CYB 6030 Wilmington University Week 3 IDS and IPS Case Study Questions Introduction: To secure an enterprise network, students must have a good understand

CYB 6030 Wilmington University Week 3 IDS and IPS Case Study Questions Introduction:

To secure an enterprise network, students must have a good understanding of network security. This week focuses on the six key areas of network security: 1) Understanding and assessing risk, 2) Confidentiality, integrity, and availability (CIA), 3) Defense in-depth, 4) Authentication vs. authorization, 5) Vulnerabilities and 6) Policy. Students will gain both current and historical computer security view of threats and vulnerabilities. An understanding of how threats and vulnerabilities impact confidentiality, integrity, and availability. Security Policies will be discussed that impact operations and end users. Discussions around sound security policies such as password management. Ensuring that policy covers infrastructure, networks and endpoints both Unix and Windows. Incident Handling and Incident Response will also be covered in-depth. Security strategies for defending the enterprise will be discussed both offensive and defensive protection strategies.

OBJECTIVES/LEARNING OUTCOMES

At the end of the week, students will be able to:

Understand the best practices for network security.
Develop a deeper understanding of network security, tools, techniques and security architectures.
Analyze networking and the security issues associated with internal networks, internet and cloud computing.
Apply the essential concepts, algorithms, and protocols as part of network security.
Develop hands-on experience with network security tools and defense techniques.
Demonstrate proficiency in configuring and operating various network security devices (IPS/IDS).
Synthesize defensive computer network tactics, techniques, and procedures.
The student will gain an understanding of Incident Response and Forensics.
Identify the variables associated with preparation and organization of incident response and tasks to implement.
Apply the mechanisms and plans the organization uses to detect an events and incidents.
Devise strategies and methods to focus on breach detection and intrusion prevention.
Understand defensive network security techniques.
Synthesize the tasks used to formulate the network sensing and monitoring.
Apply real world scenarios to prepare for business continuity planning.
Become familiar with “hacker” motivations and:
Analyze the special requirements for dealing with breaches and crises.
Develop a response for security challenges.
Refine technical writing skills through preparation of research reports and homework assignments.
Become familiar with information retrieval and research methods.
Access and retrieve information from a variety of electronic databases and other reliable information resources on the World Wide Web (WWW).
Construct documented support for group projects and individual research using the retrieved information from the WWW.
Use library resources to support group projects and individual research.
ACTIVITIES AND ASSIGNMENTS
Week 3 Readings and Resources
Week 3 Discussion
Week 3 Case Study Questions
Week 3 Hands-on Exercise
Week 3 Chapter Quiz
Week 3 Readings and Resources

The following readings support this week’s activities. Specific resources are noted with each assignment.

McAfee Network Security Platform (NSP) User Guide
McAfee Advanced Threat Detection (ATD) User Guide
McAfee Enterprise Security Manager (ESM) User Guide
Hacking exposed: network security secrets and solutions. (McClure, S., Scambray, J., Kurtz, G., & Kurtz. (2009)
Network security through data analysis: building situational awareness, Chapters 5 – 9 (Collins, M., & Collins, M. S., 2014)

Week 3 Discussion Board

2424 unread replies.2424 replies.

Watch the following videos from the MTA Network Fundamentals 98-366 Training Course: Network Fundamentals 3 and Networking Fundamentals 4.

Networking Fundamentals: 03 Understanding Wired and Wireless Networks (Links to an external site.)

Networking Fundamentals – 04 – The Router: NAT, Firewall, DMZ, Port Forwarding and VPN (Links to an external site.)

Research and discuss the differences of IPv4 vs IPv6
Discuss the differences between public and private IP addresses.
Research and discuss why network time is so critical. How is it set?

Please post your initial response by Wednesday 11:55 and respond to two classmates posts by Sunday 11:55.

