View difference between Paste ID: iMfb6J9G and 4W8iryHb

 This is the training I (Kiran Karnad) used to provide at the 3-day infosec training workshop when I was working at VCIPL
 
 Module 00 - Student Introduction
 Student Introduction
 Certification
 ECSA Track
 LPT Track
 What next after ECSA Training?
 Demo - Overview of Available Resources
 Lab Sessions
 Student Introduction Review
 Module 01 - The Need for Security Analysis
 The Need for Security Analysis
 What are we Concerned About?
 So What are you Trying to Protect?
 Why are Intrusions so Often Successful?
 What are the Greatest Challenges?
 Environmental Complexity
 New Technologies
 New Threats and Exploits
 Demo - Keep Updated with Research
 Limited Focus
 Limited Expertise
 Tool: Data Loss Cost Calculator
 Demo - Tech//404 Data Loss Calculator
 In Order to Ensure…
 Authentication
 Authorization
 Confidentiality
 Integrity
 Availability
 Non-Repudiation
 We Must be Diligent
 Threat Agents
 Assessment Questions
 How Much Security is Enough?
 Risk
 Simplifying Risk
 Risk Analysis
 Risk Assessment Answers Seven Questions:
 Steps of Risk Assessment
 Demo - Risk Assessment
 Demo - CIO-view Self-assessment
 Risk Assessment Values
 Demo - Quantitative Threat Analysis
 Information Security Awareness
 Security Policies
 Security Policy Basics
 Demo - Policy Templates
 Types of Policies
 Promiscuous Policy
 Permissive Policy
 Prudent Policy
 Paranoid Policy
 Acceptable-Use Policy
 User-Account Policy
 Remote-Access Policy
 Information-Protection Policy
 Firewall-Management Policy
 Special-Access Policy
 Network-Connection Policy
 Business-Partner Policy
 Data Classification Policies
 Intrusion Detection Policies
 Virus Prevention Policies
 Laptop Security Policy
 Personal Security Policy
 Cryptography Policy
 Fair and Accurate Credit Transactions Act of 2003 (FACTA)
 Other Important Policies
 Policy Statements
 Basic Document Set of Information Security Policies
 ISO 17799
 Domains of ISO 17799
 No Simple Solutions
 U.S. Legislation
 California SB 1386
 Sarbanes-Oxley 2002
 Gramm-Leach-Bliley Act (GLBA)
 Health Insurance Portability and Accountability Act (HIPAA)
 USA Patriot Act 2001
 U.K. Legislation
 How Does This Law Affect a Security Officer?
 The Data Protection Act 1998
 The Human Rights Act 1998
 Interception of Communications
 The Freedom of Information Act 2000
 The Audit Investigation and Community Enterprise Act 2005
 Demo - Vmware Overview
 Demo - Opening an Existing XP VMware System
 Demo - Opening VM Appliance
 Demo - Installing a New VM System
 Demo - Booting XP from Backtrack ISO
 Module 1 Review
 Module 02 - Advanced Googling
 Advanced Googling
 Site Operator
 intitle:index.of
 Demo - Default Pages: tsweb
 error | warning
 Demo - Google as a Proxy
 login | logon
 username | userid | employee.ID | “your username is”
 password | passcode | “your password is”
 admin | administrator
 –ext:html –ext:htm –ext:shtml –ext:asp –ext:php
 inurl:temp | inurl:tmp | inurl:backup | inurl:bak
 Google Advanced Search Form
 Categorization of the Operators
 allinanchor:
 allintext:
 Demo - Google Locating Live Cams
 Locating Public Exploit Sites
 Locating Exploits via Common Code Strings
 Locating Vulnerable Targets
 Locating Targets via Demonstration Pages
 Demo - Google Hack HoneyPot
 Demo - Goolag and Wikto
 Demo - Wikto Results and Google Guide
 Module 2 Review
 Module 03 - TCP/IP Packet Analysis
 TCP/IP Packet Analysis
 TCP/IP Model
 Demo - TCP/IP Movie Recommendation
 Application Layer
 Transport Layer
 Internet Layer
 Network Access Layer
 Comparing OSI and TCP/IP
 Demo - Engage Packet Builder
 TCP
 TCP Header
 IP Header: Protocol Field
 UDP
 TCP and UDP Port Numbers
 Port Numbers
 Demo - Warriors of the Net
 IANA
 Source and Destination Port Numbers
 Demo - Techtionary.com Port Numbers
 What Makes Each Connection Unique?
 Structure of a Packet
 TCP Operation
 Three-Way Handshake
 Demo - Techtionary.com TCP Handshake
 Flow Control
 Windowing
 Windowing and Window Sizes
 Simple Windowing
 Acknowledgement
 Sliding Windows
 Sequencing Numbers
 Synchronization
 Positive Acknowledgment and Retransmission (PAR)
 What is Internet Protocol v6 (IPv6)?
 Why IPv6?
 IPv4/IPv6 Transition Mechanisms
 IPv6 Security Issues
 Security Flaws in IPv6
 IPv6 Infrastructure Security
 Ipsec
 Firewalls and Packet Filtering
 Denial-of-Service (DoS) Attacks
 UDP Operation
 Internet Control Message Protocol (ICMP)
 ICMP Message Delivery
 Format of an ICMP Message
 Unreachable Networks
 Time Exceeded Message
 IP Parameter Problem
 ICMP Control Messages
 ICMP Redirects
 Clock Synchronization and Transit Time Estimation
 Information Requests and Reply Message Formats
 Address Masks
 Router Solicitation and Advertisement
 Module 3 Review
 Module 04 - Advanced Sniffing Techniques
 Advanced Sniffing Techniques
 Demo - Basic Sniffers
 Demo - Packet Capturing with Windows Packetyzer
 What is Wireshark?
 Wireshark: Filters
 Wireshark: Tshark
 Wireshark: Tcpdump
 Demo - Tcpdump
 Protocol Dissection
 Steps to Solve GNU/ Linux Server Network Connectivity Issues
 Using Wireshark for Network Troubleshooting
 Using Wireshark for System Administration
 ARP Problems
 Demo - Sniffers and ARP
 ICMP Echo Request/Reply Header Layout
 TCP Flags
 Scenario 1: SYN no SYN+ACK
 Scenario 2: SYN Immediate Response RST
 Scenario 3: SYN SYN+ACK ACK
 Tapping into the Network
 Using Wireshark for Security Administration
 Sniffer Detection
 Wireless Sniffing with Wireshark
 Frequency
 Using Channel Hopping
 Interference and Collisions
 Recommendations for Sniffing Wireless Traffic
 Analyzing Wireless Traffic
 IEEE 802.11 Header
 Filters
 Unencrypted Data Traffic
 Identifying Hidden SSIDs
 Identifying EAP Authentication Failures
 Identifying WEP
 Identifying IPsec/VPN
 Decrypting Traffic
 Scanning
 TCP Connect Scan
 SYN Scan
 XMAS Scan
 Null Scan
 Remote Access Trojans
 Wireshark DNP3 Dissector Infinite Loop Vulnerability
 Time Stamps
 Time Zones
 Packet Reassembling
 Checksums
 Module 4 Review
 Module 05 - Vulnerability Analysis with Nessus
 Vulnerability Analysis with Nessus
 Nessus
 Features of Nessus
 Nessus Assessment Process
 Demo - Nessus on Windows
 Demo - Nessus on Windows Cont'd and GFI LANguard Comparison
 False Positives
 Examples of False Positives
 Identifying False Positives
 Suspicious Signs
 Demo - Backtrack 4 Nessus Install
 Module 5 Review
 Module 06 - Advanced Wireless Testing
 Advanced Wireless Testing
 Wireless Concepts
 Demo - Techtionary Website
 802.11 Types
 Core Issues with 802.11
 What’s the Difference?
