建立您自己的安全实验室:风险管理实用手册[英文原版]
Michael Gregg
Build Your Own Security Lab
Published by Wiley Publishing,Inc.,Indianapolis,Indiana
Published simultaneously in Canada
ISBN:978-0-470-17986-4
Manufactured in the United States of America
Build Your Own Security Lab is designed to take readers to the next stage of personal knowledge and skill development. Rather than presenting just the concept or discussing the tools that fit in a specific category, Build Your Own Security Lab takes these topics and provides real-world implementation details. Learning how to apply higher-level security skills is an essential skill need to pursue an advanced security career, and to make progress toward obtaining more complex security certifications, including SSCP, CISSP, CEH, CHFI, and the like. I hope that you enjoy this book, and please let me know how it helps you advance in the field of IT security.
《建立你自己的安全实验室》这本书专门为读者发展下一阶段的个人知识和技能而写,绝不是仅仅只讨论适合于一个特定范畴的概念或工具,《建立你自己的安全实验室》这本书讨论了这些主题并提供了真实的实现细节。学习如何申请高级安全技能是追求安全与风险管理高级职位的必不可少的技能,也是取得事业进步获得更复杂的安全管理的资质证书(包括SSCP,CISSP,CEH,CHFI等等)的重要书籍,我希望读者你喜欢这本书,并请让我知道它是如何帮助你获得成功的。
Acknowledgments xxi
Introduction xxiii
Chapter 1 Hardware and Gear 1
Why Build a Lab?2
Hackers Welcome 4
Hacker Software 4
Hacker Hardware 5
The Essential Gear 8
Obtaining Requisite Hardware/Software 10
Stuff You Already Have 10
New-Equipment Purchases 10
Used-Equipment Purchases 11
Online Auctions 12
Thrift Stores 13
Company Sales 14
Assembling the Network Lab 14
Starting Clean 16
Configuring the Network 17
Installing Operating Systems 21
Windows XP 21
Linux 23
Connecting Everything Together 23
Adding On 25
Summary 26
Key Terms 27
Exercises 28
Equipment Checklist 28
Exploring Linux Options 29
Exploring Other Operating System Options 30
Chapter 2 Building a Software Test Platform 31
Server OS Installations 31
Microsoft Windows 32
Linux 36
Navigating in Linux 39
Linux Basics 41
Other Operating Systems 44
Mac OS X 44
ReactOS 45
Windows PE 45
Virtualization 47
VMware Workstation 48
VMware Server 51
Virtual PC 52
Client-Side Tools 53
Learning Applications 55
Summary 56
Key Terms 57
Exercises 58
Using VMware to Build a Windows Image 58
Using VMware to Build a ReactOS Image 59
Running BackTrack from VMware 60
Chapter 3 Passive Information Gathering 63
Starting at the Source 64
Scrutinizing Key Employees 68
Dumpster Diving(Electronic)71
Analyzing Web Page Coding 74
Exploiting Web Site Authentication Methods 77
Mining Job Ads and Analyzing Financial Data 80
Using Google to Mine Sensitive Information 83
Exploring Domain Ownership 84
WHOIS 85
Regional Internet Registries 88
Domain Name Server 89
Identifying Web Server Software 93
Web Server Location 95
Summary 96
Key Terms 97
Exercises 98
IP Address and Domain Identification 98
Information Gathering 99
Google Hacking 100
Banner Grabbing 101
Telnet 101
Netcat 102
VisualRoute 103
Chapter 4 Detecting Live Systems 105
Detecting Active Systems 105
Wardriving 106
ICMP(Ping)107
Port Scanning 111
TCP/IP Basics 111
The Network Access Layer 112
The Internet Layer 113
The Host-to-Host Layer 116
The Application Layer 117
TCP and UDP Port Scanning 120
Advanced Port-Scanning Techniques 123
Idle Scan 123
Port-Scanning Tools 126
Nmap 126
SuperScan 129
Other Scanning Tools 129
OS Fingerprinting 131
Passive Fingerprinting 131
Active Fingerprinting 134
OS Fingerprinting Tools 135
Scanning Countermeasures 136
Summary 139
Key Terms 140
Exercises 141
Port Scanning with Nmap 141
Port Scanning with SuperScan 142
Using Look@LAN 143
Passive Fingerprinting 144
Active Fingerprinting 146
Chapter 5 Enumerating Systems 149
Enumeration 149
SNMP Services 150
SNMP Enumeration Tools 152
SNMP Enumeration Countermeasures 153
Routing Devices 154
Routing Enumeration Tools 156
Routing Enumeration Countermeasures 158
Windows Devices 161
Server Message Block and Interprocess Communication 163
Enumeration and the IPC$Share 164
Windows Enumeration Tools 165
Windows Enumeration Countermeasures 168
Advanced Enumeration 170
Password Cracking 170
Protecting Passwords 174
Sniffing Password Hashes 174
Exploiting a Vulnerability 175
Buffer Overflows 178
Summary 180
Key Terms 180
Exercises 181
SNMP Enumeration 181
Enumerating Routing Protocols 184
Enumeration with DumpSec 185
Rainbow Table Attacks 187
Chapter 10 Intrusion Detection 325
Overview of Intrusion Detection and Prevention 325
IDS Types and Components 326
IDS Engines 328
An Overview of Snort 330
Platform Compatibility 331
Assessing Hardware Requirements 331
Installing Snort on a Windows System 333
MySQL 333
Limiting Access 333
Installing the Base Components 334
Basic Configuration 337
Verification of Configuration 339
Building Snort Rules 342
The Rule Header 343
Logging with Snort 345
Rule Options 345
Creating and Testing a Simple Rule Set 347
The Snort User Interface 349
IDScenter 349
Installing IDScenter 349
Configuring IDScenter 350
Basic Analysis and Security Engine 355
Advanced Snort:Detecting Buffer Overflows 356
Responding to Attacks/Intrusions 357
Summary 360
Key Terms 360
Exercises 361
Building a Snort Windows System 361
Making a One-Way Data Cable 363
Chapter 11 Forensic Detection 365
Computer Forensics 366
Acquisition 367
Drive Removal and Fingerprint 369
Drive-Wiping 371
Logical and Physical Copies 372
Logical Copies 373
Physical Copies 374
Imaging the Drive 374
Authentication 376
Trace-Evidence Analysis 379
Browser Cache 382
Email Evidence 383
Deleted/Overwritten Files and Evidence 385
Other Trace Evidence 386
Hiding Techniques 387
Common File-Hiding Techniques 387
Advanced File-Hiding Techniques 389
Steganography 391
Antiforensics 395
Summary 396
Key Terms 396
Exercises 397
Detecting Hidden Files 397
Basic File-Hiding 397
Advanced File-Hiding 398
Reading Email Headers 399
Use S-Tools to Embed and Encrypt a Message 400
Appendix A About the DVD 405
System Requirements 405
Using the DVD 406
What’s on the DVD 406
Troubleshooting 408
Customer Care 408
Index 409