Here is the Crowdstrike Article:

https://medium.com/@viveik.chauhan/how-i-bypass-crowdstrike-restriction-1bc558abd464

Week 3 Case Study Questions
INSTRUCTIONS
Save the attached assignment file to your computer.
Read the instructions for the assignment carefully.
Answer all of the questions on the assignment.
Provide Citations and References for all research sources that you use. If you need help with citations and references, click this link: APA Citation Style (Cornell University, 2011). (Links to an external site.)
Upload your competed assignment and submit.
ATTACHMENTS
Week 3 – Case Study.pdf
CYB6030Week3CaseStudyQuestions.docx
Week 3 Hands-on Exercise
INSTRUCTIONS
Save the attached assignment file to your computer.
Read the instructions for the assignment carefully.
Answer all of the questions on the assignment.
Provide Citations and References for all research sources that you use. If you need help with citations and references, click this link: APA Citation Style (Cornell University, 2011). (Links to an external site.)
Upload your competed assignment and submit.
ATTACHMENTS
CYB6030Week3HandsOnExercise.docx CYB 6030: Week 2 Case Study Questions:
A. Please read the following paper:
Bosco, P. & Khiabani, H. (2016). Intrusion Detection and Prevention Systems
Cheat Sheet: Choosing the Best Solution, Common Misconfigurations, Evasion
Techniques, and Recommendations. SANS Institute
B. After you read the paper, answer the following questions:
1) In one paragraph, briefly describe the difference between IDS and IPS.
2) If you were designing a network, which of the devices would you put inline – IDS or
IPS? Why?
3) What are the most common mistake made implementing IPS/IDS security systems?
4) In less than one page, research and recommend security improvements involving
IPS/IDS for Wilmington University.
CYB 6010: Week 3 Hands-on Exercise
A. Read and Review the McAfee Network Security Platform (NSP) User Guide
B. After reading and reviewing the McAfee Network Security Platform (NSP) User Guide
and Network security through data analysis: building situational awareness. Chapters 59. , perform the following steps/exercises:
1.
2.
3.
4.
5.
6.
7.
8.
Logon to the VM
Login to the NSP
Logon to the NSM
Ensure Week 3 traffic has been processed through the NSP
Analyze the alerts that appear on the NSM and the ATD console
Take a screenshot of the NSM and ATD consoles with the top 10 alerts
Research and write a report for the Top 5 alerts and malware discovered by the ATD.
Submit a single file with the NSP and ATD report with screenshots from NSM and ATD.
HACKING EXPOSED:
NETWORK SECURITY
SECRETS & SOLUTIONS
SECOND EDITION
This page intentionally left blank.
HACKING EXPOSED:
NETWORK SECURITY
SECRETS & SOLUTIONS
SECOND EDITION
JOEL SCAMBRAY
STUART MCCLURE
GEORGE KURTZ
Osborne/McGraw-Hill
Berkeley New York St. Louis San Francisco
Auckland Bogotá Hamburg London Madrid
Mexico City Milan Montreal New Delhi Panama City
Paris São Paulo Singapore Sydney
Tokyo Toronto
abc
McGraw-Hill
Copyright © 2001 by The McGraw-Hill Companies. All rights reserved. Manufactured in the United States of America. Except as permitted under the United States Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by
any means, or stored in a database or retrieval system, without the prior written permission of the publisher.
0-07-219214-3
The material in this eBook also appears in the print version of this title: 0-07-212748-1.
All trademarks are trademarks of their respective owners. Rather than put a trademark symbol after every occurrence of a trademarked name, we use names in an editorial fashion only, and to the benefit of the trademark owner, with no intention of infringement of the trademark. Where such designations appear in this book, they have been printed with initial caps.
McGraw-Hill eBooks are available at special quantity discounts to use as premiums and sales promotions, or for use in corporate
