|
Course Description Who Should Attend Duration:
Certification Legal Agreement Course Outline Version 6 CEHv6 Curriculum consists of instructor-led training and self-study. The Instructor will provide the details of self-study modules to the students beginning of the class.
Module 1: Introduction to Ethical Hacking
o
Phase1-Reconnaissaance
·
Reconnaissance Types
o
Phase2-Scanning
o
Phase3-Gaining Access
o
Phase4-Maintaining Access
o
Phase5-Covering Tracks
o
Operating
System attacks
o
Application-level attacks
o
Shrink Wrap
code attacks
o
Misconfiguration attacks
o
Why Hackers
Need Vulnerability Research
o
Vulnerability Research Tools
o
Vulnerability Research Websites
·
National
Vulnerability Database (nvd.nist.gov)
·
Securitytracker (www.securitytracker.com)
·
Securiteam
(www.securiteam.com)
·
Secunia
(www.secunia.com)
·
Hackerstorm
Vulnerability Database Tool (www.hackerstrom.com)
·
HackerWatch
(www.hackerwatch.org)
·
MILWORM
Module 2: Hacking Laws
§
U.S.
Securely Protect Yourself Against Cyber Trespass Act (SPY ACT)
§
Legal
Perspective (U.S. Federal Law)
o
18 U.S.C. §
1029
·
Penalties
o
18 U.S.C. §
1030
·
Penalties
o
18 U.S.C. § 1362
o
18 U.S.C. § 2318
o
18 U.S.C. § 2320
o
18 U.S.C. § 1831
o
47 U.S.C. § 605,
unauthorized publication or use of
communications
o
Washington:
·
RCW
9A.52.110
o
Florida:
·
§ 815.01 to
815.07
o
Indiana:
§
Federal
Managers Financial Integrity Act of 1982
§
The Freedom
of Information Act 5 U.S.C. § 552
§
Federal
Information Security Management Act (FISMA)
§
The Privacy
Act Of 1974 5 U.S.C. § 552a
§
USA Patriot
Act of 2001
§
United
Kingdom’s Cyber Laws
§
United
Kingdom: Police and Justice Act 2006
§
European
Laws
§
Japan’s
Cyber Laws
§
Australia :
The Cybercrime Act 2001
§
Indian Law:
THE INFORMTION TECHNOLOGY ACT
§
Argentina
Laws
§
Germany’s
Cyber Laws
§
Singapore’s
Cyber Laws
§
Belgium
Law
§
Brazilian
Laws
§
Canadian
Laws
§
France Laws
§
German Laws
§
Italian
Laws
§
MALAYSIA: THE COMPUTER CRIMES ACT 1997
§
HONGKONG: TELECOMMUNICATIONS
§
Korea: ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK
UTILIZATION AND INFORMATION PROTECTION, ETC.
§
Greece Laws
§
Denmark
Laws
§
Netherlands
Laws
§
Norway
§
ORDINANCE
§
Mexico
§
SWITZERLAND
Module 3: Footprinting
o
Unearthing
Initial Information
·
Finding
Company’s URL
·
Internal
URL
·
Extracting
Archive of a Website
§
www.archive.org
·
Google
Search for Company’s Info
·
People
Search
§
Yahoo
People Search
§
Satellite
Picture of a Residence
§
Best
PeopleSearch
§
People-Search-America.com
§
Switchboard
§
Anacubis
§
Google
Finance
§
Yahoo
Finance
·
Footprinting through Job Sites
·
Passive
Information Gathering
·
Competitive
Intelligence Gathering
§
Why Do You
Need Competitive Intelligence?
§
Competitive
Intelligence Resource
§
Companies
Providing Competitive Intelligence Services
§
Carratu
International
§
CI Center
§
Competitive
Intelligence - When Did This Company Begin? How Did It Develop?
§
Competitive
Intelligence - Who Leads This Company
§
Competitive
Intelligence - What Are This Company's Plans
§
Competitive
Intelligence - What Does Expert Opinion Say About The Company
§
Competitive
Intelligence - Who Are The Leading Competitors?
§
Competitive
Intelligence Tool: Trellian
§
Competitive
Intelligence Tool: Web Investigator
·
Public and
Private Websites
o
Sensepost
Footprint Tools
o
Big Brother
o
BiLE Suite
o
Alchemy
Network Tool
o
Advanced
Administrative Tool
o
My IP Suite
o
Wikto
Footprinting Tool
o
Whois
Lookup
o
Whois
o
SmartWhois
o
ActiveWhois
o
LanWhois
o
CountryWhois
o
WhereIsIP
o
Ip2country
o
CallerIP
o
Web Data
Extractor Tool
o
Online
Whois Tools
o
What is
MyIP
o
DNS
Enumerator
o
SpiderFoot
o
Nslookup
o
Extract DNS
Information
o
Expired
Domains
o
DomainKing
o
Domain Name
Analyzer
o
DomainInspect
o
MSR Strider
URL Tracer
o
Mozzle
Domain Name Pro
o
Domain
Research Tool (DRT)
o
Domain
Status Reporter
o
Reggie
o
Locate the
Network Range
·
ARIN
·
Traceroute
§
Traceroute
Analysis
·
3D
Traceroute
·
NeoTrace
·
VisualRoute
Trace
·
Path
Analyzer Pro
·
Maltego
·
Layer Four
Traceroute
·
Prefix
WhoIs widget
·
Touchgraph
·
VisualRoute
Mail Tracker
·
eMailTrackerPro
·
Read Notify
o
1st
E-mail Address Spider
o
Power
E-mail Collector Tool
o
GEOSpider
o
Geowhere
Footprinting Tool
o
Google
Earth
o
Kartoo
Search Engine
o
Dogpile
(Meta Search Engine)
o
Tool:
WebFerret
o
robots.txt
o
WTR - Web
The Ripper
o
Website
Watcher
Module 4: Google Hacking
§
What is Google hacking
§
What a hacker can do with vulnerable site
§
Anonymity
with Caches
§
Using
Google as a Proxy Server
§
Directory
Listings
o
Locating
Directory Listings
o
Finding
Specific Directories
o
Finding
Specific Files
o
Server
Versioning
§
Going Out
on a Limb: Traversal Techniques
o
Directory
Traversal
o
Incremental
Substitution
§
Extension
Walking
o
admin login
o
Locating
Exploits Via Common Code Strings
o
Locating
Targets Via Demonstration Pages
o
Locating
Targets Via Source Code
o
Locating
Targets Via CGI Scanning
o
Finding IIS
5.0 Servers
o
IIS HTTP/1.1 Error Page Titles
o
“Object Not Found” Error Message
Used to Find IIS 5.0
o
Apache Web
Server
o
ASP Dumps
Provide Dangerous Details
o
Many Errors
Reveal Pathnames and Filenames
o
CGI
Environment Listings Reveal Lots of Information
o
A Typical
Apache Default Web Page
o
Locating
Default Installations of IIS 4.0 on Windows NT 4.0/OP
o
Default
Pages Query for Web Server
o
Outlook Web
Access Default Portal
o
Windows
Registry Entries Can Reveal Passwords
o
Usernames,
Cleartext Passwords, and Hostnames!
Module 5: Scanning
o
Checking
for live systems - ICMP Scanning
·
Angry IP
·
HPing2
·
Ping Sweep
·
Firewalk
Tool
·
Firewalk
Commands
·
Firewalk
Output
·
Nmap
·
Nmap: Scan
Methods
·
NMAP Scan
Options
·
NMAP Output
Format
·
TCP
Communication Flags
·
Three Way
Handshake
o
Syn
Stealth/Half Open Scan
o
Stealth
Scan
o
Xmas Scan
o
Fin Scan
o
Null Scan
o
Idle Scan
o
ICMP Echo
Scanning/List Scan
o
TCP
Connect/Full Open Scan
o
FTP Bounce
Scan
·
Ftp Bounce
Attack
o
SYN/FIN
Scanning Using IP Fragments
o
UDP
Scanning
o
Reverse
Ident Scanning
o
RPC Scan
o
Window Scan
o
Blaster
Scan
o
Portscan
Plus, Strobe
o
IPSec Scan
o
Netscan
Tools Pro
o
WUPS – UDP
Scanner
o
Superscan
o
IPScanner
o
Global
Network Inventory Scanner
o
Net Tools
Suite Pack
o
Floppy Scan
o
FloppyScan
Steps
o
E-mail
Results of FloppyScan
o
Atelier Web
Ports Traffic Analyzer (AWPTA)
o
Atelier Web Security Port Scanner (AWSPS)
o
IPEye
o
ike-scan
o
Infiltrator Network Security Scanner
o
YAPS: Yet Another Port Scanner
o
Advanced Port Scanner
o
NetworkActiv Scanner
o
NetGadgets
o
P-Ping Tools
o
MegaPing
o
LanSpy
o
HoverIP
o
LANView
o
NetBruteScanner
o
SolarWinds Engineer’s Toolset
o
AUTAPF
o
OstroSoft Internet Tools
o
Advanced IP Scanner
o
Active Network Monitor
o
Advanced Serial Data Logger
o
Advanced Serial Port Monitor
o
WotWeb
o
Antiy Ports
o
Port Detective
o
Roadkil’s Detector
o
Portable Storage Explorer
o
Why War
Dialing
o
Wardialing
o
Phonesweep
– War Dialing Tool
o
THC Scan
o
ToneLoc
o
ModemScan
o
War Dialing
Countermeasures: Sandtrap Tool
o
OS
Fingerprinting
·
Active
Stack Fingerprinting
·
Passive
Fingerprinting
o
Active
Banner Grabbing Using Telnet
o
GET
REQUESTS
o
P0f –
Banner Grabbing Tool
o
p0f for
Windows
o
Httprint
Banner Grabbing Tool
o
Tool: Miart
HTTP Header
o
Tools for
Active Stack Fingerprinting
·
Xprobe2
·
Ringv2
·
Netcraft
o
Disabling
or Changing Banner
o
IIS
Lockdown Tool
o
Tool:
ServerMask
o
Hiding File
Extensions
o
Tool:
PageXchanger
o
Bidiblah
Automated Scanner
o
Qualys Web
Based Scanner
o
SAINT
o
ISS
Security Scanner
o
Nessus
o