 Other Types of Wireless
 Spread Spectrum Background
 Channels
 Access Point
 Service Set ID
 Demo - Linksys-AP Config SSID
 Default SSIDs
 Chipsets
 Wi-Fi Equipment
 Expedient Antennas
 Vulnerabilities to 802.1x and RADIUS
 Security - WEP
 Wired Equivalent Privacy (WEP)
 Exclusive OR
 Encryption Process
 Chipping Sequence
 WEP Issues
 WEP - Authentication Phase
 WEP - Shared Key Authentication
 WEP - Association Phase
 WEP Flaws
 WEP Attack
 Demo - Authentication Settings
 Demo - WEP Set-Up Security
 Demo - Cain and Abel WEP Cracking
 WPA Interim 802.11 Security
 WPA
 Demo - Cracking WPA with Cain and Abel
 WPA2 (Wi-Fi Protected Access 2)
 802.1X Authentication and EAP
 EAP Types
 Cisco LEAP
 TKIP (Temporal Key Integrity Protocol)
 Wireless Networks Testing
 Wireless Communications Testing
 Report Recommendations
 Wireless Attack Countermeasures
 Demo - MAC-SSID Security
 Wireless Penetration Testing with Windows
 War Driving
 The Jargon – WarChalking
 Wireless: Tools of the Trade
 Demo - Kismet in Windows
 Demo - Tool: Kismet in Linux
 Demo - Vistumbler War Driving and GPS Map Plotting
 How Does NetStumbler Work?
 “Active” vs. “Passive” WLAN Detection
 Disabling the Beacon
 Running NetStumbler
 Demo - Tool: Netstumbler
 AirCrack-ng
 AirCrack-ng: How Does it Work?
 AirCrack-ng: FMS and Korek Attacks
 AirCrack-ng: Notes
 Demo - Hacking WEP Encryption
 Determining Network Topology: Network View
 WarDriving and Wireless Penetration Testing with OS X
 Using a GPS
 Deauthenticating Clients
 StumbVerter
 MITM Attack Design
 MITM Attack Variables
 Hardware for the Attack: Antennas, Amps, and WiFi Cards
 Choosing the Right Antenna
 Amplifying the Wireless Signal
 IP Forwarding and NAT using IPtables
 Demo - Jasager fon Router
 Module 6 Review
 Module 07 - Designing a DMZ
 Designing a DMZ
 Introduction
 DMZ Concepts
 DMZ Design Fundamentals
 Advanced Design Strategies
 Types of Firewall and DMZ Architectures
 "Inside vs. Outside" Architecture
 "Three-Homed Firewall" DMZ Architecture
 Weak Screened Subnet Architecture
 Strong Screened Subnet Architecture
 Designing a DMZ using IPtables
 Designing Windows DMZ
 Precautions for DMZ Setup
 Demo - Designing DMZs
 Advanced Implementation of a Solaris DMZ Server
 Solaris DMZ Servers in a Conceptual Highly Available Configuration
 Hardening Checklists for DMZ Servers and Solaris
 Placement of Wireless Equipment
 Access to DMZ and Authentication Considerations
 Wireless DMZ Components
 WLAN DMZ Security Best Practices
 Ethernet Interface Requirements and Configuration
 DMZ Router Security Best Practice
 Six Ways to Stop Data Leaks
 Module 7 Review
 Module 08 - Snort Analysis
 Snort Analysis
 Snort Overview
 Modes of Operation
 Features of Snort
 Configuring Snort
 Snort: Variables
 Snort: Pre-processors
 Snort: Output Plug-ins
 Snort: Rules
 How Snort Operates
 Initializing Snort
 Demo - Snort IDS Testing Scanning Tools
 Signal Handlers
 Parsing the Configuration File
 Decoding
 Possible Decoders
 Pre-processing
 Detection
 Content Matching
 The Stream4 Pre-processor
 Inline Functionality
 Writing Snort Rules
 Snort Rule Header
 Snort Rule Header: Actions
 Snort Rule Header: Other Fields
 IP Address Negation Rule
 IP Address Filters
 The direction Operator
 Rule Options
 Activate/Dynamic Rules
 Metadata Rule Options: msg
 The reference Keyword
 The sid/rev Keyword
 The classtype Keyword
 Payload Detection Rule Options: content
 Modifier Keywords
 The uricontent Keyword
 The fragoffset Keyword
 Writing Good Snort Rules
 Tool for Writing Snort Rules: IDS Policy Manager
 Honeynet Security Console Tool
 Key Features
 Module 8 Review
 Module 09 - Log Analysis
 Log Analysis
 Logs
 Events that Need to be Logged
 What to Look Out For in Logs
 Automated Log Analysis Approaches
 Log Shipping
 Syslog
 Setting up a Syslog
 System Error Logs
 Kiwi Syslog Daemon
 Configuring Kiwi Syslog to Log to a MS SQL Database
 Configuring a Cisco Router for Syslog
 Configuring a DLink Router for Syslog
 Gathering Log Files from an IIS Web Server
 Apache Web Server Log
 AWStats Log Analyzer
 Cisco Router Logs
 Analyzing Netgear Wireless Router Logs
 Wireless Traffic Analysis Using Wireshark
 Configuring Firewall Logs in Local Windows System
 Viewing Local Windows Firewall Log
 Viewing Windows Event Log
 Collecting & Monitoring UNIX Syslog
 iptables
 Log Prefixing with iptables
 Firewall Log Analysis with grep
 SQL Database Log
 Using SQL Server to Analyze Web Logs
 Analyzing Oracle Logs: The Oracle Metric Log File
 ApexSQL Log
 Analyzing Solaris System Logs
 Demo - Splunk
 Module 9 Review
 Module 10 - Advanced Exploits and Tools
 Advanced Exploits and Tools
 Common Vulnerabilities
 Buffer Overflows Revisited
 Smashing the Stack for Fun and Profit
 Smashing the Heap for Fun and Profit
 Format Strings for Chaos and Mayhem
 The Anatomy of an Exploit
 Demo - Fuzzing for Weaknesses
 Vulnerable Code
 Shellcode
 Shellcode Examples
 Shellcode (cont’d)
 Demo - Stack Function
 Delivery Code
 Delivery Code: Example
 Demo - Compiling Exploits from Source Code
 Linux Exploits versus Windows
 Windows versus Linux
 Tools of the Trade: Debuggers
 Tools of the Trade: GDB
 Tools of the Trade: Metasploit
 Demo - Metasploit Intro
 Demo - Metasploit 101
 Demo - Metasploit Interactive
 Tools of the Trade: Canvas
 Lab
 Tools of the Trade: CORE Impact
 Ways to Use CORE Impact
 Microsoft Baseline Security Analyzer (MBSA)
 Network Security Analysis Tool (NSAT)
 Sunbelt Network Security Inspector (SNSI)
 Demo - Saint Exploit of Windows XP
 Demo - dcom101 Exploit Autoshovel of Shell
 Demo - dcom Exploit Netcat Shovel of Shell and Extracting Hashes
 Demo - Backtrack 4 Milw0rm Metasploit Updates
 Module 10 Review
 Module 11 - Penetration Testing Methodologies
 Penetration Testing Methodologies
 Demo - dradis Effective Information Sharing
 What is Penetration Testing?
 Why Penetration Testing?
 What Should be Tested?
 What Makes a Good Penetration Test?
 Common Penetration Testing Techniques
 Penetration Testing Process
 Scope of Penetration Testing
 Blue Teaming/Red Teaming
 Types of Penetration Testing
 Black-box Penetration Testing
 White-box Penetration Testing
 Announced Testing/ Unannounced Testing
 Grey-box Penetration Testing
 Strategies of Penetration Testing
 External Penetration Testing
 Internal Security Assessment
 Application Security Assessment
 Types of Application Security Assessment
 Network Security Assessment
 Wireless/Remote Access Assessment
 Telephony Security Assessment
 Social Engineering
 Penetration Testing Consultants
 Required Skills Sets
 Hiring a Penetration Tester
 Responsibilities of a Penetration Tester
 Profile of a Good Penetration Tester
 Why Should the Company Hire You?