training programs. For more information, please contact George Hoare, Special Sales, at george_hoare@mcgraw-hill.com or (212)
904-4069.
TERMS OF USE
This is a copyrighted work and The McGraw-Hill Companies, Inc. (“McGraw-Hill”) and its licensors reserve all rights in and to the
work. Use of this work is subject to these terms. Except as permitted under the Copyright Act of 1976 and the right to store and
retrieve one copy of the work, you may not decompile, disassemble, reverse engineer, reproduce, modify, create derivative works
based upon, transmit, distribute, disseminate, sell, publish or sublicense the work or any part of it without McGraw-Hill’s prior consent. You may use the work for your own noncommercial and personal use; any other use of the work is strictly prohibited. Your
right to use the work may be terminated if you fail to comply with these terms.
THE WORK IS PROVIDED “AS IS”. McGRAW-HILL AND ITS LICENSORS MAKE NO GUARANTEES OR WARRANTIES
AS TO THE ACCURACY, ADEQUACY OR COMPLETENESS OF OR RESULTS TO BE OBTAINED FROM USING THE
WORK, INCLUDING ANY INFORMATION THAT CAN BE ACCESSED THROUGH THE WORK VIA HYPERLINK OR
OTHERWISE, AND EXPRESSLY DISCLAIM ANY WARRANTY, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
TO IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. McGraw-Hill and its
licensors do not warrant or guarantee that the functions contained in the work will meet your requirements or that its operation will
be uninterrupted or error free. Neither McGraw-Hill nor its licensors shall be liable to you or anyone else for any inaccuracy, error
or omission, regardless of cause, in the work or for any damages resulting therefrom. McGraw-Hill has no responsibility for the content of any information accessed through the work. Under no circumstances shall McGraw-Hill and/or its licensors be liable for any
indirect, incidental, special, punitive, consequential or similar damages that result from the use of or inability to use the work, even
if any of them has been advised of the possibility of such damages. This limitation of liability shall apply to any claim or cause whatsoever whether such claim or cause arises in contract, tort or otherwise.
DOI: 10.1036/0072192143
To my parents and their parents, who set me on the path; to my wife,
who continues to guide me along it; and to my children, who have
taken it in miraculous new directions.
—Joel Scambray
To my wife and child, without whose love and support little else would
matter; and to my parents for their continuing confidence in me.
—Stuart McClure
This book is dedicated to my loving wife, Anna. I could not have
completed two editions of this book without her understanding,
support, and continuous encouragement. I also would like to thank my
entire family for their assistance in helping me “find the time” when
deadlines seemed impossible.
—George Kurtz
To those who seek the truth, may they continue to search free from
restraint and censorship.
—The Authors
vi
Hacking Exposed: Network Security Secrets and Solutions
About the Authors
Joel Scambray
Joel Scambray is a Principal of Foundstone Inc. (http://www
.foundstone.com), where he provides information system security
consulting services to clients ranging from members of the Fortune 50
to newly minted startups. He has field-tested knowledge of numerous
security technologies and has designed and analyzed security architectures for a variety of applications and products. Mr. Scambray’s
regular publications include the monthly “Ask Us About…Security”
(http://www.microsoft.com/technet/security/) for Microsoft’s
TechNet web site, and the weekly “Security Watch” column in
InfoWorld magazine (http://www.infoworld.com/security), where he has additionally
published over a dozen technology product analyses. He has held positions as a Manager
for Ernst & Young LLP’s eSecurity Solutions group, Senior Test Center Analyst for
InfoWorld, and Director of IT for a major commercial real estate firm. Mr. Scambray is a
Certified Information Systems Security Professional (CISSP) and Certified Checkpoint
