Ethical Hacking: A Hands-on Introduction to Breaking In

Brief Contents
Contents in Detail
Acknowledgments
Foreword
Introduction
	Why Read This Book?
	Installing Python
	What Is in the Book?
		Part I: Networking Fundamentals
		Part II: Cryptography
		Part III: Social Engineering
		Part IV: Exploitation
		Part V: Controlling the Network
	Reaching Out
Chapter 1: Setting Up
	Virtual Lab
	Setting Up VirtualBox
	Setting Up pfSense
		Setting Up the Internal Network
		Configuring pfSense
	Setting Up Metasploitable
	Setting Up Kali Linux
	Setting Up the Ubuntu Linux Desktop
	Your First Hack: Exploiting a Backdoor in Metasploitable
		Getting the IP Address of the Metasploitable Server
		Using the Backdoor to Gain Access
Part I: Network Fundamentals
	Chapter 2: Capturing Traffic with ARP Spoofing
		How the Internet Transmits Data
			Packets
			MAC Addresses
			IP Addresses
			ARP Tables
		ARP Spoofing Attacks
		Performing an ARP Spoofing Attack
		Detecting an ARP Spoofing Attack
		Exercises
			Inspect ARP Tables
			Implement an ARP Spoofer in Python
			MAC Flooding
	Chapter 3: Analyzing Captured Traffic
		Packets and the Internet Protocol Stack
			The Five-Layer Internet Protocol Stack
		Viewing Packets in Wireshark
		Analyzing Packets Collected by Your Firewall
			Capturing Traffic on Port 80
		Exercises
			pfSense
			Exploring Packets in Wireshark
	Chapter 4: Crafting TCP Shells and Botnets
		Sockets and Process Communication
			TCP Handshakes
			A TCP Reverse Shell
		Accessing the Victim Machine
			Scanning for Open Ports
			Exploiting a Vulnerable Service
		Writing a Reverse Shell Client
		Writing a TCP Server That Listens for Client Connections
		Loading the Reverse Shell onto the Metasploitable Server
		Botnets
		Exercises
			A Multiclient Bot Server
			SYN Scans
			Detecting XMas Scans
Part II: Cryptography
	Chapter 5: Cryptography and Ransomware
		Encryption
			One-Time Pad
			Pseudorandom Generators
			Insecure Block Ciphers Modes
			Secure Block Ciphers Modes
		Encrypting and Decrypting a File
		Email Encryption
			Public-Key Cryptography
			Rivest–Shamir–Adleman Theory
			The RSA Math
		Encrypting a File with RSA
			Optimal Asymmetric Encryption Padding
		Writing Ransomware
		Exercises
			The Ransomware Server
			Extending the Ransomware Client
			Unsolved Codes
	Chapter 6: TLS and Diffie-Hellman
		Transport Layer Security
			Message Authentication
			Certificate Authorities and Signatures
			Certificate Authorities
		Using Diffie-Hellman to Compute a Shared Key
			Step 1: Generating the Shared Parameters
			Step 2: Generating the Public–Private Key Pair
			Why Can't a Hacker Calculate the Private Key?
			Step 3: Exchanging Key Shares and Nonces
			Step 4: Calculating the Shared Secret Key
			Step 5: Key Derivation
			Attacking Diffie-Hellman
		Elliptic-Curve Diffie-Hellman
			The Math of Elliptic Curves
			The Double and Add Algorithm
			Why Can't a Hacker Use Gxy and axy to Calculate the Private Key A?
		Writing TLS Sockets
			The Secure Client Socket
			The Secure Server Socket
		SSL Stripping and HSTS Bypass
		Exercise: Add Encryption to your Ransomware Server
Part III: Social Engineering
	Chapter 7: Phishing and Deepfakes
		A Sophisticated and Sneaky Social Engineering Attack
		Faking Emails
			Performing a DNS Lookup of a Mail Server
			Communicating with SMTP
			Writing an Email Spoofer
			Spoofing SMTPS Emails
		Faking Websites
		Creating Deepfake Videos
			Accessing Google Colab
			Importing the Machine Learning Models
		Exercises
			Voice Cloning
			Phishing at Scale
			SMTP Auditing
	Chapter 8: Scanning Targets
		Link Analysis
			Maltego
			Leaked Credential Databases
			SIM Jacking
		Google Dorking
		Scanning the Entire Internet
			Masscan
			Shodan
		IPv6 and NAT Limitations
			Internet Protocol Version 6 (IPv6)
			NAT
		Vulnerability Databases
		Vulnerability Scanners
		Exercises
			nmap Scans
			Discover
			Writing Your Own OSINT Tool
Part IV: Exploitation
	Chapter 9: Fuzzing for Zero-Day Vulnerabilities
		Case Study: Exploiting the Heartbleed OpenSSL Vulnerability
			Creating an Exploit
			Starting the Program
			Writing the Client Hello Message
			Reading the Server Response
			Crafting the Malicious Heartbeat Request
			Reading the Leaked Memory Contents
			Writing the Exploit Function
			Putting It Together
		Fuzzing
			A Simplified Example
			Writing Your Own Fuzzer
			American Fuzzy Lop
		Symbolic Execution