GFI
Languard
o
Security
Administrator’s Tool for Analyzing Networks (SATAN)
o
Retina
o
Nagios
o
PacketTrap's pt360 Tool Suite
o
NIKTO
§
SAFEsuite
Internet Scanner, IdentTCPScan
o
Cheops
o
Friendly
Pinger
o
LANsurveyor
o
Ipsonar
o
LANState
§
Insightix
Visibility
§
IPCheck
Server Monitor
§
PRTG
Traffic Grapher
o
Proxy
Servers
o
Free Proxy
Servers
o
Use of
Proxies for Attack
o
SocksChain
o
Proxy
Workbench
o
Proxymanager Tool
o
Super Proxy
Helper Tool
o
Happy
Browser Tool (Proxy Based)
o
Multiproxy
o
Tor Proxy
Chaining Software
o
Additional
Proxy Tools
o
Anonymizers
·
Surfing Anonymously
·
Primedius
Anonymizer
·
StealthSurfer
·
Anonymous
Surfing: Browzar
·
Torpark
Browser
·
GetAnonymous
·
IP Privacy
·
Anonymity 4
Proxy (A4Proxy)
·
Psiphon
·
Connectivity Using Psiphon
·
AnalogX
Proxy
·
NetProxy
·
Proxy+
·
ProxySwitcher Lite
·
JAP
·
Proxomitron
o
Google
Cookies
·
G-Zapper
o
SSL Proxy
Tool
o
How to Run
SSL Proxy
o
HTTP
Tunneling Techniques
·
Why Do I
Need HTTP Tunneling
·
Httptunnel
for Windows
·
How to Run
Httptunnel
·
HTTP-Tunnel
·
HTTPort
o
Spoofing IP
Address
·
Spoofing IP
Address Using Source Routing
·
Detection
of IP Spoofing
·
Despoof
Tool
Module 6: Enumeration
o
So What's
the Big Deal
o
DumpSec
Tool
o
NetBIOS
Enumeration Using Netview
·
Nbtstat
Enumeration Tool
·
SuperScan
·
Enum Tool
o
Enumerating
User Accounts
·
GetAcct
o
Null
Session Countermeasure
o
PsExec
o
PsFile
o
PsGetSid
o
PsKill
o
PsInfo
o
PsList
o
PsLogged On
o
PsLogList
o
PsPasswd
o
PsService
o
PsShutdown
o
PsSuspend
o
Management
Information Base (MIB)
o
SNMPutil
Example
o
SolarWinds
o
SNScan
o
Getif SNMP
MIB Browser
o
UNIX
Enumeration
o
SNMP UNIX
Enumeration
o
SNMP
Enumeration Countermeasures
o
LDAP
enumeration
o
JXplorer
o
LdapMiner
o
Softerra
LDAP Browser
o
NTP
enumeration
o
SMTP
enumeration
o
Smtpscan
o
Web
enumeration
o
Asnumber
o
Lynx
o
Windows
Active Directory Attack Tool
o
How To Enumerate Web Application Directories in IIS Using DirectoryServices
§
Tools:
o
NBTScan
o
NetViewX
o
FREENETENUMERATOR
o
Terminal Service Agent
o
TXNDS
o
Unicornscan
o
Amap
o
Netenum
Module 7: System Hacking
o
CEH hacking
Cycle
o
Password
Types
o
Types of
Password Attack
·
Passive
Online Attack: Wire Sniffing
·
Passive
Online Attack: Man-in-the-middle and replay attacks
·
Active
Online Attack: Password
Guessing
·
Offline
Attacks
Ø
Brute force
Attack
Ø
Pre-computed Hashes
Ø
Syllable
Attack/Rule-based Attack/ Hybrid attacks
Ø
Distributed
network Attack
Ø
Rainbow
Attack
·
Non-Technical Attacks
o
Default
Password Database
§
http://www.defaultpassword.com/
§
http://www.cirt.net/cgi-bin/passwd.pl
§
http://www.virus.org/index.php?
o
PDF
Password Cracker
o
Abcom PDF
Password Cracker
o
Password
Mitigation
o
Permanent
Account Lockout-Employee Privilege Abuse
o
Administrator Password Guessing
·
Manual
Password cracking Algorithm
·
Automatic
Password Cracking Algorithm
o
Performing
Automated Password Guessing
·
Tool: NAT
·
Smbbf (SMB
Passive Brute Force Tool)
·
SmbCrack
Tool: Legion
·
Hacking
Tool: LOphtcrack
o
Microsoft
Authentication
·
LM, NTLMv1,
and NTLMv2
·
NTLM And LM
Authentication On The Wire
·
Kerberos
Authentication
·
What is LAN
Manager Hash?
Ø
LM “Hash”
Generation
Ø
LM Hash
·
Salting
·
PWdump2 and
Pwdump3
·
Tool:
Rainbowcrack
·
Hacking
Tool: KerbCrack
·
Hacking
Tool: NBTDeputy
·
NetBIOS DoS
Attack
·
Hacking
Tool: John the Ripper
o
Password
Sniffing
o
How to
Sniff SMB Credentials?
o
SMB Replay
Attacks
o
Replay
Attack Tool: SMBProxy
o
SMB Signing
o
Tool: LCP
o
Tool:
SID&User
o
Tool:
Ophcrack 2
o
Tool: Crack
o
Tool:
Access PassView
o
Tool:
Asterisk Logger
o
Tool: CHAOS
Generator
o
Tool:
Asterisk Key
o
Password
Recovery Tool:
MS Access Database Password Decoder
o
Password
Cracking Countermeasures
o
Do Not
Store LAN Manager Hash in SAM Database
o
LM Hash
Backward Compatibility
o
How to
Disable LM HASH
o
Password
Brute-Force Estimate Tool
o
Syskey
Utility
o
AccountAudit
o
CEH Hacking
Cycle
o
Privilege
Escalation
o
Cracking
NT/2000 passwords
o
Active@
Password Changer
·
Change
Recovery Console Password -
Method 1
·
Change
Recovery Console Password -
Method 2
o
Privilege
Escalation Tool: x.exe
o
CEH Hacking
Cycle
o
Tool:
psexec
o
Tool:
remoexec
o
Ras N Map
o
Tool:
Alchemy Remote Executor
o
Emsa
FlexInfo Pro
o
Keystroke
Loggers
o
E-mail
Keylogger
o
Revealer
Keylogger Pro
o
Handy
Keylogger
o
Ardamax
Keylogger
o
Powered
Keylogger
o
Quick
Keylogger
o
Spy-Keylogger
o
Perfect
Keylogger
o
Invisible
Keylogger
o
Actual Spy
o
SpyToctor
FTP Keylogger
o
IKS
Software Keylogger
o
Ghost
Keylogger
o
Hacking
Tool: Hardware Key Logger
o
What is
Spyware?
o
Spyware:
Spector
o
Remote Spy
o
Spy Tech
Spy Agent
o
007 Spy
Software
o
Spy Buddy
o
Ace Spy
o
Keystroke
Spy
o
Activity
Monitor
o
Hacking
Tool: eBlaster
o
Stealth
Voice Recorder
o
Stealth
Keylogger
o
Stealth
Website Logger
o
Digi
Watcher Video Surveillance
o
Desktop Spy
Screen Capture Program
o
Telephone
Spy
o
Print
Monitor Spy Tool
o
Stealth
E-Mail Redirector
o
Spy
Software: Wiretap Professional
o
Spy
Software: FlexiSpy
o
PC
PhoneHome
o
Keylogger
Countermeasures
o
Anti
Keylogger
o
Advanced
Anti Keylogger
o
Privacy
Keyboard
o
Spy Hunter
- Spyware Remover
o
Spy Sweeper
o
Spyware
Terminator
o
WinCleaner
AntiSpyware
o
CEH Hacking
Cycle
o
Hiding
Files
o
RootKits
·
Why
rootkits
·
Hacking
Tool: NT/2000 Rootkit
·
Planting
the NT/2000 Rootkit
·
Rootkits in
Linux
·
Detecting
Rootkits
·
Steps for
Detecting Rootkits
·
Rootkit
Detection Tools
·
Sony
Rootkit Case Study
·
Rootkit: Fu
·
AFX Rootkit
·
Rootkit:
Nuclear
·
Rootkit:
Vanquish
·
Rootkit
Countermeasures
·
Patchfinder
·
RootkitRevealer
o
Creating
Alternate Data Streams
o
How to
Create NTFS Streams?
·
NTFS Stream
Manipulation
·
NTFS
Streams Countermeasures
·
NTFS Stream
Detectors (ADS Spy and ADS Tools)
·
Hacking
Tool: USB Dumper
o
What is
Steganography?
·
Steganography Techniques
§
Least
Significant Bit Insertion in Image files
§
Process of
Hiding Information in Image Files
§
Masking and
Filtering in Image files
§
Algorithms
and transformation
·
Tool: Merge
Streams
·
Invisible
Folders
·
Tool:
Invisible Secrets
·
Tool :
Image Hide
·
Tool:
Stealth Files
·
Tool:
Steganography
·
Masker
Steganography Tool
·
Hermetic
Stego
·
DCPP – Hide
an Operating System
·
Tool:
Camera/Shy
·
www.spammimic.com
·
Tool:
Mp3Stego
·
Tool:
Snow.exe
·
Steganography Tool: Fort Knox
·
Steganography Tool: Blindside
·
Steganography Tool: S- Tools
·
Steganography Tool: Steghide
·
Tool:
Steganos
·
Steganography Tool: Pretty Good Envelop
·
Tool:
Gifshuffle
·
Tool:
JPHIDE and JPSEEK
·
Tool:
wbStego
·
Tool:
OutGuess
·
Tool: Data
Stash
·
Tool: Hydan
·
Tool: Cloak
·
Tool:
StegoNote
·
Tool:
Stegomagic
·
Steganos
Security Suite
·
C
Steganography
·
Isosteg
·
FoxHole
·
Video
Steganography
·
Case Study:
Al-Qaida members Distributing Propaganda to Volunteers
using Steganography
·
Steganalysis
·
Steganalysis Methods/Attacks on Steganography
·
Stegdetect
·
SIDS
·
High-Level
View
·
Tool:
dskprobe.exe
·
Stego
Watch- Stego Detection Tool
·
StegSpy
o
CEH Hacking
Cycle
o
Covering
Tracks
o
Disabling
Auditing
o
Clearing
the Event Log
o
Tool:
elsave.exe
o
Hacking
Tool: Winzapper
o
Evidence
Eliminator
o
Tool:
Traceless
o
Tool:
Tracks Eraser Pro
o
Armor Tools
o
Tool:
ZeroTracks
o
PhatBooster
Module 8: Trojans and Backdoors
o
Overt and
Covert Channels
o
Working of
Trojans
o
Different
Types of Trojans
§
Remote
Access Trojans
§
Data-Sending Trojans
§
Destructive
Trojans
§
Denial-of-Service (DoS) Attack Trojans
§
Proxy
Trojans
§
FTP Trojans
§
Security
Software Disablers
o
What do
Trojan Creators Look for?
