Ethical Hacking: A Hands-on Introduction to Breaking In
A hands-on guide to hacking computer systems from the ground up, from capturing traffic to crafting sneaky, successful trojans.

A crash course in modern hacking techniques, Ethical Hacking is already being used to prepare the next generation of offensive security experts. In its many hands-on labs, you’ll explore crucial skills for any aspiring penetration tester, security researcher, or malware analyst.

You’ll begin with the basics: capturing a victim’s network traffic with an ARP spoofing attack and then viewing it in Wireshark. From there, you’ll deploy reverse shells that let you remotely run commands on a victim’s computer, encrypt files by writing your own ransomware in Python, and fake emails like the ones used in phishing attacks. In advanced chapters, you’ll learn how to fuzz for new vulnerabilities, craft trojans and rootkits, exploit websites with SQL injection, and escalate your privileges to extract credentials, which you’ll use to traverse a private network.

You’ll work with a wide range of professional penetration testing tools—and learn to write your own tools in Python—as you practice tasks like:

  • Deploying the Metasploit framework’s reverse shells and embedding them in innocent-seeming files
  • Capturing passwords in a corporate Windows network using Mimikatz
  • Scanning (almost) every device on the internet to find potential victims
  • Installing Linux rootkits that modify a victim’s operating system
  • Performing advanced Cross-Site Scripting (XSS) attacks that execute sophisticated JavaScript payloads
Along the way, you’ll gain a foundation in the relevant computing technologies. Discover how advanced fuzzers work behind the scenes, learn how internet traffic gets encrypted, explore the inner mechanisms of nation-state malware like Drovorub, and much more.

Developed with feedback from cybersecurity students, Ethical Hacking addresses contemporary issues in the field not often covered in other books and will prepare you for a career in penetration testing. Most importantly, you’ll be able to think like an ethical hacker⁠: someone who can carefully analyze systems and creatively gain access to them.
1140050480
Ethical Hacking: A Hands-on Introduction to Breaking In
A hands-on guide to hacking computer systems from the ground up, from capturing traffic to crafting sneaky, successful trojans.

A crash course in modern hacking techniques, Ethical Hacking is already being used to prepare the next generation of offensive security experts. In its many hands-on labs, you’ll explore crucial skills for any aspiring penetration tester, security researcher, or malware analyst.

You’ll begin with the basics: capturing a victim’s network traffic with an ARP spoofing attack and then viewing it in Wireshark. From there, you’ll deploy reverse shells that let you remotely run commands on a victim’s computer, encrypt files by writing your own ransomware in Python, and fake emails like the ones used in phishing attacks. In advanced chapters, you’ll learn how to fuzz for new vulnerabilities, craft trojans and rootkits, exploit websites with SQL injection, and escalate your privileges to extract credentials, which you’ll use to traverse a private network.

You’ll work with a wide range of professional penetration testing tools—and learn to write your own tools in Python—as you practice tasks like:

  • Deploying the Metasploit framework’s reverse shells and embedding them in innocent-seeming files
  • Capturing passwords in a corporate Windows network using Mimikatz
  • Scanning (almost) every device on the internet to find potential victims
  • Installing Linux rootkits that modify a victim’s operating system
  • Performing advanced Cross-Site Scripting (XSS) attacks that execute sophisticated JavaScript payloads
Along the way, you’ll gain a foundation in the relevant computing technologies. Discover how advanced fuzzers work behind the scenes, learn how internet traffic gets encrypted, explore the inner mechanisms of nation-state malware like Drovorub, and much more.

Developed with feedback from cybersecurity students, Ethical Hacking addresses contemporary issues in the field not often covered in other books and will prepare you for a career in penetration testing. Most importantly, you’ll be able to think like an ethical hacker⁠: someone who can carefully analyze systems and creatively gain access to them.
49.99 In Stock
Ethical Hacking: A Hands-on Introduction to Breaking In

Ethical Hacking: A Hands-on Introduction to Breaking In

by Daniel G. Graham
Ethical Hacking: A Hands-on Introduction to Breaking In

Ethical Hacking: A Hands-on Introduction to Breaking In

by Daniel G. Graham

Paperback

$49.99 
  • SHIP THIS ITEM
    Qualifies for Free Shipping
  • PICK UP IN STORE

    Your local store may have stock of this item.