 Companies’ Concerns
 Methodology
 Demo - NIST Methodology
 Demo - PenTest Templates and Methodologies
 Penetration Testing Roadmap
 Guidelines for Security Checking
 Operational Strategies for Security Testing
 Security Category of the Information System
 Identifying Benefits of Each Test Type
 Prioritizing the Systems for Testing
 ROI on Penetration Testing
 Determining Cost of Each Test Type
 Need for a Methodology
 Penetration Test vs. Vulnerability Test
 Reliance on Checklists and Templates
 Phases of Penetration Testing
 Pre-Attack Phase
 Best Practices
 Results that can be Expected
 Passive Reconnaissance
 Active Reconnaissance
 Attack Phase
 Activity: Perimeter Testing
 Activity: Web Application Testing - I
 Activity: Web Application Testing – II
 Activity: Wireless Testing
 Activity: Acquiring Target
 Activity: Escalating Privileges
 Activity: Execute, Implant, and Retract
 Post-Attack Phase and Activities
 Module 11 Review
 Module 12 - Customers and Legal Agreements
 Customers and Legal Agreements
 Why do Organizations Need Pen-Testing?
 Initial Stages in Penetration Testing
 Understand Customer Requirements
 Create a Checklist of Testing Requirements
 Penetration Testing ‘Rules of Behavior’
 Demo - ISSAF Customers and Legal
 Penetration Testing Risks
 Penetration Testing by Third Parties
 Precautions While Outsourcing Penetration Testing
 Legal Consequences
 Demo - Computer Crimes and Implications
 Get Out of Jail Free Card
 Permitted Items in Legal Agreement
 Confidentiality and NDA Agreements
 Non-Disclosure and Secrecy Agreements (NDA)
 The Contract
 Liability Issues
 Negligence Claim
 Plan for the Worst
 Drafting Contracts
 How Much to Charge?
 Module 12 Review
 Module 13 - Rules of Engagement
 Rules of Engagement
 Rules of Engagement (ROE)
 Demo - OSSTMM Model
 Scope of ROE
 Steps for Framing ROE
 Clauses in ROE
 Demo - ScreenHunter Desktop Capture Tool
 Module 13 Review
 Module 14 - Penetration Testing Planning and Scheduling
 Penetration Testing Planning and Scheduling
 Test Plan
 Purpose of Test Plan
 Building a Penetration Test Plan
 Demo - Overview OSSTMM
 IEEE STD. 829–1998 SECTION HEADINGS
 Test Plan Identifier
 Test Deliverables
 Penetration Testing Planning Phase
 Define the Scope
 Project Scope
 When to Retest?
 Responsibilities
 Skills and Knowledge Required
 Internal Employees
 Penetration Testing Teams
 Tiger Team
 Building Tiger Team
 Questions to Ask Before Hiring Consultants to the Tiger Team
 Meeting With the Client
 Kickoff Meeting
 Penetration Testing Project Plan
 Work Breakdown Structure or Task List
 Penetration Testing Schedule
 Penetration Testing Project Scheduling Tools
 Test Plan Checklist
 Penetration Testing Hardware/Software Requirements
 EC-Council’s Vampire Box
 Begin Penetration Testing
 Demo - Installing Backtrack 4 into VMWare Environment
 Module 14 Review
 Module 15 - Customers and Legal Agreements
 Pre-Penetration Testing Checklist
 Demo - Pentest Checklist
 Step 1: Gather Information about Client Organization’s History and Background
 Step 2: Visit the Client Organization Premises
 Step 3: List the Client Organization’s Penetration Testing Requirements
 Step 4: Obtain Penetration Testing Permission from the Company’s Stakeholders
 Step 5: Obtain Detailed Proposal of Test and Services that are Proposed to be carried out
 Step 6: Identify the Office Space/Location your Team would be Working in for this Project
 Step 7: Obtain Temporary Identity Cards from the Organization for the Team who is Involved in the Process
 Step 8: Identify who will be Leading the Penetration Testing Project (Chief Penetration Tester)
 Step 9: Request from the Client Organization the Previous Penetration Testing/Vulnerability Assessment Reports
 Step 10: Prepare Rules of Engagement that Lists the Company’s Core Competencies/ Limitations/ Timescales
 Step 11: Hire a Lawyer who Understands IT and can Handle your Penetration Testing Legal Documents
 Step 12: Prepare PT Legal Document and get Vetted with your Lawyer
 Step 13: Prepare Non Disclosure Agreement (NDA) and have the Client Sign them
 Step 14: Obtain (if possible) Liability Insurance from a Local Insurance Firm
 Step 15: Identify your Core Competencies/Limitations
 Step 16: Allocate a Budget for the Penetration Testing Project ( X amount of $ )
 Step 17: Prepare a Tiger Team
 Step 18: List the Security Tools that you will be using for the Penetration Testing Project
 Step 19: List the Hardware and Software Requirements for the Penetration Testing Project
 Step 20: Identify the Clients Security Compliance Requirements
 Step 21: List the Servers, Workstations, Desktops and Network Devices that need to be Tested
 Step 22: Identify the Type of Testing that would be carried out - Black Box or White Box Testing
 Step 23: Identify the Type of Testing that would be carried out - Announced/ Unannounced
 Step 24: Identify Local Equipment Required for Pen Test
 Step 25: Identify Local Manpower Required for Pen Test
 Step 26: List the Contact Details of Personnel from Client Organization who will be in Charge of the Pen Test
 Step 27: Obtain the Contact Details of the Key Personnel for Approaching in case of an Emergency
 Step 29: List the Tests that will not be carried out at the Client Network
 Step 30: Identify the Purpose of the Test you are carrying out at the Client Organization
 Step 31: Identify the Network Topology in which the Test would be carried out
 Step 32: Obtain Special Permission if Required from Local Law Enforcement Agency
 Step 33: List known Waivers/Exemptions
 Step 34: List the Contractual Constraints in the Penetration Testing Agreement
 Step 35: Identify the Reporting Timescales with the Client Organization
 Step 36: Identify the List of Penetration Testers Required for this Project
 Step 37: Negotiate per Day/per Hour Fee that you will be Charging for the Penetration Testing Project
 Step 38: Draft the Timeline for the Penetration Testing Project
 Step 39: Draft a Quotation for the Services that you'll be Providing to the Client Organization
 Step 40: Identify how the Final Penetration Testing Report will be Delivered to the Client Organization
 Step 41: Identify the Reports to be Delivered After Pen Test
 Step 42: Identify the Information Security Administrator who will be helping you in the Penetration Testing
 Module 15 Review
 Module 16 - Information Gathering
 Information Gathering
 What is Information Gathering?
 Information Gathering Steps
 Step 1: Crawl the Website and Mirror the Pages on Your PC
 Demo - HTTrack Website Copier
 Step 2: Crawl the FTP Site and Mirror the Pages on Your PC
 Demo - Wget and Backtrack 4 Live CD
 Step 3: Look up Registered Information in the Whois Database
 Demo - CentralOps and Domains by Proxy
 Demo - Backtrack and Whois
 Step 4: List the Products Sold by the Company
 Demo - Firecat (Firefox Addons)
 Step 5: List the Contact Information, Email Addresses, and Telephone Numbers
 Step 6: List the Company’s Distributors
 Step 7: List the Company’s Partners
 Demo - Email Spider
 Step 8: Search the Internet, Newsgroups, Bulletin Boards, Negative Websites for Information about the Company
 Demo - Maltego
 Step 9: Search for Trade Association Directories
 Step 10: Search for Link Popularity of Company Website
 Demo - Alexa
 Step 11: Compare Price of Product or Service with the Competitor
 Step 12: Find the Geographical Location
 Demo - Shazou
 Use Google Map to Find Geographical Location
 Step 13: Search the Internet Archive Pages about the Company
 Demo - Archive.org
 Step 14: Search Similar or Parallel Domain Name Listings
 Demo - ServerSniff TLDs
 Step 15: Search Job Posting Sites about the Company
 Step 16: Browse Social Network Websites
 Demo - Social Networking
 Step 17: Write Down Key Employees
 Step 18: Investigate Key Persons – Searching in Google, Look up their Resumes and Cross Link Information
 Step 19: List Employee Company and Personal Email Address
 Step 20: Search for Web Pages Posting Patterns and Revision Numbers
 Demo - No Tech Hacking
 Step 21: Email the Employee Disguised as Customer Asking for Quotation
 Step 22: Visit the Company as Inquirer and Extract Privileged Information
 Step 23: Visit the Company Locality
 Step 24: Use Web Investigation Tools to Extract Sensitive Data Targeting the Company
 Step 25: Use Intelius and Conduct Background Check on Company Key Personnel
 Step 26: Search on eBay for Company’s Presence
 Step 27: Use the Domain Research Tool to Investigate the Company’s Domain
 Step 28: Use the EDGAR Database to Research Company Information
 Step 34: Use GHDB and Search for the Company Name
 Demo - Summary
 Demo - Vmware 64bit Error Fix
 Demo - SEAT
 Demo - Metagoofil Search
 Demo - CORE Impact Email Info Gathering
 Module 16 Review
 Module 17 - Vulnerability Analysis
 Vulnerability Analysis
 Why Assess?