Security Engineer (CCSE).
Joel Scambray can be reached at joel@hackingexposed.com.
Stuart McClure
Stuart McClure is President/CTO of Foundstone, Inc. (http://www
.foundstone.com) and has over 10 years of IT and security experience.
Mr. McClure specializes in security assessments, firewall reviews,
e-commerce application testing, hosts reviews, PKI technologies,
intrusion detection, and incident response. For over two years,
Mr. McClure has co-authored a weekly column on security called
“Security Watch” for InfoWorld magazine, a global security column
addressing topical security issues, exploits, and vulnerabilities.
Mr. McClure has spent the past four years with the both Big 5 security
consulting and the InfoWorld Test Center where he tested dozens of network and security
hardware and software products. Prior to InfoWorld, Mr. McClure spent over seven years
managing and securing networks and systems ranging from Cisco, Novell, Solaris, AIX,
AS/400, Window NT, and Linux in corporate, academic, and government landscapes.
Stuart McClure can be reached at stuart@hackingexposed.com.
Copyright 2001 The McGraw Hill Companies, Inc. Click Here for Terms of Use.
About the Authors
George Kurtz
George Kurtz is CEO of Foundstone (http://www.foundstone.com), a
cutting edge security consulting and training organization. Mr. Kurtz
is an internationally recognized security expert and has performed
hundreds of firewall, network, and e-commerce related security assessments throughout his security consulting career. Mr. Kurtz has
significant experience with intrusion detection and firewall technologies, incident response procedures, and remote access solutions. He is
regular speaker at many security conferences and has been quoted in a
wide range of publications, including The Wall Street Journal,
InfoWorld, USA Today, and the Associated Press. Mr. Kurtz is routinely called to comment
on breaking security events and has been featured on various television stations, including CNN, CNBC, NBC, and ABC.
George Kurtz can be reached at george@hackingexposed.com.
vii
viii
Hacking Exposed: Network Security Secrets and Solutions
About the Technical Reviewers
Saumil Shah
Saumil Shah provides information security consulting services to Foundstone clients,
specializing in ethical hacking and security architecture. He holds a designation as a Certified Information Systems Security Professional (CISSP). Mr. Shah has over six years of
experience with system administration, network architecture, integrating heterogeneous
platforms and information security, and has performed numerous ethical hacking
exercises for many significant companies in the IT arena. Prior to joining Foundstone,
Mr. Shah was a senior consultant with Ernst & Young where he was responsible for their
ethical hacking and security architecture solutions. Mr. Shah has also authored a book
titled The Anti-Virus Book, published by Tata McGraw-Hill India, and he worked at the
Indian Institute of Management, Ahmedabad, as a research assistant.
Saumil Shah can be reached at saumil.shah@foundstone.com.
Victor Robert “Bob” Garza
Bob Garza is a Senior IT Network Engineer for a large multinational corporation in the
Silicon Valley. His primary areas of responsibility include operational support, network
management, and security for a network with over 25 thousand hosts. He has over 20
years of experience in the computing industry and is author of several “For Dummies”
books. Mr. Garza has also written reviews of networking and security products for
InfoWorld and Federal Computer Week for the past nine years. Mr. Garza holds an M.S. in
Telecommunications Management and a B.S. in Information Systems Management.
Eric Schultze
Eric Schultze has been involved with information technology and security for the past
nine years, with a majority of his time focused on assessing and securing Microsoft technologies and platforms. He is a frequent speaker at security conferences including
