Course Content

• General Introduction
• Prerequisites and presentation of the “security track”
• Goal of the course
• “Who is out there?”, who are the players?
• Defining “security”. What is “security”
• Security Triangle and Security Auditing Loop
• Walking in the Foot Steps of The Attacker
• General introduction to the attackers’ process, step by step on a theoretical basis
• Active Information Gathering Techniques
• Information gathering and footprinting, defining the sources
• Gathering Open-Source information through different sources (incl. Whois database search)
• Highly underestimated: Social Engineering
• Searching the Fine Web (STFW)
• Search Engine Related Issues and Information Leakage, example on Google
• Interrogating the Domain Name System – DNS
• Tools for every day
• Mapping out the network (PSTN): War Dailing
• War Dailing and related terms
• Corporate War Dailers
• Portscanning and Operating System Fingerprinting
• Portscanning: using different techniques and protocol violations
• Operating System Fingerprinting through banner grabbing, active and passive stack fingerprinting; tools and related techniques; common stack fingerprinting, ICMP-based, Temporal Response Analysis
• Anonymous Scanning Techniques
• Initial Sequence Numbers and Pseudo Random Number Generators
• Operating Systems ISN generators
• Idle host scanning: technique and different phases
• Simple Network Management Protocol (SNMP)
• Basic introduction to SNMP
• Information gathering and gathered using SNMP on a network
• Vulnerability Scanning
• Open Source Vulnerability Scanning: Nessus. Nessus deployment and configuration. Publishing Network Vulnerability Assesment Reports
• Example of NASL, the Nessus Attack Scripting Language
• Commercial Vulnerability Scanning: introduction to Retina (Eeye) and ISS
• General Enumeration Techniques
• How can we gather more information about different platforms: Windows and Linux
• Cracking
• General introduction to password cracking, “crackers” and the cracking process
• Unix and Windows: introduction to passwords, the cracking tools and techniques
• Cracking access to remote maintenance tools: Virtual Network Computing (VNC); cracking access to a VNC server
• Danger of password protected systems: DNS
• Cracking access to other services
• Remarks about the S/KEY OTP system
• Webcracking challenge: scripts, flash, “Diffing” and”“Decompiling”
• Exploiting Trust
• What is spoofing, spoofing defined
• ARP spoofing and poisoning
• Spoofing the Domain Name System (DNS), the danger of automatic updates. Selective DNS spoofin
• E-mail “spoofing”
• E-mail hijacking using the Domain Name System
• Fun with TCP/IP
• Back to basics: TCP/IP concepts
• Blue print of session hijacking
• Effects of session hijacking
• Performing session hijacking
• Performing session hijacking on switched networks
• Performing MITM attacks against SSH using session hijacking
• Host based session hijacking: TTY-hijacking
• "HTTPS"
• “HTTPS Man In The Middle”:
• Intercepting and modifying HTTP traffic and cookies.
• Intercepting HTTPS encrypted traffic
• Denial of Service
• Defining “Denial of Service”
• Denial of service attack types: hogging the CPU, OOB attacks, fragmentation attacks illustrated, ping of death, FW-1
• Packet crafters, defined and deployment
• PROTOS – SNMP
• Distributed Denial of Service
• General introduction to Distributed Denial of Service and evolution
• Deploying the Tribal Flood Network (TFN)
• Deploying Distributed Denial of Service attacks using more stealth; deploying Stacheldraht
• Keeping Access
• Application Trojan Horse Backdoors
• Traditional rootkits
• Kernel Level Rootkits
• Application Trojan Horse: example: introduction to Back Orifice and its deployment
• Trojan wrappers
• More about kernel level rootkits
• Deployment of the Knark Rootkit
• Rootkits and the Windows environment
• Firewall enumeration techniques and evasion
• Tracerouting
• Tracerouting through firewalls: techniques
• Firewalking
• FW-1 enumeration
• Tunneling techniques: using SSH and other protocols to bypass firewalls
• "WebWacking""– concerning HTTP and CGI
• Abusing proxy servers & exploiting the intranet through the external proxy
• Bypassing control mechanisms using proxy servers
• HTTP information gathering: search engines
• HTTP information leakage; robots, ht://dig, default scripts, É
• CGI problem illustration, Apache 1.3.23 and web page defacement
• CGI scanners and Whisker
• XSS or Cross-site scripting
• Nice things to know about Microsoft Internet Information Services
• "MS Internet Information Server"
• The MS IIS/PWS Escaped Characters Decoding Command Executing explained.
• WiFi – 802.11b
• Basic introduction to 802.11b
• Security threats: what are the common threats?
• Taking it into practise: scanning, mapping out wireless networks
• WEP attacks and Wireless sniffing
• Stack Based Buffer Overflow Attacks
• Buffer overflow: introduction to buffer overflows and the “stack”
• Buffer overflow: problem code example
• Buffer overflow: process memory organization
• Buffer overflow: the stack region and initial procedure operations
• Buffer overflow: proof of concept on SUSE Linux
• Buffer overflows through input and recognizing them
• Shell code: what is shell code and how does it look like?
• Heap overflows: basic overview
• Automated Memory Manipulation Attacks – SSH CRC32
• SSH1 CRC-32 compensation attack detector vulnerability, history
• SSH1 CRC-32 compensation attack detector vulnerability explained
• Common mistakes related to security incidents
• Attack against the SSH daemons
• Format strings
• General definition and description of a format string attack
• The Network File System (NFS)
• Presenting the Network File System
• NFS: a look at the server configuration and available options
• "Database insecurity"
• What is SQL?
• Describing basic SQL queries
• Introduction to SQL Injection Techniques
• TCPdump and basic introduction to network sniffers
• Basic introduction to TCPdump
• Basic introduction to Ethereal and commercial network sniffers
• Intrusion Detection Systems
• Defining Intrusion Detection Systems
• Reasons to acquire and use Intrusion Detection Systems
• Strengths and limitations of Intrusion Detection Systems (IDS)
• IDS building blocks, categories (~families) and common classification
• Active and passive responses
• IDS related tools: File Integrity Checkers
• IDS related tools: Honey Pots/Nets – Padded Cells: definition, advantages and disadvantages
• IDS attack naming conventions
• Attacks against NIDS and evasion techniques
• Anti Intrusion Detection Tactics
• A closer look at the Whisker anti-IDS tactics
• Denial of Service against IDS (example Snort)
• IDS (D)DoS: host isolation illustration
• Snort installation and use
• Understanding Snort Rules. Writing snort rules: basic examples
• Deployment strategies
• ARIS Analyzer: global early warning systems
• Maintaining System Integrity
• Introduction to system integrity by Tripwire
• Tripwire installation and configuration
• Basic introduction to some important laws (Belgium)
• Belgian Law: IT criminality, 28^{th November 2000}
• Cooperation protocol ISPA
• Wardriving: what is its status?
• Some common questions?
• Legal case: Argentinia, April 15th, 2002
• Going extreme
• Eavesdropping risk of CRT displays
• Eavesdropping risks: LEDs
• Basic introduction to TEMPEST
• TEMPEST, proof of concept
• Bypassing biometrics: fun with fingerprints

Target Group

Security officers, auditors, security professionals, site administrators and anyone who is concerned about the integrity of the network infrastructure.

Prerequisites

• Strong knowledge of the TCP/IP protocols and Windows Operating System.
• Exposure to Linux or other Unix-based OS.