Open Space Ranchi

Ethical Hacking and Countermeasures (312-50)

• The exam codes EC0-350 are 312-50 are the same exam.
• The exam title "Certified Ethical Hacker" and "Ethical Hacking and Countermeasures" are the same
• VUE and Prometric systems use different exam codes.
• The CEHv4 exam has been retired since June 1st 2007
• CEHv5 exam is available on Prometric Prime, APTC and VUE.
• Exams at VUE and Prometric APTC requires Eligibility Code.
• Please visit :
• http://www.eccouncil.org/takeexam.htm for details
•
• Credit Towards Certification

Certified Ethical Hacker
Master of Security Science (MSS)
Skills Measured
The Exam 312-50 tests CEH candidates on the following 22 domains.
1. Ethics and Legal Issues
2. Footprinting
3. Scanning
4. Enumeration
5. System Hacking
6. Trojans and Backdoors
7. Sniffers
8. Denial of Service
9. Social Engineering
10. Session Hijacking
11. Hacking Web Servers
12. Web Application Vulnerabilities
13. Web Based Password Cracking Techniques
14. SQL Injection
15. Hacking Wireless Networks
16. Virus and Worms
17. Physical Security
18. Hacking Linux
19. IDS, Firewalls and Honeypots
20. Buffer Overflows
21. Cryptography
22. Penetration Testing Methodologies

Skills Measured
The Exam 312-50 tests CEH candidates on the following 22 domains.
1. Ethics and Legal Issues
2. Footprinting
3. Scanning
4. Enumeration
5. System Hacking
6. Trojans and Backdoors
7. Sniffers
8. Denial of Service
9. Social Engineering
10. Session Hijacking
11. Hacking Web Servers
12. Web Application Vulnerabilities
13. Web Based Password Cracking Techniques
14. SQL Injection
15. Hacking Wireless Networks
16. Virus and Worms
17. Physical Security
18. Hacking Linux
19. IDS, Firewalls and Honeypots
20. Buffer Overflows
21. Cryptography
22. Penetration Testing Methodologies
Ethics and Legality
 Ethics and Legality
 Understand Ethical Hacking terminology
 Define the Job role of an ethical hacker
 Understand the different phases involved in ethical hacking
 Identify different types of hacking technologies
 List the 5 stages of ethical hacking?
 What is hacktivism?
 List different types of hacker classes
 Define the skills required to become an ethical hacker
 What is vulnerability research?
 Describe the ways in conducting ethical hacking
 Understand the Legal implications of hacking
 Understand 18 U.S.C. § 1030 US Federal Law
Footprinting
 Define the term Footprinting
 Describe information gathering methodology
 Describe competitive intelligence
 Understand DNS enumeration
 Understand Whois, ARIN lookup
 Identify different types of DNS records
 Understand how traceroute is used in Footprinting
 Understand how e-mail tracking works
 Understand how web spiders work
Scanning
 Define the term port scanning, network scanning and vulnerability scanning
 Understand the CEH scanning methodology
 Understand Ping Sweep techniques
 Understand nmap command switches
 Understand SYN, Stealth, XMAS, NULL, IDLE and FIN scans
 List TCP communication flag types
 Understand War dialing techniques
 Understand banner grabbing and OF fingerprinting techniques
 Understand how proxy servers are used in launching an attack
 How does anonymizers work
 Understand HTTP tunneling techniques
 Understand IP spoofing techniques
Enumeration
 What is Enumeration?
 What is meant by null sessions
 What is SNMP enumeration?
 What are the steps involved in performing enumeration?
System hacking
 Understanding password cracking techniques
 Understanding different types of passwords
 Identifying various password cracking tools
 Understand Escalating privileges
 Understanding keyloggers and other spyware technologies
 Understand how to Hide files
 Understanding rootkits
 Understand Steganography technologies
 Understand how to covering your tracks and erase evidences
Trojans and Backdoors
 What is a Trojan?
 What is meant by overt and covert channels?
 List the different types of Trojans
 What are the indications of a Trojan attack?
 Understand how “Netcat” Trojan works
 What is meant by “wrapping”
 How does reverse connecting Trojans work?
 What are the countermeasure techniques in preventing Trojans?
 Understand Trojan evading techniques
Sniffers
 Understand the protocol susceptible to sniffing
 Understand active and passive sniffing
 Understand ARP poisoning
 Understand ethereal capture and display filters
 Understand MAC flooding
 Understand DNS spoofing techniques
 Describe sniffing countermeasures
Denial of Service
 Understand the types of DoS Attacks
 Understand how DDoS attack works
 Understand how BOTs/BOTNETS work
 What is “smurf” attack
 What is “SYN” flooding
 Describe the DoS/DDoS countermeasures
Social Engineering
 What is Social Engineering?
 What are the Common Types of Attacks
 Understand Dumpster Diving
 Understand Reverse Social Engineering
 Understand Insider attacks
 Understand Identity Theft
 Describe Phishing Attacks
 Understand Online Scams
 Understand URL obfuscation
 Social Engineering countermeasures
Session Hijacking
 Understand Spoofing vs. Hijacking
 List the types of Session Hijacking
 Understand Sequence Prediction
 What are the steps in performing session hijacking
 Describe how you would prevent session hijacking
Hacking Web Servers
 List the types of web server vulnerabilities
 Understand the attacks Against Web Servers
 Understand IIS Unicode exploits
 Understand patch management techniques
 Understand Web Application Scanner
 What is Metasploit Framework?
 Describe Web Server hardening methods
Web Application Vulnerabilities
 Understanding how web application works
 Objectives of web application hacking
 Anatomy of an attack
 Web application threats
 Understand Google hacking
 Understand Web Application Countermeasures
Web Based Password Cracking Techniques
 List the Authentication types
 What is a Password Cracker?
 How does a Password Cracker work?
 Understand Password Attacks - Classification
 Understand Password Cracking Countermeasures
SQL Injection
 What is SQL injection?
 Understand the Steps to conduct SQL injection
 Understand SQL Server vulnerabilities
 Describe SQL Injection countermeasures
Wireless Hacking
 Overview of WEP, WPA authentication systems and cracking techniques
 Overview of wireless Sniffers and SSID, MAC Spoofing
 Understand Rogue Access Points
 Understand Wireless hacking techniques
 Describe the methods in securing wireless networks
Virus and Worms
 Understand the difference between an virus and a Worm
 Understand the types of Viruses
 How a virus spreads and infects the system
 Understand antivirus evasion techniques
 Understand Virus detection methods
Physical Security
 Physical security breach incidents
 Understanding physical security
 What is the need for physical security?
 Who is accountable for physical security?
 Factors affecting physical security
Linux Hacking
 Understand how to compile a Linux Kernel
 Understand GCC compilation commands
 Understand how to install LKM modules
 Understand Linux hardening methods
Evading IDS, Honeypots and Firewalls
 List the types of Intrusion Detection Systems and evasion techniques
 List firewall and honeypot evasion techniques
Buffer Overflows
 Overview of stack based buffer overflows
 Identify the different types of buffer overflows and methods of detection
 Overview of buffer overflow mutation techniques
Cryptography
 Overview of cryptography and encryption techniques
 Describe how public and private keys are generated
 Overview of MD5, SHA, RC4, RC5, Blowfish algorithms
Penetration Testing Methodologies
 Overview of penetration testing methodologies
 List the penetration testing steps
 Overview of the Pen-Test legal framework
 Overview of the Pen-Test deliverables
 List the automated penetration testing tools

Course Outline Version 5
Module 1: Introduction to Ethical Hacking
 Why Security?
 Essential Terminologies
 Elements of Security
 The Security, Functionality, and Ease of Use Triangle
 What Does a Malicious Hacker Do?
o Reconnaissance
o Scanning
o Gaining access
o Maintaining access
o Covering Tracks
 Types of Hacker Attacks
o Operating System attacks
o Application-level attacks
o Shrink Wrap code attacks
o Misconfiguration attacks
 Hacktivism
 Hacker Classes
 Hacker Classes and Ethical Hacking
 What Do Ethical Hackers Do?
 Can Hacking be Ethical?
 How to Become an Ethical Hacker?
 Skill Profile of an Ethical Hacker
 What is Vulnerability Research?
 Why Hackers Need Vulnerability Research?
 Vulnerability Research Tools
 Vulnerability Research Websites
 How to Conduct Ethical Hacking?
 Approaches to Ethical Hacking
 Ethical Hacking Testing
 Ethical Hacking Deliverables
 Computer Crimes and Implications
 Legal Perspective
o U.S. Federal Law
o Japan’s Cyber Laws
o United Kingdom’s Cyber Laws
o Australia’s Cyber Laws
o Germany’s Cyber Laws
o Singapore’s Cyber Laws

