
Network Protocols for Security Professionals
Description
Alles über E-Books | Antworten auf Fragen rund um E-Books, Kopierschutz und Dateiformate finden Sie in unserem Info- & Hilfebereich.
With the increased demand for computer systems and the ever-evolving internet, network security now plays an even bigger role in securing IT infrastructures against attacks. Equipped with the knowledge of how to find vulnerabilities and infiltrate organizations through their networks, you'll be able to think like a hacker and safeguard your organization's network and networking devices. Network Protocols for Security Professionals will show you how. This comprehensive guide gradually increases in complexity, taking you from the basics to advanced concepts. Starting with the structure of data network protocols, devices, and breaches, you'll become familiar with attacking tools and scripts that take advantage of these breaches. Once you've covered the basics, you'll learn about attacks that target networks and network devices. Your learning journey will get more exciting as you perform eavesdropping, learn data analysis, and use behavior analysis for network forensics. As you progress, you'll develop a thorough understanding of network protocols and how to use methods and tools you learned in the previous parts to attack and protect these protocols. By the end of this network security book, you'll be well versed in network protocol security and security countermeasures to protect network protocols.
All prices
More details
Content
- Cover
- Title Page
- Copyright and credits
- Contributors
- About the reviewers
- Table of Contents
- Preface
- Part 1: Protecting the Network - Technologies, Protocols, Vulnerabilities, and Tools
- Chapter 1: Data Centers and the Enterprise Network Architecture and its Components
- Exploring networks and data flows
- The data center, core, and user networks
- Switching (L2) and routing (L3) topologies
- Switching (L2) and routing (L3)
- L2 and L3 architectures
- L2 and L3 architecture data flow
- L2 and L3 architecture data flow with redundancy
- L2 and L3 topologies with firewalls
- L2 and L3 topologies with overlays
- The network perimeter
- The data, control, and management planes
- The data plane
- The control plane
- The management plane
- SDN and NFV
- Software-defined networking (SDN)
- Network function virtualization (NFV)
- Cloud connectivity
- Type of attacks and where they are implemented
- Attacks on the internet
- Attacks from the internet targeting organizational networks
- Attacks on firewalls
- Attacks on servers
- Attacks on local area networks (LANs)
- Attacks on network routers and routing protocols
- Attacks on wireless networks
- Summary
- Questions
- Chapter 2: Network Protocol Structures and Operations
- Data network protocols and data structures
- Layer 2 protocols - STP, VLANs, and security methods
- The Ethernet protocols
- LAN switching
- VLANs and VLAN tagging
- Spanning tree protocols
- Layer 3 protocols - IP and ARP
- Routers and routing protocols
- Routing operations
- Routing protocols
- Layer 4 protocols - UDP, TCP, and QUIC
- UDP
- TCP
- QUIC
- Vulnerabilities in layer 4 protocols
- Encapsulation and tunneling
- Summary
- Questions
- Chapter 3: Security Protocols and Their Implementation
- Security pillars - confidentiality, integrity, and availability
- Encryption basics and protocols
- Services provided by encryption
- Stream versus block ciphers
- Symmetric versus asymmetric encryption
- Public key infrastructure and certificate authorities
- Authentication basics and protocols
- Authentication types
- Username/password with IP address identification authentication
- Encrypted username/password authentication
- Extensible authentication protocol (EAP)
- Authorization and access protocols
- Hash functions and message digests
- IPSec and key management protocols
- VPNs
- IPSec principles of operation
- IPSec tunnel establishment
- IPSec modes of operation
- IPSec authentication and encryption protocols
- IPSec AH protocol
- IPSec ESP protocol
- SSL/TLS and proxies
