''

(12)

Paketto Keiretsu (scanrand, paratrace)

(11)

References

107

(1)

Past and Present Forms of Fingerprinting

108

(17)

xprobe2

109

(5)

References

114

(1)

pOf

114

(4)

References

118

(1)

amap

118

(4)

References

122

(1)

Winfingerprint

122

(3)

Sniffing Tools

125

(15)

libpcap and WinPcap

126

(1)

References

127

(1)

Passive Sniffing vs. Active Sniffing

127

(7)

References

134

(3)

References

137

(1)

Defenses Against Active Sniffing

137

(1)

Sniffing for Usernames and Passwords

138

(1)

References

139

(1)

Sniffing and Hacking LAN Manager Logon Credentials

140

(8)

Using the Challenge and Hashes (the Hard Way)

143

(1)

Using ettercap (the Easy Way)

144

(2)

References

146

(1)

Sniffing and Cracking Kerberos

146

(2)

Summary

148

(5)

Questions

150

(1)

Answers

151

(2)

Automated Penetration Testing

153

(28)

Python Survival Skills

154

(7)

Getting Python

154

(1)

Hello, World

154

(1)

Python Objects

155

(5)

References

160

(1)

Automated Penetration Testing Tools

161

(16)

Core IMPACT

161

(3)

References

164

(1)

Immunity CANVAS

165

(4)

References

169

(1)

Metasploit

169

(8)

References

177

(1)

Summary

177

(4)

Questions

177

(2)

Answers

179

(2)

Part III Exploits 101

181

(136)

Programming Survival Skills

183

(30)

Programming

184

(4)

The Problem-Solving Process

184

(1)

Pseudo-code

185

(2)

Programmers vs. Hackers

187

(1)

References

188

(1)

C Programming Language

188

(6)

Basic C Language Constructs

188

(5)

Sample Program

193

(1)

Compiling with gcc

193

(1)

References

194

(1)

Computer Memory

194

(5)

Random Access Memory (RAM)

195

(1)

Endian

195

(1)

Segmentation of Memory

195

(1)

Programs in Memory

196

(1)

Buffers

197

(1)

Strings in Memory

197

(1)

Pointers

197

(1)

Putting the Pieces of Memory Together

198

(1)

References

198

(1)

Intel Processors

199

(3)

Registers

199

(1)

Arithmetic Logic Unit (ALU)

199

(1)

Program Counter

200

(1)

Control Unit

200

(1)

Buses

200

(2)

References

202

(1)

Assembly Language Basics

202

(4)

Machine vs. Assembly vs. C

202

(1)

AT&T vs. NASM

202

(2)

Addressing Modes

204

(1)

Assembly File Structure

205

(1)

Assembling

206

(1)

References

206

(1)

Debugging with gdb

206

(3)

gdb Basics

206

(2)

Disassembly with gdb

208

(1)

References

209

(1)

Summary

209

(4)

Questions

210

(2)

Answers

212

(1)

Basic Linux Exploits

213

(26)

Stack Operations

213

(3)

Stack Data Structure

214

(1)

Operational Implementation

214

(1)

Function Calling Procedure

214

(1)

References

215

(1)

Buffer Overflows

216

(5)

Example Buffer Overflow

216

(1)

Overflow of meet.c

217

(3)

Ramifications of Buffer Overflows

220

(1)

References

221

(1)

Local Buffer Overflow Exploits

221

(8)

Components of the Exploit

222

(1)

Exploiting Stack Overflows by Command Line

223

(2)

Exploiting Stack Overflows with Generic Exploit Code

225

(1)

Exploitation of meet.c

226

(1)

Exploiting Small Buffers

227

(2)

References

229

(1)

Remote Buffer Overflow Exploits

229

(5)

Client/Server Model

229

(3)

Determining the Remote esp Value

232

(1)

Manual Brute Force with Perl

232

(2)

References

234

(1)

Summary

234

(5)

Questions

235

(2)

Answers

237

(2)

Advance Linux Exploits

239

(30)

Format String Exploits

239

(11)

The Problem

240

(3)

Reading from Arbitrary Memory

243

(2)

Writing to Arbitrary Memory

245

(2)

Taking .dtors to root

247

(3)

References

250

(1)

Heap Overflow Exploits

250

(12)

Heap Overflows

251

(1)

Memory Allocators (malloc)

252

(1)

dlmalloc

253

(4)