Module 2: Footprinting
 Revisiting Reconnaissance
 Defining of Footprinting
 Information Gathering Methodology
 Unearthing Initial Information
 Finding a Company’s URL
 Internal URL
 Extracting Archive 0f a Website
 Google Search for Company’s Info.
 People Search
 Footprinting Through Job Sites
 Passive Information Gathering
 Competitive Intelligence Gathering
 Why Do You Need Competitive Intelligence?
 Companies Providing Competitive Intelligence Services
 Competitive Intelligence
o When Did This Company Begin?
o How Did It Develop?
o What Are This Company's Plans?
o What Does Expert Opinion Say About The Company?
o Who Are The Leading Competitors?
 Public and Private Websites
 Tools
o DNS Enumerator
o SpiderFoot
o Sensepost Footprint Tools
• BiLE.pl
• BiLE-weigh.pl
• tld-expand.pl
• vet-IPrange.pl
• qtrace.pl
• vet-mx.pl
• jarf-rev
• jarf-dnsbrute
o Wikito Footprinting Tool
o Web Data Extractor Tool
o Whois
o Nslookup
o Necrosoft
o ARIN
o Traceroute
o Neo Trace
o GEOSpider
o Geowhere
o GoogleEarth
o VisualRoute Trace
o Kartoo Search Engine
o Touchgraph Visual Browser
o SmartWhois
o VisualRoute Mail Tracker
o eMailTrackerPro
o Read Notify
o HTTrack Web Site Copier
o Web Ripper
o robots.txt
o Website watcher
o E-mail Spider
o Power E-mail Collector Tool
 Steps to Perform Footprinting

Module 3: Scanning
 Definition of Scanning
 Types of Scanning
o Port Scanning
o Network Scanning
o Vulnerability Scanning
 Objectives of Scanning
 CEH Scanning Methodology
o Check for live systems
• ICMP Scanning
• Angry IP
• HPING2
• Ping Sweep
• Firewalk
o Check for open ports
• Nmap
• TCP Communication Flags
• Three Way Handshake
• SYN Stealth / Half Open Scan
• Stealth Scan
• Xmas Scan
• FIN Scan
• NULL Scan
• IDLE Scan
• ICMP Echo Scanning/List Scan
• TCP Connect / Full Open Scan
• FTP Bounce Scan
• FTP Bounce Attack
• SYN/FIN Scanning Using IP Fragments
• UDP Scanning
• Reverse Ident Scanning
• RPC Scan
• Window Scan
• Blaster Scan
• PortScan Plus, Strobe
• IPSecScan
• NetScan Tools Pro
• WUPS – UDP Scanner
• SuperScan
• IPScanner
• MegaPing
• Global Network Inventory Scanner
• Net Tools Suite Pack
• FloppyScan
• War Dialer Technique
• Why War Dialing?
• Wardialing
• PhoneSweep
• THC Scan
• SandTrap Tool
o Banner grabbing/OS Fingerprinting
• OS Fingerprinting
• Active Stack Fingerprinting
• Passive Fingerprinting
• Active Banner Grabbing Using Telnet
• GET REQUESTS
• p0f – Banner Grabbing Tool
• p0f for Windows
• Httprint Banner Grabbing Tool
• Active Stack Fingerprinting
• XPROBE2
• RING V2
• Netcraft
• Disabling or Changing Banner
• Apache Server
• IIS Server
• IIS Lockdown Tool
• ServerMask
• Hiding File Extensions
• PageXchanger 2.0
o Identify Service
o Scan for Vulnerability
• Bidiblah Automated Scanner
• Qualys Web-based Scanner
• SAINT
• ISS Security Scanner
• Nessus
• GFI LANGuard
• SATAN (Security Administrator’s Tool for Analyzing Networks)
• Retina
• NIKTO
• SAFEsuite Internet Scanner
• IdentTCPScan
o Draw network diagrams of Vulnerable hosts
• Cheops
• FriendlyPinger
o Prepare proxies
• Proxy Servers
• Use of Proxies for Attack
• SocksChain
• Proxy Workbench
• ProxyManager Tool
• Super Proxy Helper Tool
• Happy Browser Tool (Proxy-based)
• MultiProxy
• TOR Proxy Chaining Software
o Anonymizers
• Primedius Anonymizer
• Browzar
• Torpark Browser
• G-Zapper - Google Cookies
o SSL Proxy Tool
o HTTP Tunneling Techniques
o HTTPort
o Spoofing IP Address - Source Routing
o Detecting IP Spoofing
o Despoof Tool
o Scanning Countermeasures
o Tool: SentryPC


Module 4: Enumeration
 Overview of System Hacking Cycle
 What is Enumeration?
 Techniques for Enumeration
 Netbios Null Sessions
 Tool
o DumpSec
o NetBIOS Enumeration Using Netview
o Nbtstat
o SuperScan4
o Enum
o sid2user
o user2sid
o GetAcct
 Null Session Countermeasures
 PSTools
o PsExec
o PsFile
o PsGetSid
o PsKill
o PsInfo
o PsList
o PsLoggedOn
o PsLogList
o PsPasswd
o PsService
o PsShutdown
o PsSuspend
o PsUptime
 SNMP Enumeration
 Management Information Base
 Tools
o SNMPutil
o Solarwinds
o SNScan V1.05
o Getif SNMP MIB Browser
 UNIX Enumeration
 SNMP UNIX Enumeration
 SNMP Enumeration Countermeasures
 Tools
o Winfingerprint
o Windows Active Directory Attack Tool
o IP Tools Scanner
o Enumerate Systems Using Default Passwords
 Steps to Perform Enumeration

Module 5: System Hacking
 Cracking Passwords
o Password Types
o Types of Password Attacks
o Passive Online – Wire Sniffing
o Passive Online Attacks
o Active Online – Password Guessing
o Offline Attacks
• Dictionary Attack
• Hybrid Attack
• Brute-force Attack
• Pre-computed Hashes
o Non-Technical Attacks
o Password Mitigation
o Permanent Account Lockout – Employee Privilege Abuse
o Administrator Password Guessing
o Manual Password Cracking Algorithm
o Automatic Password Cracking Algorithm
o Performing Automated Password Guessing
o Tools
• NAT
• Smbbf (SMB Passive Brute Force Tool)
• SmbCrack Tool
• Legion
• LOphtcrack
o Microsoft Authentication - LM, NTLMv1, and NTLMv2
o Kerberos Authentication
o What is LAN Manager Hash?
o Salting
o Tools
• PWdump2 and Pwdump3
• Rainbowcrack
• KerbCrack
• NBTDeputy
• NetBIOS DoS Attack
• John the Ripper
o Password Sniffing
o How to Sniff SMB Credentials?
o Sniffing Hashes Using LophtCrack
o Tools
• ScoopLM
• SMB Replay Attacks
• Replay Attack Tool: SMBProxy
• Hacking Tool: SMB Grind
• Hacking Tool: SMBDie
o SMBRelay Weaknesses & Countermeasures
o Password Cracking Countermeasures
o LM Hash Backward Compatibility
o How to Disable LM HASH?
o Tools
• Password Brute-Force Estimate Tool
• Syskey Utility
 Escalating Privileges
o Privilege Escalation
o Cracking NT/2000 Passwords
o Active@ Password Changer
o Change Recovery Console Password
o Privilege Escalation Tool: x.exe
 Executing applications
o Tool:
• Psexec
• Remoexec
• Alchemy Remote Executor
• Keystroke Loggers
• E-mail Keylogger
• Spytector FTP Keylogger
• IKS Software Keylogger
• Ghost Keylogger
• Hardware Keylogger
• Keyboard Keylogger: KeyGhost Security Keyboard
• USB Keylogger:KeyGhost USB Keylogger
o What is Spyware?
o Tools
• Spyware: Spector
• Remote Spy
• eBlaster
• Stealth Voice Recorder
• Stealth Keylogger
• Stealth Website Logger
• Digi-Watcher Video Surveillance
• Desktop Spy Screen Capture Program
• Telephone Spy
• Print Monitor Spy Tool
• Perfect Keylogger
• Stealth Email Redirector
• Spy Software: Wiretap Professional
• Spy Software: FlexiSpy
• PC PhoneHome
o Keylogger Countermeasures
o Anti-Keylogger
o PrivacyKeyboard
 Hiding Files
o Hacking Tool: RootKit
o Why Rootkits?
o Rootkits in Linux
o Detecting Rootkits
o Rootkit Detection Tools
• BlackLight from F-Secure Corp
• RootkitRevealer from Sysinternals
• Malicious Software Removal Tool from Microsoft Corp
o Sony Rootkit Case Study
o Planting the NT/2000 Rootkit
o Rootkits
• Fu
• AFX Rootkit 2005
• Nuclear
• Vanquish
o Rootkit Countermeasures
o Patchfinder2.0
o RootkitRevealer
o Creating Alternate Data Streams
o How to Create NTFS Streams?
o NTFS Stream Manipulation
o NTFS Streams Countermeasures
o NTFS Stream Detectors
• ADS Spy
• ADS Tools
o What is Steganography?
o Tools
• Merge Streams
• Invisible Folders
• Invisible Secrets 4
• Image Hide
• Stealth Files
• Steganography
• Masker Steganography Tool
• Hermetic Stego
• DCPP – Hide an Operating System
• Camera/Shy
• Mp3Stego
• Snow.exe
o Video Steganography
o Steganography Detection
o SIDS ( Stego intrusion detection system )
o High-Level View
o Tool : dskprobe.exe
 Covering tracks
o Disabling Auditing
o Clearing the Event Log
o Tools
• elsave.exe
• Winzapper
• Evidence Eliminator
• Traceless
• Tracks Eraser Pro
• ZeroTracks

