Linux Server Security – Hack and Defend

Preface xiii
<p>Introduction xv</p>
<p>Chapter 1: Invisibility Cloak 1</p>
<p>Background 1</p>
<p>Probing Ports 1</p>
<p>Confusing a Port Scanner 2</p>
<p>Installing knockd 2</p>
<p>Packages 3</p>
<p>Changing Default Settings 3</p>
<p>Altering Filesystem Locations 4</p>
<p>Some Config Options 5</p>
<p>Starting the Service 5</p>
<p>Changing the Default Network Interface 5</p>
<p>Packet Types and Timing 5</p>
<p>Testing Your Install 6</p>
<p>Port Knocking Clients 7</p>
<p>Making Your Server Invisible 7</p>
<p>Testing Your iptables 8</p>
<p>Saving iptables Rules 9</p>
<p>Further Considerations 10</p>
<p>Smartphone Client 10</p>
<p>Troubleshooting 10</p>
<p>Security Considerations 10</p>
<p>Ephemeral Sequences 11</p>
<p>Summary 12</p>
<p>Chapter 2: Digitally Fingerprint Your Files 13</p>
<p>Filesystem Integrity 13</p>
<p>Whole Filesystem 16</p>
<p>Rootkits 17</p>
<p>Confi guration 19</p>
<p>False Positives 21</p>
<p>Well Designed 22</p>
<p>Summary 23</p>
<p>Chapter 3: Twenty–First–Century Netcat 25</p>
<p>History 25</p>
<p>Installation Packages 27</p>
<p>Getting Started 27</p>
<p>Transferring Files 29</p>
<p>Chatting Example 30</p>
<p>Chaining Commands Together 30</p>
<p>Secure Communications 31</p>
<p>Executables 33</p>
<p>Access Control Lists 34</p>
<p>Miscellaneous Options 34</p>
<p>Summary 35</p>
<p>Chapter 4: Denying Service 37</p>
<p>NTP Infrastructure 37</p>
<p>NTP Reflection Attacks 38</p>
<p>Attack Reporting 40</p>
<p>Preventing SNMP Reflection 41</p>
<p>DNS Resolvers 42</p>
<p>Complicity 43</p>
<p>Bringing a Nation to Its Knees 44</p>
<p>Mapping Attacks 45</p>
<p>Summary 46</p>
<p>Chapter 5: Nping 49</p>
<p>Functionality 49</p>
<p>TCP 50</p>
<p>Interpreter 51</p>
<p>UDP 52</p>
<p>ICMP 52</p>
<p>ARP 53</p>
<p>Payload Options 53</p>
<p>Echo Mode 54</p>
<p>Other Nping Options 57</p>
<p>Summary 58</p>
<p>Chapter 6: Logging Reconnoiters 59</p>
<p>ICMP Misconceptions 59</p>
<p>tcpdump 60</p>
<p>Iptables 61</p>
<p>Multipart Rules 64</p>
<p>Log Everything for Forensic Analysis 64</p>
<p>Hardening 65</p>
<p>Summary 67</p>
<p>Chapter 7: Nmap s Prodigious NSE 69</p>
<p>Basic Port Scanning 69</p>
<p>The Nmap Scripting Engine 71</p>
<p>Timing Templates 73</p>
<p>Categorizing Scripts 74</p>
<p>Contributing Factors 75</p>
<p>Security Holes 75</p>
<p>Authentication Checks 77</p>
<p>Discovery 78</p>
<p>Updating Scripts 79</p>
<p>Script Type 80</p>
<p>Regular Expressions 80</p>
<p>Graphical User Interfaces 81</p>
<p>Zenmap 81</p>
<p>Summary 82</p>
<p>Chapter 8: Malware Detection 85</p>
<p>Getting Started 85</p>
<p>Definition Update Frequency 85</p>
<p>Malware Hash Registry 86</p>
<p>Prevalent Threats 86</p>
<p>LMD Features 86</p>
<p>Monitoring Filesystems 88</p>
<p>Installation 88</p>
<p>Monitoring Modes 90</p>
<p>Configuration 91</p>
<p>Exclusions 91</p>
<p>Running from the CLI 92</p>
<p>Reporting 92</p>
<p>Quarantining and Cleaning 93</p>
<p>Updating LMD 94</p>
<p>Scanning and Stopping Scans 94</p>
<p>Cron Job 96</p>
<p>Reporting Malware 96</p>
<p>Apache Integration 96</p>
<p>Summary 97</p>
<p>Chapter 9: Password Cracking with Hashcat 99</p>
<p>History 99</p>
<p>Understanding Passwords 99</p>
<p>Keyspace 100</p>
<p>Hashes101</p>
<p>Using Hashcat 103</p>
<p>Hashcat Capabilities 103</p>
<p>Installation 103</p>
<p>Hash Identifi cation104</p>
<p>Choosing Attack Mode 106</p>
<p>Downloading a Wordlist 106</p>
<p>Rainbow Tables 107</p>
<p>Running Hashcat 107</p>
<p>oclHashcat 110</p>
<p>Hashcat–Utils 111</p>
<p>Summary 111</p>
<p>Chapter 10: SQL Injection Attacks 113</p>
<p>History 113</p>
<p>Basic SQLi 114</p>
<p>Mitigating SQLi in PHP 115</p>
<p>Exploiting SQL Flaws 117</p>
<p>Launching an Attack 118</p>
<p>Trying SQLi Legally 120</p>
<p>Summary 121</p>
<p>Index 123</p>