Exploiting Heap Overflows

257

(4)

Alternative Exploits

261

(1)

References

261

(1)

Memory Protection Schemes

262

(2)

Libsafe

262

(1)

GRSecurity Kernel Patches and Scripts

262

(1)

Stackshield

263

(1)

Bottom Line

263

(1)

References

264

(1)

Summary

264

(5)

Questions

265

(2)

Answers

267

(2)

Writing Linux Shellcode

269

(26)

Basic Linux Shellcode

269

(10)

System Calls

270

(2)

Exit System Call

272

(2)

setreuid System Call

274

(2)

Shell-Spawning Shellcode with execve

276

(3)

References

279

(1)

Port-Binding Shellcode

279

(8)

Linux Socket Programming

279

(3)

Assembly Program to Establish a Socket

282

(2)

Test the Shellcode

284

(3)

References

287

(1)

Reverse Connecting Shellcode

287

(3)

Reverse Connecting C Program

287

(1)

Reverse Connecting Assembly Program

288

(2)

References

290

(1)

Summary

290

(5)

Questions

292

(2)

Answers

294

(1)

Writing a Basic Windows Exploit

295

(22)

Compiling and Debugging Windows Programs

295

(18)

Compiling on Windows

295

(2)

Debugging on Windows

297

(9)

Building a Basic Windows Exploit

306

(7)

Summary

313

(4)

Questions

314

(1)

Answers

315

(2)

Part IV Vulnerability Analysis

317

(94)

Passive Analysis

319

(30)

Ethical Reverse Engineering

319

(1)

References

320

(1)

Why Reverse Engineering?

320

(1)

Reverse Engineering Considerations

321

(1)

Source Code Analysis

321

(8)

Source Code Auditing Tools

322

(1)

The Utility of Source Code Auditing Tools

323

(2)

Manual Source Code Auditing

325

(4)

References

329

(1)

Binary Analysis

329

(1)

Automated Binary Analysis Tools

329

(16)

References

332

(1)

Manual Auditing of Binary Code

332

(13)

References

345

(1)

Summary

345

(4)

Questions

346

(1)

Answers

347

(2)

Advanced Reverse Engineering

349

(26)

Why Try to Break Software?

350

(1)

The Software Development Process

350

(1)

Instrumentation Tools

351

(10)

Debuggers

352

(2)

Code Coverage Tools

354

(1)

Profiling Tools

354

(1)

Flow Analysis Tools

354

(2)

Memory Monitoring Tools

356

(5)

References

361

(1)

Fuzzing

361

(1)

Instrumented Fuzzing Tools and Techniques

362

(9)

A Simple URL Fuzzer

362

(3)

Fuzzing Unknown Protocols

365

(1)

SPIKE

365

(4)

SPIKE Proxy

369

(1)

Sharefuzz

369

(1)

References

370

(1)

Summary

371

(4)

Questions

371

(2)

Answers

373

(2)

From Vulnerability to Exploit

375

(22)

Exploitability

376

(4)

Debugging for Exploitation

376

(4)

References

380

(1)

Understanding the Problem

380

(10)

Preconditions and Postconditions

380

(1)

Repeatability

381

(9)

References

390

(1)

Documenting the Problem

390

(1)

Background Information

390

(1)

Circumstances

391

(1)

Research Results

391

(1)

Summary

391

(6)

Questions

392

(2)

Answers

394

(3)

Closing the Holes: Mitigation

397

(14)

Mitigation Alternatives

397

(3)

Port Knocking

398

(1)

References

398

(1)

Migration

398

(1)

References

399

(1)

Patching

400

(11)

Source Code Patching Considerations

400

(2)

Binary Patching Considerations

402

(4)

References

406

(1)

Summary

406

(1)

Questions

406

(2)

Answers

408

(3)

Index

411

Amazon no longer offers textbook rentals. We do!

Gray Hat Hacking : The Ethical Hacker's Handbook

Gray Hat Hacking : The Ethical Hacker's Handbook

9780072257090

0072257091

Summary

Author Biography

Table of Contents

Supplemental Materials

Write a Review

Amazon no longer offers textbook rentals. We do!

Gray Hat Hacking : The Ethical Hacker's Handbook

Gray Hat Hacking : The Ethical Hacker's Handbook

9780072257090

0072257091

Summary

Author Biography

Table of Contents

Supplemental Materials

Write a Review

Related Products