Module 6: Trojans and Backdoors
 Introduction
 Effect on Business
 What is a Trojan?
 Overt and Covert Channels
 Working of Trojans
 Different Types of Trojans
 What Do Trojan Creators Look For?
 Different Ways a Trojan Can Get into a System
 Indications of a Trojan Attack
 Ports Used by Trojans
 How to Determine which Ports are “Listening”?
 Classic Trojans Found in the Wild
 Trojans
o Tini
o iCmd
o NetBus
o Netcat
o Beast
o MoSucker
o Proxy Server
o SARS Trojan Notification
 Wrappers
 Wrapper Covert Program
 Wrapping Tools
o One file EXE Maker
o Yet Another Binder
o Pretator Wrapper
 Packaging Tool: WordPad
 RemoteByMail
 Tool: Icon Plus
 Defacing Application: Restorator
 HTTP Trojans
 Trojan Attack through Http
 HTTP Trojan (HTTP RAT)
 Shttpd Trojan - HTTP Server
 Reverse Connecting Trojans
 Nuclear RAT Trojan (Reverse Connecting)
 Tool: BadLuck Destructive Trojan
 ICMP Tunneling
 ScreenSaver Password Hack Tool – Dummylock
 Trojan
o Phatbot
o Amitis
o Senna Spy
o QAZ
o Back Orifice
o Back Oriffice 2000
o SubSeven
o CyberSpy Telnet Trojan
o Subroot Telnet Trojan
o Let Me Rule! 2.0 BETA 9
o Donald Dick
o RECUB
 Hacking Tool: Loki
 Atelier Web Remote Commander
 Trojan Horse Construction Kit
 How to Detect Trojans?
 Tools
o Netstat
o fPort
o TCPView
o CurrPorts
o Process Viewer
o What’s on My Computer
o Super System Helper
 Delete Suspicious Device Drivers
 Inzider - Tracks Processes and Ports
 Tools
o What's Running?
o MSConfig
o Registry-What’s Running
o Autoruns
o Hijack This (System Checker)
o Startup List
 Anti-Trojan Software
 Evading Anti-Virus Techniques
 Evading Anti-Trojan/Anti-Virus Using Stealth Tools v2.0
 Backdoor Countermeasures
 Tools
o Tripwire
o System File Verification
o MD5sum.exe
o Microsoft Windows Defender
 How to Avoid a Trojan Infection?

Module 7: Sniffers
 Definition of Sniffing
 Protocols Vulnerable to Sniffing
o Tool: Network View – Scans the Network for Devices
o The Dude Sniffer
o Ethereal
o tcpdump
 Types of Sniffing
o Passive Sniffing
o Active sniffing
 ARP - What is Address Resolution Protocol?
 ARP Spoofing Attack
o How Does ARP Spoofing Work?
o ARP Poisoning
o Mac Duplicating Attack
 Tools for ARP Spoofing
o Arpspoof (Linux-based tool)
o Ettercap (Linux and Windows)
 MAC Flooding
 Tools for MAC Flooding
o Macof (Linux-based tool)
o Etherflood (Linux and Windows)
 Threats of ARP Poisoning
 IRS – ARP Attack Tool
 ARPWorks Tool
 Tool: Nemesis
 Sniffer Hacking Tools (dsniff package)
o Arpspoof
o Dnsspoof
o Dsniff
o Filesnarf
o Mailsnarf
o Msgsnarf
o Tcpkill
o Tcpnice
o Urlsnarf
o Webspy
o Webmitm
 DNS Poisoning Techniques
 Types of DNS Poisoning:
o Intranet DNS Spoofing (Local network)
o Internet DNS Spoofing (Remote network)
o Proxy Server DNS Poisoning
o DNS Cache Poisoning
 Interactive TCP Relay
 Sniffers
o HTTP Sniffer: EffeTech
o Ace Password Sniffer
o MSN Sniffer
o SmartSniff
o Session Capture Sniffer: NetWitness
o Session Capture Sniffer: NWreader
o Cain and Abel
o Packet Crafter Craft Custom TCP/IP Packets
o SMAC
o NetSetMan Tool
o Raw Sniffing Tools
o Sniffit
o Aldebaran
o Hunt
o NGSSniff
o Ntop
o Pf
o IPTraf
o EtherApe
o Netfilter
o Network Probe
o Maa Tec Network Analyzer
 Tools
o Snort
o Windump
o Etherpeek
o Mac Changer
o Iris
o NetIntercept
o WinDNSSpoof
 How to Detect Sniffing?
 AntiSniff Tool
 ArpWatch Tool
 Countermeasures


Module 8: Denial of Service
 What are Denial of Service Attacks?
 Goal of DoS
 Impact and the Modes of Attack
 Types of Attacks
o DoS attack
o DDos attack
 DoS Attack Classification
o Smurf
o Buffer Overflow Attack
o Ping of death
o Teardrop
o SYN Attack
 DoS Attack Tools
o Jolt2
o Bubonic.c
o Land and LaTierra
o Targa
o Blast20
o Nemesy
o Panther2
o Crazy Pinger
o Some Trouble
o UDP Flood
o FSMax
 Botnets
 Uses of botnets
 Types of Bots
o Agobot/Phatbot/Forbot/XtremBot
o SDBot/RBot/UrBot/UrXBot
o mIRC-based Bots - GT-Bots
 Tool: Nuclear Bot
 What is DDoS Attack?
 Characteristics of DDoS Attacks
 DDOS Unstoppable
 Agent Handler Model
 DDoS IRC based Model
 DDoS Attack Taxonomy
 Amplification Attack
 Reflective DNS Attacks
 Reflective DNS Attacks Tool: ihateperl.pl
 DDoS Tools
o Trin00
o Tribe Flood Network (TFN)
o TFN2K
o Stacheldraht
o Shaft
o Trinity
o Knight
o Mstream
o Kaiten
 Worms
 Slammer Worm
 Spread of Slammer Worm – 30 min
 MyDoom.B
 SCO Against MyDoom Worm
 How to Conduct a DDoS Attack
 The Reflected DoS Attacks
 Reflection of the Exploit
 Countermeasures for Reflected DoS
 DDoS Countermeasures
 Taxonomy of DDoS Countermeasures
 Preventing Secondary Victims
 Detect and Neutralize Handlers
 Detect Potential Attacks
 Mitigate or Stop the Effects of DDoS Attacks
 Deflect Attacks
 Post-attack Forensics
 Packet Traceback

Module 9: Social Engineering
 What is Social Engineering?
 Human Weakness
 “Rebecca” and “Jessica”
 Office Workers
 Types of Social Engineering
o Human-based
o Computer-based
 Preventing Insider Threat
 Common Targets of Social Engineering
 Factors that make Companies Vulnerable to Attacks
 Why is Social Engineering Effective?
 Warning Signs of an Attack
 Tool : Netcraft Anti-Phishing Toolbar
 Phases in a Social Engineering Attack
 Behaviors Vulnerable to Attacks
 Impact on the Organization
 Countermeasures
 Policies and Procedures
 Security Policies - Checklist
 Phishing Attacks and Identity Theft
 What is Phishing?
 Phishing Report
 Attacks
 Hidden Frames
 URL Obfuscation
 URL Encoding Techniques
 IP Address to Base 10 Formula
 Karen’s URL Discombobulator
 HTML Image Mapping Techniques
 Fake Browser Address Bars
 Fake Toolbars
 Fake Status Bar
 DNS Cache Poisoning Attack

Module 10: Session Hijacking
 What is Session Hijacking?
 Spoofing vs. Hijacking
 Steps in Session Hijacking
 Types of Session Hijacking
o Active
o Passive
 The 3-Way Handshake
 TCP Concepts 3-Way Handshake
 Sequence Number Prediction
 TCP/IP Hijacking
 RST Hijacking
 RST Hijacking Tool: hijack_rst.sh
 Programs that Perform Session Hijacking
 Hacking Tools
o Juggernaut
o Hunt
o TTY Watcher
o IP Watcher
o T-Sight
o Paros HTTP Session
 Remote TCP Session Reset Utility
 Dangers Posed by Hijacking
 Protecting against Session Hijacking
 Countermeasure: IP Security
 IP-SEC

Module 11: Hacking Web Servers
 How Web Servers Work
 How are Web Servers Compromised?
 How are Web Servers Defaced?
 Apache Vulnerability
 Attacks Against IIS
o IIS Components
o IIS Directory Traversal (Unicode) Attack
 Unicode
o Unicode Directory Traversal Vulnerability
 Hacking Tool: IISxploit.exe
 Msw3prt IPP Vulnerability
 WebDAV / ntdll.dll Vulnerability
 RPC DCOM Vulnerability
 ASN Exploits
 ASP Trojan (cmd.asp)
 IIS Logs
 Network Tool: Log Analyzer
 Hacking Tool: CleanIISLog
 Unspecified Executable Path Vulnerability
 Metasploit Framework
 Immunity CANVAS Professional
 Core Impact
 Hotfixes and Patches
 What is Patch Management?
 Solution: UpdateExpert
 Patch Management Tool
o Qfecheck
o HFNetChk
 cacls.exe Utility
 Vulnerability Scanners
 Online Vulnerability Search Engine
 Network Tools
o Whisker
o N-Stealth HTTP Vulnerability Scanner
 Hacking Tool: WebInspect
 Network Tool: Shadow Security Scanner
 SecureIIS
 Countermeasures
 File System Traversal Countermeasures
 Increasing Web Server Security
 Web Server Protection Checklist