o
Different
Ways a Trojan can Get into a System
o
How to
Determine which Ports are Listening
o
Trojan:
iCmd
o
MoSucker
Trojan
o
Proxy
Server Trojan
o
SARS Trojan
Notification
o
Wrappers
o
Wrapper
Covert Program
o
Wrapping
Tools
o
One Exe
Maker / YAB / Pretator Wrappers
o
Packaging
Tool: WordPad
o
RemoteByMail
o
Tool: Icon
Plus
o
Defacing
Application: Restorator
o
Tetris
o
HTTP
Trojans
o
Trojan
Attack through Http
o
HTTP Trojan
(HTTP RAT)
o
Shttpd
Trojan - HTTP Server
o
Reverse
Connecting Trojans
o
Nuclear RAT
Trojan (Reverse Connecting)
o
Tool:
BadLuck Destructive Trojan
o
ICMP
Tunneling
o
ICMP
Backdoor Trojan
o
Microsoft
Network Hacked by QAZ Trojan
o
Backdoor.Theef (AVP)
o
T2W
(TrojanToWorm)
o
Biorante
RAT
o
DownTroj
o
Turkojan
o
Trojan.Satellite-RAT
o
Yakoza
o
DarkLabel
B4
o
Trojan.Hav-Rat
o
Poison Ivy
o
Rapid
Hacker
o
SharK
o
HackerzRat
o
TYO
o
1337 Fun
Trojan
o
Criminal
Rat Beta
o
VicSpy
o
Optix PRO
o
ProAgent
o
OD Client
o
AceRat
o
Mhacker-PS
o
RubyRAT
Public
o
SINner
o
ConsoleDevil
o
ZombieRat
o
FTP Trojan
- TinyFTPD
o
VNC Trojan
o
Webcam
Trojan
o
DJI RAT
o
Skiddie Rat
o
Biohazard
RAT
o
Troya
o
ProRat
o
Dark Girl
o
DaCryptic
o
Net-Devil
o
Trojan:
Tini
o
Trojan:
NetBus
o
Trojan:
Netcat
o
Netcat
Client/Server
o
Netcat
Commands
o
Trojan:
Beast
o
Trojan:
Phatbot
o
Trojan:
Amitis
o
Trojan:
Senna Spy
o
Trojan: QAZ
o
Trojan:
Back Orifice
o
Trojan:
Back Oriffice 2000
o
Back
Oriffice Plug-ins
o
Trojan:
SubSeven
o
Trojan:
CyberSpy Telnet Trojan
o
Trojan:
Subroot Telnet Trojan
o
Trojan: Let
Me Rule! 2.0 BETA 9
o
Trojan:
Donald Dick
o
Netstat
o
fPort
o
TCPView
o
CurrPorts
Tool
o
Process
Viewer
o
Delete
Suspicious Device Drivers
o
Check for
Running Processes: What’s on My Computer
o
Super
System Helper Tool
o
Inzider-Tracks Processes and Ports
o
Tool:
What’s Running
o
MS
Configuration Utility
o
Registry-
What’s Running
o
Autoruns
o
Hijack This
(System Checker)
o
Startup
List
§
TrojanHunter
§
Comodo
BOClean
§
Trojan
Remover: XoftspySE
§
Trojan
Remover: Spyware Doctor
§
SPYWAREfighter
Module 9: Viruses and Worms
o
Infection
Phase
o
Attack
Phase
§
Mode of
Virus Infection
o
System
Sector virus
o
Stealth
Virus
o
Bootable
CD-Rom Virus
·
Self
-Modification
·
Encryption
with a Variable Key
o
Polymorphic
Code
o
Metamorphic
Virus
o
Cavity
Virus
o
Sparse
Infector Virus
o
Companion
Virus
o
File
Extension Virus
o
Virus:
Win32.AutoRun.ah
o
Virus:W32/Virut
o
Virus:W32/Divvi
o
Worm.SymbOS.Lasco.a
o
Disk Killer
o
Bad Boy
o
HappyBox
o
Java.StrangeBrew
o
MonteCarlo
Family
o
PHP.Neworld
o
W32/WBoy.a
o
ExeBug.d
o
W32/Voterai.worm.e
o
W32/Lecivio.worm
o
W32/Lurka.a
o
W32/Vora.worm!p2p
o
AVG
Antivirus
o
Norton
Antivirus
o
McAfee
o
Socketsheild
o
BitDefender
o
ESET Nod32
o
CA
Anti-Virus
o
F-Secure
Anti-Virus
o
Kaspersky
Anti-Virus
o
F-Prot
Antivirus
o
Panda
Antivirus Platinum
o
avast!
Virus Cleaner
o
ClamWin
o
Norman
Virus Control
Module 10: Sniffers
o
Passive
Sniffing
o
Active
Sniffing
o
ARP
Spoofing Attack
o
How does
ARP Spoofing Work
o
ARP Poising
o
MAC
Duplicating
o
MAC
Duplicating Attack
o
Tools for
ARP Spoofing
·
Ettercap
·
ArpSpyX
o
MAC
Flooding
·
Tools for
MAC Flooding
Ø
Linux Tool:
Macof
Ø
Windows
Tool: Etherflood
o
Threats of
ARP Poisoning
o
Irs-Arp
Attack Tool
o
ARPWorks
Tool
o
Tool:
Nemesis
o
IP-based sniffing
o
Linux tool:
Arpspoof
o
Linux Tool:
Dnssppoof
o
Linux Tool:
Dsniff
o
Linux Tool:
Filesnarf
o
Linux Tool:
Mailsnarf
o
Linux Tool:
Msgsnarf
o
Linux Tool:
Sshmitm
o
Linux Tool:
Tcpkill
o
Linux Tool:
Tcpnice
o
Linux Tool:
Urlsnarf
o
Linux Tool:
Webspy
o
Linux Tool:
Webmitm
o
Intranet
DNS Spoofing (Local Network)
o
Internet
DNS Spoofing (Remote Network)
o
Proxy
Server DNS Poisoning
o
DNS Cache
Poisoning
o
HTTP
Sniffer: EffeTech
o
Ace
Password Sniffer
o
Win Sniffer
o
MSN Sniffer
o
SmartSniff
o
Session
Capture Sniffer: NetWitness
o
Session
Capture Sniffer: NWreader
o
Packet
Crafter Craft Custom TCP/IP Packets
o
SMAC
o
NetSetMan
Tool
o
Ntop
o
EtherApe
o
Network
Probe
o
Maa Tec
Network Analyzer
o
Tool: Snort
o
Tool:
Windump
o
Tool:
Etherpeek
o
NetIntercept
o
Colasoft
EtherLook
o
AW Ports
Traffic Analyzer
o
Colasoft
Capsa Network Analyzer
o
CommView
o
Sniffem
o
NetResident
o
IP Sniffer
o
Sniphere
o
IE HTTP
Analyzer
o
BillSniff
o
URL Snooper
o
EtherDetect
Packet Sniffer
o
EffeTech
HTTP Sniffer
o
AnalogX
Packetmon
o
Colasoft
MSN Monitor
o
IPgrab
o
EtherScan
Analyzer
o
Antisniff
Tool
o
Arpwatch
Tool
o
PromiScan
o
proDETECT
Module 11: Social Engineering
o
Human-Based
Social Engineering
·
Technical
Support Example
·
More Social
Engineering Examples
·
Human-Based
Social Engineering: Eavesdropping
·
Human-Based
Social Engineering: Shoulder Surfing
·
Human-Based
Social Engineering: Dumpster Diving
·
Dumpster
Diving Example
·
Oracle
Snoops Microsoft’s Trash Bins
·
Movies to
Watch for Reverse Engineering
o
Computer
Based Social Engineering
o
Insider
Attack
o
Disgruntled
Employee
o
Preventing
Insider Threat
o
Common
Targets of Social Engineering
§
Social Engineering Threats
o
Online
o
Telephone
o
Personal approaches
o
Defenses Against Social Engineering Threats
§
Factors that make Companies Vulnerable to Attacks
§
Why is Social Engineering Effective
§
Warning Signs of an Attack
§
Tool : Netcraft Anti-Phishing Toolbar
§
Phases in a
Social Engineering Attack
§
Behaviors
Vulnerable to Attacks
§
Impact on
the Organization
§
Countermeasures
§
Policies
and Procedures
§
Security
Policies - Checklist
§
Impersonating Orkut, Facebook, MySpace
§
Orkut
§
Impersonating on Orkut
§
MW.Orc worm
§
Facebook
§
Impersonating on Facebook
§
MySpace
§
Impersonating on MySpace
§
How to
Steal Identity
§
Comparison
§
Original
§
Identity
Theft
§
http://www.consumer.gov/idtheft/
Module 12: Phishing
§
Phishing
§
Introduction
§
Reasons for
Successful Phishing
§
Phishing
Methods
§
Process of
Phishing
§
Types of
Phishing Attacks
o
Man-in-the-Middle Attacks
o
URL
Obfuscation Attacks
o
Cross-site
Scripting Attacks
o
Hidden
Attacks
o
Client-side
Vulnerabilities
o
Deceptive
Phishing
o
Malware-Based Phishing
o
DNS-Based
Phishing
o
Content-Injection Phishing
o
Search
Engine Phishing
§
Phishing
Statistics: Feb’ 2008
§
Anti-Phishing
§
Anti-Phishing Tools
o
PhishTank
SiteChecker
o
NetCraft
o
GFI
MailEssentials
o
SpoofGuard
o
Phishing
Sweeper Enterprise
o
TrustWatch
Toolbar
o
ThreatFire
o
GralicWrap
o
Spyware
Doctor
o
Track
Zapper Spyware-Adware Remover
o
AdwareInspector
o
Email-Tag.com
Module 13: Hacking Email Accounts
Module 14: Denial-of-Service
o
Smurf
Attack
o
Buffer
Overflow Attack
o
Ping of
Death Attack
o
Teardrop
Attack
o
SYN Attack
o
SYN
Flooding
o
DoS Attack
Tools
o
DoS Tool:
Jolt2
o
DoS Tool:
Bubonic.c
o
DoS Tool:
Land and LaTierra
o
DoS Tool:
Targa
o
DoS Tool:
Blast
o
DoS Tool:
Nemesy
o
DoS Tool:
Panther2
o
DoS Tool:
Crazy Pinger
o
DoS Tool:
SomeTrouble
o
DoS Tool:
UDP Flood
o
DoS Tool:
FSMax
o
DDoS Tool:
Trinoo
o
DDoS Tool:
Tribal Flood Network
o
DDoS Tool:
TFN2K
o
DDoS Tool:
Stacheldraht
o
DDoS Tool:
Shaft
o
DDoS Tool:
Trinity
o
DDoS Tool:
Knight and Kaiten
o
DDoS Tool:
Mstream
Module
15: Session Hijacking
o
RST
Hijacking Tool: hijack_rst.sh
o
Juggernaut
o
Hunt
o
TTY-Watcher
o
IP watcher
o
Session
Hijacking Tool: T-Sight
o
Remote TCP
Session Reset Utility (SOLARWINDS)
o
Paros HTTP
Session Hijacking Tool
o
Dnshijacker
Tool
o
Hjksuite
Tool
Module 16: Hacking Web Servers
o
How are
Servers Defaced
o
IIS
Components
o
IIS
Directory Traversal (Unicode) Attack
o
Unicode
Directory Traversal Vulnerability
o
Hacking
Tool: IISxploit.exe
o
Msw3prt IPP
Vulnerability
o
RPC DCOM
Vulnerability
o
ASP Trojan
o
IIS Logs
o
Network
Tool: Log Analyzer
o
Hacking
Tool: CleanIISLog
o
IIS
Security Tool: Server Mask
o
ServerMask
ip100
o
Tool:
CacheRight
o
Tool:
CustomError
o
Tool:
