Wireshark for Security Professionals

Name: Wireshark for Security Professionals | Using Wireshark and the Metasploit Framework
Brand: Wiley
Price: 35.99 EUR
Availability: OnlineOnly

Using Wireshark and the Metasploit Framework

Jessey Bullock Jeff T. Parker(Autor*in)

Wiley (Verlag)

Erschienen am 28. Februar 2017

288 Seiten

E-Book

PDF mit Adobe-DRM

Systemvoraussetzungen

978-1-118-91823-4 (ISBN)

35,99 €inkl. 7% MwSt.

Systemvoraussetzungen

für PDF mit Adobe-DRM

E-Book Einzellizenz

Als Download verfügbar

Beschreibung

Master Wireshark to solve real-world security problems
If you don't already use Wireshark for a wide range of information security tasks, you will after this book. Mature and powerful, Wireshark is commonly used to find root cause of challenging network issues. This book extends that power to information security professionals, complete with a downloadable, virtual lab environment.
Wireshark for Security Professionals covers both offensive and defensive concepts that can be applied to essentially any InfoSec role. Whether into network security, malware analysis, intrusion detection, or penetration testing, this book demonstrates Wireshark through relevant and useful examples.
Master Wireshark through both lab scenarios and exercises. Early in the book, a virtual lab environment is provided for the purpose of getting hands-on experience with Wireshark. Wireshark is combined with two popular platforms: Kali, the security-focused Linux distribution, and the Metasploit Framework, the open-source framework for security testing. Lab-based virtual systems generate network traffic for analysis, investigation and demonstration. In addition to following along with the labs you will be challenged with end-of-chapter exercises to expand on covered material.
Lastly, this book explores Wireshark with Lua, the light-weight programming language. Lua allows you to extend and customize Wireshark's features for your needs as a security professional. Lua source code is available both in the book and online. Lua code and lab source code are available online through GitHub, which the book also introduces. The book's final two chapters greatly draw on Lua and TShark, the command-line interface of Wireshark.
By the end of the book you will gain the following:
* Master the basics of Wireshark
* Explore the virtual w4sp-lab environment that mimics a real-world network
* Gain experience using the Debian-based Kali OS among other systems
* Understand the technical details behind network attacks
* Execute exploitation and grasp offensive and defensive activities, exploring them through Wireshark
* Employ Lua to extend Wireshark features and create useful scripts
To sum up, the book content, labs and online material, coupled with many referenced sources of PCAP traces, together present a dynamic and robust manual for information security professionals seeking to leverage Wireshark.