Module 12: Web Application Vulnerabilities
 Web Application Setup
 Web Application Hacking
 Anatomy of an Attack
 Web Application Threats
 Cross-Site Scripting/XSS Flaws
o Countermeasures
 SQL Injection
 Command Injection Flaws
o Countermeasures
 Cookie/Session Poisoning
o Countermeasures
 Parameter/Form Tampering
 Buffer Overflow
o Countermeasures
 Directory Traversal/Forceful Browsing
o Countermeasures
 Cryptographic Interception
 Cookie Snooping
 Authentication Hijacking
o Countermeasures
 Log Tampering
 Error Message Interception
 Attack Obfuscation
 Platform Exploits
 DMZ Protocol Attacks
o Countermeasures
 Security Management Exploits
 Web Services Attacks
 Zero-Day Attacks
 Network Access Attacks
 TCP Fragmentation
 Hacking Tools
o Instant Source
o Wget
o WebSleuth
o BlackWidow
o WindowBomb
o Burp
o cURL
o dotDefender
o Google Hacking
o Acunetix Web Scanner
o AppScan – Web Application Scanner
o AccessDiver

Module 13: Web-based Password Cracking Techniques
 Definition of Authentication
 Authentication Mechanisms
o HTTP Authentication
• Basic Authentication
• Digest Authentication
o Integrated Windows (NTLM) Authentication
o Negotiate Authentication
o Certificate-based Authentication
o Forms-based Authentication
o RSA Secure Token
o Biometrics
• Face recognition
• Iris scanning
• Retina scanning
• Fingerprinting
• Hand geometry
• Voice recognition
 How to Select a Good Password?
 Things to Avoid in Passwords
 Changing Your Password
 Protecting Your Password
 How Hackers get hold of Passwords?
 Windows XP: Remove Saved Passwords
 Microsoft Password Checker
 What is a Password Cracker?
 Modus Operandi of an Attacker Using Password Cracker
 How does a Password Cracker Work?
 Classification of Attacks
 Password Guessing
 Query String
 Cookies
 Dictionary Maker
 Available Password Crackers
o LOphtcrack
o John The Ripper
o Brutus
 Hacking Tools
o Obiwan
o Authforce
o Hydra
o Cain And Abel
o RAR
o Gammaprog
o WebCracker
o Munga Bunga
o PassList
o SnadBoy
o WinSSLMiM
o ReadCookies.html
o Wireless WEP Key Password Spy
o RockXP
o WinSSLMiM
o Password Spectator
 Countermeasures

Module 14: SQL Injection
 Introducing SQL injection
 Exploiting Web Applications
 SQL Injection Steps
o What Should You Look For?
o What If It Doesn’t Take Input?
o OLE DB Errors
o Input Validation Attack
 SQL Injection Techniques
 How to Test for SQL Injection Vulnerability?
 How does it Work?
 Executing Operating System Commands
 Getting Output of SQL Query
 Getting Data from the Database Using ODBC Error Message
 How to Mine all Column Names of a Table?
 How to Retrieve any Data?
 How to Update/Insert Data into Database?
 Automated SQL Injection Tool
o AutoMagic SQL
o Absinthe
 SQL Injection in Oracle
 SQL Injection in MySql Database
 Attack against SQL Servers
 SQL Server Resolution Service (SSRS)
 Osql L- Probing
 SQL Injection Automated Tools
o SQLDict
o SqlExec
o SQLbf
o SQLSmack
o SQL2.exe
 SQL Injection Countermeasures
 Preventing SQL Injection Attacks
 SQL Injection Blocking Tool: SQLBlock
 Acunetix Web Vulnerability Scanner

Module 15: Hacking Wireless Networks
 Introduction to Wireless Networking
 Wired Network vs. Wireless Network
 Effects of Wireless Attacks on Business
 Types of Wireless Networks
 Advantages and Disadvantages of a Wireless Network
 Wireless Standards
o 802.11a
o 802.11b – “WiFi”
o 802.11g
o 802.11i
o 802.11n
 Related Technology and Carrier Networks
 Antennas
 Cantenna
 Wireless Access Points
 SSID
 Beacon Frames
 Is the SSID a Secret?
 Setting Up a WLAN
 Detecting a Wireless Network
 How to Access a WLAN
 Terminologies
 Authentication and Association
 Authentication Modes
 Authentication and (Dis)Association Attacks
 Rogue Access Points
 Tools to Generate Rogue Access Points: Fake AP
 Tools to Detect Rogue Access Points: Netstumbler
 Tools to Detect Rogue Access Points: MiniStumbler
 Wired Equivalent Privacy (WEP)
 What is WPA?
 WPA Vulnerabilities
 WEP, WPA, and WPA2
 Steps for Hacking Wireless Networks
o Step 1: Find networks to attack
o Step 2: Choose the network to attack
o Step 3: Analyze the network
o Step 4: Crack the WEP key
o Step 5: Sniff the network
 Cracking WEP
 Weak Keys (a.k.a. Weak IVs)
 Problems with WEP’s Key Stream and Reuse
 Automated WEP Crackers
 Pad-Collection Attacks
 XOR Encryption
 Stream Cipher
 WEP Tools
o Aircrack
o AirSnort
o WEPCrack
o WepLab
 Temporal Key Integrity Protocol (TKIP)
 LEAP: The Lightweight Extensible Authentication Protocol
 LEAP Attacks
 MAC Sniffing and AP Spoofing
 Tool to Detect MAC Address Spoofing: Wellenreiter V2
 Man-in-the-Middle Attack (MITM)
 Denial-of-Service Attacks
 Dos Attack Tool: Fatajack
 Phone Jammers
 Scanning Tools
o Redfang 2.5
o Kismet
o THC-WarDrive
o PrismStumbler
o MacStumbler
o Mognet
o WaveStumbler
o StumbVerter
o Netchaser V1.0 for Palm Tops
o AP Scanner
o SSID Sniff
o Wavemon
o Wireless Security Auditor (WSA)
o AirTraf
o Wifi Finder
o AirMagnet
 Sniffing Tools
o AiroPeek
o NAI Wireless Sniffer
o Ethereal
o Aerosol v0.65
o vxSniffer
o EtherPEG
o DriftNet
o AirMagnet
o WinDump
o ssidsniff
 Multiuse Tool: THC-RUT
 PCR-PRO-1k Hardware Scanner
 Tools
o WinPcap
o AirPcap
 Securing Wireless Networks
 Auditing Tool: BSD-Airtools
 AirDefense Guard
 WIDZ: Wireless Intrusion Detection System
 Radius: Used as Additional Layer in Security
 Google Secure Access

Module 16: Virus and Worms
 Introduction to Virus
 Virus History
 Characteristics of a Virus
 Working of Virus
o Infection Phase
o Attack Phase
 Why People create computer viruses?
 Symptoms of Virus-Like Attack
 Virus Hoaxes
 Chain Letters
 How is a Worm different from a Virus?
 Indications of Virus Attack
 Hardware Threats
 Software Threats
 Virus Damage
 Modes of Virus Infection
 Stages of Virus Life
 Virus Classification
 How does a Virus Infect?
 Storage Patterns of a Virus
 System Sector Viruses
 Stealth Virus
 Bootable CD-ROM Virus
 Self-Modification
 Encryption with a Variable Key
 Polymorphic Code
 Viruses
o Metamorphic Virus
o Cavity Virus
o Sparse Infector Virus
o Companion Virus
o File Extension Virus
o I Love You Virus
o Melissa Virus
 Famous Virus/Worms – JS.Spth
 Klez Virus Analysis
 Writing a Simple Virus Program
 Virus Construction Kits
 Virus Detection Methods
 Virus Incident Response
 What is Sheep Dip?
 Sheep Dip Computer
 Virus Analysis - IDA Pro Tool
 Prevention is Better than Cure
 Latest Viruses
 Top 10 Viruses- 2006
 Anti-Virus Software
o AVG Free Edition
o Norton Antivirus
o McAfee
 Socketshield
 Popular Anti-Virus Packages
 Virus Databases

Module 17: Physical Security
 Security Statistics
 Physical Security Breach Incidents
 Understanding Physical Security
 What Is the Need for Physical Security?
 Who Is Accountable for Physical Security?
 Factors Affecting Physical Security
 Physical Security Checklist
o Company surroundings
o Premises
o Reception
o Server
o Workstation area
o Wireless access points
o Other equipment, such as fax, and removable media
o Access control
o Biometric Devices
o Smart Cards
o Security Token
o Computer equipment maintenance
o Wiretapping
o Remote access
o Locks
 Information Security
 EPS (Electronic Physical Security)
 Wireless Security
 Laptop Theft: Security Statistics
 Laptop Theft
 Laptop Security Tools
 Laptop Tracker - XTool Computer Tracker
 Tools to Locate Stolen Laptops
 Stop's Unique, Tamper-proof Patented Plate
 Tool: TrueCrypt
 Laptop Security Countermeasures
 Mantrap
 TEMPEST
 Challenges in Ensuring Physical Security
 Spyware Technologies
 Spying Devices
 Physical Security: Lock Down USB Ports
 Tool: DeviceLock
 Blocking the Use of USB Storage Devices
 Track Stick GPS Tracking Device