 Vulnerability Classification
 What is Vulnerability Assessment?
 Demo - Vulnerability Research Resources
 Demo - Nessus 4 Windows Install and Wikto Scan Webgoat
 Types of Vulnerability Assessment
 Demo - Nessus 3 Webgoat Scan BT4
 Demo - Nessus 4 Webgoat Scan
 Demo - GFI LANguard
 How to Conduct a Vulnerability Assessment
 How to Obtain a High Quality Vulnerability Assessment
 Vulnerability Assessment Phases
 Pre-Assessment Phase
 Assessment Phase
 Post-Assessment Phase
 Vulnerability Analysis Stages
 Comparing Approaches to Vulnerability Assessment
 Characteristics of a Good Vulnerability Assessment Solution
 Vulnerability Assessment Considerations
 Vulnerability Assessment Reports
 Demo - Nessus 3 BT Exporting NBE Report
 Vulnerability Report Model
 Timeline
 Types of Vulnerability Assessment Tools
 Choosing a Vulnerability Assessment Tool
 Vulnerability Assessment Tools Best Practices
 Vulnerability Assessment Tools
 Demo - Retina Security Scanner
 Other Vulnerability Tools
 Report
 Vulnerability Assessment Reports
 Automated Scanning Server Reports
 Periodic Vulnerability Scanning Report
 Module 17 Review
 Module 18 - External Penetration Testing
 External Penetration Testing
 Penetration Testing Roadmap
 External Intrusion Test and Analysis
 How is it Done?
 Client Benefits
 External Penetration Testing
 Steps – Conduct External Penetration Testing
 Demo - CORE Impact Network Vulnerability Test
 Demo - Samaurai Live CD Intro
 Step 1: Inventory Company’s External Infrastructure
 Step 2: Create Topological Map of the Network
 Step 3: Identify the IP Address
 Step 4: Locate the Traffic Route that Goes to the Web Servers
 Step 5/6: Locate TCP/UDP Traffic Path to the Destination
 Step 7: Identify the Physical Location of the Target Servers
 Step 8: Examine the Use IPV6 at the Remote Location
 Step 9: Lookup Domain Registry for IP Information
 Step 10: Find IP Block Information about the Target
 Step 11: Locate the ISP Servicing the Client
 Step 12: List Open Ports
 Open Ports on Web Server
 Step 13: List Closed Ports
 Port Scanning Tools
 Step 14: List Suspicious Ports that are Half Open/Closed
 Step 15: Port Scan Every Port (65,536) on the Target’s Network
 Step 16: Use SYN Scan on the Target and See the Response
 Step 17: Use Connect Scan on the Target and See the Response
 Demo - N-stalker Results Webgoat
 Demo - Breaking Access Control Passwords with Xhydra
 Demo - Viewing Website with Telnet
 Demo - Input-injection Attack
 Demo - Fast-track Overview and Install
 Demo - Fast-track Exploits
 Demo - Fast-track Clientside Attacks
 Demo - Fast-track Mass Attack
 Module 18 Review
 Module 19 - Internal Network Penetration Testing
 Internal Network Penetration Testing
 Penetration Testing Roadmap
 Internal Testing
 Methods of Internal Testing
 Enumerate Other Machines
 Step 1: Map the Internal Network
 Demo - Spiceworks Inventory
 Step 2: Scan the Network for Live Hosts
 Demo - SNMP Enumerating with BT
 Demo - FireScope MIB Tool
 Step 3: Port Scan Individual Machines
 Step 4: Try to Gain Access Using Known Vulnerabilities
 Demo - SMB NAT Dictionary Attacks
 Demo - Injecting the Abel Service
 Demo - Nslookup DNS Zone Transfer
 Step 5: Attempt to Establish Null Sessions
 Demo - Enumerate Banners
 Demo - Null Session Multiple Tools
 Demo - Null Session Countermeasures
 Step 6: Enumerate Users
 Step 7: Sniff the Network Using Wireshark
 Step 8: Sniff Pop3/FTP/Telnet Passwords
 Step 9: Sniff Email Messages/VoIP Traffic
 Sniffer Tools
 Demo - ARP Poisoning with Cain
 Step 10: Attempt Replay Attacks
 Demo - SSL MITM
 Step 11: Attempt ARP Poisoning
 Step 11a: Attempt Mac Flooding
 Step 12: Conduct a Man-in-the Middle Attack
 Step 13: Attempt DNS Poisoning
 Demo - Cain DNS Spoof
 Step 14: Try a Login to a Console Machine
 Step 15: Boot the PC Using Alternate OS and Steal the SAM File
 Demo - Local Password Reset
 Demo - Backtrack Local XP Password Attack
 Copying Commands in Knoppix
 ERD Commander 2005
 Reset Administrator Password
 Step 16: Attempt to Plant a Software Keylogger to Steal Passwords
 Keyloggers and Spy Software
 Demo - Hardware Keystroke Loggers
 Step 17: Attempt to Plant a Hardware Keylogger to Steal Passwords
 Step 18: Attempt to Plant a Spyware on the Target Machine
 Step 19: Attempt to Plant a Trojan on the Target Machine
 Step 20: Attempt to Create a Backdoor Account on the Target Machine
 Demo - Secure Tunnels and Anonymizer Techniques
 Step 21: Attempt to Bypass Anti-virus Software Installed on the Target Machine
 Demo - Stealth Tools v2 to Hide Viruses and Malware
 Step 22: Attempt to Send Virus Using the Target Machine
 Step 23: Attempt to Plant Rootkits on the Target Machine
 Demo - Dreampakpl Rootkit
 Step 24: Hide Sensitive Data on Target Machines
 Demo - Alternate Data Streams
 Step 25: Hide Hacking Tools and Other Data in Target Machines
 Step 26: Use Various Steganography Techniques to Hide Files on Target Machine
 Demo - Steganography
 Step 27: Escalate User Privileges
 Demo - Privilege Escalation
 Step 28: Capture POP3 Traffic
 Step 29: Capture SMTP Traffic
 Step 32: Capture HTTP Traffic
 Step 33: Capture HTTPS Traffic (Even Though it cannot be Decoded)
 Step 34: Capture RDP Traffic
 Step 35: Capture VoIP Traffic
 Demo - Cain VoIP RDP Interception
 Steps 40 and 41
 Step 42: Attempt Session Hijacking on Telnet Traffic
 Steps 43 and 44
 Continue Testing
 CORE Impact - Automated Tool
 Metasploit - Tool
 Canvas – Automated Tool
 Vulnerability Scanning Tools
 Document Everything
 Module 19 Review
 
 
 Module 20 - Router and Switches Penetration Testing
 Router and Switches Penetration Testing
 Demo - Cain and Abel Routing Protocols and ID Networks
 Penetration Testing Roadmap
 Router Testing Issues
 Need for Router Testing
 General Requirements
 Technical Requirements
 Try to Compromise the Router
 Steps for Router Penetration Testing
 Step 1: Identify the Router Hostname
 Step 2: Port Scan the Router
 Step 3: Identify the Router Operating System and its Version
 Steps 4/5: Identify Protocols Running/Testing for Package Leakage at the Router
 Step 6: Test for Router Misconfigurations
 Step 7: Test for VTY/TTY Connections
 The Process to Get Access to the Router
 Step 8: Test for Router Running Modes
 Privilege Mode Attacks
 Step 9: Test for SNMP Capabilities
 SNMP “Community String”
 Step 10: Test for TFTP Connections
 TFTP Testing
 Step 11: Test if Finger is Running on the Router
 Step 12: Test for CDP Protocol Running on the Router
 How to Test CDP Protocol?