Related collections and offers


Overview

A hands-on guide to hacking computer systems from the ground up, from capturing traffic to crafting sneaky, successful trojans.

A crash course in modern hacking techniques, Ethical Hacking is already being used to prepare the next generation of offensive security experts. In its many hands-on labs, you’ll explore crucial skills for any aspiring penetration tester, security researcher, or malware analyst.

You’ll begin with the basics: capturing a victim’s network traffic with an ARP spoofing attack and then viewing it in Wireshark. From there, you’ll deploy reverse shells that let you remotely run commands on a victim’s computer, encrypt files by writing your own ransomware in Python, and fake emails like the ones used in phishing attacks. In advanced chapters, you’ll learn how to fuzz for new vulnerabilities, craft trojans and rootkits, exploit websites with SQL injection, and escalate your privileges to extract credentials, which you’ll use to traverse a private network.

You’ll work with a wide range of professional penetration testing tools—and learn to write your own tools in Python—as you practice tasks like:

  • Deploying the Metasploit framework’s reverse shells and embedding them in innocent-seeming files
  • Capturing passwords in a corporate Windows network using Mimikatz
  • Scanning (almost) every device on the internet to find potential victims
  • Installing Linux rootkits that modify a victim’s operating system
  • Performing advanced Cross-Site Scripting (XSS) attacks that execute sophisticated JavaScript payloads
Along the way, you’ll gain a foundation in the relevant computing technologies. Discover how advanced fuzzers work behind the scenes, learn how internet traffic gets encrypted, explore the inner mechanisms of nation-state malware like Drovorub, and much more.

Developed with feedback from cybersecurity students, Ethical Hacking addresses contemporary issues in the field not often covered in other books and will prepare you for a career in penetration testing. Most importantly, you’ll be able to think like an ethical hacker⁠: someone who can carefully analyze systems and creatively gain access to them.

Product Details

ISBN-13: 9781718501874
Publisher: No Starch Press
Publication date: 11/02/2021
Pages: 376
Sales rank: 582,122
Product dimensions: 9.10(w) x 6.90(h) x 0.90(d)

About the Author

Dr. Daniel Graham is an Assistant professor of Computer Science at The University of Virginia in Charlottesville, Virginia. His research interests include secure embedded systems and networks. Before joining UVA, Dr. Graham was a Program Manager at Microsoft in Seattle, Washington. He publishes in IEEE journals relating to sensors and networks.

