ETHICAL HACKING
A Hands-on Introduction to Breaking In
by Daniel G. Graham
San Francisco
ETHICAL HACKING. Copyright 2021 by Daniel G. Graham.
All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner and the publisher.
ISBN-13: 978-1-7185-0187-4 (print)
ISBN-13: 978-1-7185-0188-1 (ebook)
Publisher: William Pollock
Managing Editor: Jill Franklin
Production Manager: Rachel Monaghan
Production Editors: Kassie Andreadis and Katrina Taylor
Developmental Editor: Frances Saux
Cover and Interior Design: Octopod Studios
Cover Illustrator: Garry Booth
Technical Reviewer: Ed Novak
Copyeditor: George Hale
Production Services: Octal Publishing, Inc.
For information on book distributors or translations, please contact No Starch Press, Inc. directly:
No Starch Press, Inc.
245 8th Street, San Francisco, CA 94103
phone: 415.863.9900; fax: 415.863.9950;
Library of Congress Control Number: 2021940441
No Starch Press and the No Starch Press logo are registered trademarks of No Starch Press, Inc. Other product and company names mentioned herein may be the trademarks of their respective owners. Rather than use a trademark symbol with every occurrence of a trademarked name, we are using the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark.
The information in this book is distributed on an As Is basis, without warranty. While every precaution has been taken in the preparation of this work, neither the author nor No Starch Press, Inc. shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the information contained in it.
This book is dedicated to my loving wife, Shea Graham, who supported me throughout this process. I want the world to know how much I love you. Thanks for reading all the rough drafts. This book would not have been possible without your encouragement and support. May our future children be inspired to share their ideas with the universe and grow into a prosperous generation of Christians.
And to my family: my father, Errol Graham, son of a carpenter and the first in our family to go to college; my mother, Angelique Graham, who loves us unconditionally and always supported us; my sister, Dr. Dominique Vaughn, who is my friend for life; and my brother-in-law Adrian Vaughn, my father-in-law Les Tinsley, and my mother-in-law Fay Tinsley.
Daniel G. Graham, PhD
About the Author
Dr. Daniel G. Graham is an assistant professor of computer science at the University of Virginia in Charlottesville. His research interests include secure embedded systems and networks. Before teaching at UVA, Dr. Graham was a program manager at Microsoft. He publishes in IEEE journals relating to sensors and networks.
About the Technical Reviewer
Dr. Ed Novak is an assistant professor of computer science at Franklin and Marshall College in Lancaster, Pennsylvania. He received a PhD from The College of William and Mary in 2016. His research interests revolve around security and privacy in smart mobile devices.
BRIEF CONTENTS
CONTENTS IN DETAIL
1
SETTING UP
PART I
NETWORK FUNDAMENTALS
2
CAPTURING TRAFFIC WITH ARP SPOOFING
3
ANALYZING CAPTURED TRAFFIC
4
CRAFTING TCP SHELLS AND BOTNETS
PART II
CRYPTOGRAPHY
5
CRYPTOGRAPHY AND RANSOMWARE
6
TLS AND DIFFIE-HELLMAN
PART III
SOCIAL ENGINEERING
7
PHISHING AND DEEPFAKES
8
SCANNING TARGETS
PART IV
EXPLOITATION
9
FUZZING FOR ZERO-DAY VULNERABILITIES
10
BUILDING TROJANS
11
BUILDING AND INSTALLING LINUX ROOTKITS
12
STEALING AND CRACKING PASSWORDS
13
SERIOUS CROSS-SITE SCRIPTING EXPLOITATION
PART V
CONTROLLING THE NETWORK
14
PIVOTING AND PRIVILEGE ESCALATION
15
MOVING THROUGH THE CORPORATE WINDOWS NETWORK
16
NEXT STEPS
ACKNOWLEDGMENTS
I want to thank everyone who helped make this book possible. I especially want to thank my wife, Shea Graham, who proofed the early versions of this book. Thanks for all your love and encouragement.
To the editorial and production teams at No Starch Press, thank you. Frances Saux, your excellent comments and careful edits made the book better. Thank you for all your hard work. George Hale and Bob Russell, thanks for double-checking each chapter. Thanks to production editors Kassie Andreadis and Katrina Taylor and the founder of No Starch Press, Bill Pollock.
To the technical scholars whose comments and conversations helped shape this book: thank you. Ed Novak, PhD, you did a fantastic job editing the technical details of the book. To my friend and colleague Jesse Laeuchli, PhD, thank you for helping design the books virtual lab and suggesting topics and exercises to include. To my colleagues David Wu, PhD, and Charles Reiss, PhD, thanks for the comments, emails, and conversations on cryptography and Linux kernel modules.
To Srikar Chittari and my other undergraduate research assistants, Jacob Pacheco and Jeffery Gerken, who volunteered to test the chapters, and to my students who got an early preview of the book and helped catch various bugs: thank you.
To Jim Cohoon, thanks for introducing me to the world of computer science. To my faculty mentor Tom Horton, PhD, and Kevin Skadron, PhD, chair of the computer science department, thanks for your kind words of encouragement. And to Juan Gilbert, PhD, chair of the Department of Computer and Information Science and Engineering at the University of Florida, thank you for writing the foreword.
Finally, to Professor Malathi Veeraraghavan, PhD, thank you for introducing me to the fantastic field of networking. You will be dearly missed by your former students and the faculty of the University of Virginia.
FOREWORD
We exist in a time where hackers hold more influence than ever before. Hacking can now impact the lives of millions of people by targeting elections, power grids, and all sorts of infrastructure that people rely on for their day-to-day activities, not to mention their well-being.
In 2021, hackers used ransomware to take down the United States largest gasoline pipeline. This fueled anxiety, canceled flights, and caused shortages. The well-executed attack was personal for many people who experienced its impact firsthand.
With this level of influence, it is imperative that we not only teach ethical hacking but also encourage it. Ethical Hacking