- Protocol basics
- The handshake protocol
- Network security components - RADIUS/TACACS+, FWs, IDS/IPSs, NAC, and WAFs
- Firewalls
- RADIUS, NAC, and other authentication features
- Web application firewalls (WAFs)
- Summary
- Questions
- Chapter 4: Using Network Security Tools, Scripts, and Code
- Commercial, open source, and Linux-based tools
- Open source tools
- Commercial tools
- Information gathering and packet analysis tools
- Basic network scanners
- Network analysis and management tools
- Protocol discovery tools
- Vulnerability analysis tools
- Nikto
- Legion
- Exploitation tools
- The Metasploit Framework (MSF)
- Stress testing tools
- Windows tools
- Kali Linux tools
- Network forensics tools
- Wireshark and packet capture tools
- Summary
- Questions
- Chapter 5: Finding Protocol Vulnerabilities
- Black box, white box, and gray box testing
- Black box and fuzzing
- Enterprise networks testing
- Provider networks testing
- Fuzzing phases
- Common vulnerabilities
- Layer 2-based vulnerabilities
- Layer 3-based vulnerabilities
- Layer 4-based vulnerabilities
- Layer 5-based vulnerabilities
- Layer 6-based vulnerabilities
- Layer 7-based vulnerabilities
- Fuzzing tools
- Basic fuzzing
- Breaking usernames and passwords (brute-force attacks)
- Fuzzing network protocols
- Crash analysis - what to do when we find a bug
- Summary
- Questions
- Part 2: Network, Network Devices, and Traffic Analysis-Based Attacks
- Chapter 6: Finding Network-Based Attacks
- Planning a network-based attack
- Gathering information from the network
- Stealing information from the network
- Preventing users from using IT resources
- Active and passive attacks
- Active attacks
- Passive attacks
- Reconnaissance and information gathering
- Listening to network broadcasts
- Listening on a single device/port-mirror
- Network-based DoS/DDoS attacks and flooding
- Flooding through scanning attacks
- Random traffic generation flooding
- Generating and defending against flooding and DoS/DDoS attacks
- L2-based attacks
- MAC flooding
- STP, RSTP, and MST attacks
- L3- and ARP-based attacks
- ARP poisoning
- DHCP starvation
- Summary
- Questions
- Chapter 7: Detecting Device-Based Attacks
- Network devices' structure and components
- The functional structure of communications devices
- The physical structure of communications devices
- Attacks on the management plane and how to defend against them
- Brute-force attacks on console, Telnet, and SSH passwords
- Brute-force attacks against SNMP passwords (community strings)
- Brute-force attacks against HTTP/HTTPS passwords
- Attacks on other ports and services
- SYN-scan and attacks targeting the management plane processes' availability
- Attacks on the control plane and how to defend against them
- Control plane-related actions that influence device resources
- Attacks on the data plane and how to defend against them
- Protection against heavy traffic through an interface
- Attacks on system resources
- Memory-based attacks, memory leaks, and buffer overflows
- CPU overload and vulnerabilities
- Summary
- Questions
- Chapter 8: Network Traffic Analysis and Eavesdropping
- Packet analysis tools - Wireshark, TCPdump, and others
- Network analyzers
- Network packets
- Python/Pyshark for deep network analysis
- Advanced packet dissection with LUA
- ARP spoofing, session hijacking, and data hijacking tools, scripts, and techniques
- ARP protocol
- ARP poisoning
- Packet generation and replaying tools
- Summary
- Questions
- Chapter 9: Using Behavior Analysis and Anomaly Detection
- Collection and monitoring methods
- SNMP
- NetFlow and IPFIX
- Wireshark and network analysis tools
- Establishing a baseline
- Small business/home network
- Medium-size enterprise network
- Typical suspicious patterns
- Scanning patterns
- Summary
- Questions
- Part 3: Network Protocols - How to Attack and How to Protect
- Chapter 10: Discovering LAN, IP, and TCP/UDP-Based Attacks
- Layer 2 attacks - how to generate them and how to protect against them
- Attacks on the switching discovery mechanisms
- Attacks on a VLAN mechanism and VLAN flooding