Table of Contents

Acknowledgments xvii

Foreword xix

Introduction xxi

Why Read This Book? xxii

Installing Python xxii

What Is in the Book? xxii

Part I Networking Fundamentals xxiii

Part II Cryptography xxiii

Part III Social Engineering xxiv

Part IV Exploitation xxiv

Part V Controlling the Network xxv

Reaching Out xxv

1 Setting Up 1

Virtual Lab 2

Setting Up VirtualBox 3

Setting Up pfSense 3

Setting Up the Internal Network 5

Configuring pfSense 6

Setting Up Metasploitable 8

Setting Up Kali Linux 9

Setting Up the Ubuntu Linux Desktop 10

Your First Hack: Exploiting a Backdoor in Metasploitable 11

Getting the IP Address of the Metasploitable Server 12

Using the Backdoor to Gain Access 13

Part I Network Fundamentals

2 Capturing Traffic with Arp Spoofing 17

How the Internet Transmits Data 17

Packets 18

MAC Addresses 18

IP Addresses 18

ARP Tables 20

ARP Spoofing Attacks 21

Performing an ARP Spoofing Attack 21

Defecting an ARP Spoofing Attack 26

Exercises 27

Inspect ARP Tables 27

Implement an ARP Spoofer in Python 28

MAC Flooding 29

3 Analyzing Captured Traffic 31

Packets and the internet Protocol Stack 31

The Five-Layer Internet Protocol Stack 33

Viewing Packets in Wireshark 37

Analyzing Packets Collected by Your Firewall 42

Capturing Traffic on Port 80 42

Exercises 44

PfSense 44

Exploring Packets in Wireshark 45

4 Crafting TCP Shells and Botnets 47

Sockets and Process Communication 48

TCP Handshakes 48

A TCP Reverse Shell 50

Accessing the Victim Machine 52

Scanning for Open Ports 52

Exploiting a Vulnerable Service 54

Writing a Reverse Shell Client 55

Writing a TCP Server That Listens for Client Connections 56

Loading the Reverse Shell onto the Metasploitable Server 57

Botnets 58

Exercises 61

A Multiclient Bot Server 61

SYN Scans 62

Detecting XMas Scans 63

Part II Cryptography

5 Cryptography and Ransomware 67

Encryption 68

One-Time Pad 68

Pseudorandom Generators 71

Insecure Block Ciphers Modes 72

Secure Block Ciphers Modes 74

Encrypting and Decrypting a File 75

Email Encryption 76

Public-Key Cryptography 76

Rivest-Shamir-Adleman Theory 77

The RSA Math 77

Encrypting a File with RSA 79

Optimal Asymmetric Encryption Padding 81

Writing Ransomware 82

Exercises 85

The Ransomware Server 85

Extending the Ransomware Client 86

Unsolved Codes 86

6 TLS and Diffie-Hellman 89

Transport Layer Security 90

Message Authentication 91

Certificate Authorities and Signatures 92

Certificate Authorities 93

Using Diffie-Hellman to Compute a Shared Key 94

Step 1 Generating the Shared Parameters 95

Step 2 Generating the Public-Private Key Pair 96

Why Can't a Hacker Calculate the Private Key? 97

Step 3 Exchanging Key Shares and Nonces 98

Step 4 Calculating the Shared Secret Key 98

Step 5 Key Derivation 99

Attacking Diffie-Hellman 100

Elliptic-Curve Diffie-Hellman 100

The Math of Elliptic Curves 101

The Double and Add Algorithm 102

Why Can't a Hacker Use Gxy and axy to Calculate the Private Key A? 103

Writing TLS Sockets 104

The Secure Client Socket 104

The Secure Server Socket 106

SSL Stripping and HSTS Bypass 107

Exercise: Add Encryption to your Ransomware Server 107

Part III Social Engineering

7 Phishing and Deepfakes 113

A Sophisticated and Sneaky Social Engineering Attack 114

Faking Emails 114

Performing a DNS Lookup of a Mail Server 115

Communicating with SMTP 115

Writing an Email Spoofer 117

Spoofing SMTPS Emails 119

Faking Websites 121

Creating Deepfake Videos 123

Accessing Google Colab 124

Importing the Machine Learning Models 125

Exercises 127

Voice Cloning 127

Phishing at Scale 128

SMTP Auditing 129

8 Scanning Targets 131

Link Analysis 132

Maltego 133

Leaked Credential Databases 136

SIM Jacking 137

Google Dorking 138

Scanning the Entire Internet 139

Masscan 139

Shodan 143

IPv6 and NAT Limitations 144

Internet Protocol Version 6 [IPv6] 144

NAT 145

Vulnerability Databases 146

Vulnerability Scanners 148

Exercises 151

Nmap Scans 152

Discover 152

Writing Your Own OSINT Tool 154

Part IV Exploitation

9 Fuzzing for Zero-Day Vulnerabilities 159

Case Study: Exploiting the Heartbleed OpenSSL Vulnerability 160

Creating an Exploit 160

Starting the Program 161

Writing the Client Hello Message 162

Reading the Server Response 164

Crafting the Malicious Heartbeat Request 165

Reading the Leaked Memory Contents 166

Writing the Exploit Function 167

Putting It Together 167

Fuzzing 168

A Simplified Example 168

Writing Your Own Fuzzer 169

American Fuzzy Lop 170

Symbolic Execution 174

A Symbolic Execution of the Test Program 175

Limitations of Symbolic Execution 175