NetWorld Interop, Usenix, BlackHat, SANS, and MIS and is a faculty instructor for the
Computer Security Institute. Mr. Schultze has also appeared on TV and in many publications including NBC, CNBC, TIME, ComputerWorld, and The Standard. Mr. Schultz’s
prior employers include Foundstone, Inc., SecurityFocus.com, Ernst & Young, Price
Waterhouse, Bealls Inc., and Salomon Brothers. A contributing author to the first
edition of Hacking Exposed, he is currently a Security Program Manager for a software
development company.
Martin W. Dolphin
Martin Dolphin is Senior Manager of Security Technology Solutions in the New England
Practice for Ernst & Young. Mr. Dolphin has more than 10 years of computer administration experience with more than 5 years of security experience specializing in Windows NT,
Novell NetWare, and Internet security. Mr. Dolphin can also be found teaching the
Extreme Hacking—Defending Your Site class.
Copyright 2001 The McGraw Hill Companies, Inc. Click Here for Terms of Use.
CONTENTS
Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . .
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
xvii
xxi
xxiii
Part 1
Casing the Establishment
Case Study: Target Acquisition . . . . . . . . . . . . . . . . . . . .
2
▼ 1 Footprinting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5
6
6
6
8
13
22
27
31
What Is Footprinting? . . . . . . . . . . . . . . . . .
Why Is Footprinting Necessary? . . . . . . . .
Internet Footprinting . . . . . . . . . . . . . . . . . .
Step 1. Determine the Scope of Your Activities
Step 2. Network Enumeration . . . . . . . . . .
Step 3. DNS Interrogation . . . . . . . . . . . .
Step 4. Network Reconnaissance . . . . . . . .
Summary . . . . . . . . . . . . . . . . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
Copyright 2001 The McGraw Hill Companies, Inc. Click Here for Terms of Use.
ix
x
Hacking Exposed: Network Security Secrets and Solutions
▼ 2 Scanning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Scan Types . . . . . . . . . . . . . . . . . . . .
Identifying TCP and UDP Services Running
Windows-Based Port Scanners . . . . . . . .
Port Scanning Breakdown . . . . . . . . . . .
Active Stack Fingerprinting . . . . . . . . . .
Passive Stack Fingerprinting . . . . . . . . .
The Whole Enchilada: Automated Discovery Tools
Summary . . . . . . . . . . . . . . . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
▼ 3 Enumeration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
33
44
46
51
57
61
65
67
68
.
.
.
.
.
.
.
.
.
71
72
76
87
95
99
100
100
106
113
Case Study: Know Your Enemy . . . . . . . . . . . . . . . . . . . .
116
▼ 4 Hacking Windows 95/98 and ME . . . . . . . . . . . . . . . . . . . . . . .
117
118
119
124
129
130
130
137
138
Windows NT/2000 Enumeration . . . . . . . . . . . .
NT/2000 Network Resource Enumeration . . .
NT/2000 User and Group Enumeration . . . . .
NT/2000 Applications and Banner Enumeration
Let Your Scripts Do the Walking . . . . . . . . .
Novell Enumeration . . . . . . . . . . . . . . . . . . .
Browsing the Network Neighborhood . . . . . .
UNIX Enumeration . . . . . . . . . . . . . . . . . . . .
Summary . . . . . . . . . . . . . . . . . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
Part II
System Hacking
Win 9x Remote Exploits . . . . . . . . . . . . . . . .
Direct Connection to Win 9x Shared Resources
Win 9x Backdoor Servers and Trojans . . . . .
Known Server Application Vulnerabilities . .
Win 9x Denial of Service . . . . . . . . . . . . .
Win 9x Local Exploits . . . . . . . . . . . . . . . . . .
Windows Millennium Edition (ME) . . . . . . . . .
Summary . . . . . . . . . . . . . . . . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
▼ 5 Hacking Windows NT . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
141
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Where We’re Headed . . . . . . . . . . . . . . . . . . . . . .
What About Windows 2000? . . . . . . . . . . . . . . . . . .
143
143
143
Contents