			A Symbolic Execution of the Test Program
			Limitations of Symbolic Execution
		Dynamic Symbolic Execution
		Using DSE to Crack a Passcode
			Creating an Executable Binary
			Installing and Running Angr
			The Angr Program
		Exercises
			Capture the Flag Games with Angr
			Fuzzing Web Protocols
			Fuzzing an Open Source Project
			Implement Your Own Concolic Execution Engine
	Chapter 10: Building Trojans
		Case Study: Re-Creating Drovorub by Using Metasploit
			Building the Attacker's Server
			Building the Victim Client
			Uploading the Implant
			Using the Attacker Agent
			Why We Need a Victim Kernel Module
		Hiding an Implant in a Legitimate File
			Creating a Trojan
			Hosting the Trojan
			Downloading the Infected File
			Controlling the Implant
		Evading Antivirus by Using Encoders
			The Base64 Encoder
			Writing a Metasploit Module
			Shikata Ga Nai Encoder
		Creating a Windows Trojan
			Hiding the Trojan in Minesweeper
			Hiding the Trojan in a Word Document (or Another Innocent File)
		Creating an Android Trojan
			Deconstructing the APK to View the Implant
			Rebuilding and Signing the APK
			Testing the Android Trojan
		Exercises
			Evil-Droid
			Writing Your Own Python Implant
			Obfuscate Your Implant
			Build a Platform-Specific Executable
	Chapter 11: Building and Installing Linux Rootkits
		Writing a Linux Kernel Module
			Backing Up Your Kali Linux Virtual Machine
			Writing the Code
			Compiling and Running Your Kernel Module
		Modifying System Calls
			How System Calls Work
			Hooking Syscalls
		Hooking the Shutdown Syscall
		Hiding Files
			The linux_dirent struct
			Writing the Hooking Code
		Using Armitage to Exploit a Host and Install a Rootkit
			Scanning the Network
			Exploiting a Host
			Installing a Rootkit
		Exercises
			The Keylogger
			Self-Hiding Module
	Chapter 12: Stealing and Cracking Passwords
		SQL Injection
		Stealing Passwords from a Website's Database
			Enumerating Reachable Files on the Web Server
			Performing SQL Injection
		Writing Your Own SQL Injection Tool
			Understanding HTTP Requests
			Writing the Injection Program
		Using SQLMap
		Hashing Passwords
			The Anatomy of the MD5 Hash
			Cracking Hashes
			Salting Hashes with a Nonce
		Building a Salted Hash Cracker
		Popular Hash Cracking and Brute-Forcing Tools
			John the Ripper
			Hashcat
			Hydra
		Exercises
			NoSQL Injection
			Brute-Forcing Web Logins
			Burp Suite
	Chapter 13: Serious Cross-Site Scripting Exploitation
		Cross-Site Scripting
			How JavaScript Can Be Malicious
			Stored XSS Attacks
			Reflected XSS Attacks
		Finding Vulnerabilities with OWASP Zed Attack Proxy
		Using Browser Exploitation Framework Payloads
			Injecting the BeEF Hook
			Performing a Social Engineering Attack
		Moving from Browser to Machine
			Case Study: Exploiting an Old Version of the Chrome Browser
			Installing Rootkits via Website Exploitation
		Exercise: Hunting for Bugs in a Bug Bounty Program
Part V: Controlling The Network
	Chapter 14: Pivoting and Privilege Escalation
		Pivoting from a Dual-Homed Device
			Configuring a Dual-Homed Device
			Connecting a Machine to Your Private Network
			Pivoting with Metasploit
			Writing an Attacker Proxy
		Extracting Password Hashes on Linux
			Where Linux Stores Usernames and Passwords
			Performing a Dirty COW Privilege Escalation Attack
		Exercises
			Adding NAT to Your Dual-Homed Device
			Suggested Reading on Windows Privilege Escalation
	Chapter 15: Moving Through the Corporate Windows Network
		Creating a Windows Virtual Lab
		Extracting Password Hashes with Mimikatz
		Passing the Hash with NT LAN Manager
		Exploring the Corporate Windows Network
		Attacking the DNS Service
		Attacking Active Directory and LDAP Services
			Writing an LDAP Query Client
			Using SharpHound and Bloodhound for LDAP Enumeration
		Attacking Kerberos
			The Pass-the-Ticket Attack
			The Golden Ticket and DC Sync Attacks
		Exercise: Kerberoasting
	Chapter 16: Next Steps
		Setting Up a Hardened Hacking Environment
			Remaining Anonymous with Tor and Tails
			Setting Up a Virtual Private Server
			Setting Up SSH
			Installing Your Hacking Tools
			Hardening the Server
			Auditing Your Hardened Server
		Other Topics
			Software-Defined Radios
			Attacking Cellular Infrastructure
			Escaping the Air Gap
			Reverse Engineering
			Physical Hacking Tools
			Forensics
			Hacking Industrial Systems
			Quantum Computation
		Connect with Others
	Index