Network Protocols for Security Professionals: Probe and identify network-based vulnerabilities and safeguard against network protocol breaches

Cover
Title Page
Copyright and credits
Contributors
About the reviewers
Table of Contents
Preface
Part 1: Protecting the Network – Technologies, Protocols, Vulnerabilities, and Tools
Chapter 1: Data Centers and the Enterprise Network Architecture and its Components
	Exploring networks and data flows
	The data center, core, and user networks
	Switching (L2) and routing (L3) topologies
		Switching (L2) and routing (L3)
		L2 and L3 architectures
		L2 and L3 architecture data flow
		L2 and L3 architecture data flow with redundancy
		L2 and L3 topologies with firewalls
		L2 and L3 topologies with overlays
	The network perimeter
	The data, control, and management planes
		The data plane
		The control plane
		The management plane
	SDN and NFV
		Software-defined networking (SDN)
		Network function virtualization (NFV)
	Cloud connectivity
	Type of attacks and where they are implemented
		Attacks on the internet
		Attacks from the internet targeting organizational networks
		Attacks on firewalls
		Attacks on servers
		Attacks on local area networks (LANs)
		Attacks on network routers and routing protocols
		Attacks on wireless networks
	Summary
	Questions
Chapter 2: Network Protocol Structures and Operations
	Data network protocols and data structures
	Layer 2 protocols – STP, VLANs, and security methods
		The Ethernet protocols
		LAN switching
		VLANs and VLAN tagging
		Spanning tree protocols
	Layer 3 protocols – IP and ARP
	Routers and routing protocols
		Routing operations
		Routing protocols
	Layer 4 protocols – UDP, TCP, and QUIC
		UDP
		TCP
		QUIC
		Vulnerabilities in layer 4 protocols
	Encapsulation and tunneling
	Summary
	Questions
Chapter 3: Security Protocols and Their Implementation
	Security pillars – confidentiality, integrity, and availability
	Encryption basics and protocols
		Services provided by encryption
		Stream versus block ciphers
		Symmetric versus asymmetric encryption
	Public key infrastructure and certificate authorities
	Authentication basics and protocols
		Authentication types
		Username/password with IP address identification authentication
		Encrypted username/password authentication
		Extensible authentication protocol (EAP)
	Authorization and access protocols
	Hash functions and message digests
	IPSec and key management protocols
		VPNs
		IPSec principles of operation
		IPSec tunnel establishment
		IPSec modes of operation
		IPSec authentication and encryption protocols
		IPSec AH protocol
		IPSec ESP protocol
	SSL/TLS and proxies
		Protocol basics
		The handshake protocol
	Network security components – RADIUS/TACACS+, FWs, IDS/IPSs, NAC, and WAFs
		Firewalls
		RADIUS, NAC, and other authentication features
		Web application firewalls (WAFs)
	Summary
	Questions
Chapter 4: Using Network Security Tools, Scripts, and Code
	Commercial, open source, and Linux-based tools
		Open source tools
		Commercial tools
	Information gathering and packet analysis tools
		Basic network scanners
		Network analysis and management tools
		Protocol discovery tools
	Vulnerability analysis tools
		Nikto
		Legion
	Exploitation tools
		The Metasploit Framework (MSF)
	Stress testing tools
		Windows tools
		Kali Linux tools
	Network forensics tools
		Wireshark and packet capture tools
	Summary
	Questions
Chapter 5: Finding Protocol Vulnerabilities
	Black box, white box, and gray box testing
	Black box and fuzzing
		Enterprise networks testing
		Provider networks testing
		Fuzzing phases
	Common vulnerabilities
		Layer 2-based vulnerabilities
		Layer 3-based vulnerabilities
		Layer 4-based vulnerabilities
		Layer 5-based vulnerabilities
		Layer 6-based vulnerabilities
		Layer 7-based vulnerabilities
	Fuzzing tools
		Basic fuzzing
		Breaking usernames and passwords (brute-force attacks)
		Fuzzing network protocols
	Crash analysis – what to do when we find a bug
	Summary
	Questions
Part 2: Network, Network Devices, and Traffic Analysis-Based Attacks
Chapter 6: Finding Network-Based Attacks
	Planning a network-based attack
		Gathering information from the network
		Stealing information from the network
		Preventing users from using IT resources
	Active and passive attacks
		Active attacks
		Passive attacks
	Reconnaissance and information gathering
		Listening to network broadcasts
		Listening on a single device/port-mirror
	Network-based DoS/DDoS attacks and flooding
		Flooding through scanning attacks
		Random traffic generation flooding
		Generating and defending against flooding and DoS/DDoS attacks
	L2-based attacks
		MAC flooding
		STP, RSTP, and MST attacks
	L3- and ARP-based attacks
		ARP poisoning
		DHCP starvation
	Summary
	Questions
Chapter 7: Detecting Device-Based Attacks
	Network devices' structure and components
		The functional structure of communications devices
		The physical structure of communications devices
	Attacks on the management plane and how to defend against them
		Brute-force attacks on console, Telnet, and SSH passwords
		Brute-force attacks against SNMP passwords (community strings)
		Brute-force attacks against HTTP/HTTPS passwords
		Attacks on other ports and services