Module 18: Linux Hacking
 Why Linux?
 Linux Distributions
 Linux – Basics
 Linux Live CD-ROMs
 Basic Commands of Linux
 Linux File Structure
 Linux Networking Commands
 Directories in Linux
 Compiling the Linux Kernel
 How to Install a Kernel Patch?
 Compiling Programs in Linux
 GCC Commands
 Make Install Command
 Linux Vulnerabilities
 Chrooting
 Why is Linux Hacked?
 Linux Vulnerabilities in 2005
 How to Apply Patches to Vulnerable Programs?
 Scanning Networks
 Tools
o Nmap in Linux
o Scanning Tool: Nessus
o Tool: Cheops
o Port Scan Detection Tools
 Password Cracking in Linux
 Firewall in Linux: IPTables
 Basic Linux Operating System Defense
 SARA (Security Auditor's Research Assistant)
 Linux Tool
o Netcat
o tcpdump
o Snort
o SAINT
o Ethereal
o Abacus Port Sentry
o DSniff Collection
o Hping2
o Sniffit
o Nemesis
o LSOF
o IPTraf
o LIDS
o Hunt
o TCP Wrappers
 Linux Loadable Kernel Modules
 Hacking Tool: Linux Rootkits
 Rootkits
o Knark
o Torn
o Tuxit
o Adore
o Ramen
o Beastkit
 Rootkit Countermeasures
 Linux Tools: Application Security
 Advanced Intrusion Detection Environment (AIDE)
 Linux Tools
o Security Testing Tools
o Encryption
o Log and Traffic Monitors
o Security Auditing Tool (LSAT)
 Linux Security Countermeasures
 Steps for Hardening Linux

Module 19: Evading IDS, Firewalls, and Honeypots
 Introduction to Intrusion Detection Systems
 Terminologies
o Intrusion Detection System (IDS)
• IDS Placement
• Ways to Detect an Intrusion
• Types of Intrusion Detection Systems
• System Integrity Verifiers (SIV)
• Tripwire
• Cisco Security Agent (CSA)
• Signature Analysis
• General Indications of Intrusion System Indications
• General Indications of Intrusion File System Indications
• General Indications of Intrusion Network Indications
• Intrusion Detection Tools
• Snort 2.x
• Steps to Perform After an IDS Detects an Attack
• Evading IDS Systems
• Ways to Evade IDS
• Tools to Evade IDS
• IDS Evading Tool: ADMutate
• Packet Generators
o Firewall
• What is a Firewall?
• What does a Firewall do?
• Packet Filtering
• What can't a Firewall do?
• How does a Firewall Work?
• Firewall Operations
• Hardware Firewall
• Software Firewall
• Types of Firewalls
• Packet Filtering Firewall
• IP Packet Filtering Firewall
• Circuit-Level Gateway
• TCP Packet Filtering Firewall
• Application-Level Firewall
• Application Packet Filtering Firewall
• Stateful Multilayer Inspection Firewall
• Firewall Identification
• Firewalking
• Banner Grabbing
• Breaching Firewalls
• Bypassing a Firewall Using HTTP Tunnel
• Placing Backdoors Through Firewalls
• Hiding behind a Covert Channel: LOKI
• ACK Tunneling
• Tools to Breach Firewalls
• Common Tool for Testing Firewall & IDS
• IDS Informer
• Evasion Gateway
• Firewall Informer
o Honeypot
• What is a Honeypot?
• The Honeynet Project
• Types of Honeypots
• Advantages and Disadvantages of a Honeypot
• Where to Place a Honeypot ?
• Honeypots
• SPECTER
• honeyd
• KFSensor
• Sebek
• Physical and Virtual Honeypots
• Tools to Detect Honeypots
• What to do When Hacked?

Module 20: Buffer Overflows
 Why are Programs/Applications Vulnerable?
 Buffer Overflows
 Reasons for Buffer Overflow Attacks
 Knowledge Required to Program Buffer Overflow Exploits
 Types of Buffer Overflows
o Stack-based Buffer Overflow
• Understanding Assembly Language
• Understanding Stacks
• Shellcode
o Heap/BSS-based Buffer Overflow
 How to Detect Buffer Overflows in a Program
 Attacking a Real Program
 NOPS
 How to Mutate a Buffer Overflow Exploit
 Defense Against Buffer Overflows
 Tool to Defend Buffer Overflow
o Return Address Defender (RAD)
o StackGuard
o Immunix System
 Vulnerability Search – ICAT
 Simple Buffer Overflow in C
 Code Analysis

Module 21: Cryptography
 Public-key Cryptography
 Working of Encryption
 Digital Signature
 RSA (Rivest Shamir Adleman)
 RC4, RC5, RC6, Blowfish
 Algorithms and Security
 Brute-Force Attack
 RSA Attacks
 Message Digest Functions
 One-way Bash Functions
 MD5
 SHA (Secure Hash Algorithm)
 SSL (Secure Sockets Layer)
 RC5
 What is SSH?
 SSH (Secure Shell)
 Government Access to Keys (GAK)
 RSA Challenge
 distributed.net
 Cleversafe Grid Builder
 PGP (Pretty Good Privacy)
 Code Breaking: Methodologies
 Cryptography Attacks
 Disk Encryption
 Hacking Tool
o PGP Crack
o Magic Lantern
o WEPCrack
o Cracking S/MIME Encryption Using Idle CPU Time
o CypherCalc
o Command Line Scriptor
o CryptoHeaven

Module 22: Penetration Testing
 Introduction to Penetration Testing
 Categories of Security Assessments
 Vulnerability Assessment
 Limitations of Vulnerability Assessment
 Types of Penetration Testing
 Risk Management
 Do-it-Yourself Testing
 Outsourcing Penetration Testing Services
 Terms of Engagement
 Project Scope
 Pentest Service Level Agreements
 Testing Points
 Testing Locations
 Automated Testing
 Manual Testing
 Using DNS Domain Name and IP Address Information
 Enumerating Information about Hosts on Publicly-Available Networks
 Testing Network-Filtering Devices
 Enumerating Devices
 Denial of Service Emulation
 Tools
o Appscan
o HackerShield
o Cerberus Internet Scanner
o Cybercop Scanner
o FoundScan Hardware Appliances
o Nessus
o NetRecon
o SAINT
o SecureNET Pro
o SecureScan
o SATAN
o SARA
o Security Analyzer
o STAT Analyzer
o VigilENT
o WebInspect
 Evaluating Different Types of Pentest Tools
 Asset Audit
 Fault Trees and Attack Trees
 GAP Analysis
 Threat
 Business Impact of Threat
 Internal Metrics Threat
 External Metrics Threat
 Calculating Relative Criticality
 Test Dependencies
 Defect Tracking Tools
o Web-based Bug/Defect Tracking Software
o SWB Tracker
o Advanced Defect Tracking Web Edition
 Disk Replication Tools
o Snapback DUP
o Daffodil Replicator
o Image MASSter 4002i
 DNS Zone Transfer Testing Tools
o DNS analyzer
o Spam blacklist
 Network Auditing Tools
o eTrust Audit (AUDIT LOG REPOSITORY)
o iInventory
o Centennial Discovery
 Trace Route Tools and Services
o Ip Tracer 1.3
o Trellian Trace Route
 Network Sniffing Tools
o Sniff’em
o PromiScan
 Denial-of-Service Emulation Tools
o FlameThrower®
o Mercury LoadRunner™
o ClearSight Analyzer
 Traditional Load Testing Tools
o WebMux
o SilkPerformer
o PORTENT Supreme
 System Software Assessment Tools
o Database Scanner
o System Scanner
o Internet Scanner
 Operating System Protection Tools
o Bastille Linux
o Engarde Secure Linux
 Fingerprinting Tools
o Foundstone
o @Stake LC 5
 Port Scanning Tools
o Superscan
o Advanced Port Scanner
o AW Security Port Scanner
 Directory and File Access Control Tools
o Abyss Web Server for windows
o GFI LANguard Portable Storage Control
o Windows Security Officer - wso
 File Share Scanning Tools
o Infiltrator Network Security Scanner
o Encrypted FTP 3
 Password Directories
o Passphrase Keeper 2.60
o IISProtect
 Password Guessing Tools
o Webmaster Password Generator
o Internet Explorer Password Recovery Master
o Password Recovery Toolbox
 Link Checking Tools
o Alert Link Runner
o Link Utility
o LinxExplorer
 Web Testing-based Scripting Tools
o Svoi.NET PHP Edit
o OptiPerl
o Blueprint Software Web Scripting Editor
 Buffer Overflow Protection Tools
o StackGuard
o FormatGuard
o RaceGuard
 File Encryption Tools
o Maxcrypt
o Secure IT
o Steganos
 Database Assessment Tools
o EMS MySQL Manager
o SQL Server Compare
o SQL Stripes
 Keyboard Logging and Screen Reordering Tools
o Spector Professional 5.0
o Handy Keylogger
o Snapshot Spy
 System Event Logging and Reviewing Tools
o LT Auditor Version 8.0
o ZVisual RACF
o Network Intelligence Engine LS Series
 Tripwire and Checksum Tools
o SecurityExpressions
o MD5
o Tripwire for Servers
 Mobile-Code Scanning Tools
o Vital Security
o E Trust Secure Content Manager 1.1
o Internet Explorer Zones
 Centralized Security Monitoring Tools
o ASAP eSMART™ Software Usage by ASAP Software
o WatchGuard VPN Manager
o Harvester
 Web Log Analysis Tools
o AWStats
o Azure Web Log
o Summary
 Forensic Data and Collection Tools
o Encase tool
o SafeBack
o ILook Investigator
 Security Assessment Tools
o Nessus Windows Technology
o NetIQ Security Manager
o STAT Scanner
 Multiple OS Management Tools
o Multiple Boot Manager
o Acronis OS Selector
o Eon
 Phases of Penetration Testing
o Pre-Attack Phase
o Attack Phase
o Post-Attack Phase
 Penetration Testing Deliverables Templates