Weitere Details

Weitere Ausgaben

Personen

Inhalt

1 - Cover [Seite 1]
2 - Title Page [Seite 3]
3 - Copyright [Seite 4]
4 - About the Authors [Seite 7]
5 - About the Technical Editor [Seite 8]
6 - Acknowledgments [Seite 9]
7 - Credits [Seite 6]
8 - Contents [Seite 11]
9 - Introduction [Seite 15]
9.1 - Overview of the Book and Technology [Seite 15]
9.2 - How This Book Is Organized [Seite 16]
9.3 - Who Should Read This Book [Seite 17]
9.4 - Tools You Will Need [Seite 18]
9.5 - What's on the Website [Seite 18]
9.6 - Summary [Seite 18]
10 - Chapter 1: Introducing Wireshark [Seite 19]
10.1 - What Is Wireshark? [Seite 20]
10.1.1 - A Best Time to Use Wireshark? [Seite 20]
10.1.2 - Avoiding Being Overwhelmed [Seite 21]
10.2 - The Wireshark User Interface [Seite 21]
10.2.1 - Packet List Pane [Seite 23]
10.2.2 - Packet Details Pane [Seite 24]
10.2.3 - Packet Bytes Pane [Seite 26]
10.3 - Filters [Seite 27]
10.3.1 - Capture Filters [Seite 27]
10.3.2 - Display Filters [Seite 31]
10.4 - Summary [Seite 35]
10.5 - Exercises [Seite 36]
11 - Chapter 2: Setting Up the Lab [Seite 37]
11.1 - Kali Linux [Seite 38]
11.2 - Virtualization [Seite 40]
11.2.1 - Basic Terminology and Concepts [Seite 41]
11.2.2 - Benefits of Virtualization [Seite 41]
11.3 - VirtualBox [Seite 42]
11.3.1 - Installing VirtualBox [Seite 42]
11.3.2 - Installing the VirtualBox Extension Pack [Seite 49]
11.3.3 - Creating a Kali Linux Virtual Machine [Seite 51]
11.3.4 - Installing Kali Linux [Seite 58]
11.4 - The W4SP Lab [Seite 64]
11.4.1 - Requirements [Seite 64]
11.4.2 - A Few Words about Docker [Seite 65]
11.4.3 - What Is GitHub? [Seite 66]
11.4.4 - Creating the Lab User [Seite 67]
11.4.5 - Installing the W4SP Lab on the Kali Virtual Machine [Seite 68]
11.4.6 - Setting Up the W4SP Lab [Seite 71]
11.4.7 - The Lab Network [Seite 72]
11.5 - Summary [Seite 73]
11.6 - Exercises [Seite 74]
12 - Chapter 3: The Fundamentals [Seite 75]
12.1 - Networking [Seite 76]
12.1.1 - OSI Layers [Seite 76]
12.1.2 - Networking between Virtual Machines [Seite 79]
12.2 - Security [Seite 81]
12.2.1 - The Security Triad [Seite 81]
12.2.2 - Intrusion Detection and Prevention Systems [Seite 81]
12.2.3 - False Positives and False Negatives [Seite 82]
12.2.4 - Malware [Seite 82]
12.2.5 - Spoofing and Poisoning [Seite 84]
12.3 - Packet and Protocol Analysis [Seite 84]
12.3.1 - A Protocol Analysis Story [Seite 85]
12.3.2 - Ports and Protocols [Seite 89]
12.4 - Summary [Seite 91]
12.5 - Exercises [Seite 92]
13 - Chapter 4: Capturing Packets [Seite 93]
13.1 - Sniffing [Seite 94]
13.1.1 - Promiscuous Mode [Seite 94]
13.1.2 - Starting the First Capture [Seite 96]
13.1.3 - TShark [Seite 100]
13.2 - Dealing with the Network [Seite 104]
13.2.1 - Local Machine [Seite 105]
13.2.2 - Sniffing Localhost [Seite 106]
13.2.3 - Sniffing on Virtual Machine Interfaces [Seite 110]
13.2.4 - Sniffing with Hubs [Seite 114]
13.2.5 - SPAN Ports [Seite 116]
13.2.6 - Network Taps [Seite 119]
13.2.7 - Transparent Linux Bridges [Seite 121]
13.2.8 - Wireless Networks [Seite 123]
13.3 - Loading and Saving Capture Files [Seite 126]
13.3.1 - File Formats [Seite 126]
13.3.2 - Ring Buffers and Multiple Files [Seite 129]
13.3.3 - Recent Capture Files [Seite 134]
13.4 - Dissectors [Seite 136]
13.4.1 - W4SP Lab: Managing Nonstandard HTTP Traffic [Seite 136]
13.4.2 - Filtering SMB Filenames [Seite 138]
13.4.3 - Packet Colorization [Seite 141]
13.5 - Viewing Someone Else's Captures [Seite 144]