HttpZip
o
Tool:
LinkDeny
o
Tool:
ServerDefender AI
o
Tool:
ZipEnable
o
Tool:
w3compiler
o
Yersinia
o
Solution:
UpdateExpert
o
Patch
Management Tool: qfecheck
o
Patch
Management Tool: HFNetChk
o
cacls.exe
utility
o
Shavlik
NetChk Protect
o
Kaseya
Patch Management
o
IBM Tivoli
Configuration Manager
o
LANDesk
Patch Manager
o
BMC Patch
Manager
o
ConfigureSoft Enterprise Configuration Manager (ECM)
o
BladeLogic
Configuration Manager
o
Opsware
Server Automation System (SAS)
o
Best
Practices for Patch Management
o
ServersCheck Monitoring
o
GFI Network
Server Monitor
o
Servers
Alive
o
Webserver
Stress Tool
o
Monitoring
Tool: Secunia PSI
Module 17: Web Application Vulnerabilities
o
An Example
of XSS
o
Countermeasures
o
Countermeasures
o
Countermeasures
o
Countermeasures
o
Countermeasures
o
Countermeasures
o
Countermeasures
o
Web
Services Attacks
o
Zero-Day
Attacks
o
Network
Access Attacks
o
Instant
Source
o
Wget
o
WebSleuth
o
BlackWidow
o
SiteScope
Tool
o
WSDigger
Tool – Web Services Testing Tool
o
CookieDigger Tool
o
SSLDigger
Tool
o
SiteDigger
Tool
o
WindowBomb
o
Burp:
Positioning Payloads
o
Burp:
Configuring Payloads and Content Enumeration
o
Burp:
Password Guessing
o
Burp Proxy
o
Burpsuite
o
Hacking
Tool: cURL
o
dotDefender
o
Acunetix
Web Scanner
o
AppScan –
Web Application Scanner
o
AccessDiver
o
Tool:
Falcove Web Vulnerability Scanner
o
Tool:
NetBrute
o
Tool: Emsa
Web Monitor
o
Tool:
KeepNI
o
Tool:
Parosproxy
o
Tool:
WebScarab
o
Tool:
Watchfire AppScan
o
Tool:
WebWatchBot
o
Tool:
Mapper
Module 18:
Web-Based Password Cracking Techniques
o
HTTP
Authentication
·
Basic
Authentication
·
Digest
Authentication
o
Integrated
Windows (NTLM) Authentication
o
Negotiate
Authentication
o
Certificate-based Authentication
o
Forms-based
Authentication
o
RSA SecurID
Token
o
Biometrics
Authentication
·
Types of
Biometrics Authentication
Ø
Fingerprint-based Identification
Ø
Hand
Geometry- based Identification
Ø
Retina
Scanning
Ø
Afghan
Woman Recognized After 17 Years
Ø
Face
Recognition
Ø
Face Code:
WebCam Based Biometrics Authentication System
o
Password
Guessing
o
Query
String
o
Cookies
o
Dictionary
Maker
o
L0phtCrack
(LC4)
o
John the
Ripper
o
Brutus
o
ObiWaN
o
Authforce
o
Hydra
o
Cain & Abel
o
RAR
o
Gammaprog
o
WebCracker
o
Munga Bunga
o
PassList
o
SnadBoy
o
MessenPass
o
Wireless
WEP Key Password Spy
o
RockXP
o
Password
Spectator Pro
o
Passwordstate
o
Atomic
Mailbox Password Cracker
o
Advanced
Mailbox Password Recovery (AMBPR)
o
Tool:
Network Password Recovery
o
Tool: Mail
PassView
o
Tool:
Messenger Key
o
Tool:
SniffPass
o
WebPassword
o
Password
Administrator
o
Password
Safe
o
Easy Web
Password
o
PassReminder
o
My Password
Manager
Module
19: SQL Injection
o
Hacking
Tool: SQLDict
o
Hacking
Tool: SQLExec
o
SQL Server
Password Auditing Tool: sqlbf
o
Hacking
Tool: SQLSmack
o
Hacking
Tool: SQL2.exe
o
sqlmap
o
sqlninja
o
SQLIer
o
Automagic
SQL Injector
o
Absinthe
o
Blind SQL
Injection: Countermeasure
o
Blind SQL
Injection Schema
Module 20: Hacking Wireless Networks
§
Introduction to Wireless
o
Introduction to Wireless Networking
o
Wired
Network vs. Wireless Network
o
Effects of
Wireless Attacks on Business
o
Types of
Wireless Network
o
Advantages
and Disadvantages of a Wireless Network
§
Wireless
Standards
o
Wireless
Standard: 802.11a
o
Wireless
Standard: 802.11b – “WiFi”
o
Wireless
Standard: 802.11g
o
Wireless
Standard: 802.11i
o
Wireless
Standard: 802.11n
§
Wireless
Concepts and Devices
o
Related
Technology and Carrier Networks
o
Antennas
o
Cantenna –
www.cantenna.com
o
Wireless
Access Points
o
SSID
o
Beacon
Frames
o
Is the SSID
a Secret
o
Setting up
a WLAN
o
Authentication and Association
o
Authentication Modes
o
The 802.1X
Authentication Process
§
WEP and WPA
o
Wired
Equivalent Privacy (WEP)
o
WEP Issues
o
WEP -
Authentication Phase
o
WEP -
Shared Key Authentication
o
WEP -
Association Phase
o
WEP Flaws
o
What is WPA
o
WPA
Vulnerabilities
o
WEP, WPA,
and WPA2
o
WPA2 Wi-Fi
Protected Access 2
§
Attacks and
Hacking Tools
o
Terminologies
o
WarChalking
o
Authentication and (Dis) Association Attacks
o
WEP Attack
o
Cracking
WEP
o
Weak Keys
(a.k.a. Weak IVs)
o
Problems
with WEP’s Key Stream and Reuse
o
Automated
WEP Crackers
o
Pad-Collection Attacks
o
XOR
Encryption
o
Stream
Cipher
o
WEP Tool:
Aircrack
o
Aircrack-ng
o
WEP Tool:
AirSnort
o
WEP Tool:
WEPCrack
o
WEP Tool:
WepLab
o
Attacking
WPA Encrypted Networks
o
Attacking
WEP with WEPCrack on Windows using Cygwin
o
Attacking
WEP with WEPCrack on Windows using PERL Interpreter
o
Tool:
Wepdecrypt
o
WPA-PSK
Cracking Tool: CowPatty
o
802.11
Specific Vulnerabilities
o
Evil Twin:
Attack
o
Rogue
Access Points
o
Tools to
Generate Rogue Access Points: Fake AP
o
Tools to
Detect Rogue Access Points:
Netstumbler
o
Tools to
Detect Rogue Access Points: MiniStumbler
o
ClassicStumbler
o
AirFart
o
AP Radar
o
Hotspotter
o
Cloaked
Access Point
o
WarDriving
Tool: shtumble
o
Temporal
Key Integrity Protocol (TKIP)
o
LEAP:
The Lightweight Extensible Authentication Protocol
o
LEAP
Attacks
o
LEAP Attack
Tool: ASLEAP
o
Working of
ASLEAP
o
MAC
Sniffing and AP Spoofing
o
Defeating
MAC Address Filtering in Windows
o
Manually
Changing the MAC Address in Windows XP and 2000
o
Tool to
Detect MAC Address Spoofing:
Wellenreiter
o
Man-in-the-Middle Attack (MITM)
o
Denial-of-Service Attacks
o
DoS Attack
Tool: Fatajack
o
Hijacking
and Modifying a Wireless Network
o
Phone
Jammers
o
Phone
Jammer: Mobile Blocker
o
Pocket
Cellular Style Cell Phone Jammer
o
2.4Ghz
Wi-Fi & Wireless Camera Jammer
o
3 Watt
Digital Cell Phone Jammer
o
3 Watt Quad
Band Digital Cellular Mobile Phone Jammer
o
20W Quad
Band Digital Cellular Mobile Phone Jammer
o
40W Digital Cellular Mobile Phone Jammer
o
Detecting a
Wireless Network
§
Scanning
Tools
o
Scanning
Tool: Kismet
o
Scanning
Tool: Prismstumbler
o
Scanning
Tool: MacStumbler
o
Scanning
Tool: Mognet V1.16
o
Scanning
Tool: WaveStumbler
o
Scanning
Tool: Netchaser V1.0 for Palm
Tops
o
Scanning
Tool: AP Scanner
o
Scanning
Tool: Wavemon
o
Scanning
Tool: Wireless Security Auditor (WSA)
o
Scanning
Tool: AirTraf
o
Scanning
Tool: WiFi Finder
o
Scanning
Tool: WifiScanner
o
eEye Retina
WiFI
o
Simple
Wireless Scanner
o
wlanScanner
§
Sniffing
Tools
o
Sniffing
Tool: AiroPeek
o
Sniffing
Tool: NAI Wireless Sniffer
o
MAC
Sniffing Tool: WireShark
o
Sniffing
Tool: vxSniffer
o
Sniffing
Tool: Etherpeg
o
Sniffing
Tool: Drifnet
o
Sniffing
Tool: AirMagnet
o
Sniffing
Tool: WinDump
o
Sniffing
Tool: Ssidsniff
o
Multiuse
Tool: THC-RUT
o
Tool:
WinPcap
o
Tool:
AirPcap
o
AirPcap:
Example Program from the Developer's Pack
o
Microsoft
Network Monitor
§
Hacking
Wireless Networks
o
Steps for
Hacking Wireless Networks
o
Step 1:
Find Networks to Attack
o
Step 2:
Choose the Network to Attack
o
Step 3:
Analyzing the Network
o
Step 4:
Cracking the WEP Key
o
Step 5:
Sniffing the Network
§
Wireless
Security
o
WIDZ:
Wireless Intrusion Detection System
o
Radius:
Used as Additional Layer in Security
o
Securing
Wireless Networks
o
Wireless
Network Security Checklist
o
WLAN
Security: Passphrase
o
Don’ts in
Wireless Security
§
Wireless
Security Tools
o
WLAN
Diagnostic Tool: CommView for WiFi PPC
o
WLAN
Diagnostic Tool: AirMagnet Handheld Analyzer
o
Auditing
Tool: BSD-Airtools
o
AirDefense
Guard (www.AirDefense.com)
o
Google
Secure Access
o
Tool:
RogueScanner
Module 21: Physical Security
o
Physical
Security Checklist -Company surroundings
o
Gates
o
Security
Guards
o
Physical
Security Checklist: Premises
o
CCTV
Cameras
o
Reception
o
Server Room
o
Workstation
Area
o
Wireless
Access Point
o
Other
Equipments
o
Access
Control
·
Biometric
Devices
·
Biometric
Identification Techniques
·
Authentication Mechanisms
·