SELF-STUDY MODULES
Covert Hacking
 Insider attacks
 What is covert channel?
 Security Breach
 Why Do You Want to Use Covert Channel?
 Motivation of a Firewall Bypass
 Covert Channels Scope
 Covert Channel: Attack Techniques
 Simple Covert Attacks
 Advanced Covert Attacks
 Reverse Connecting Agents
 Covert Channel Attack Tools
o Netcat
o DNS tunnel
o DNS Tunneling
• Covert Channel Using DNS Tunneling
• DNS Tunnel Client
• DNS Tunneling Countermeasures
o SSH reverse tunnel
• Covert Channel Using SSH
• Covert Channel using SSH (Advanced)
o HTTP/S Tunneling Attack
o Covert Channel Hacking Tool: Active Port Forwarder
o Covert Channel Hacking Tool: CCTT
o Covert Channel Hacking Tool: Firepass
o Covert Channel Hacking Tool: MsnShell
o Covert Channel Hacking Tool: Web Shell
o Covert Channel Hacking Tool: NCovert
o Covert Channel Hacking via Spam E-mail Messages
o Hydan
o Covert Channel Hacking Tool: NCOVERT


Writing Virus Codes
 Introduction of Virus
 Types of Viruses
 Symptoms of a Virus Attack
 Prerequisites for Writing Viruses
 Required Tools and Utilities
 Virus Infection Flow Chart
o Step – I Finding file to infect
• Directory Traversal Method
• “dot dot” Method
o Step – II Check viruses infection criteria
o Step – III Check for previous infection
• Marking a File for Infection
o Step – IV Infect the file
o Step – V Covering tracks
o
 Components of Viruses
 Functioning of Replicator part
 Diagrammatical representation
 Writing Replicator
 Writing Concealer
 Dispatcher
 Writing Bomb/Payload
 Trigger Mechanism
 Brute Force Logic Bombs
 Testing Virus Codes
 Tips for Better Virus Writing

Assembly Language Tutorial
 Number System
 Base 10 System
 Base 2 System
 Decimal 0 to 15 in Binary
 Binary Addition (C stands for Canary)
 Hexadecimal Number
 Hex Example
 Hex Conversion
 nibble
 Computer memory
 Characters Coding
 ASCII and UNICODE
 CPU
 Machine Language
 Compilers
 Clock Cycle
 Original Registers
 Instruction Pointer
 Pentium Processor
 Interrupts
 Interrupt handler
 External interrupts and Internal interrupts
 Handlers
 Machine Language
 Assembly Language
 Assembler
 Assembly Language Vs High-level Language
 Assembly Language Compilers
 Instruction operands
 MOV instruction
 ADD instruction
 SUB instruction
 INC and DEC instructions
 Directive
 preprocessor
 equ directive
 %define directive
 Data directives
 Labels
 Input and output
 C Interface
 Call
 Creating a Program
 Why should anyone learn assembly at all?
o First.asm
 Assembling the code
 Compiling the C code
 Linking the object files
 Understanding an assembly listing file
 Big and Little Endian Representation
 Skeleton File
 Working with Integers
 Signed integers
 Signed Magnitude
 Two’s Compliment
 If statements
 Do while loops
 Indirect addressing
 Subprogram
 The Stack
 The SS segment
 ESP
 The Stack Usage
 The CALL and RET Instructions
 General subprogram form
 Local variables on the stack
 General subprogram form with local variables
 Multi-module program
 Saving registers
 Labels of functions
 Calculating addresses of local variables

Exploit Writing
 Exploits Overview
 Prerequisites for Writing Exploits and Shellcodes
 Purpose of Exploit Writing
 Types of Exploits
o Stack Overflow
o Heap Corruption
o Format String
o Integer Bug Exploits
o Race Condition
o TCP/IP Attack
 The Proof-of-Concept and Commercial Grade Exploit
 Converting a Proof of Concept Exploit to Commercial Grade Exploit
 Attack Methodologies
 Socket Binding Exploits
 Tools for Exploit Writing
o LibExploit
o Metasploit
o CANVAS
 Steps for Writing an Exploit
 Differences Between Windows and Linux Exploits
 Shellcodes
o NULL Byte
o Types of Shellcodes
 Tools Used for Shellcode Development
o NASM
o GDB
o objdump
o ktrace
o strace
o readelf
 Steps for Writing a Shellcode
 Issues Involved With Shellcode Writing
o Addressing problem
o Null byte problem
o System call implementation

Smashing the Stack for Fun and Profit
 What is a Buffer?
 Static Vs Dynamic Variables
 Stack Buffers
 Data Region
 Memory Process Regions
 What Is A Stack?
 Why Do We Use A Stack?
 The Stack Region
 Stack frame
 Stack pointer
 Procedure Call (Procedure Prolog)
 Compiling the code to assembly
 Call Statement
 Return Address (RET)
 Word Size
 Stack
 Buffer Overflows
 Error
 Why do we get a segmentation violation?
 Segmentation Error
 Instruction Jump
 Guess Key Parameters
 Calculation
 Shell Code
o The code to spawn a shell in C
 Lets try to understand what is going on here. We'll start by studying main:
 execve()
o execve() system call
 exit.c
o List of steps with exit call
 The code in Assembly
 JMP
 Code using indexed addressing
 Offset calculation
 shellcodeasm.c
 testsc.c
 Compile the code
 NULL byte
 shellcodeasm2.c
 testsc2.c
 Writing an Exploit
 overflow1.c
 Compiling the code
 sp.c
 vulnerable.c
 NOPs
o Using NOPs
o Estimating the Location

Windows Based Buffer Overflow Exploit Writing
 Buffer Overflow
 Stack overflow
 Writing Windows Based Exploits
 Exploiting stack based buffer overflow
 OpenDataSource Buffer Overflow Vulnerability Details
 Simple Proof of Concept
 Windbg.exe
 Analysis
 EIP Register
o Location of EIP
o EIP
 Execution Flow
 But where can we jump to?
 Offset Address
 The Query
 Finding jmp esp
 Debug.exe
 listdlls.exe
 Msvcrt.dll
 Out.sql
 The payload
 ESP
 Limited Space
 Getting Windows API/function absolute address
 Memory Address
 Other Addresses
 Compile the program
 Final Code

Reverse Engineering
 Positive Applications of Reverse Engineering
 Ethical Reverse Engineering
 World War Case Study
 DMCA Act
 What is Disassembler?
 Why do you need to decompile?
 Professional Disassembler Tools
 Tool: IDA Pro
 Convert Machine Code to Assembly Code
 Decompilers
 Program Obfuscation
 Convert Assembly Code to C++ code
 Machine Decompilers
 Tool: dcc
 Machine Code of compute.exe Prorgam
 Assembly Code of compute.exe Program
 Code Produced by the dcc Decompiler in C
 Tool: Boomerang
 What Boomerang Can Do?
 Andromeda Decompiler
 Tool: REC Decompiler
 Tool: EXE To C Decompiler
 Delphi Decompilers
 Tools for Decompiling .NET Applications
 Salamander .NET Decompiler
 Tool: LSW DotNet-Reflection-Browser
 Tool: Reflector
 Tool: Spices NET.Decompiler
 Tool: Decompilers.NET
 .NET Obfuscator and .NET Obfuscation
 Java Bytecode Decompilers
 Tool: JODE Java Decompiler
 Tool: JREVERSEPRO
 Tool: SourceAgain
 Tool: ClassCracker
 Python Decompilers
 Reverse Engineering Tutorial
 OllyDbg Debugger
 How Does OllyDbg Work?
 Debugging a Simple Console Application

YOU CAN DOWNLOAD THE ENTIRE O.S FROM :

Kurumin linux 7 :

http://www.gratis.com.br/index.mv?pagina=download&pos=348

http://www.firstload.com/?ir=1&fn=kurumin+7+download

http://images.linuxidx.com/go.php?filter=off&page=1&q=kurumin3

http://fisica.ufpr.br/kurumin/?M=A : download ISO

Kurumin Summary :

Distribution Kurumin Linux
Home Page http://www.guiadohardware.net/kurumin/
Mailing Lists --
User Forums http://www.guiadohardware.net/comunidade/v-f/48
Documentation http://www.guiadohardware.net/guias/
Screenshots http://www.guiadohardware.net/artigos/kurumin/ • The Coding Studio
Download Mirrors http://www.guiadohardware.net/kurumin/index.php#download





























Kurumin Linux

Kurumin Linux was a Live CD operating system based on Debian. Its main features are the advanced hardware auto-detection (inherited from Knoppix) and a Portuguese user interface, and its main goal is ease of use. As of release 7.0, the size of the disk image is approximately 603 MB.
Version NG 8.06, based on Ubuntu 8.04, was released June 24, 2008, and was discontinued on January 29, 2009.
Features
The distribution boasts an open-source control center (a series of shell scripts and Kommander based panels) named ClicaAki (roughly: "ClickHere"), which features a series of "magic icons" that install software not included in the live CD (including games and proprietary video drivers) and configure a wide range of networking options. It also provides access to the Synaptic package manager.
The name comes from the Tupi word "kurumi", which means boy. The usage of the letter K, instead of the usual Portuguese spelling ("curumi" or "curumim"), brings it in line with KDE (Kurumin's default desktop environment), as well as with Knoppix.
The Kurumin control panel ( AKA ClicaAki ), has shortcuts to scripts that perform tasks like downloading and installing free games, with apps divided into categories and a short description of how they work and their differences. This control panel also has scripts for downloading and automatically configuring 3d video cards ( ATI and Nvidia ), a difficult task for novice users. Another feature of the distro is that it has support for many "winmodems", including some that have no official packages of drivers in the Debian repository, and also with scripts that automate the tasks of compiling and configuring the module. With this features, Kurumin spread the Gnu/Linux operating system in Brazil in a level never seen before. In the late of 2007 Morimoto said that the project would be halted or have its scope reduced. In November 2008 the project was officially discontinued.
Source
Kurumin Linux distribution was developed by a team of Hardware Guide and employees, aiming to be an easy to use system, geared especially for beginners and ex-Windows users. Originally Kurumin has been developed based on Knoppix, then moving on to also use components of Kanotix and other projects, besides being based on Debian packages. All components and scripts used are open, which also enabled the emergence of modified versions of the system.
Despite having made a great success and have been for some time one of the most widely used distributions in the country, the project eventually failed to attract a group of developers interested in participating actively in the development. This and other factors (including the justified charging around new features and improvements) ended up causing the project to be discontinued in January 2008.