 Step 13: Test for NTP Protocol
 Step 14: Test for Access to Router Console Port
 Step 15: Test for Loose and Strict Source Routing
 Steps 16 and 17: Test for IP Spoofing/IP Handling Bugs
 Step 18: Test ARP Attacks
 Step 19: Test for Routing Protocol Assessment
 Step 20: RIP Testing
 Step 21: Test for OSPF Protocol
 Step 22: Test BGP Protocol
 Step 23: Test for EIGRP Protocol
 Step 24: Test Router Denial of Service Attacks
 Step 25: Test Router’s HTTP Capabilities
 Step 26: Test Through HSRP Attack
 Router Testing Report
 Steps for Testing Switches
 Step 1: Testing Address Cache Size
 Step 2: Data Integrity and Error Checking Test
 Step 3: Testing for Back-to-Back Frame Capacity
 Step 4: Testing for Frame Loss
 Step 5: Testing for Latency
 Step 6: Testing for Throughput
 Step 7: Test for Frame Error Filtering
 Step 8: Fully Meshed Test
 Step 9: Stateless QoS Functional Test
 Step 10: Spanning Tree Network Convergence Performance Test
 Step 11: OSPF Performance Test
 Step 12: Test for VLAN Hopping
 Step 13: Test for MAC Table Flooding
 Step 14: Testing for ARP Attack
 Step 15: Check for VTP Attack
 Module 20 Review
 Module 21 - Firewall Penetration Testing
 Firewall Penetration Testing
 Penetration Testing Roadmap
 What is a Firewall?
 What Does a Firewall Do?
 Packet Filtering
 What Can't a Firewall Do?
 How Does a Firewall Work?
 Firewall Logging Functionality
 Firewall Policy
 Periodic Review of Information Security Policies
 Firewall Implementation
 Build a Firewall Ruleset
 Maintenance and Management of Firewall
 Types of Firewall
 Demo - Introduction to Vyatta
 Packet Filtering Firewall
 IP Packet Filtering Firewall
 Circuit Level Gateway
 Application Level Firewall
 Stateful Multilayer Inspection Firewall
 Multilayer Inspection Firewall
 Steps for Conducting Firewall Penetration Testing
 Step 1: Locate the Firewall
 Step 2: Traceroute to Identify the Network Range
 Step 3: Port Scan the Firewall
 Step 4: Grab the Banner
 Step 5: Create Custom Packets and Look for Firewall Responses
 Step 6: Test Access Control Enumeration
 Step 7: Test to Identify Firewall Architecture
 Step 8: Testing Firewall Policy
 Step 9: Test Firewall Using Firewalking Tool
 Step 10: Test for Port Redirection
 Firewall Identification
 Step 11: Testing the Firewall from Both Sides
 Step 12: Overt Firewall Test from Outside
 Step 13: Test Covert Channels
 Step 14: Covert Firewall Test from Outside
 Step 15: Test HTTP Tunneling
 Step 16: Test Firewall Specific Vulnerabilities
 Demo - Vyatta
 Demo - CORE Impact Targeting Vyatta
 Document Everything
 Module 21 Review
 Module 22 - IDS Penetration Testing
 IDS Penetration Testing
 Penetration Testing Roadmap
 What is an IDS?
 Demo - IDS Blink and Ossec.net
 Network IDS
 Host-based IDS
 Demo - Blink Personal IPS IDS
 Application-based IDS
 Multi-Layer Intrusion Detection Systems
 Multi-Layer Intrusion Detection System Benefits
 Wireless Intrusion Detection Systems (WIDS)
 IDS Testing Tool - Evasion Gateway
 Common Techniques Used to Evade IDS Systems
 IDS Penetration Testing Steps
 Steps 1/2: Test for Resource Exhaustion/ IDS by Sending ARP Flood
 Steps 3/4: Test the IDS by MAC Spoofing/ IP Spoofing
 Steps 5/6: Test by Sending a Packet to the Broadcast Address/Inconsistent Packets
 Steps 7/8: Test IP Packet Fragmentation/Duplicate Fragments
 Steps 9/10: Test for Overlapping Fragments/Ping of Death
 Steps 11/12: Test for Odd Sized Packets/TTL Evasion
 Steps 13/14: Test by Sending a Packet to Port 0/UDP Checksum
 Steps 15/16: Test for TCP Retransmissions/ TCP Flag Manipulation
 The TCP Header looks like this:
 Step 17: Test TCP Flags
 Steps 18/19: Test the IDS by Sending SYN Floods/ Sequence Number Prediction
 Step 20: Test for Backscatter
 Steps 21/22: Test the IDS with ICMP Packets/ IDS Using Covert Channels
 Step 23: Test Using TCPReplay
 Step 24: Test Using TCPOpera
 Step 26: Test the IDS Using URL Encoding
 Step 27: Test the IDS Using Double Slashes
 Step 28: Test the IDS for Reverse Traversal
 Step 29: Test for Self Reference Directories
 Step 31: Test for IDS Parameter Hiding
 Step 32: Test for HTTP-Misformatting
 Step 33: Test for Long URLs
 Step 34: Test for DoS/Win Directory Syntax
 Step 35: Test for Null Method Processing
 Step 36: Test for Case Sensitivity
 Step 37: Test Session Splicing
 Module 22 Review
 Module 23 - Wireless Network Penetration Testing
 Wireless Network Penetration Testing
 Penetration Testing Roadmap
 Wireless Security Threats
 Wireless Assessment
 Attempt Wireless Monitoring
 Wireless Vulnerability Testing
 Wireless Penetration Testing Steps
 Demo - inSSIDer
 Demo - Wi-Spy Spectrum Analyzer
 Demo - Tips Resources
 Module 23 Review
 Module 24 - Denial of Service Penetration Testing
 Denial of Service Penetration Testing
 How Does a Denial of Service Attack Work?
 Distributed Denial of Service Attack
 Warning
 How to Conduct Denial of Service Attack Penetration Testing?
 Demo - Ping of Death and Nemesy
 Module 24 Review
 Module 25 - Password Cracking Penetration Testing
 Password Cracking Penetration Testing
 Passwords
 Common Password Vulnerabilities
 Password Cracking Techniques
 Types of Password Cracking Attacks
 Demo - Cain and Abel Dictionary Attack
 Demo - Cracking your Local XP 64-bit Password with Ophcrack
 Demo - Cracking the Hash Imported into Cain and Abel
 Demo - Rainbow Table Cracking
 Steps in Password Cracking Penetration Testing
 Step 5: Attempt to Guess Passwords
 Demo - Removing a PDF Password
 Module 25 Review
 Module 26 - Social Engineering Penetration Testing
 Social Engineering Penetration Testing
 What is Social Engineering?
 Requirements of Social Engineering
 Steps in Conducting Social Engineering Penetration Test
 Before you Start
 Dress Like a Businessman
 Step 1: Attempt Social Engineering Techniques Using Phone
 Step 2: Attempt Social Engineering by Vishing
 Step 3: Attempt Social Engineering by Telephone
 Step 4: Attempt Social Engineering Using Email
 Demo - Hotmail Social Engineering
 Step 10: Attempt Social Engineering by Desktop Information
 Step 12: Attempt Social Engineering Using Websites
 Module 26 Review
 Module 27 - Stolen Laptops, PDAs, and Cell Phones Penetration Testing
 Stolen Laptops, PDAs, and Cell Phones Penetration Testing
 Penetration Testing Roadmap
 Stolen Laptop Testing
 Laptop Theft
 Demo - Darik's Boot and Nuke
 Penetration Testing Steps
 Step 1: Identify Sensitive Data in the Devices
 Look for Personal Information in the Stolen Laptop
 Step 2: Look for Passwords
 Step 3: Look for Company Infrastructure or Finance Documents
 Step 4: Extract the Address Book and Phone Numbers
 Step 5: Extract Schedules and Appointments
 Step 6: Extract Applications Installed on these Devices
 Step 7: Extract Email Messages from these Devices
 Step 8: Gain Access to Server Resources by Using Information you Extracted
 Step 9: Attempt Social Engineering with the Extracted Information
 Check for BIOS Password
 Look into the Encrypted File
 Check Cookies in Web Browsers
 Install Software
 Attempt to Enable Wireless
 Module 27 Review
 Module 28 - Application Penetration Testing
 Application Penetration Testing
 Application Testing
 What is a Defect?
