Chapter 1: Linux Hacking
§ Common Terminology
o Introduction to Linux Hacking
o Linux Distributions
o Linux Basics
o Linux LiveCDs
o Files and Directories
o File System
o Linux Basic Commands
o Linux Networking Commands
o Directories in Linux
o Installing. Configuring. and Compiling Linux Kernel
o How to Install a Kernel Patch
- Compiling Programs in Linux
o GNU Compiler Collection (GCC) Compiler
o GCC Commands
o Make Files
o Make Install Command
- Linux Vulnerabilities
- Linux Security
o chrooting
· Limitations of chrooting
o Linux Kernel BER Decoding Remote Buffer Overflow Vulnerability
o Why Is Linux Hacked?
o How to Hack Root Password in Linux
§ LILO Bootloader
o Steps to Hack Root Password in Linux
o Scanning Networks
o Tool: Nessus
o Port Scan Detection Tools
o Password Cracking in Linux
o Tool: John the Ripper
o Firewall in Linux: IPTables
· How IPTables Works
o Netfilter
o IPTables Command
o Basic Linux Operating System Defense
o Tcpdump
o Hping2
- Linux Loadable Kernel Modules
- Tool: Chkrootkit
- Linux Security Tools
o Linux Tools: Application Security
o Advanced Intrusion Detection Environment (AIDE)
o EnGarde Secure Linux
o EnGarde Secure Linux: Secure Shell Configuration
o EnGarde Secure Linux: Attack Graph
o AppArmor
o Strobe
o Encryption
o Log and Traffic Monitors
o Linux Security Auditing Tool (LSAT)
o Linux Security Countermeasures
o Steps for Hardening Linux
o Issues with Open Source Linux
o Linux Security Checklist
Chapter 2: Mac OS X Hacking
- Case Example
- Introduction to Mac OS X Hacking
- Introduction to Mac OS
- Vulnerabilities in MAC OS
o MAC OS X Vulnerabilities and Solution Statistics
o Apple QuickTime Buffer Overflow Vulnerability
o Apple Mac OS X Pixlet Video Handling Remote Code Execution Vulnerability
o Heap-based Buffer Overflow Vulnerability in ColorSync Profile
o Apple ImageIO EXIF Metadata Buffer Overflow Vulnerability
o Apple Mac OS X MobileMe Session Hijack Vulnerability
o Apple Mac OS X AppleTalk Kernel Buffer Overflow Vulnerability
o Apple Mac OS X Remote Apple Events Out of Bounds Memory Access Security Vulnerability
o Crafted URL Vulnerability
o CoreText Uninitialized Pointer Vulnerability
o ImageIO Integer overflow Vulnerability
o DirectoryService Vulnerability
o iChat UPnP Buffer Overflow Vulnerability
o ImageIO Memory Corruption Vulnerability
o Code Execution Vulnerability
o UFS Filesystem Integer Overflow Vulnerability
o Kernel "fpathconf()" System call Vulnerability
o UserNotificationCenter Privilege Escalation Vulnerability
o Other Vulnerabilities in MAC
o How a Malformed Installer Package Can Crack Mac OS X
- Demonstrated Damage
- Worms, Viruses, and Trojans in MAC OS X
o MAC OS X Threats
o Trojan:
o OSX/Jahlav-C
o OSX/iWorkS-A
o OSX.Trojan.iServices.A
o Worm:
o OSX/Tored.A
o OSX/Leap-A
o Inqtana.A: F-Secure Worm on OS X
o Preventive Measures for OSX Inqtana.A
o Viruses in MAC: Macro Viruses
o Antivirus Applications in Mac OS X
o DoorStop X Firewall
o Intego NetBarrier
o Intego ContentBarrier
o Flying Buttress
Chapter 3: Hacking Routers, Cable Modems, and Firewalls
- Introduction to Hacking Routers, Cable Modems, and Firewalls
- Routers
- Cable Characteristics: Networking Cables
o Types of Twisted Pair Cable
o Types of Coaxial Cables
o Types of Fiber Optic Cables
o Cable Modems
- Media Connectors
- Concentrators
- Repeaters and Hubs
- Modems
- Multiplexers
- Gateways
- Patch Panel
- Switch
o Security Features of Firewall
o Software and Hardware Firewall
o Difference between Hardware and Software Firewalls
o Types of Firewalls:
· IP Packet Filters
· Circuit Level Gateway
· Application Level Firewalls
· Stateful Multilayer Inspection Firewall
o Network Security Software
- Types of Router Attacks
- Router Attack Topology
- Denial of Service (DoS) Attacks