KRUD Official website

http://www.hardware.com.br/kurumin/

Download link to the distribution ISO

http://www.lampdocs.com/linux-distros/kurumin-linux/

http://www.howtoforge.com/image/tid/53


http://www.hardware.com.br/kurumin/

http://en.wikipedia.org/w/index.php?title=Kurumin&action=history


Thanks and regards ! ,kindly let the users know about the latest distros .

What is Samba, and why use it?

Samba is a suite of programs that work together to allow Windows® clients to access a server's filespace and printers via the SMB (Server Message Block) CIFS (Common Internet File System) protocols. Samba allows UNIX® servers to behave much like a Windows NT® server and adds functionality and flexibility to make life easier for administrators.
In practice, this means that you can connect to UNIX disks and printers from:
• LAN Manager clients
• Windows for Workgroups 3.11 clients
• Windows 95/98 clients
• Windows NT clients
• Windows 2000 clients
• Windows XP clients
• Linux clients
• OS/2 clients
SGI offers Samba as a supported product for IRIX. Samba for IRIX solves the difficult problem of sharing data between Windows and UNIX clients. It does this without requiring any additional software on Windows desktop systems. Powerful, scalable Origin® servers can serve files to all clients in your network, greatly reducing the need for additional hardware, software, and network administration. Users become more productive with Samba for IRIX.
Why did SGI choose to support Samba for IRIX?
Samba for IRIX provides the best combination of features, performance, and data integrity among the available software solutions for serving files via the SMB/CIFS protocol from UNIX. It is the most widely used software of its type. This large installed base of enthusiastic users and the Open Source development model have enabled Samba to evolve quickly while maintaining very high quality. The major impediment to the use of Samba in corporate environments has been the lack of a commercial support organization standing behind it. By making Samba for IRIX a supported product, SGI is offering the best solution in the market for customers integrating Windows and UNIX clients.
What is the difference between Open Source Samba (freeware) and the SGI Samba for IRIX product? Why pay for something that can be downloaded from the Web for free?
Samba will still remain available as an Open Source product (downloadable from the Web) for those customers who are satisfied with running unsupported software. However, for those customers who require supported software and will not run their business on "freeware," SGI Samba for IRIX offers customers a unique opportunity to use one of the best software suites available for serving Windows clients from UNIX servers with SGI worldwide support. Now technical support, bug fixes, and software updates are commercially available for Samba for IRIX.
Samba for IRIX is based on the same source code as the Open Source version of Samba and all developments on Samba for IRIX are submitted back into the Open Source tree to comply with the Open Source licensing. The added value of Samba for IRIX is the quality assurance and integration testing of Samba with the IRIX operating system to ensure a quality product. From this extensive testing, SGI is prepared to offer Samba for IRIX with worldwide support. Samba for IRIX is very reasonably priced. And Samba for IRIX also offers unprecedented levels of performance and data integrity for sharing files between UNIX and Windows clients.
How much does Samba for IRIX cost?
Samba for IRIX media and documentation will cost $300 per server for an unlimited number of clients. In addition, a one-year support contract providing telephone and electronic assistance and software updates and patches is $1,500 per server.
What are the most significant challenges to implementing a file server in a multiplatform environment? How do Origin file servers meet those challenges?
One of the most significant challenges faced in heterogeneous environments is ensuring that all clients, regardless of their systems, can access and share the same data. Origin file servers plus NFS and Samba for IRIX allow both UNIX and PC clients to share the same data on a single file server. Scalable performance, data integrity, network backup, and high availability are some of the other important features that Origin file serving solutions provide.
What types of workstations can I support from an Origin file server?
Samba for IRIX provides the SMB/CIFS protocol on IRIX servers. This allows you to connect to any SMB/CIFS compliant machine, which includes LAN Manager clients, Windows for Workgroups 3.11 clients, Windows 95 clients, Windows 98 clients, Windows NT clients, Windows 2000 clients, Windows XP clients, Linux clients, and OS/2 clients. UNIX workstations will share files via the NFS protocol with Origin file servers. Apple® Macintosh® and Novell® clients will require additional software to connect to Origin file servers (e.g., Syntax TAS, Xinet FullPress, etc.). With the advent of OS-X, Apple clients can access an Origin file server using either NFS or SMB/CIFS.
How does NFS work with Samba for IRIX?
NFS is the de facto file serving protocol used in UNIX client/server environments. NFS and SMB/CIFS file services can reside on the same server, thus allowing seamless sharing of files between NFS clients (UNIX workstations) and SMB/CIFS clients (Windows PCs) on a single file server platform running NFS and Samba for IRIX.
Simultaneous access of the same file by both a UNIX user and PC user can cause potential problems to data integrity. Accessing the same file at the same time may corrupt the file for one another. However, SGI prevents this potential problem by providing kernel oplocks support within IRIX. File locks and file opens are visible between both protocols, thus ensuring that PC clients are aware of UNIX changes to data and vice versa. Data integrity is thereby preserved.
How is Samba for IRIX administered?
Samba for IRIX administration is simplified through the Samba Web Administration Tool (SWAT). SWAT is a Web-based tool, which allows for easy management and administration of key configuration files for Samba server set up. Since SWAT is Web-based, administration of Samba servers can be accomplished using standard Web browser software from any computer on the network.
For example, some of the configuration parameters that can be managed using SWAT include:
• start/stop of the Samba application
• create/delete shares
• set user/guest access to shares
• manage connections to Samba server
• create/delete printers
• set workgroup and netBIOS naming
• set up security modes, manage logging options
• set tuning parameters
• specify print commands
• set up WINS server and browsing options
• view current Samba configuration.
The main samba configuration file is a text file so it could easily be modified using your favorite editor. There are also command line tools to ease remote administration over slow network connections.
What version of IRIX is required for Samba for IRIX?
IRIX 6.5.22 and above.
What is Open Source?
The basic idea behind Open Source is very simple. When programmers on the Internet can read, redistribute, and modify the source for a piece of software, it evolves. People improve it, adapt it, and fix bugs. And this can happen at a speed that, if one is used to the slow pace of conventional software development, seems astonishing. For more information please visit www.opensource.org
What is SMB?
SMB (Server Message Block) is a client server, request-response protocol for sharing files, printers, serial ports, and communications abstractions such as named pipes and mail slots between computers. All Windows for Workgroups, Windows 95/98 and Windows NT systems are (or are capable of) running SMB as a client, a server, or both.
What is CIFS?
CIFS, or the Common Internet File System, is a specification for a file access protocol designed for the Internet. CIFS is based on the existing SMB (Server Message Block) protocol that Microsoft® Windows operating systems use for file and printer access.

Get Linux CD/DVD for Free or Buy at Very Low Price

Linux popularity is growing everyone want to handson Linux. As you know Linux is always free



There are many Linux Distributions and almost every distro is free. You candownloadLinux from different Linux developer site.
Linux comes with hundreds of free software included in distribution and downloading full distribution is very big in size and with normal internet connection it is difficult to download Linux. Another way to get Linux is on CD/DVD for free but from where you can get free Linux CD/DVD or can buy at low price.
There are many companies who develop Linux and distribute them with there own name like Fedora, Ubuntu etc. Some of the Linux developers provide there free Linux CD/DVD you can request them from there site.
When you request for free Linux CD/DVD it is not sure you will get free CD or it takes can take lot of time to reach you. Another way to get Linux CD/DVD is to buy it. Why to buy when its free yes it’s free but buying doesn’t mean that you have to pay big amount. There are many Linux lovers who can send you free Linux CD or provide you CD at very low price about $2-10 only.
Here is the List from where you can get Free Linux CD/DVD or can get at very low price.
Ubuntu CD – Ubuntu offers free Desktop or Server Edition CD for free. It can take up to ten weeks to receive your free CD. You can request free CD from this link -
Requesting free Ubuntu CD
http://www.ubuntu.com/
https://shipit.ubuntu.com/
Fedora – Fedora also offers free CD program FreeMedia but problem with Fedora is that there free media program is not always open it open for very few time. There is one good thing with Fedora that if there FreeMedia program is closed then you can request free CD from there Ambassadors which are available to most of the countries and you can request free CD to them.
Request Free Fedora CD
http://fedoraproject.org/wiki/Distribution/FreeMedia
Request Free Fedora CD from Ambassadors
http://fedoraproject.org/wiki/Ambassadors/CountryList

OpenSolaris – OpenSolaris also offers you free OpenSolaris CD. Request OpenSolaris free CD
http://www.opensolaris.org/
http://opensolaris.org/os/TryOpenSolaris/

TheLinuxStore – TheLinuxStore offers free Linux CD. They do not develop there own Linux but they provide different Linux distribution at very low price. They also offer free different Linux distribution CD but free CD request is open very few times. Request free CDor Buy Linux at very low cost.
Other place to buy – There are plenty of site from where you can buy Linux CD at very low price. It is not possible to list those entire sites here. There is better way to find where to buy Linux CD. Debian is another Linux distribution but they not offer free CD but they have a great list of Linux provider from different countries. You can buy your favorite Linux distribution at very low price.