 Defects vs. Failures
 Defect Ratio
 Requirements and Design Testing
 Web Applications Penetration Testing
 What is a Web Application?
 Demo - Webgoat Hands-on Web Testing
 Demo - Foundstone Overview Hacme Bank Weak Apps
 Web Application Penetration Testing Steps
 Step 1: Fingerprinting the Web Application Environment
 Step 2: Investigate the Output from HEAD and OPTIONS Http Requests
 Step 3: Investigate the Format and Wording of 404/Other Error Pages
 Step 4: Test for Recognized File Types/Extensions/Directories
 Step 5: Examine Source of Available Pages
 Step 6: Manipulate Inputs in Order to Elicit a scripting Error
 Step 7: Test Inner Working of a Web Application
 Step 8: Test Database Connectivity
 Step 9: Test the Application Code
 Random Numbers vs. Unique Numbers
 Step 10: Testing the Use of GET and POST in Web Application
 Step 11: Test for Parameter-Tampering Attacks on Website
 Step 12: Test for URL Manipulation
 Step 13: Test for Cross Site scripting
 Step 14: Test for Hidden Fields
 Step 15: Test Cookie Attacks
 Step 16: Test for Buffer Overflows
 Step 17: Test for Bad Data
 Step 18: Test Client-Side scripting
 Step 19: Test for Known Vulnerabilities
 Step 20: Test for Race Conditions
 Step 21: Test with User Protection via Browser Settings
 Step 22: Test for Command Execution Vulnerability
 Step 23: Test for SQL Injection Attacks
 Step 24: Test for Blind SQL Injection
 Step 25: Test for Session Fixation Attack
 Step 26: Test for Session Hijacking
 Step 27: Test for XPath Injection Attack
 Step 28: Test for Server Side Include Injection Attack
 Step 29: Test for Logic Flaws
 Step 30: Test for Binary Attacks
 Step 31: Test for XML Structural
 Step 32: Test for XML Content-level
 Step 33: Test for WS HTTP GET Parameters/REST Attacks
 Step 34: Test for Malicious SOAP Attachments
 Step 35: Test for WS Replay
 Testing Tools
 KSES/ Mieliekoek.pl
 Webgoat
 AppScan
 URL Scan
 Demo - Hacme Bank Scan using N-Stalker
 Demo - Hacme Bank Scan Core Web Testing
 Module 28 Review
 Module 29 - Physical Security Penetration Testing
 Physical Security Penetration Testing
 Physical Attacks
 Steps in Conducting Physical Security Penetration Testing
 Demo - Bump Key Animation
 Step 1: Map the Possible Entrances
 Step 2: Map the Physical Perimeter
 Step 3: Penetrate Locks Used on the Gates, Doors, and Closets
 Step 4: Observing From a Distance
 Step 5: Penetrate Server Rooms, Cabling, and Wires
 Step 6: Attempt Lock Picking Techniques
 Step 7: Fire Detection Systems
 Step 8: Air Conditioning Systems
 Step 9: Electromagnetic Interception
 Check for the Following
 Step 10: Test if the Company has a Physical Security Policy
 Step 11: Physical Assets
 Step 12: Risk Test
 Step 13: Test if any Valuable Paper Document is Kept at the Facility
 Step 14: Check how these Documents are Protected
 Step 15: Employee Access
 Step 16: Test for Radio Frequency ID (RFID)
 Step 17: Physical Access to Facilities
 Step 18: Documented Process
 Step 19: Test People in the Facility
 Step 20: Who is Authorized?
 Step 21: Test Fire Doors
 Step 22: Check for Active Network Jacks in Meeting Rooms
 Step 23: Check for Active Network Jacks in Company Lobby
 Step 24: Check for Sensitive Information Lying around Meeting Rooms
 Step 25: Check for Receptionist/Guard Leaving Lobby
 Step 26: Check for Accessible Printers at the Lobby – Print Test Page
 Step 27: Obtain Phone/Personnel Listing from the Lobby Receptionist
 Step 28: Listen to Employee Conversation in Communal Areas/Cafeteria
 Step 29: Can you Enter the Ceiling Space and Enter Secure Rooms
 Step 30: Check Windows/Doors for Visible Alarm Senses
 Step 31: Check Visible Areas for Sensitive Information
 Step 32: Try to Shoulder Surf Users Logging on
 Step 33: Try to Videotape Users Logging on
 Steps 34 and 35
 Step 36: Intercept and Analyze Guard Communication
 Step 37: Attempt Piggybacking on Guarded Doors
 Step 38: Attempt to Use Fake ID to Gain Access
 Step 39: Test “ After Office Hours” Entry Methods
 Step 40: Identify all Unguarded Entry Points
 Step 43: Attempt to Bypass Sensors Configured on Doors and Windows
 Step 44: Attempt Dumpster Diving Outside the Company Trash Area
 Step 45: Use Binoculars from Outside the Building and See if you can View What is Going On Inside
 Step 46: Use Active High Frequency Voice Sensors to Hear Private Conversation among Company Staff
 Step 47: Dress as a FedEx/UPS Employee and Try to Gain Access to the Building
 Document Everything
 Module 29 Review
 Module 30 - Database Penetration Testing
 Database Penetration Testing
 List of Steps
 Demo - NTOSpider
 Step 1: Scan for Default Ports Used by the Database
 Step 2: Scan for Non-Default Ports Used by the Database
 Step 3: Identify the Instance Names Used by the Database
 Step 4: Identify the Version Numbers Used by the Database
 Step 5: Attempt to Brute-Force Password Hashes from the Database
 Step 6: Sniff Database Related Traffic on the Local Wire
 Step 7: Microsoft SQL Server Testing
 Step 7.1: Test for Direct Access Interrogation
 Step 7.2: Scan for Microsoft SQL Server Ports ( TCP/UDP 1433)
 Step 7.3: Test for SQL Server Resolution Service (SSRS)
 Step 7.4: Test for Buffer Overflow in pwdencrypt() Function
 Step 7.5: Test for Heap/Stack Buffer Overflow in SSRS
 Step 7.6: Test for Buffer Overflows in Extended Stored Procedures
 Step 7.7: Test for Service Account Registry Key
 Step 7.8: Test the Stored Procedure to Run Web Tasks
 Step 7.9: Exploit SQL Injection Attack
 Step 7.10: Blind SQL Injection
 Demo - SQL Injection with Lee Lawson
 Step 7.11: Google Hacks
 Step 7.12: Attempt Direct-exploit Attacks
 Step 7.13: Try to Retrieve Server Account List
 Step 7.14: Using OSQL Test for Default/Common Passwords
 Step 7.15: Try to Retrieve Sysxlogins Table
 Try to Retrieve Sysxlogins Table Views
 SQL Server System Tables
 Step 7.16: Brute-force SA Account
 Step 8: Oracle Server Testing
 Port Scanning Basic Techniques
 Step 8.2: Check the Status of TNS Listener Running at Oracle Server
 Listener Modes
 Step 8.3: Try to Login Using Default Account Passwords
 Step 8.4: Try to Enumerate SIDs
 Step 8.5: Use SQL Plus to Enumerate System Tables
 SQL PLUS: Screenshot
 Step 9: MySQL Server Database Testing
 Step 9.2: Extract the Version of Database being Used
 Step 9.3: Try to Login Using Default/Common Passwords
 Step 9.4: Brute-force Accounts Using Dictionary Attack
 Dictionary Attack Tools
 Dictionary Attack Tool: SQLdict
 Step 9.5: Extract System and User Tables from the Database
 Demo - CORE Impact Webgoat Information Gathering
 Demo - CORE Impact Webgoat SQL Numeric Injection
 Demo - Hacme Bank Testing with Wikto
 Module 30 Review
 Module 31 - VoIP Penetration Testing
 VoIP Penetration Testing
 Penetration Testing Roadmap
 Vulnerability Assessment