13.6 - Summary [Seite 145]
13.7 - Exercises [Seite 146]
14 - Chapter 5: Diagnosing Attacks [Seite 147]
14.1 - Attack Type: Man-in-the-Middle [Seite 148]
14.1.1 - Why MitM Attacks Are Effective [Seite 148]
14.1.2 - How MitM Attacks Get Done: ARP [Seite 149]
14.1.3 - W4SP Lab: Performing an ARP MitM Attack [Seite 151]
14.1.4 - W4SP Lab: Performing a DNS MitM Attack [Seite 159]
14.1.5 - How to Prevent MitM Attacks [Seite 165]
14.2 - Attack Type: Denial of Service [Seite 166]
14.2.1 - Why DoS Attacks Are Effective [Seite 167]
14.2.2 - How DoS Attacks Get Done [Seite 168]
14.2.3 - How to Prevent DoS Attacks [Seite 173]
14.3 - Attack Type: Advanced Persistent Threat [Seite 174]
14.3.1 - Why APT Attacks Are Effective [Seite 174]
14.3.2 - How APT Attacks Get Done [Seite 175]
14.3.3 - Example APT Traffic in Wireshark [Seite 175]
14.3.4 - How to Prevent APT Attacks [Seite 179]
14.4 - Summary [Seite 180]
14.5 - Exercises [Seite 180]
15 - Chapter 6: Offensive Wireshark [Seite 181]
15.1 - Attack Methodology [Seite 181]
15.2 - Reconnaissance Using Wireshark [Seite 183]
15.3 - Evading IPS/IDS [Seite 186]
15.3.1 - Session Splicing and Fragmentation [Seite 186]
15.3.2 - Playing to the Host, Not the IDS [Seite 187]
15.3.3 - Covering Tracks and Placing Backdoors [Seite 187]
15.4 - Exploitation [Seite 188]
15.4.1 - Setting Up the W4SP Lab with Metasploitable [Seite 189]
15.4.2 - Launching Metasploit Console [Seite 189]
15.4.3 - VSFTP Exploit [Seite 190]
15.4.4 - Debugging with Wireshark [Seite 191]
15.4.5 - Shell in Wireshark [Seite 193]
15.4.6 - TCP Stream Showing a Bind Shell [Seite 194]
15.4.7 - TCP Stream Showing a Reverse Shell [Seite 201]
15.4.8 - Starting ELK [Seite 206]
15.5 - Remote Capture over SSH [Seite 208]
15.6 - Summary [Seite 209]
15.7 - Exercises [Seite 210]
16 - Chapter 7: Decrypting TLS, Capturing USB, Keyloggers, and Network Graphing [Seite 211]
16.1 - Decrypting SSL/TLS [Seite 211]
16.1.1 - Decrypting SSL/TLS Using Private Keys [Seite 213]
16.1.2 - Decrypting SSL/TLS Using Session Keys [Seite 217]
16.2 - USB and Wireshark [Seite 220]
16.2.1 - Capturing USB Traffic on Linux [Seite 221]
16.2.2 - Capturing USB Traffic on Windows [Seite 224]
16.2.3 - TShark Keylogger [Seite 226]
16.3 - Graphing the Network [Seite 230]
16.3.1 - Lua with Graphviz Library [Seite 231]
16.4 - Summary [Seite 236]
16.5 - Exercises [Seite 237]
17 - Chapter 8: Scripting with Lua [Seite 239]
17.1 - Why Lua? [Seite 240]
17.2 - Scripting Basics [Seite 241]
17.2.1 - Variables [Seite 243]
17.2.2 - Functions and Blocks [Seite 244]
17.2.3 - Loops [Seite 246]
17.2.4 - Conditionals [Seite 248]
17.3 - Setup [Seite 248]
17.3.1 - Checking for Lua Support [Seite 249]
17.3.2 - Lua Initialization [Seite 250]
17.3.3 - Windows Setup [Seite 251]
17.3.4 - Linux Setup [Seite 251]
17.4 - Tools [Seite 252]
17.4.1 - Hello World with TShark [Seite 254]
17.4.2 - Counting Packets Script [Seite 255]
17.4.3 - ARP Cache Script [Seite 259]
17.5 - Creating Dissectors for Wireshark [Seite 262]
17.5.1 - Dissector Types [Seite 263]
17.5.2 - Why a Dissector Is Needed [Seite 263]
17.5.3 - Experiment [Seite 271]
17.6 - Extending Wireshark [Seite 273]
17.6.1 - Packet Direction Script [Seite 273]
17.6.2 - Marking Suspicious Script [Seite 275]
17.6.3 - Snooping SMB File Transfers [Seite 278]
17.7 - Summary [Seite 280]
18 - Index [Seite 283]
19 - EULA [Seite 291]

Systemvoraussetzungen

Als PDF speichern Als Link merken