The Quest for Administrator . . . . . . . . . . . . . . . . . . . .
Remote Exploits: Denial of Service and Buffer Overflows
Privilege Escalation . . . . . . . . . . . . . . . . . . . . . .
Consolidation of Power . . . . . . . . . . . . . . . . . . . . . .
Exploiting Trust . . . . . . . . . . . . . . . . . . . . . . . .
Sniffers . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Remote Control and Back Doors . . . . . . . . . . . . . .
Port Redirection . . . . . . . . . . . . . . . . . . . . . . . .
General Countermeasures to Privileged Compromise . .
Rootkit: The Ultimate Compromise . . . . . . . . . . . . . . . .
Covering Tracks . . . . . . . . . . . . . . . . . . . . . . . . . . .
Disabling Auditing . . . . . . . . . . . . . . . . . . . . . .
Clearing the Event Log . . . . . . . . . . . . . . . . . . . .
Hiding Files . . . . . . . . . . . . . . . . . . . . . . . . . .
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
144
160
164
174
185
190
194
203
207
211
214
214
214
215
216
▼ 6 Hacking Windows 2000 . . . . . . . . . . . . . . . . . . . . . . . . . . . .
219
221
221
226
229
229
229
229
233
233
238
241
241
246
249
251
251
252
252
252
252
255
257
257
257
260
261
Footprinting . . . . . . . . . . . . . . . . . . . . . . . . . .
Scanning . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Enumeration . . . . . . . . . . . . . . . . . . . . . . . . . .
Penetration . . . . . . . . . . . . . . . . . . . . . . . . . . .
NetBIOS-SMB Password Guessing . . . . . . . . . .
Eavesdropping on Password Hashes . . . . . . . . .
Attacks Against IIS 5 . . . . . . . . . . . . . . . . . .
Remote Buffer Overflows . . . . . . . . . . . . . . .
Denial of Service . . . . . . . . . . . . . . . . . . . . . . .
Privilege Escalation . . . . . . . . . . . . . . . . . . . . . .
Pilfering . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Grabbing the Win 2000 Password Hashes . . . . . .
The Encrypting File System (EFS) . . . . . . . . . . .
Exploiting Trust . . . . . . . . . . . . . . . . . . . . .
Covering Tracks . . . . . . . . . . . . . . . . . . . . . . . .
Disabling Auditing . . . . . . . . . . . . . . . . . . .
Clearing the Event Log . . . . . . . . . . . . . . . . .
Hiding Files . . . . . . . . . . . . . . . . . . . . . . .
Back Doors . . . . . . . . . . . . . . . . . . . . . . . . . . .
Startup Manipulation . . . . . . . . . . . . . . . . .
Remote Control . . . . . . . . . . . . . . . . . . . . .
Keystroke Loggers . . . . . . . . . . . . . . . . . . .
General Countermeasures: New Windows Security Tools
Group Policy . . . . . . . . . . . . . . . . . . . . . .
runas . . . . . . . . . . . . . . . . . . . . . . . . . . .
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
xi
xii
Hacking Exposed: Network Security Secrets and Solutions
▼ 7 Novell NetWare Hacking . . . . . . . . . . . . . . . . . . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
265
267
268
275
277
282
285
287
290
292
298
299
302
. . . .
. . . .
. . . .
302
303
303
▼ 8 Hacking UNIX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
305
306
306
307
307
308
312
317
322
339
357
358
369
370
. . . . . . . . . . . . . . . . . .
374
▼ 9 Dial-Up, PBX, Voicemail, and VPN Hacking . . . . . . . . . . . . . . . . .
377
380
380
381
382
Attaching but Not Touching . . . . . . . . . . . . . . . . . .
Enumerate Bindery and Trees . . . . . . . . . . . . . . . . .
Opening the Unlocked Doors . . . . . . . . . . . . . . . . .
Authenticated Enumeration . . . . . . . . . . . . . . . . . .
Gaining Admin . . . . . . . . . . . . . . . . . . . . . . . . .
Application Vulnerabilities . . . . . . . . . . . . . . . . . .
Spoofing Attacks (Pandora) . . . . . . . . . . . . . . . . . .
Once You Have Admin on a Server . . . . . . . . . . . . . .
Owning the NDS Files . . . . . . . . . . . . . . . . . . . . .
Log Doctoring . . . . . . . . . . . . . . . . . . . . . . . . . .
Console Logs . . . . . . . . . . . . . . . . . . . . . . .
Further Resources . . . . . . . . . . . . . . ….
Purchase answer to see full
attachment