 VoIP Risks and Vulnerabilities
 VoIP Security Threat
 VoIP Penetration Testing Steps
 Demo - VoIP Overview Testing
 Step 1: Test for Eavesdropping
 Step 2: Test for Flooding and Logic Attacks
 Step 3: Test for Denial of Service (DoS) Attack
 Step 4: Test for Call Hijacking & Redirection Attack
 Step 5: Test for ICMP Ping Sweeps
 Step 6: Test for ARP Pings
 Step 7: Test for TCP Ping Scans
 Step 8: Test for SNMP Sweeps
 Step 9: Test for Port Scanning and Service Discovery
 Step 10: Test for Host/Device Identification
 Step 11: Test for Banner Grabbing
 Step 12: Test for SIP User/Extension Enumeration
 Step 13: Test for Automated OPTIONS Scanning with sipsak
 Step 14: Test for Automated REGISTER, INVITE, and OPTIONS Scanning with SIPSCAN against SIP Server
 Step 15: Test for Enumerating TFTP Servers
 Step 16: Test for SNMP Enumeration
 Step 17: Test for Sniffing TFTP Configuration File Transfers
 Step 18: Test for Number Harvesting and Call Pattern Tracking
 VoIP Security Tools
 AuthTool
 VoIPong
 Demo - VoIP Interception with Cain and Abel
 VoIPong: Screenshots
 Vomit
 PSIPDump
 Netdude
 Netdude: Features
 Oreka
 rtpBreak
 SNScan
 Smap
 Example: Locating Devices
 Example: Fingerprinting Devices
 Example: Learning Mode
 SIPScan
 Scanning SIP Phones
 SIPScan: Screenshot
 SIPcrack
 VoIPaudit
 Sipsak
 SIPp
 SipBomber
 Spitter
 VoIP Fuzzing Tools
 VoIP Signaling Manipulation Tools
 VoIP Media Manipulation Tools
 Module 31 Review
 Module 32 - VPN Penetration Testing
 VPN Penetration Testing
 Virtual Private Network (VPN)
 VPN Penetration Testing Steps
 Demo - VPN Testing
 Step 1.1 Scanning: 500 UDP IPSEC
 Step 1.2 Scanning: 1723 TCP PPTP
 Step 1.3 Scanning: 443 TCP/SSL
 Step 1.4 Scanning: nmap -sU -P0 -p 500
 Step 1.5 Scanning: Ipsecscan xxx.xxx.xxx.xxx-255
 Step 2: Fingerprinting
 Step 2.1: Get the IKE Handshake
 Step 2.2: UDP Backoff Fingerprinting
 Step 2.3: Vendor ID Fingerprinting
 Step 2.4: Check for IKE Aggressive Mode
 Step 3.1: PSK Crack: ikeprobe xxx.xxx.xxx.xxx-255
 Step 3.2 PSK Crack: Sniff for Responses with C&A or IKECrack
 Step 4: Test for Default User Accounts
 Step 4.1: Check for Unencrypted Username in a File or the Registry
 Check for Unencrypted Username in a File or the Registry: Screenshot
 Step 4.2: Test for Plain-Text Password
 Step 5: Test for SSL VPN
 Tool: IKE-scan
 IKE-scan: Screenshot
 Tool: IKEProbe
 Tool: VPNmonitor
 Tool: IKECrack
 Module 32 Review
 Module 33 - War Dialing
 War Dialing
 War Dialing Techniques
 Why Conduct a War Dialing Pentest?
 Pre-Requisites for War Dialing Penetration Testing
 Software Selection for War Dialing
 Guidelines for Configuring Different War Dialing Software
 Recommendations for Establishing an Effective War Dialing Process
 Interpreting War Dialing Results
 List of War Dialing Tools
 Demo - New War Dialing Tool: WarVOX
 PhoneSweep
 THC Scan
 ToneLoc
 ModemScan - www.wardial.net
 War Dialing Countermeasures SandTrap Tool
 Module 33 Review
 Module 34 - Virus and Trojan Detection
 Virus and Trojan Detection
 Steps for Detecting Trojans and Viruses
 Step 1: Use netstat -a to Detect Trojans Connections
 Step 2: Check Windows Task Manager
 Step 3: Check Whether Scanning Programs are Enabled
 Step 3.1: Perform Scanning for Suspicious Running Processes
 Step 3.2: Perform Scanning for Suspicious Registry Entries
 Step 3.3: Check for Suspicious Open Ports
 Step 3.4: Check Whether Suspicious Network Activities are Present
 Step 3.5: Use HijackThis to Scan for Spyware
 Step 4: Check Whether Anti-Virus and Anti-Trojan Programs are Working
 Step 5: Detection of a Boot-Sector Virus
 Spyware Detectors
 Demo - Beast Trojan
 Anti-Trojans
 Anti-Virus Software
 Module 34 Review
 Module 35 - Log Management Penetration Testing
 Log Management Penetration Testing
 Need for Log Management
 Challenges in Log Management
 Steps for Log Management Penetration Testing
 Step 1: Scan for Log Files
 Step 2: Try to Flood Syslog Servers with Bogus Log Data
 Step 3: Try Malicious Syslog Message Attack (Buffer Overflow)
 Step 4: Perform Man-in-the-Middle Attack
 Step 5: Check Whether the Logs are Encrypted
 Step 6: Check Whether Arbitrary Data Can be Injected Remotely into Microsoft ISA Server Log File
 Step 7: Perform DoS Attack Against Check Point FW-1 Syslog Daemon (Only for CheckPoint Firewall)
 Step 8: Send Syslog Messages Containing Escape Sequences to Syslog Daemon of Check Point FW-1 NG FP3
 Checklist For Secure Log Management
 Module 35 Review
 Module 36 - File Integrity Checking
 File Integrity Checking
 File Integrity
 Integrity Checking Techniques
 Demo - File Integrity Checkers
 Steps for Checking File Integrity
 Step 1: Check While you Unzip the File
 Step 2: Check for CRC Value Integrity Checking
 CRC Checking in Windows
 Step 3: Check for Hash Value Integrity Checking
 Step 3.1: Get the File and Previously Calculated Hash Value for the File
 Step 3.2: Generate a New Hash Value for the File
 Step 3.3: Match the Old and New Hash Values
 File Integrity Checking Tools
 Module 36 Review
 Module 37 - Bluetooth and Hand Held Device Penetration Testing
 Bluetooth and Hand Held Device Penetration Testing
 Jailbreaking an iPhone
 Steps for iPhone Penetration Testing
 Demo - Jailbreak
 Demo - iPod Custom Apps
 Step 1: Jailbreak the iPhone
 Jailbreaking Using PwnageTool or QuickPwn
 Jailbreaking Using QuickPwn
 Step-by-Step Guide to Jailbreak iPhone 3G and Preserve Baseband using PwnageTool
 Step 2: Unlock the iPhone
 Step 4: Hack iPhone using Metasploit
 Step 5: Check for Access Point with Same Name and Encryption Type
 Step 6: Check Whether Malformed Data Can be Sent to the Device
 Step 7: Check Whether Basic Memory Mapping Information Can be Extracted
 Vulnerabilities in BlackBerry
 Steps for Penetration Testing
 Step 1: Try Blackjacking on BlackBerry
 Step 2: Try to Attack by Sending Malformed TIFF Image Files
 PDA Attacks
 Steps for Penetration Testing 2
 Step 1: Check Whether Passwords can be Cracked
 Step 2: Try for ActiveSync Attacks
 Step 3: Check Whether the IR Port is Enabled
 Step 4: Check Whether Encrypted Data can be Decrypted
 Bluetooth: Introduction
 Different Attacks in Bluetooth Devices
 Steps for Penetration Testing in Bluetooth
 Step 1: Check Whether the PIN Can be Cracked
 Step 2: Try to Perform a Blueprinting Attack
 Step 3: Check Whether you are able to Extract the SDP Profiles
 Step 4: Try Pairing Code Attacks
 Step 5: Try a Man-in-the-Middle Attack
 Step 6: Try a BlueJacking Attack
 Step 7: Try a BTKeylogging Attack
 Step 8: Try Bluesmacking -The Ping of Death
 Step 9: Try a BlueSnarfing Attack
 Try a BlueSnarfing Attack
 Step 10: Try a BlueBug Attack
 Step 11: Try BlueSpam
 Module 37 Review
 Module 38 - Telecommunication and Broadband Communication Penetration Testing
 Telecommunication and Broadband Communication Penetration Testing