Authentication Mechanism Challenges: Biometrics
·
Faking
Fingerprints
·
Smart cards
·
Security
Token
·
Computer
Equipment Maintenance
·
Wiretapping
·
Remote
Access
·
Lapse of
Physical Security
·
Locks
Ø
Lock
Picking
Ø
Lock
Picking Tools
Module 22: Linux Hacking
§
Why Linux
§
Linux
Distributions
§
Linux Live
CD-ROMs
§
Basic
Commands of Linux: Files & Directories
§
Linux Basic
o
Linux File
Structure
o
Linux
Networking Commands
Module 23: Evading IDS, Firewalls and Detecting Honey Pots
§
Introduction to Intrusion Detection System
§
Terminologies
§
Intrusion
Detection System (IDS)
o
IDS
Placement
o
Ways to
Detect an Intrusion
o
Types of
Instruction Detection Systems
o
System
Integrity Verifiers (SIVS)
o
Tripwire
o
Cisco
Security Agent (CSA)
o
True/False,
Positive/Negative
o
Signature
Analysis
o
General
Indication of Intrusion: System Indications
o
General
Indication of Intrusion: File System Indications
o
General
Indication of Intrusion: Network Indications
o
Intrusion
Detection Tools
·
Snort
·
Running
Snort on Windows 2003
·
Snort
Console
·
Testing
Snort
·
Configuring
Snort (snort.conf)
·
Snort Rules
·
Set up
Snort to Log to the Event Logs and to Run as a Service
·
Using
EventTriggers.exe for Eventlog Notifications
·
SnortSam
o
Steps to
Perform after an IDS detects an attack
o
Evading IDS
Systems
·
Ways to
Evade IDS
·
Tools to
Evade IDS
§
IDS Evading
Tool: ADMutate
§
Packet
Generators
§
What is a
Firewall?
o
What Does a
Firewall Do
o
Packet
Filtering
o
What can’t
a firewall do
o
How does a
Firewall work
o
Firewall
Operations
o
Hardware
Firewall
o
Software
Firewall
o
Types of
Firewall
·
Packet
Filtering Firewall
·
IP Packet
Filtering Firewall
·
Circuit-Level Gateway
·
TCP Packet
Filtering Firewall
·
Application
Level Firewall
·
Application
Packet Filtering Firewall
·
Stateful
Multilayer Inspection Firewall
o
Packet
Filtering Firewall
o
Firewall
Identification
o
Firewalking
o
Banner
Grabbing
o
Breaching
Firewalls
o
Bypassing a
Firewall using HTTPTunnel
o
Placing
Backdoors through Firewalls
o
Hiding
Behind a Covert Channel: LOKI
o
Tool:
NCovert
o
ACK
Tunneling
o
Tools to
breach firewalls
§
Common Tool
for Testing Firewall and IDS
o
IDS testing
tool: IDS Informer
o
IDS Testing
Tool: Evasion Gateway
o
IDS Tool:
Event Monitoring Enabling Responses to Anomalous Live Disturbances (Emerald)
o
IDS Tool:
BlackICE
o
IDS Tool:
Next-Generation Intrusion Detection Expert System (NIDES)
o
IDS Tool:
SecureHost
o
IDS Tool:
Snare
o
IDS Testing
Tool: Traffic IQ Professional
o
IDS Testing
Tool: TCPOpera
o
IDS testing
tool: Firewall Informer
o
Atelier Web
Firewall Tester
§
What is
Honeypot?
o
The
Honeynet Project
o
Types of
Honeypots
§
Low-interaction honeypot
§
Medium-interaction honeypot
§
High-interaction honeypot
o
Advantages
and Disadvantages of a Honeypot
o
Where to
place Honeypots
o
Honeypots
·
Honeypot-SPECTER
·
Honeypot -
honeyd
·
Honeypot –
KFSensor
·
Sebek
o
Physical
and Virtual Honeypots
§
Tools to
Detect Honeypots
§
What to do
when hacked
Module 24: Buffer Overflows
o
A Simple
Uncontrolled Overflow of the Stack
o
Stack Based
Buffer Overflows
o
Heap Memory
Buffer Overflow Bug
o
Heap-based
Buffer Overflow
o
Shellcode
o
Attacking a
Real Program
§
NOPs
§
How to
Mutate a Buffer Overflow Exploit
§
Once the
Stack is Smashed
o
Tool to
Defend Buffer Overflow: Return Address Defender (RAD)
o
Tool to
Defend Buffer Overflow: StackGuard
o
Tool to
Defend Buffer Overflow: Immunix System
o
Vulnerability Search: NIST
o
Valgrind
o
Insure++
o
Comparing
Functions of libc and Libsafe
o
Code
Analysis
Module 25: Cryptography
§
Introduction to Cryptography
§
Classical
Cryptographic Techniques
o
Encryption
o
Decryption
§
Cryptographic Algorithms
§
RSA (Rivest
Shamir Adleman)
o
Example of
RSA Algorithm
o
RSA Attacks
o
RSA
Challenge
§
Data
Encryption Standard (DES)
o
DES
Overview
§
RC4, RC5,
RC6, Blowfish
o
RC5
§
Message
Digest Functions
o
One-way
Bash Functions
o
MD5
§
SHA (Secure
Hash Algorithm)
§
SSL (Secure
Sockets Layer)
§
What is
SSH?
o
SSH (Secure
Shell)
§
Algorithms
and Security
§
Disk
Encryption
§
Government
Access to Keys (GAK)
§
Digital
Signature
o
Components
of a Digital Signature
o
Method of
Digital Signature Technology
o
Digital
Signature Applications
o
Digital
Signature Standard
o
Digital
Signature Algorithm: Signature Generation/Verification
o
Digital
Signature Algorithms: ECDSA, ElGamal Signature Scheme
o
Challenges
and Opportunities
§
Digital
Certificates
o
Cleversafe
Grid Builder http://www.cleversafe.com/
§
PGP (Pretty
Good Privacy)
§
CypherCalc
§
Command
Line Scriptor
§
CryptoHeaven
§
Hacking
Tool: PGP Crack
§
Magic
Lantern
§
Advanced
File Encryptor
§
Code
Breaking: Methodologies
§
Cryptanalysis
§
Cryptography Attacks
§
Brute-Force
Attack
§
Cracking
S/MIME Encryption Using Idle CPU Time
§
distributed.net
§
Use Of
Cryptography
Module 26: Penetration Testing
§
Introduction to Penetration Testing (PT)
§
Categories
of security assessments
§
Vulnerability Assessment
§
Limitations
of Vulnerability Assessment
§
Penetration
Testing
§
Types of
Penetration Testing
§
Risk
Management
§
Do-It-Yourself Testing
§
Outsourcing
Penetration Testing Services
§
Terms of
Engagement
§
Project
Scope
§
Pentest
Service Level Agreements
§
Testing
points
§
Testing
Locations
§
Automated
Testing
§
Manual
Testing
§
Using DNS
Domain Name and IP Address Information
§
Enumerating
Information about Hosts on Publicly Available Networks
§
Testing
Network-filtering Devices
§
Enumerating
Devices
§
Denial-of-Service Emulation
§
Pentest
using Appscan
§
HackerShield
§
Pen-Test
Using Cerberus Internet Scanner
§
Pen-Test
Using Cybercop Scanner
§
Pen-Test
Using FoundScan Hardware Appliances
§
Pen-Test
Using Nessus
§
Pen-Test
Using NetRecon
§
Pen-Test
Using SAINT
§
Pen-Test
Using SecureNet Pro
§
Pen-Test
Using SecureScan
§
Pen-Test
Using SATAN, SARA and Security Analyzer
§
Pen-Test
Using STAT Analyzer
§
Pentest
Using VigilENT
§
Pentest
Using WebInspect
§
Pentest
Using CredDigger
§
Pentest
Using Nsauditor
§
Evaluating
Different Types of Pen-Test Tools
§
Asset Audit
§
Fault Tree
and Attack Trees
§
GAP
Analysis
§
Threat
§
Business
Impact of Threat
§
Internal
Metrics Threat
§
External
Metrics Threat
§
Calculating
Relative Criticality
§
Test
Dependencies
§
Defect
Tracking Tools: Bug Tracker Server
§
Disk
Replication Tools
§
DNS Zone
Transfer Testing Tools
§
Network
Auditing Tools
§
Trace Route
Tools and Services
§
Network
Sniffing Tools
§
Denial of
Service Emulation Tools
§
Traditional
Load Testing Tools
§
System
Software Assessment Tools
§
Operating
System Protection Tools
§
Fingerprinting Tools
§
Port
Scanning Tools
§
Directory
and File Access Control Tools
§
File Share
Scanning Tools
§
Password
Directories
§
Password
Guessing Tools
§
Link
Checking Tools
§
Web-Testing
Based Scripting tools
§
Buffer
Overflow protection Tools
§
File
Encryption Tools
§
Database
Assessment Tools
§
Keyboard
Logging and Screen Reordering Tools
§
System
Event Logging and Reviewing Tools
§
Tripwire
and Checksum Tools
§
Mobile-code
Scanning Tools
§
Centralized
Security Monitoring Tools
§
Web Log
Analysis Tools
§
Forensic
Data and Collection Tools
§
Security
Assessment Tools
§
Multiple OS
Management Tools
§
Phases of
Penetration Testing
§
Pre-attack
Phase
§
Best
Practices
§
Results
that can be Expected
§
Passive
Reconnaissance
§
Active
Reconnaissance
§
Attack
Phase
o
Activity:
Perimeter Testing
o
Activity:
Web Application Testing
o
Activity:
Wireless Testing
o
Activity:
Acquiring Target
o
Activity:
Escalating Privileges
o
Activity:
Execute, Implant and Retract
§
Post Attack
Phase and Activities
§
Penetration
Testing Deliverables Templates
Module 27: Covert Hacking
§
Insider
Attacks
§
What is
Covert Channel?