		SYN-scan and attacks targeting the management plane processes' availability
	Attacks on the control plane and how to defend against them
		Control plane-related actions that influence device resources
	Attacks on the data plane and how to defend against them
		Protection against heavy traffic through an interface
	Attacks on system resources
		Memory-based attacks, memory leaks, and buffer overflows
		CPU overload and vulnerabilities
	Summary
	Questions
Chapter 8: Network Traffic Analysis and Eavesdropping
	Packet analysis tools – Wireshark, TCPdump, and others
		Network analyzers
		Network packets
	Python/Pyshark for deep network analysis
	Advanced packet dissection with LUA
	ARP spoofing, session hijacking, and data hijacking tools, scripts, and techniques
		ARP protocol
		ARP poisoning
	Packet generation and replaying tools
	Summary
	Questions
Chapter 9: Using Behavior Analysis and Anomaly Detection
	Collection and monitoring methods
		SNMP
		NetFlow and IPFIX
		Wireshark and network analysis tools
	Establishing a baseline
		Small business/home network
		Medium-size enterprise network
	Typical suspicious patterns
		Scanning patterns
	Summary
	Questions
Part 3: Network Protocols – How to Attack and How to Protect
Chapter 10: Discovering LAN, IP, and TCP/UDP-Based Attacks
	Layer 2 attacks – how to generate them and how to protect against them
		Attacks on the switching discovery mechanisms
		Attacks on a VLAN mechanism and VLAN flooding
	ICMP-based attacks, ping scans, the ping of death, and L3 DDoS
		Ping scans and L3 DDoS
		The ping of death and malformed packets
		IP fragmentation and teardrop attacks
	Layer 4 TCP and UDP attacks
		UDP flooding attacks
		SYN flooding and stealth scan attacks and countermeasures
		TCP RST (reset) and FIN attacks
		Various TCP flag combination attacks
	TCP sequence attacks and session hijacking attacks
	Summary
	Questions
Chapter 11: Implementing Wireless Network Security
	Wireless standards, protocols, and encryption standards
		Wireless standards – IEEE 802.11
		Wireless lab setup
	Sniffing wireless networks
		Sniffing packets on the target AP
	Packet injection
	Discovering hidden SSIDs
	Compromising open authentication wireless networks
	WLAN encryptions and their corresponding flaws and attacks
	Network jamming – DOS/DDOS wireless network attacks
	Evil twin attack – honeypots
	Person-in-the-Middle (PITM) attacks
	Implementing a secure wireless architecture
	Summary
	Questions
Chapter 12: Attacking Routing Protocols
	IGP standard protocols – the behaviors RIP (brief), OSPF, and IS-IS
		RIP protocol behavior
		OSPF protocol behavior
		IS-IS protocol behavior
		Dual IS-IS
		CLNP
		IS-IS levels
	Falsification, overclaiming, and disclaiming
	DDOS, mistreating, and attacks on the control plane
		Planes
		DOS and DDOS
		Reflection attacks
	Routing table poisoning and attacks on the management plane
	Traffic generation and attacks on the data plane
		Attacks on the data plane
	How to configure your routers to protect
	BGP – protocol and operation
	BGP hijacking
	BGP mitigation
	Summary
	Questions
Chapter 13: DNS Security
	The DNS protocol, behavior, and data structure
		The DNS protocol
		DNS behavior and structure
	DNS attack discovery – tools and analysis
		DNS enumeration
		Vulnerability scanning
	Attacks on DNS resources – DNS flooding, NX records, and subdomains
		NX record attacks
		DNS flooding
	Attacks on a service – domain spoofing and hijacking, or cache poisoning
	Using DNS to bypass network controls – DNS tunneling
	DNS protection
	Summary
	Questions
Chapter 14: Securing Web and Email Services
	HTTP and HTTP2 protocol behavior, data structure, and analysis
		HTTP behavior, data structure, and analysis
		Proxy servers
		HTTP request formation
		HTTP versions
	HTTPS protocol behavior, data structure, and analysis
		What is HTTPS?
		TTP hacking tools – scanners, vulnerability checkers, and others
	Web vulnerabilities and exploitation
		SQL injection
		Remote code execution
		Cross-Site Scripting (XSS)
		Buffer overflow
		Session hijacking
	Email protocols and loopholes
		SMTP protocol loopholes
		Phishing
	Countermeasures and defense
	Summary
	Questions
Chapter 15: Enterprise Applications Security – Databases and Filesystems
	Microsoft network protocols – NetBIOS, SMB, and LDAP operations, vulnerabilities, and exploitation
		NetBIOS
		SMB operations, vulnerabilities, and exploitation
		LDAP operations, vulnerabilities, and exploitation
	Database network protocols – TDS and SQLNet operations
		TDS
		SQLNet
	Attacking SQL databases
		Enumeration of SQL servers in a domain
		Misconfiguration audit
		SQL server exploitation
	Countermeasures to protect network protocols and databases
	Summary
	Questions
Chapter 16: IP Telephony and Collaboration Services Security
	IP telephony – protocols and operations
		VoIP
		SIP and its operations
		RTP and its operations
	IP telephony penetration testing lab setup
	IP telephony penetration testing methodology
		Enumeration
		IP telephony penetration testing
	IP telephony security and best practices
		Securing the IP telephony network
		Securing the IP telephony device
		Securing the media layer
		Securing the signaling layer
	Summary
	Questions
Assessments
Index
Other Books You May Enjoy