 Broadband Communication
 Risk in Broadband Communication
 Steps for Broadband Communication Penetration Testing
 Step 1: Check Whether the Firewall Device is Installed on Network
 Step 1.1: Check Whether Personal and Hardware Firewalls are Installed
 Step 1.2: Check Whether These Firewalls Prevent Intruders or Detect Any Rogue Software
 Step 1.3: Check Whether the Logging is Enabled on the Firewall
 Step 1.4: Check Whether the Firewall is in Stealth Mode
 Step 2: Check Whether Web Browsers are Properly Configured
 Step 2.1: Check Whether the Browser has Default Configuration
 Step 2.2: Check for the Browser Plugins
 Step 2.3: Check Whether Active Code is Enabled
 Step 2.4: Check Whether the Browser Version is Updated
 Step 2.5: Check Whether the Cookies are Enabled
 Step 2.6: Check Whether the scripting Languages are Enabled
 Step 3: Check for Operating System Configuration Options
 Step 3.1: Check Whether Operating System and Application Software are Updated
 Step 3.2: Check Whether the File and Printer Sharing Option is Enabled
 Step 3.3: Check Whether the Anti-Virus Programs are Enabled
 Step 3.4: Check the Configuration of Anti-Virus Program
 Step 3.5: Check Whether Anti-Spyware is Enabled
 Step 4: Check for Wireless and other Home Networking Technologies
 Step 4.1: Check for VPN Policy Configurations
 Step 4.2: Try for Wiretapping
 Step 4.3: Try to Perform War Driving
 Step 4.4: Check Whether the Wireless Base Station is at Default Configuration
 Step 4.5: Check Whether WEP is Implemented
 Step 4.6: Try to Crack the WEP Key
 Step 4.7: Try to Crack the SSID Password
 Step 4.8: Check Whether the Simple Network Management Protocol (SNMP) is Enabled
 Guidelines for Securing Telecommuting and Home Networking Resources
 Module 38 Review
 Module 39 - Email Security Penetration Testing
 Email Security Penetration Testing
 Introduction to Email Security
 Pre-Requisite For Email Penetration Testing
 Demo - Hacking Email Accounts
 Steps for Email Penetration Testing
 Step 1: Try to Access Email ID and Password
 Step 2: Check Whether Anti-Phishing Software is Enabled
 Step 3: Check Whether Anti-Spamming Tools are Enabled
 Step 4: Try to Perform Email Bombing
 Step 5: Perform CLSID Extension Vulnerability Test
 Step 6: Perform VBS Attachment Vulnerability Test
 Step 7: Perform Double File Extension Vulnerability Test
 Step 8: Perform Long Filename Vulnerability Test
 Step 9: Perform ActiveX Vulnerability Test
 Step 10: Perform Iframe Remote Vulnerability Test
 Step 11: Perform MIME Header Vulnerability Test
 Step 12: Perform Malformed File Extension Vulnerability Test
 Step 13: Perform Access Exploit Vulnerability Test
 Step 14: Perform Fragmented Message Vulnerability Test
 Step 15: Perform Long Subject Attachment Checking Test
 List of Anti-Phishing Tools
 PhishTank SiteChecker
 PhishTank SiteChecker: Screenshot
 NetCraft
 GFI MailEssentials
 SpoofGuard
 List of Anti-Spamming Tools
 AEVITA Stop SPAM Email
 SpamExperts Desktop
 Spytech SpamAgent
 Module 39 Review
 Module 40 - Security Patches Penetration Testing
 Security Patches Penetration Testing
 Patch Management
 Patch and Vulnerability Group (PVG)
 Countermeasure Testing Steps
 Step 1: Check If Organization has a PVG in Place
 Step 2: Check Whether the Security Environment is Updated
 Step 3: Check Whether Organization uses Automated Patch Management Tools
 Step 4: Check the Last Date of Patching
 Step 5: Check the Patches on Non-Production Systems
 Step 6: Check the Vender Authentication Mechanism
 Step 7: Check Whether Downloaded Patches Contain Viruses
 Step 8: Check for Dependency of New Patches
 Security Checklist for Patch Management
 Patch Management Tools
 Module 40 Review
 Module 41 - Data Leakage Penetration Testing
 Data Leakage Penetration Testing
 Penetration Testing Roadmap
 Data Leakage
 Data Leakage Statistics
 How Much Security?
 How Data Can be Leaked
 What to Protect
 Steps for Data Leakage
 Step 1: Check Physical Availability of USB Devices
 Step 2: Check Whether USB Drive is Enabled
 Step 3: Try to Enable USB
 Step 4: Check Whether USB Asked for Password
 Step 5: Check Whether Bluetooth is Enabled
 Step 6: Check if the Firewire is Enabled
 Step 7: Check if FTP Ports 21 and 22 are Enabled
 Step 8: Check Whether any Memory Slot is Available and Enabled in Systems
 Step 9: Check Whether Employees are Using Camera Devices within Restricted Areas
 Step 10: Check Whether Systems have Any Camera Driver Installed
 Step 11: Check Whether Anti-Spyware and Anti-Trojans are Enabled
 Step 12: Check Whether Encrypted Data Can be Decrypted
 Step 13: Check if the Internal Hardware Components are Locked
 Step 14: Check Whether Size of Mail and Mail Attachments is Restricted
 Data Privacy and Protection Acts
 Data Protection Tools
 Module 41 Review
 Module 42 - Penetration Testing Deliverables and Conclusion
 Penetration Testing Deliverables and Conclusion
 Destroy the Report
 Sign-Off Document
 Module 42 Review
 Module 43 - Penetration Testing Report and Documentation Writing
 Penetration Testing Report and Documentation Writing
 Penetration Testing Report
 Documentation Writing
 Table of Contents
 Summary of Execution
 Summary of Weaknesses
 Scope of the Project
 Result Analysis
 Recommendations
 Appendices
 Test Reports on Network
 Summary Recommendations
 Exploited Vulnerabilities
 Payment Card Industry (PCI) Report
 Client-Side Test Reports
 Client-Side Penetration Test Report
 User Report
 Test Reports on Web Applications
 Web Application Testing Report
 Detailed Findings
 Detailed Results
 Strategic and Tactical Directives
 Writing the Final Report
 Creating the Final Report
 Report Format
 Delivery
 Report Retention
 Module 43 Review
 Module 44 - Penetration Testing Report Analysis
 Penetration Testing Report Analysis
 Report on Penetration Testing
 Pen-Test Team Meeting
 Research Analysis
 Pen-Test Findings
 Rating Findings
 Demo - Practical Threat Analysis Tool
 Example of Finding- I
 Example of Finding- II
 Analyze
 Module 44 Review
 Module 45 - Post Testing Actions
 Post Testing Actions
 Prioritize Recommendations
 Develop Action Plan
 Create Process for Minimizing Misconfiguration Chances
 Updates and Patches
 Capture Lessons Learned and Best Practices
 Create Security Policies
 Conduct Training
 Take Social Engineering Class
 Destroy the Pen-Test Report
 Module 45 Review
 Module 46 - Ethics of a Licensed Penetration Tester
 Ethics of a Licensed Penetration Tester
 What Makes a Licensed Penetration Tester?
 Modus Operandi
 Evolving as a Licensed Penetration Tester
 Licensed Penetration Tester Dress Code
 LPT Audited Logos
 Example: LPT Audited Logos
 Module 46 Review
 Module 47 - Standards and Compliance
 Customers and Legal Agreements
 Module 47 Review
 Course Closure