§
Security
Breach
§
Why Do You
Want to Use Covert Channel?
§
Motivation
of a Firewall Bypass
§
Covert
Channels Scope
§
Covert
Channel: Attack Techniques
§
Simple
Covert Attacks
§
Advanced
Covert Attacks
§
Standard
Direct Connection
§
Reverse
Shell (Reverse Telnet)
§
Direct
Attack Example
§
In-Direct
Attack Example
§
Reverse
Connecting Agents
§
Covert
Channel Attack Tools
o
Netcat
o
DNS
Tunneling
o
Covert
Channel Using DNS Tunneling
o
DNS Tunnel
Client
o
DNS
Tunneling Countermeasures
o
Covert
Channel Using SSH
o
Covert
Channel using SSH (Advanced)
o
HTTP/S
Tunneling Attack
§
Covert
Channel Hacking Tool: Active Port Forwarder
§
Covert
Channel Hacking Tool: CCTT
§
Covert
Channel Hacking Tool: Firepass
§
Covert
Channel Hacking Tool: MsnShell
§
Covert
Channel Hacking Tool: Web Shell
§
Covert
Channel Hacking Tool: NCovert
o
Ncovert -
How it works
§
Covert
Channel Hacking via Spam E-mail Messages
§
Hydan
Module 28: Writing Virus Codes
§
Introduction of Virus
§
Types of
Viruses
§
Symptoms of
a Virus Attack
§
Prerequisites for Writing Viruses
§
Required
Tools and Utilities
§
Virus
Infection Flow Chart
o
Virus
Infection: Step I
·
Directory
Traversal Method
·
Example
Directory Traversal Function
·
“dot dot”
Method
·
Example
Code for a “dot dot” Method
o
Virus
Infection: Step II
o
Virus
Infection: Step III
·
Marking a
File for Infection
o
Virus
Infection: Step IV
o
Virus
Infection: Step V
§
Components
of Viruses
o
Functioning
of Replicator part
o
Writing
Replicator
o
Writing
Concealer
o
Dispatcher
o
Writing
Bomb/Payload
·
Trigger
Mechanism
·
Bombs/Payloads
·
Brute Force
Logic Bombs
§
Testing
Virus Codes
§
Tips for
Better Virus Writing
Module 29: Assembly Language Tutorial
o
First.asm
Module 30: Exploit Writing
o
Format
String
o
Integer Bug
Exploits
o
Race
Condition
o
TCP/IP
Attack
o
LibExploit
o
Metasploit
o
CANVAS
o
NASM
o
GDB
o
objdump
o
ktrace
o
strace
o
readelf
o
Addressing
problem
o
Null byte
problem
o
System call
implementation
Module 31: Smashing the Stack for Fun and Profit
o
The code to
spawn a shell in C
o
execve()
system call
o
List of
steps with exit call
o
Using NOPs
o
Estimating
the Location
Module 32:
Windows Based Buffer Overflow Exploit Writing
o
Location of
EIP
o
EIP
Module 33: Reverse Engineering
§
Positive
Applications of Reverse Engineering
§
Ethical
Reverse Engineering
§
World War
Case Study
§
DMCA Act
§
What is
Disassembler?
§
Why do you
need to decompile?
§
Professional Disassembler Tools
§
Tool: IDA
Pro
§
Convert
Machine Code to Assembly Code
§
Decompilers
§
Program
Obfuscation
§
Convert
Assembly Code to C++ code
§
Machine
Decompilers
§
Tool: dcc
§
Machine
Code of compute.exe Prorgam
§
Assembly
Code of compute.exe Program
§
Code
Produced by the dcc Decompiler in C
§
Tool:
Boomerang
§
What
Boomerang Can Do?
§
Andromeda
Decompiler
§
Tool: REC
Decompiler
§
Tool: EXE
To C Decompiler
§
Delphi
Decompilers
§
Tools for
Decompiling .NET Applications
§
Salamander
.NET Decompiler
§
Tool: LSW
DotNet-Reflection-Browser
§
Tool:
Reflector
§
Tool:
Spices NET.Decompiler
§
Tool:
Decompilers.NET
§
.NET
Obfuscator and .NET Obfuscation
§
Java
Bytecode Decompilers
§
Tool: JODE
Java Decompiler
§
Tool:
JREVERSEPRO
§
Tool:
SourceAgain
§
Tool:
ClassCracker
§
Python
Decompilers
§
Reverse
Engineering Tutorial
§
OllyDbg
Debugger
§
How Does
OllyDbg Work?
§
Debugging a
Simple Console Application
Module 34: MAC OS X Hacking
o
Crafted URL Vulnerability
o
CoreText Uninitialized Pointer Vulnerability
o
ImageIO Integer overflow Vulnerability
o
DirectoryService Vulnerability
o
iChat UPnP buffer overflow Vulnerability
o
ImageIO Memory Corruption Vulnerability
o
Code Execution Vulnerability
o
UFS filesystem integer overflow Vulnerability
o
Kernel "fpathconf()" System call Vulnerability
o
UserNotificationCenter Privilege Escalation Vulnerability
o
Other Vulnerabilities in MAC
o
OSX/Leap-A
o
Inqtana.A
o
Macro
Viruses
o
VirusBarrier
o
McAfee Virex for Macintosh
o
Endpoint
Security and Control
o
Norton Internet Security
o
MacScan
o
ClamXav
o
IPNetsentryx
o
FileGuard
Module 35: Hacking Routers,
cable Modems and Firewalls
o
Finding a
Cisco Router
o
How to Get
into Cisco Router
o
Breaking
the Password
o
Is Anyone
Here
o
Covering
Tracks
o
Looking
Around
o
OneStep:
ZUP
Module 36:
Hacking Mobile Phones, PDA and Handheld Devices
o
Spyware:
SymbOS/Htool-SMSSender.A.intd
o
Spyware:
SymbOS/MultiDropper.CG
o
Best
Practices against Malware
o
Blackberry
Attacks
o
Blackberry
Attacks: Blackjacking
o
BlackBerry
Wireless Security
o
BlackBerry
Signing Authority Tool
o
Countermeasures
o
PDA
Security Issues
o
ActiveSync
attacks
o
HotSync
Attack
o
PDA Virus:
Brador
o
PDA
Security Tools: TigerSuite PDA
o
Security
Policies for PDAs
o
Misuse of
iPod
o
Jailbreaking
o
Tools for
jailbreaking: iFuntastic
o
Prerequisite for iPhone Hacking
o
Step by
Step iPhone Hacking using iFuntastic
o
Step by
step iPhone Hacking
o
AppSnapp
·
Steps for
AppSnapp
o
Tool to
Unlock iPhone: iPhoneSimFree
o
Tool to
Unlock iPhone: anySIM
o
Steps for
Unlocking your iPhone using AnySIM
o
Activate
the Voicemail Button on your Unlocked iPhone
o
Podloso
Virus
o
Security
tool: Icon Lock-iT XP
o
Threats to
Organizations Due to Mobile Devices
o
Security
Actions by Organizations
o
Skulls
o
Duts
o
Doomboot.A:
Trojan
o
Kaspersky
Antivirus Mobile
o
Airscanner
o
BitDefender
Mobile Security
o
SMobile
VirusGuard
o
Symantec
AntiVirus
o
F-Secure Antivirus for Palm OS
o
BullGuard
Mobile Antivirus
o
Sprite
Terminator
o
Mobile
Security Tools: Virus Scan Mobile
Module 37: Bluetooth Hacking
o
Bluejacking
o
Tools for
Bluejacking
o
BlueSpam
o
Blue snarfing
o
BlueBug Attack
o
Short Pairing Code Attacks
o
Man-In-Middle Attacks
o
OnLine PIN
Cracking Attack
o
BTKeylogging attack
o
BTVoiceBugging
attack
o
Blueprinting
o
Bluesmacking - The Ping of
Death
o
Denial-of-Service Attack
o
BlueDump
Attack
o
BTScanner
o
Bluesnarfer
o
Bluediving
o
Transient Bluetooth Environment Auditor
o
BTcrack
o
Blooover
o
Hidattack
o
Cabir
o
Mabir
o
Lasco
o
BlueWatch
o
BlueSweep
o
Bluekey
o
BlueFire Mobile Security Enterprise
Edition
o
BlueAuditor
o
Bluetooth Network Scanner
Module 38: VoIP Hacking
o
Information
Sources
o
Unearthing
Information
o
Organizational Structure and Corporate Locations
o
Help Desk
o
Job
Listings
o
Phone
Numbers and Extensions
o
VoIP
Vendors
o
Resumes
o
WHOIS and
DNS Analysis
o
Steps to
Perform Footprinting
o
Host/Device
Discovery
o
ICMP Ping
Sweeps
o
ARP Pings
o
TCP Ping
Scans
o
SNMP Sweeps
o
Port
Scanning and Service Discovery
o
TCP SYN
Scan
o
UDP Scan
o
Host/Device
Identification
o
Steps to
Perform Enumeration
o
Banner
Grabbing with Netcat
o
SIP
User/Extension Enumeration
o
Enumerating
TFTP Servers
o
SNMP
Enumeration
o
Enumerating
VxWorks VoIP Devices
o
Denial-of-Service (DoS)
o
Distributed Denial-of-Service (DDoS)
Attack
o
Internal
Denial-of-Service Attack
o
DoS Attack
Scenarios
o
Eavesdropping
o
Packet
Spoofing and Masquerading
o
Replay
Attack
o
Call
Redirection and Hijacking
o
ARP
Spoofing
o
ARP
Spoofing Attack
o
Service
Interception
o
H.323-Specific Attacks
o
SIP
Security Vulnerabilities
o
SIP Attacks
o
Flooding Attacks
o
DNS Cache
Poisoning
o
Sniffing
TFTP Configuration File Transfers
o
Performing
Number Harvesting and Call Pattern Tracking
o
Call
Eavesdropping
o
Interception through VoIP Signaling Manipulation
o
Man-In-The-Middle (MITM) Attack
o
Application-Level Interception Techniques
o
What is
Fuzzing
o
Signaling
and Media Manipulation
o
VoIP
Phishing
Module 39: RFID Hacking
§
RFID-
Definition
§
Components
of RFID Systems
§
RFID
Collisions
o
Business
Process Risk
o
Business
Intelligence Risk
o
Privacy
Risk
o
Externality
Risk
§
RFID and
Privacy Issues
§
Countermeasures
§
RFID
Security and Privacy Threats
o
Sniffing
o
Tracking
o
Spoofing
o
Replay
