:::..Brecha_hacKER..:::

O maior problema dos cursos de hacker que tem disponível e dos cursos de segurança para certificação hacker aqui no Brasil principalmente é que eles ensinam absolutamente muita teoria. Isso não adianta pessoal, o que funciona é prática total. Tem que ensinar tudo na prática e para conseguir defender sistemas da informação é preciso saber fazer exatamente o que um criminoso é capaz de fazer. E este livro ensina todos os tipos de invasões de nível avançada que criminosos usam e só assim para testar a segurança da sua rede, fazer exatamente o que um cyber criminoso vai fazer e caso consega invadir, você conserta a vulnerabilidade e ataca de novo. Com este livro REALMENTE se você dominar as técnicas dele, com certeza você se tornará um grande profissional de segurança da informação, pois você SABE FAZER O QUE UM CYBERPIRATA SABE FAZER e com isso você protege o seu sistema corrigindo as falhas de segurança com testes de intrusão hardcore ensinados aqui neste livro.

Link para download do livro avançado e inédito!

Link para Download

Veja o conteúdo do curso:

1. Module 1 - BackTrack Basics............................................ .................................................. .......18
1.1 Finding your way around the tools............................................. .........................................19
1.1.1 Exercise 1................................................. .................................................. ..............21
1.2 Basic Services.......................................... .................................................. .........................22
1.2.1 DHCP.............................................. .................................................. .......................22
1.2.2 Static IP assignment........................................ .................................................. ......22
1.2.3 Apache............................................ .................................................. .......................23
1.2.4 SSHD.............................................. .................................................. .......................23
1.2.5 Tftpd............................................. .................................................. .........................25
1.2.6 VNC Server............................................ .................................................. ...............25
1.2.7 Exercise 2................................................. .................................................. .............26
1.3 Basic Bash Environment....................................... .................................................. ............28
Overview.......................................... .................................................. ....................................28
1.3.1 Simple Bash Scripting......................................... .................................................. ..28
1.3.2 Exercise 3 .................................................. .................................................. ...........29
1.3.3 Possible Solution for ICQ Exercise.......................................... ................................30
1.3.4 Exercise 4................................................. .................................................. .............36
1.4 Netcat The Almighty.......................................... .................................................. ...............37
Overview.......................................... .................................................. ....................................37
1.4.1 Connecting to a TCP/UDP port with Netcat............................................ ................37
1.4.2 Listening on a TCP/UDP port with Netcat............................................ ...................39
1.4.3 Transferring files with Netcat............................................ .....................................40
1.4.4 Remote Administration with Netcat............................................ ............................42
1.4.4.1 Scenario 1 – Bind Shell............................................. ....................................43
1.4.4.2 Scenario 2 – Reverse Shell............................................. ..............................45
1.4.5 Exercise 5................................................. .................................................. .............47
1.5 Using WireShark (Ethereal)........................................ .................................................. ......49
Overview.......................................... .................................................. ....................................49
2

5.3.3 Exercise 13................................................ .................................................. ..........144
1.5.1 Peeking at a Sniffer........................................... .................................................. ....50
1.5.2 Capture filters........................................... .................................................. ............53
1.5.3 Following TCP Streams........................................... ................................................54
1.5.4 Exercise 6 .................................................. .................................................. ...........55
2. Module 2- Information Gathering Techniques........................................ ...................................56
A note from the authors........................................... .................................................. ................57
2.1 Open Web Information Gathering......................................... ..............................................59
Overview.......................................... .................................................. ....................................59
2.1.1 Google Hacking........................................... .................................................. ..........59
2.1.1.1 Advanced Google Operators......................................... ................................59
2.1.1.2 Searching within a Domain............................................ ..............................60
2.1.1.3 Nasty Example #1................................................ ........................................61
2.1.1.4 Nasty Example #2................................................ ........................................64
2.1.1.5 Email Harvesting........................................ .................................................. 66
2.1.1.6 Finding Vulnerable Servers using Google............................................ ........70
2.1.1.7 Google API............................................... .................................................. ...71
2.2. Miscellaneous Web Resources......................................... .................................................. 72
2.2.1 Other search engines .................................................. ............................................72
2.2.2 Netcraft.......................................... .................................................. ........................73
2.2.3 Whois Reconnaissance.................................... .................................................. ......75
2.3 Exercise 7 .................................................. .................................................. ........................80
3. Module 3- Open Services Information Gathering......................................... .............................82
A note from the authors........................................... .................................................. ................82
3.1 DNS Reconnaissance.................................... .................................................. .....................83
3.1.1 Interacting with a DNS server............................................ ......................................83
3.1.1.1 MX Queries........................................... .................................................. ......84
3.1.1.2 NS Queries........................................... .................................................. ......85
3.1.2 Automating lookups........................................... .................................................. ....85
3.1.3 Forward lookup bruteforce........................................ .............................................86
3.1.4 Reverse lookup bruteforce........................................ ..............................................90
3.1.5 DNS Zone Transfers......................................... .................................................. .....92
3.1.6 Exercise 8 .................................................. .................................................. ............99
3.2 SNMP reconnaissance.................................... .................................................. .................101
3