- Packet “Mistreating” Attacks
- Routing Table Poisoning
- Flooding
- Hit-and-run Attacks vs. Persistent Attacks
- Tools
- Yersinia for HSRP, CDP, and Other Layer 2 Attacks
- Cisco Torch
- Cracking the Enable Password
- Tool:
o John the Ripper
o Cain and Abel
Chapter 4: Hacking Mobile Phones, PDAs, and Handheld Devices
- Introduction to Hacking Mobile Phones, PDAs, and Handheld Devices
- Types of Handheld Devices
- Common Operating Systems in Handheld Devices
- Threats to Mobile Devices
- Vulnerabilities in Handheld Devices
- Vulnerabilities in Different Mobile Phones
- Malware
o Symbos_Locknut.B
o SymbOS/Htool-SMSSender.A.intd
o SymbOS/MultiDropper.CG
o Warm: SYMBOS_CABIR.A
o Worm: Symb/Cabir-A
o Trojan:
o SymbOS.Sendtool.A
o SMS.Python.Flocker
o Best Practices Against Malware
- Hacking Handheld Devices
- Personal Digital Assistant (PDA)
o PDA Security Issues
o ActiveSync Attacks
o HotSync Attack
o PDA Virus: Brador
o PDA Security Tools: TigerSuite PDA
o PDA Security Tools:
· SecuBox for Pocket PC
· SecuWipe for Pocket PC
· Trend Micro Mobile Security
· avast! PDA Edition
o Cellcrypt
o Security Policies for PDAs
o PDA Attack Countermeasures
- Defending Handheld Devices
- iPod
o Misuse of iPod
o Jailbreaking
o Tool for Jailbreaking:
· iDemocracy
· iActivator
Chapter 5: Bluetooth Hacking
- Introduction to Bluetooth
- Bluetooth Security Issues
- Bluetooth Attacks
o Bluejacking
· Steps for Bluejacking in Mobile Phones
o Bluesniff
o BlueSpam
o BlueSnarfing
o BlueBug Attack
o Bluestab (Denial-of-Service Attack)
o Blueprinting
o Bluesmacking - The Ping of Death
o Bluecasting
o BlueDump Attack
o BlueBump
o Bluechop
o Bluetooone
o BlueSniper
o BTVoiceBugging Attack
o Short Pairing Code Attacks
o Man-in-the-Middle Attack
o OnLine PIN Cracking Attack
o BTKeylogging Attack
o Fuzzing Attacks
- Bluetooth Hacking Tools
- Viruses and Worms
- Bluetooth Security Tools
o Bluesnarfer
o BTCrawler
o Bluediving
o TBEAR - Transient Bluetooth Environment auditor
o BTBrowser
o BTCrack
o BTScanner
o Hidattack
o BlueAlert and BlueFish
o Proximity
o HaraldScan
o BlueWatch
- Other BT Hacking Tools
- Countermeasures
Chapter 6: RFID Hacking
- Case Example
- Introduction to RFID Hacking
- RFID (Radio Frequency Identification)
- RFID Frequency Bands
- Components of RFID Systems
- A Simple RFID System
- Working of an RFID
- Challenges in RFID Deployment
- Steps for RFID Deployment
- RFID Applications
- RFID Collisions
- RFID Risks
o Business Process Risk
o Business Intelligence Risk
o Privacy Risk
o Externality Risk
- RFID and Privacy Issues
- RFID Security and Privacy Threats
- Countermeasures Used to Avoid RFID Attacks
- RFID Security and Privacy Threats
o Sniffing
o Tracking
o Spoofing
o Replay Attacks
o Denial-of-service
o Generic Attack
o Virus Attacks
- How to Write an RFID Virus
- How to Write an RFID Worm
- RFID Malware
o Defenses Against RFID Malware
- RFID Exploits
- Vulnerabilities in RFID-Enabled Credit Cards
- RFD Hacking Tool
- RFID Security Controls
o Management Controls
o Operational Controls
o Technical Controls
Chapter 7: Hacking USB Devices
- Case Example
- Introduction to Hacking USB Devices
- Introduction to USB Devices
- USB Attacks
o Electrical Attack
o Software Attack
o USB Attack on Windows
o W32/Madang-Fam
o VBS/Repvblik-A
o W32/Hasnot-A
o W32/Uisgon-A
o W32/Fujacks-AK
o W32/Fujacks-E
o W32/Dzan-C
o W32/SillyFD-AA
o W32/SillyFDC-BK
o W32/SillyFDC-W
o W32/LiarVB-A
o W32/Hairy-A
o W32/QQRob-ADN
o W32/VBAut-B
o W32/Tiotua-G
o HTTP W32.Drom
o W32/VB-DWC
o W32/Bdoor-AEE
o Mal/Conficker-A
o USBSecure Professional
o MyUSBonly
o USBDeview
o USB Blocker
o USB CopyNotify
o Remora USB File Guard
o Advanced USB Port Monitor
o Folder Password Expert USB
o USBlyzer
o USB PC Lock Pro
o Virus Chaser USB
o uHook Personal