attacks
o
Denial-of-service
§
Protection
Against RFID Attacks
§
RFID
Guardian
§
RFID
Malware
o
How to Write an RFID Virus
o
How to Write an RFID Worm
o
Defending
Against RFID Malware
§
RFID
Exploits
§
Vulnerabilities in RFID-enabled Credit Cards
o
Skimming Attack
o
Replay Attack
o
Eavesdropping Attack
§
RFID
Hacking Tool:
RFDump
§
RFID Security Controls
o
Management
Controls
o
Operational
Controls
o
Technical
Controls
§
RFID
Security
Module 40: Spamming
o
Farelogic
Worldcast
o
123 Hidden
Sender
o
YL Mail Man
o
Sendblaster
o
Direct
Sender
o
Hotmailer
o
PackPal
Bulk Email Server
o
IEmailer
o
AEVITA Stop
SPAM Email
o
SpamExperts
Desktop
o
SpamEater
Pro
o
SpamWeasel
o
Spytech
SpamAgent
o
AntispamSniper
o
Spam Reader
o
Spam
Assassin Proxy (SA) Proxy
o
MailWasher
Free
o
Spam Bully
Module 41: Hacking USB Devices
§
Introduction to USB Devices
§
Electrical
Attack
§
Software
Attack
§
USB Attack
on Windows
§
Viruses and
Worms
o
W32/Madang-Fam
o
W32/Hasnot-A
o
W32/Fujacks-AK
o
W32/Fujacks-E
o
W32/Dzan-C
o
W32/SillyFD-AA
o
W32/SillyFDC-BK
o
W32/LiarVB-A
o
W32/Hairy-A
o
W32/QQRob-ADN
o
W32/VBAut-B
o
HTTP
W32.Drom
§
Hacking
Tools
o
USB Dumper
o
USB
Switchblade
o
USB Hacksaw
§
USB Security Tools
o
MyUSBonly
o
USBDeview
o
USB-Blocker
o
USB
CopyNotify
o
Remora USB
File Guard
o
Advanced
USB Pro Monitor
o
Folder
Password Expert USB
o
USBlyzer
o
USB PC Lock
Pro
o
Torpark
o
Virus
Chaser USB
§
Countermeasures
Module 42: Hacking Database Servers
o
Attacking
Oracle
o
Security
Issues in Oracle
o
Types of
Database Attacks
o
How to
Break into an Oracle Database and Gain DBA Privileges
o
Oracle Worm:
Voyager
Beta
o
Ten Hacker
Tricks to Exploit SQL Server Systems
o
How SQL
Server is Hacked
o
Query
Analyzer
o
odbcping
Utility
o
Tool:
ASPRunner Professional
o
Tool:
FlexTracer
§
SQL Server
Security Best Practices: Developer Checklist
Module 43: Cyber Warfare- Hacking, Al-Qaida and Terrorism
§
Cyber
Terrorism Over Internet
§
Cyber-Warfare Attacks
§
45 Muslim
Doctors Planned US Terror Raids
§
Net Attack
§
Al-Qaeda
§
Why
Terrorists Use Cyber Techniques
§
Cyber
Support to Terrorist Operations
§
Planning
§
Recruitment
§
Research
§
Propaganda
§
Propaganda:
Hizballah Website
§
Cyber
Threat to the Military
§
Russia
‘hired botnets’ for Estonia Cyber-War
§
NATO
Threatens War with Russia
§
Bush on
Cyber War: ‘a subject I can learn a lot about’
§
E.U. Urged
to Launch Coordinated Effort Against Cybercrime
§
Budget: Eye
on Cyber-Terrorism Attacks
§
Cyber
Terror Threat is Growing, Says Reid
§
Terror Web
2.0
§
Table 1:
How Websites Support Objectives of terrorist/Extremist Groups
§
Electronic
Jihad
§
Electronic
Jihad' App Offers Cyber Terrorism for the Masses
§
Cyber Jihad
– Cyber Firesale
§
http://internet-haganah.com/haganah/
Module 44: Internet Content Filtering Techniques
Module 45: Privacy on the Internet
§
Internet
Privacy Tools: Firewall Tools
§
Internet
Privacy Tools: Others
Module 46: Securing Laptop Computers
o
Laptop
Security
o
Laptop
Security Tools
o
Laptop
Alarm
o
Flexysafe
o
Master Lock
o
eToken
o
STOP-Lock
o
True Crypt
o
PAL PC
Tracker
o
Cryptex
o
Dekart
Private Disk Multifactor
o
Laptop
Anti-Theft
o
Inspice
Trace
o
ZTRACE GOLD
o
SecureTrieve Pro
o
XTool
Laptop Tracker
o
XTool Encrypted Disk
o
XTool Asset
Auditor
o
XTool
Remote Delete
§
Securing
from Physical Laptop Thefts
§
Hardware
Security for Laptops
§
Protecting
the Sensitive Data
§
Preventing
Laptop Communications from Wireless Threats
§
Protecting
the Stolen Laptops from Being Used
§
Security
Tips
Module 47: Spying Technologies
§
Spying
§
Motives of
Spying
§
Spying
Devices
o
Spying
Using Cams
o
Video Spy
o
Video Spy
Devices
o
Tiny Spy
Video Cams
o
Underwater
Video Camera
o
Camera Spy
Devices
o
Goggle Spy
o
Watch Spy
o
Pen Spy
o
Binoculars
Spy
o
Toy Spy
o
Spy
Helicopter
o
Wireless
Spy Camera
o
Spy Kit
o
Spy Scope: Spy Telescope and Microscope
o
Spy Eye
Side Telescope
o
Audio Spy
Devices
o
Eavesdropper Listening Device
o
GPS Devices
o
Spy
Detectors
o
Spy
Detector Devices
§
Vendors
Hosting Spy Devices
o
Spy Gadgets
o
Spy Tools
Directory
o
Amazon.com
o
Spy
Associates
o
Paramountzone
o
Surveillance Protection
§
Spying
Tools
o
Net Spy
Pro-Computer Network Monitoring and Protection
o
SpyBoss Pro
o
CyberSpy
o
Spytech
SpyAgent
o
ID Computer
Spy
o
e-Surveiller
o
KGB Spy
Software
o
O&K Work
Spy
o
WebCam Spy
o
Golden Eye
§
Anti-Spying
Tools
o
Internet
Spy Filter
o
Spybot -
S&D
o
SpyCop
o
Spyware
Terminator
o
XoftSpySE
Module 48: Corporate Espionage- Hacking Using Insiders
o
NetVizor
o
Privatefirewall w/Pest Patrol
§
Countermeasures
o
Best
Practices against Insider Threat
o
Countermeasures
Module 49: Creating Security Policies
Module 50: Software Piracy and Warez
Module 51: Hacking and Cheating Online Games
Module 52: Hacking RSS and Atom
§
Introduction
§
Areas Where
RSS and Atom is Used
§
Building a
Feed Aggregator
§
Routing
Feeds to the Email Inbox
§
Monitoring
the Server with Feeds
§
Tracking
Changes in Open Source Projects
§
Risks by
Zone
o
Remote Zone
risk
o
Local Zone
Risk
§
Reader
Specific Risks
§
Utilizing
the Web Feeds Vulnerabilities
§
Example for
Attacker to Attack the Feeds
§
Tools
o
Perseptio
FeedAgent
o
RssFeedEater
o
Thingamablog
o
RSS Builder
o
RSS Submit
o
FeedDemon
o
FeedForAll
o
FeedExpress
o
RSS and
Atom Security
Module 53: Hacking Web Browsers (Firefox, IE)
§
Introduction
§
How Web
Browsers Work
§
How Web
Browsers Access HTML Documents
§
Protocols
for an URL
§
Hacking
Firefox
o
Firefox
Proof of Concept Information Leak Vulnerability
o
Firefox
Spoofing Vulnerability
o
Password
Vulnerability
o
Concerns
With Saving Form Or Login Data
o
Cleaning Up
Browsing History
o
Cookies
o
Internet History Viewer:
Cookie
Viewer
§
Firefox
Security
o
Blocking
Cookies Options
o
Tools For
Cleaning Unwanted Cookies
o
Tool:
CookieCuller
o
Getting
Started
o
Privacy
Settings
o
Security
Settings
o
Content
Settings
o
Clear
Private Data
o
Mozilla
Firefox Security Features
§
Hacking
Internet Explorer
o
Redirection
Information Disclosure Vulnerability
o
Window
Injection Vulnerability
§
Internet
Explorer Security
o
Getting
Started
o
Security
Zones
o
Custom
Level
o
Trusted
Sites Zone
o
Privacy
o
Overwrite
Automatic Cookie Handling
o
Per Site
Privacy Actions
o
Specify
Default Applications
o
Internet
Explorer Security Features
§
Hacking
Opera
o
JavaScript
Invalid Pointer Vulnerability
o
BitTorrent
Header Parsing Vulnerability
o
Torrent
File Handling Buffer Overflow Vulnerability
§
Security
Features of Opera
o
Security
and Privacy Features
§
Hacking
Safari
o
Safari
Browser Vulnerability
o
iPhone
Safari Browser Memory Exhaustion Remote Dos Vulnerability
§
Securing
Safari
o
Getting
started
o
Preferences
o
AutoFill
o
Security
Features
§
Hacking
Netscape
o
Netscape
Navigator Improperly Validates SSL Sessions
o
Netscape
Navigator Security Vulnerability
§
Securing
Netscape
o
Getting
Started
o
Privacy
Settings
o
Security
Settings
o
Content
Settings
o
Clear
Private Data
Module 54: Proxy Server Technologies
§
Introduction: Proxy Server
§
Working of
Proxy Server
§
Types of
Proxy Server
§
Socks Proxy
§
Free Proxy
Servers
§
Use of
Proxies for Attack
§
Tools
o
WinGate
o
UserGate
Proxy Server
o
Advanced
FTP Proxy Server
o
Trilent FTP
Proxy
o
SafeSquid
o
AllegroSurf
o
ezProxy
o
Proxy
Workbench
o
ProxyManager Tool
o
Super Proxy
Helper Tool
o
MultiProxy
§
How Does
MultiProxy Work
§
TOR Proxy
Chaining Software
§
TOR Proxy
Chaining Software
§
AnalogX
Proxy
§
NetProxy
§
Proxy+
§
ProxySwitcher Lite
§
Tool: JAP
§
Proxomitron
§
SSL Proxy
Tool
§
How to Run
SSL Proxy
Module 55: Data Loss Prevention
§
Introduction: Data Loss
§
Causes of
Data Loss
§
How to
Prevent Data Loss
§
Impact
Assessment for Data Loss Prevention
§
Tools
o
Security
Platform
o
Check Point
Software: Pointsec Data Security