5.3.3 Exercise 13................................................ .................................................. ..........144
3.2.1 Enumerating Windows Users:............................................ ...................................102
3.2.2 Enumerating Running Services.......................................... ...................................102
3.2.3 Enumerating open TCP ports............................................. ...................................103
3.2.4 Enumerating installed software.......................................... ..................................104
3.2.5 Exercise 9 .................................................. .................................................. ..........108
3.3 SMTP reconnaissance.................................... .................................................. .................109
3.3.1 Exercise 10................................................ .................................................. ...........111
3.4 Microsoft Netbios Information Gathering......................................... ................................112
3.4.1 Null sessions.......................................... .................................................. ...............112
3.4.2 Scanning for the Netbios Service........................................... ................................114
3.4.3 Enumerating Usernames......................................... ...............................................115
3.4.4 Exercise 11................................................ .................................................. ...........116
4. Module 4- Port Scanning.......................................... .................................................. .............117
A note from the authors........................................... .................................................. ..............117
4.1 TCP Port Scanning Basics............................................ .................................................. ...118
4.2 UDP Port Scanning Basics............................................ .................................................. ..120
4.3 Port Scanning Pitfalls.......................................... .................................................. ............120
4.4 Nmap.............................................. .................................................. .................................120
4.5 Scanning across the network........................................... .................................................1 23
4.5.1 Exercise 11 .................................................. .................................................. ........127
4.6 Unicornscan....................................... .................................................. .............................128
5. Module 5- ARP Spoofing.......................................... .................................................. ..............133
A note from the authors........................................... .................................................. ..............133
5.1 The Theory............................................ .................................................. ..........................133
5.2 Doing it the hard way............................................... .................................................. .......134
5.2.1 Victim Packet............................................ .................................................. ...........136
5.2.2 Gateway Packet............................................ .................................................. .......137
5.3 Ettercap.......................................... .................................................. .................................140
5.3.1 DNS Spoofing.......................................... .................................................. ............142
5.3.2 Fiddling with traffic........................................... .................................................. ..144
5.3.3 Exercise 12................................................ .................................................. ..........147
6. Module 6- Buffer overflow Exploitation (Win32)........................................... ..........................148
A note from the authors........................................... .................................................. ..............148
4

5.3.3 Exercise 13................................................ .................................................. ..........144
Overview.......................................... .................................................. ..................................149
6.1 Looking for the Bugs.............................................. .................................................. .........149
6.2 Fuzzing........................................... .................................................. .................................150
6.3 Replicating the Crash............................................. .................................................. .........152
6.4 Controlling EIP............................................... .................................................. .................154
6.4.1 Binary Tree analysis.......................................... .................................................. ..154
6.4.2 Sending a unique string............................................ ............................................155
6.5 Locating Space for our Shellcode......................................... ............................................158
6.6 Redirecting the execution flow.............................................. ............................................160
6.7 Finding a return address........................................... .................................................. ......161
6.7.1 Using OllyDbg........................................... .................................................. ..........161
6.8 Getting our shell............................................. .................................................. .................165
6.9 Improving exploit stability......................................... .................................................. .....169
6.9.1 Exercise 13................................................ .................................................. ...........170
7. Module 7- Working With Exploits.......................................... .................................................. 172
7.1 Looking for an exploit on BackTrack......................................... .........................................177
7.1.1 RPC DCOM Example........................................... .................................................. .177
7.1.2 Wingate Example........................................... .................................................. .......180
7.1.3 Exercise 14................................................ .................................................. ...........190
7.2 Looking for exploits on the web............................................... ..........................................191
7.2.1 Security Focus .................................................. .................................................. ...191
7.2.2 Milw0rm.com....................................... .................................................. .................194
8. Module 8- Transferring Files............................................. .................................................. ....195
Exercise.......................................... .................................................. ........................................195
8.1 The non interactive shell............................................. .................................................. .....196
8.2 Uploading Files............................................. .................................................. ...................197
8.2.1 Using TFTP.............................................. .................................................. .............197
8.2.1.1 TFTP Pros .................................................. ................................................19 9
8.2.1.2 TFTP Cons .................................................. ...............................................199
8.2.2 Using FTP............................................... .................................................. ..............199
8.2.3 Inline Transfer - Using echo and DEBUG.exe......................................... ................200
8.3 Exercise 15................................................ .................................................. ......................201
9. Module 9 – Exploit frameworks........................................ .................................................. .....202
5