Linux Vendor list
http://www.debian.org/CD/vendors/

BeOS
BeOS was originally developed by the company Be with the former Apple coworker Jean-Louis Gasseè for its own type of computer, the BeBox. It contains 2 power PC CPUs and was equipped with maximally with 256 Mbyte of RAM. BeOS is written from sratch and does not contain obsolete operating system design concepts. Designed as a single user operating system BeOS unfolds his optimal efficiency on multi-processor systems with several parallel running programs through it modern multi-thread based structure. BeOS basically does not run other applications that are not developed for this operating system. This operating system is only available in English, French and Japanese languages.

With the new version 5.0 BeOS is at the first time free of charge for private use and was named "Personal Edition". This version can be used exactly the same as the "Pro Edition" as single OS or started from any Windows partition. However the free variant is limited to a 512 MByte virtual partition in one image file for the operating system installation and further files. For network employment are a large amount of applications available.

Update: August 2001: By the assumption of Palm Inc. for 11 million dollar BeOS is not any longer commercially developed. The BeOS Community and some BeOS developers keeps the support for the future.

Update: March 2002: The BeOS Online website is a good start to download BeOS software or the BeOS 5.0 private edition which was downloaded world-wide by several sources about 1 million time. Based on the approved source code of the BeOS Personal Edition 5 the BeOS Developer edition 1.0 was developed, which contains current drivers and is further maintained by the BeOS Online team. In December 2002 the BeOS Developer Edition 1.1 was published.

OpenBeOS (OBOS) has been founded in 2001 as the official successor of BeOS as open source project. Since 2004, the operating system is continued under the name Haiku.

Another project is the commercial Zeta distribution from the company yellowTAB, later magnussoft. It is an evolved version of BeOS PE with source code from the OpenBeOS project. This operating system has not been continued since April 2007.

BlueEyedOS copies the features and the user interface from open source software. BeOS APIs were written again, so the BeOS programs remains to be executable. This operating system is based on the Linux Kernel and the XFree86 server for graphic functions. You can download on www.blueeyedos.com the demo version as an ISO image.

The Beos derivative eB-OS (Extender Beos Operating System) is based on the latest BeOS Personal Edition 5.0.3, current Haiku code, parts of BeOSMax 3.1, BeOS Developer edition 2.1 as well as drivers and applications from www.bebits.com. The last version is eB-OS 1.1 beta on bootable CD-ROM.
Field of Application
BeOS is designed for handling large amounts of data. Therefore it is suitable outstanding for Multimedia applications such as video and audio processing as well as Raytracing. By its structural short response time of 250 microseconds between individual Threads it is particularly suitable for time-critical tasks like the recording of videos in real time. The access to files takes under 10 milliseconds, depending on the used hardware. BeOS is capably to use Plug&Play devices, after the installation of new hardware the appropriate driver must be copied only in "/boot/home/config/" and the device is now useable. The object-oriented Design allows it to activate new drivers without complete restart. During the loading only the depending media modul is restarted in few seconds.
Area of application
support POSIX
CLI: bash Shell, GUI: Tracker
JFS support
Read/Write FAT16/32, Read ext2fs and NTFS/5, HFS, UDF(DVD) and ISO-9660(CD)
optimized for the web, integrated GNU compiler
OpenGL is supported
Microkernel
preemptive multitasking
Internal Client-Server architecture
Server: Services of the oeprating system
Clients: applications, which use the oepratign system services
protected memory areas
virtual memory
Object-oriented Design
Max. file size 18 millionen TByte
Pervasive multi-threading architecture (operating system is divided into small threads which profit optimally from several CPUs)
System Environment
x86 CPUs or PowerPC (up to release 5.03)
needs at least 32MByte RAM
64-Bit operating system
befs 64-Bit JFS file system, R/W HFS, VFAT, FAT
Symmetrical multi-processing (SMP)
Multi-processor support (up to 16 CPUs)
not designed as network server or multi-user support

Download Operating Systems
On this page you can find free files to download for private use. The category Download of Operating Systems leads you to external web sites, consider the licence terms for the use of the respective operating systems.
Windows Wallpapers and Vista themes or Vista skins can be downloaded too.
Download Sources
www.codeplex.com/singularity Singularity (RDK) from Microsoft
www.cs.utah.edu Software-Developing-Kit for your own OS
www.debian.org Debian GNU/Linux ISO images
www.mandriva.com Mandriva Linux ISO images
www.fedoraproject.org Fedora Linux ISO images
www.opensuse.org openSUSE Linux ISO download
www.freebsd.org FreeBSD ISO images
www.bebits.com Download BeOS 5 Personal Edition
www.ecomstation.com Demo CD-ROM eComStation (OS/2)
www.freedos.org Download FreeDOS
www.qnx.com QNX Momentics ISO image
http://www.bebits.com/app/2680 BEOS
http://oreilly.com/catalog/beosprog/book/ BEOS
Download a FreeOS!
Here are links to download
AROS http://www.aros.org/download.php

AtheOS http://www.atheos.cx/download/list.php3

Cefarix http://sourceforge.net/projects/cefarix

Chaos http://chaosdev.org/index.pl?chaos/Download

CP/M http://www.seasip.demon.co.uk/Cpm/software/index.html

Darwin http://www.opensource.apple.com/projects/darwin/release.html

DCP http://www.kc85.de/downloads.html

Debian GNU/Hurd http://www.debian.org/ports/hurd/hurd-cd

E.R.I.K.A http://erika.sssup.it/download.shtml

eCos http://ecos.sourceware.org/getstart.html

ELKS http://elks.sourceforge.net/download/

ERaMS http://erams.sourceforge.net/distrib.

EROS http://www.eros-os.org/project/build.html

Fiasco http://os.inf.tu-dresden.de/fiasco/download.html

Free-VMS ftp://freevms.nvg.org/pub/vms/freevms

FreeBSD http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/mirrors.html

FreeDOS http://www.freedos.org/freedos/files/

Freedows None

Linux http://www.linux.org

Menuet http://www.menuetos.org/download.htm

Minix http://www.cs.vu.nl/pub/minix/

MorphOS http://www.morphos.de/fileslinks.php3

NetBSD http://www.netbsd.org/Releases/

Oberon http://www.oberon.ethz.ch/native/

OpenBEOS http://sourceforge.net/projects/crux/

OpenBSD http://www.openbsd.org/ftp.html

Plan 9 http://plan9.bell-labs.com/plan9dist/download.html

PowerOS http://www.poweros.de/download.html

QNX http://get.qnx.com

ReactOS http://www.reactos.com/index.php?tab=software§ion=reactos

RTEMS http://www.rtems.com/RTEMS/Source/source.html

S.Ha.R.K http://shark.sssup.it/download.html

SkyOS http://www.skyos.org/downloads/

Solaris 8 http://www.sun.com/solaris/binaries/get.html

Unununium None

V2_OS http://www.v2os.cx/

VSTa http://vsta.sourceforge.net/

Winmac http://sourceforge.net/projects/winmac

xMach http://sourceforge.net/projects/xmach/

Yamit http://yamit.sourceforge.net/download.html

ZotOS http://members.tripod.com/~zot_os/public_html/download.html


http://www.haiku-os.org/get-haiku HAIKU
http://www.freebyte.com/operatingsystems/

5 Most Popular Linux Distributions

Main reason of increasing popularity of Linux is because there are many Linux distributions available to choose from. Every Linux distribution has its own strength which attracts user to adopt that Linux distribution.
As an open sourceoperating system Linux is always free to use. There are many Linux distributions are available and every distribution is trying to make Linux more easy to use and more powerful than any other OS.
5 Best Linux Distributions
Ubuntu is most popular Linux Distribution in market. With its easy installation and user friendly interface makes it more popular to new Linux switchers. It comes with many free bundle software which fulfills almost all requirements of users. Ubuntu is a community developed operating system that is perfect for laptops, desktops and servers. Whether you use it at home, at school or at work Ubuntu contains all the applications you’ll ever need, from word processing and email applications, to web server software and programming tools.
to web server software and programming tools.
Fedora
Fedora was introduced after Red Hat discontinued its Free Red Had distribution. Fedora is sponsored by Red Hat. By name Fedora can be the most popular Linux distributions as many knows it as Red Hat product. Fedora is easy to install and comes with lot of free applications. Linus Torvalds, the creator and primary maintainer of Linux use Fedora which inspire many to use Fedora.

Debian
Ubuntu Linux is based on Debian which tells Debian’s popularity. Debian GNU/Linux provides more than a pure OS: it comes with over 25113 packages, precompiled software bundled up in a nice format for easy installation on your machine.



openSUSE

openSUSE is quite user friendly Linux, with great user interface and Vista like start menu. openSUSE includes YaST (Yet another Setup Tool) to make installing applications very easy. It is not easy to install for new users. openSUSE project is sponsored by Novell. openSUSE focus on easy to use and improve hardware support.


Arch Linux



Arch Linux, a lightweight and flexible Linux distribution that tries to Keep It Simple. Arch Linux is for expert Linux user as it installs with bash commands no GUI desktop. You can install basic KDE desktop on Arch Linux. It is mostly used on web hosting servers for fast performance.