o
Cisco
(IronPort)
o
Content
Inspection Appliance
o
CrossRoads
Systems: DBProtector
o
Strongbox
DBProtector Architecture
o
DeviceWall
o
Exeros
Discovery
o
GFi
Software: GFiEndPointSecurity
o
GuardianEdge Data Protection Platform
o
ProCurve
Identity Driven Manager (IDM)
o
Imperva:
SecureSphere
o
MailMarshal
o
WebMarshal
o
Marshal
EndPoint
o
Novell
ZENworks Endpoint Security Management
o
Prism
EventTracker
o
Proofpoint
Messaging Security Gateway
o
Proofpoint
Platform Architecture
o
Summary
Dashboard
o
End-user
Safe/Block List
o
Defiance
Data Protection System
o
Sentrigo:
Hedgehog
o
Symantec
Database Security
o
Varonis:
DataPrivilege
o
Verdasys:
Digital Guardian
o
VolumeShield AntiCopy
o
Websense
Content Protection Suite
Module 56: Hacking Global Positioning System (GPS)
Module 57: Computer Forensics and Incident Handling
§
Computer
Forensics
o
What is
Computer Forensics
o
Need for
Computer Forensics
o
Objectives
of Computer Forensics
o
Stages of
Forensic Investigation in Tracking Cyber Criminals
o
Key Steps
in Forensic Investigations
o
List of
Computer Forensics Tools
§
Incident
Handling
o
Present
Networking Scenario
o
What is an
Incident
o
Category of
Incidents: Low Level
o
Category of
Incidents: Mid Level
o
Category of
Incidents: High Level
o
How to
Identify an Incident
o
How to
Prevent an Incident
o
Defining
the Relationship between Incident Response, Incident Handling, and Incident
Management
o
Incident
Response Checklist
o
Handling
Incidents
o
Procedure
for Handling Incident
·
Stage 1:
Preparation
·
Stage 2:
Identification
·
Stage 3:
Containment
·
Stage 4:
Eradication
·
Stage 5:
Recovery
·
Stage 6:
Follow-up
§
Incident
Management
§
Why don’t
Organizations Report Computer Crimes
§
Estimating
Cost of an Incident
§
Whom to
Report an Incident
§
Incident
Reporting
§
Vulnerability Resources
§
What is
CSIRT
o
CSIRT:
Goals and Strategy
o
Why an
Organization needs an Incident Response Team
o
CSIRT Case
Classification
o
Types of
Incidents and Level of Support
o
Incident
Specific Procedures-I (Virus and Worm Incidents)
o
Incident
Specific Procedures-II (Hacker Incidents)
o
Incident
Specific Procedures-III (Social Incidents, Physical Incidents)
o
How CSIRT
Handles Case: Steps
o
Example of
CSIRT
o
Best
Practices for Creating a CSIRT
·
Step 1:
Obtain Management Support and Buy-in
·
Step 2:
Determine the CSIRT Development Strategic Plan
·
Step 3:
Gather Relevant Information
·
Step 4:
Design your CSIRT Vision
·
Step 5:
Communicate the CSIRT Vision
·
Step 6:
Begin CSIRT Implementation
·
Step 7:
Announce the CSIRT
§
World CERTs
http://www.trusted-introducer.nl/teams/country.html
§
http://www.first.org/about/organization/teams/
§
IRTs Around
the World
Module 58: Credit Card Frauds
§
E-Crime
§
Statistics
§
Credit Card
o
Credit Card
Fraud
o
Credit Card
Fraud
o
Credit Card
Fraud Over Internet
o
Net
Credit/Debit Card Fraud In The US After Gross Charge-Offs
§
Credit Card
Generators
o
Credit Card
Generator
o
RockLegend’s !Credit Card Generator
§
Credit Card
Fraud Detection
o
Credit Card
Fraud Detection Technique: Pattern Detection
o
Credit Card
Fraud Detection Technique: Fraud Screening
o
XCART:
Online fraud Screening Service
o
Card Watch
o
MaxMind
Credit Card Fraud Detection
o
3D Secure
o
Limitations
of 3D Secure
o
FraudLabs
o
www.pago.de
o
Pago Fraud
Screening Process
o
What to do
if you are a Victim of a Fraud
o
Facts to be
Noted by Consumers
§
Best
Practices: Ways to Protect Your Credit Cards
Module 59: How to Steal Passwords
§
Password
Stealing
§
How to
Steal Passwords
§
Password
Stealing Techniques
§
Password
Stealing Trojans
o
MSN Hotmail
Password Stealer
o
AOL
Password Stealer
o
Trojan-PSW.Win32.M2.14.a
o
CrazyBilets
o
Dripper
o
Fente
o
GWGhost
o
Kesk
o
MTM
Recorded pwd Stealer
o
Password
Devil
§
Password
Stealing Tools
o
Password
Thief
o
Remote
Password Stealer
o
POP3 Email
Password Finder
o
Instant
Password Finder
o
MessenPass
o
PstPassword
o
Remote
Desktop PassView
o
IE PassView
o
Yahoo
Messenger Password
§
Recommendations for Improving Password Security
§
Best
Practices
Module 60: Firewall Technologies
§
Firewalls:
Introduction
§
Hardware
Firewalls
o
Hardware
Firewall
o
Netgear
Firewall
o
Personal
Firewall Hardware: Linksys
o
Personal
Firewall Hardware: Cisco’s PIX
o
Cisco PIX
501 Firewall
o
Cisco PIX
506E Firewall
o
Cisco PIX
515E Firewall
o
CISCO PIX
525 Firewall
o
CISCO PIX
535 Firewall
o
Check Point
Firewall
o
Nortel
Switched Firewall
§
Software
Firewalls
o
Software
Firewall
§
Windows
Firewalls
o
Norton
Personal Firewall
o
McAfee
Personal Firewall
o
Symantec
Enterprise Firewall
o
Kerio
WinRoute Firewall
o
Sunbelt
Personal Firewall
o
Xeon
Firewall
o
InJoy
Firewall
o
PC Tools
Firewall Plus
o
Comodo
Personal Firewall
o
ZoneAlarm
§
Linux
Firewalls
o
KMyFirewall
o
Firestarter
o
Guarddog
o
Firewall
Builder
§
Mac OS X
Firewalls
o
Flying
Buttress
o
DoorStop X
Firewall
o
Intego
NetBarrier X5
o
Little
Snitch
Module 61: Threats and Countermeasures
o
Account
Policies
o
Password
Policy
o
Password
Policy
o
Password
Policy - Policies
o
Enforce
Password History - Vulnerability
o
Enforce
Password History - Countermeasure
o
Enforce
Password History - Potential
Impact
o
Password
Age - Vulnerability
o
Maximum
Password Age - Countermeasure
o
Maximum
Password Age - Potential Impact
o
Maximum
Password Age
o
Minimum
Password Age
o
Minimum
Password Age - Vulnerability
o
Minimum
Password Age - Countermeasure
o
Minimum
Password Age - Potential Impact
o
Minimum
Password Age
o
Minimum
Password Length - Vulnerability
o
Minimum
Password Length - Countermeasure
o
Minimum
Password Length - Potential Impact
o
Minimum
Password Length
o
Passwords
must Meet Complexity Requirements -
Vulnerability
o
Passwords
must Meet Complexity Requirements -
Countermeasure
o
Passwords
must Meet Complexity Requirements -
Potential Impact
o
Passwords
must Meet Complexity Requirements
o
Account
Lockout Policy - Policies
o
Account
Lockout Duration - Vulnerability
o
Account
Lockout Duration - Countermeasure
o
Account
Lockout Duration - Potential
Impact
o
Account
Lockout Duration
o
Account
Lockout Threshold - Vulnerability
o
Account
Lockout Threshold - Countermeasure
o
Account
Lockout Threshold - Potential
Impact
o
Kerberos
Policy - Policies
o
Maximum
Lifetime for User Ticket
o
Maximum
Lifetime for User Ticket Renewal
o
Audit
Settings
o
Audit
Account Logon Events
o
Audit
Account Management
o
Audit
Directory Service Access
o
Audit Logon
Events
o
Audit
Object Access
o
Audit
Policy Change
o
Audit
Privilege Use
o
Audit
Process Tracking
o
Audit
System Events
o
Accounts:
Administrator Account Status -
Vulnerability
o
Accounts:
Administrator Account Status
o
Accounts:
Guest Account Status
o
Accounts:
Limit Local Account Use of Blank Passwords to Console Logon Only
o
Accounts:
Rename Administrator Account
o
Accounts:
Rename Guest Account
o
Audit:
Audit the Use of Backup and Restore Privilege
o
Audit: Shut
Down System Immediately if Unable to Log Security Audits
o
Maximum
Event Log Size
o
Prevent
Local Guests Group from Accessing Event Logs
o
Retain
Event Logs
o
Retention
Method for Event Log
o
Delegating
Access to the Event Logs
o
Logical
Disk Manager Administrative Service
o
Message
Queuing Down Level Clients
o
Message
Queuing Triggers
o
Messenger
o
Remote
Access Connection Manager
o
Remote
Desktop Help Session Manager
o
Remote
Procedure Call (RPC)
o
Remote
Procedure Call (RPC) Locator
o
Remote
Registry Service
o
Remote
Server Manager
o
Remote Server Monitor
o
Remote
Storage Notification
o
Remote
Storage Server
o
Terminal
Services Licensing
o
Terminal
Services Session Directory
o
Windows
Installer
o
Windows
System Resource Manager
o
Windows
Time
Module 62: Case Studies Module 63: Botnets Module 65: Patch Management
|