5.3.3 Exercise 13................................................ .................................................. ..........144
9.1 Metasploit........................................ .................................................. ................................202
9.1.1 Metasploit Command Line Interface (MSFCLI).......................................... ...........203
9.1.2 Metasploit Console (MSFCONSOLE)...................................... ...............................207
9.1.3 Metasploit Web Interface (MSFWEB).......................................... ..........................209
9.1.4 Exercise 16................................................ .................................................. ...........214
9.1.5 Interesting Payloads.......................................... .................................................. ...215
9.1.5.1 Meterpreter Payload........................................... ........................................215
9.1.5.2 PassiveX Payload........................................... .............................................218
9.1.5.3 Binary Payloads.......................................... ................................................21 9
9.1.6 Exercise 17................................................ .................................................. ...........221
9.1.7 Framework v3.0.............................................. .................................................. .....222
9.1.7.1 Framework 3 Auxiliary Modules........................................... ......................222
9.1.8 Framework v3.0 Kung Foo............................................... ......................................225
9.1.8.1 db_autopwn........................................ .................................................. ......225
9.1.8.2 Kernel Payloads.......................................... ................................................22 8
9.1.9 Exercise 18................................................ .................................................. ...........231
9.2 Core Impact............................................ .................................................. ..........................232
9.2.1 Exercise 19................................................ .................................................. ..........240
10. Module 10- Client Side Attacks........................................... .................................................. 241
A note from the authors........................................... .................................................. ..............241
10.1 Client side attacks........................................... .................................................. ..............242
10.2 MS04-028............................................... .................................................. .......................243
10.3 MS06-001............................................... .................................................. .......................247
10.4 Client side exploits in action............................................ ...............................................249
10.5 Exercise 20................................................ .................................................. ....................250
11. Module 11- Port Fun............................................... .................................................. .............251
A note from the authors........................................... .................................................. ..............251
11.1 Port Redirection....................................... .................................................. .....................252
11.2 SSL Encapsulation - Stunnel........................................... ...............................................254
11.2.1 Exercise 21................................................ .................................................. .........258
11.3 HTTP CONNECT Tunneling......................................... .................................................. .259
11.4 ProxyTunnel....................................... .................................................. ...........................262
11.4.1 Exercise 22................................................ .................................................. .........264
6

5.3.3 Exercise 13................................................ .................................................. ..........144
11.5 SSH Tunneling......................................... .................................................. .....................265
11.6 What about content inspection ?................................................. ....................................269
12. Module 12- Password Attacks........................................... .................................................. ...270
A note from the authors........................................... .................................................. ..............270
12.1 Online Password Attacks........................................... .................................................. ....271
12.2 Hydra............................................. .................................................. ...............................274
12.2.1 FTP Bruteforce........................................ .................................................. ..........274
12.2.2 POP3 Bruteforce........................................ .................................................. ........275
12.2.3 SNMP Bruteforce........................................ .................................................. ......275
12.2.4 Microsoft VPN Bruteforce........................................ ...........................................276
12.2.5 Hydra GTK............................................... .................................................. ..........276
12.3 Password profiling......................................... .................................................. ................277
12.3.1 WYD............................................... .................................................. ....................278
12.4 Offline Password Attacks........................................... .............................................278
12.4.1 Windows SAM............................................... .................................................. ....279
12.4.2 Windows Hash Dumping – PWDump / FGDump............................................ ......280
12.4.3 John The Ripper............................................ .................................................. .....283
12.4.4 Rainbow Tables............................................ .................................................. .....285
12.4.5 Exercise 24................................................ .................................................. .........288
12.5 Physical Access Attacks........................................... .................................................. ......289
12.5.1. Resetting Microsoft Windows........................................... ..................................289
12.5.2 Resetting a password on a Domain Controller........................................ ............292
12.5.3 Resetting Linux Systems........................................... ..........................................292
12.5.4 Resetting a Cisco Device .................................................. ..................................293
13. Module 13 - Web Application Attack vectors........................................... ..............................294
13.1 SQL Injection......................................... .................................................. .........................295
13.1.1 Identifying SQL Injection Vulnerabilities................................... ..........................298
13.1.2 Enumerating Table Names............................................. ......................................299
13.1.3 Enumerating the column types............................................. ................................300
13.1.4 Fiddling with the Database.......................................... ........................................301
13.1.5 Microsoft SQL Stored Procedures........................................ ................................302
13.1.6 Code execution......................................... .................................................. ..........303
13.2 Web Proxies........................................... .................................................. .........................304
7

5.3.3 Exercise 13................................................ .................................................. ..........144
13.3 Command injection Attacks........................................... .................................................. .306
13.3.1 Exercise 25................................................ .................................................. .........310
14. Module 14 - Trojan Horses............................................ .................................................. ......312
14.1 Binary Trojan Horses............................................ .................................................. ........312
14.2 Open source Trojan horses............................................ .................................................. 313
14.2.1 Spybot............................................ .................................................. ....................313
14.2.2 Insider........................................... .................................................. .....................313
14.3 World domination Trojan horses............................................ .........................................314
14.3.1 Rxbot............................................. .................................................. .....................314
15. Module 15 - Windows Oddities.......................................... .................................................. ..315
15.1 Alternate NTFS data Streams........................................... ..............................................315
15.1.1 Exercise 26................................................ .................................................. .........317
15.2 Registry Backdoors......................................... .................................................. ...............318
15.2.1 Exercise 27................................................ .................................................. .........320
16. Module 16 - Rootkits.......................................... .................................................. ..................321
16.1 Aphex Rootkit........................................... .................................................. .....................321
16.2 HXDEF Rootkit........................................... .................................................. ...................322
16.3 Exercise R.I.P............................................. ...............................