Dynamic Symbolic Execution 176

Using DSE to Crack a Passcode 179

Creating an Executable Binary 179

Installing and Running Angr 180

The Angr Program 181

Exercises 182

Capture the Flag Games with Angr 182

Fuzzing Web Protocols 183

Fuzzing an Open Source Project 184

Implement Your Own Concolic Execution Engine 185

10 Building Trojans 187

Case Study: Re-Creating Drovorub by Using Metasploit 188

Building the Attacker's Server 188

Building the Victim Client 190

Uploading the Implant 190

Using the Attacker Agent 191

Why We Need a Victim Kernel Module 192

Hiding an Implant in a Legitimate File 193

Creating a Trojan 193

Hosting the Trojan 197

Downloading the Infected File 197

Controlling the Implant 198

Evading Antivirus by Using Encoders 200

The Base64 Encoder 201

Writing a Metasploit Module 202

Shikata Ga Nai Encoder 204

Creating a Windows Trojan 206

Hiding the Trojan in Minesweeper 206

Hiding the Trojan in a Word Document (or Another Innocent File) 207

Creating an Android Trojan 208

Deconstructing the APK to View the Implant 208

Rebuilding and Signing the APK 211

Testing the Android Trojan 212

Exercises 215

Evil-Droid 216

Writing Your Own Python Implant 217

Obfuscate Your Implant 218

Build a Platform-Specific Executable 219

11 Building and Installing Linux Rootkits 221

Writing a Linux Kernel Module 222

Backing Up Your Kali Linux Virtual Machine 222

Writing the Code 223

Compiling and Running Your Kernel Module 224

Modifying System Calls 226

How System Calls Work 226

Hooking Syscalls 229

Hooking the Shutdown Syscall 230

Hiding Files 234

The linux_dirent struct 234

Writing the Hooking Code 235

Using Armitage to Exploit a Host and Install a Rootkit 237

Scanning the Network 238

Exploiting a Host 239

Installing a Rootkit 240

Exercises 240

The Keylogger 240

Self-Hiding Module 243

12 Stealing and Cracking Passwords 245

SQL injection 246

Stealing Passwords from a Website's Database 247

Enumerating Reachable Files on the Web Server 248

Performing SQL Injection 248

Writing Your Own SQL Injection Tool 250

Understanding HTTP Requests 250

Writing the Injection Program 252

Using SGLMap 254

Hashing Passwords 256

The Anatomy of the MD5 Hash 257

Cracking Hashes 259

Salting Hashes with a Nonce 260

Building a Salted Hash Cracker 260

Popular Hash Cracking and Brute-Forcing Tools 261

John the Ripper 261

Hashcat 262

Hydra 263

Exercises 264

NoSQL Injection 264

Brute-Forcing Web Logins 265

Burp Suite 266

13 Serious Cross-Site Scripting Exploitation 269

Cross-Site Scripting 270

How JavaScript Can Be Malicious 271

Stored XSS Attacks 273

Reflected XSS Attacks 275

Finding Vulnerabilities with OWASP Zed Attack Proxy 276

Using Browser Exploitation Framework Payloads 278

Injecting the BeEF Hook 278

Performing a Social Engineering Attack 279

Moving from Browser to Machine 281

Case Study: Exploiting an Old Version of the Chrome Browser 281

Installing Rootkits via Website Exploitation 282

Exercise: Hunting for Bugs in a Bug Bounty Program 285

Part V Controlling the Network

14 Pivoting and Privilege Escalation 289

Pivoting from a Dual-Homed Device 290

Configuring a Dual-Homed Device 290

Connecting a Machine to Your Private Network 293

Pivoting with Metasploit 294

Writing an Attacker Proxy 297

Extracting Password Hashes on Linux 298

Where Linux Stores Usernames and Passwords 299

Performing a Dirty COW Privilege Escalation Mack 300

Exercises 303

Adding NAT to Your Dual-Homed Device 303

Suggested Reading on Windows Privilege Escalation 304

15 Moving through the Corporate Windows Network 305

Creating a Windows Virtual Lab 306

Extracting Password Hashes with Mimikatz 306

Passing the Hash with NT LAN Manager 309

Exploring the Corporate Windows Network 310

Attacking the DNS Service 311

Attacking Active Directory and LDAP Services 313

Writing an LDAP Query Client 314

Using SharpHound and Bloodhound for LDAP Enumeration 317

Attacking Kerberos 318

The Pass-the-Ticket Attack 320

The Golden Ticket and DC Sync Attacks 321

Exercise: Kerberoasting 322

16 Next Steps 323

Setting Up a Hardened Hacking Environment 324

Remaining Anonymous with Tor and Tails 324

Setting Up a Virtual Private Server 326

Setting Up SSH 326

Installing Your Hacking Tools 328

Hardening the Server 329

Auditing Your Hardened Server 331

Other Topics 332

Software-Defined Radios 332

Attacking Cellular Infrastructure 333

Escaping the Air Gap 333

Reverse Engineering 334

Physical Hacking Tools 334

Forensics 334

Hacking Industrial Systems 335

Quantum Computation 335

Connect with Others 335

Index 337

From the B&N Reads Blog

Customer Reviews