- ICMP-based attacks, ping scans, the ping of death, and L3 DDoS
- Ping scans and L3 DDoS
- The ping of death and malformed packets
- IP fragmentation and teardrop attacks
- Layer 4 TCP and UDP attacks
- UDP flooding attacks
- SYN flooding and stealth scan attacks and countermeasures
- TCP RST (reset) and FIN attacks
- Various TCP flag combination attacks
- TCP sequence attacks and session hijacking attacks
- Summary
- Questions
- Chapter 11: Implementing Wireless Network Security
- Wireless standards, protocols, and encryption standards
- Wireless standards - IEEE 802.11
- Wireless lab setup
- Sniffing wireless networks
- Sniffing packets on the target AP
- Packet injection
- Discovering hidden SSIDs
- Compromising open authentication wireless networks
- WLAN encryptions and their corresponding flaws and attacks
- Network jamming - DOS/DDOS wireless network attacks
- Evil twin attack - honeypots
- Person-in-the-Middle (PITM) attacks
- Implementing a secure wireless architecture
- Summary
- Questions
- Chapter 12: Attacking Routing Protocols
- IGP standard protocols - the behaviors RIP (brief), OSPF, and IS-IS
- RIP protocol behavior
- OSPF protocol behavior
- IS-IS protocol behavior
- Dual IS-IS
- CLNP
- IS-IS levels
- Falsification, overclaiming, and disclaiming
- DDOS, mistreating, and attacks on the control plane
- Planes
- DOS and DDOS
- Reflection attacks
- Routing table poisoning and attacks on the management plane
- Traffic generation and attacks on the data plane
- Attacks on the data plane
- How to configure your routers to protect
- BGP - protocol and operation
- BGP hijacking
- BGP mitigation
- Summary
- Questions
- Chapter 13: DNS Security
- The DNS protocol, behavior, and data structure
- The DNS protocol
- DNS behavior and structure
- DNS attack discovery - tools and analysis
- DNS enumeration
- Vulnerability scanning
- Attacks on DNS resources - DNS flooding, NX records, and subdomains
- NX record attacks
- DNS flooding
- Attacks on a service - domain spoofing and hijacking, or cache poisoning
- Using DNS to bypass network controls - DNS tunneling
- DNS protection
- Summary
- Questions
- Chapter 14: Securing Web and Email Services
- HTTP and HTTP2 protocol behavior, data structure, and analysis
- HTTP behavior, data structure, and analysis
- Proxy servers
- HTTP request formation
- HTTP versions
- HTTPS protocol behavior, data structure, and analysis
- What is HTTPS?
- TTP hacking tools - scanners, vulnerability checkers, and others
- Web vulnerabilities and exploitation
- SQL injection
- Remote code execution
- Cross-Site Scripting (XSS)
- Buffer overflow
- Session hijacking
- Email protocols and loopholes
- SMTP protocol loopholes
- Phishing
- Countermeasures and defense
- Summary
- Questions
- Chapter 15: Enterprise Applications Security - Databases and Filesystems
- Microsoft network protocols - NetBIOS, SMB, and LDAP operations, vulnerabilities, and exploitation
- NetBIOS
- SMB operations, vulnerabilities, and exploitation
- LDAP operations, vulnerabilities, and exploitation
- Database network protocols - TDS and SQLNet operations
- TDS
- SQLNet
- Attacking SQL databases
- Enumeration of SQL servers in a domain
- Misconfiguration audit
- SQL server exploitation
- Countermeasures to protect network protocols and databases
- Summary
- Questions
- Chapter 16: IP Telephony and Collaboration Services Security
- IP telephony - protocols and operations
- VoIP
- SIP and its operations
- RTP and its operations
- IP telephony penetration testing lab setup
- IP telephony penetration testing methodology
- Enumeration
- IP telephony penetration testing
- IP telephony security and best practices
- Securing the IP telephony network
- Securing the IP telephony device
- Securing the media layer
- Securing the signaling layer
- Summary
- Questions
- Assessments
- Index
- Other Books You May Enjoy
Preface
This book talks about the in-depth analysis of network designs and protocols, the corresponding attacks made on them, and the appropriate security measures with a completely practical approach. The first few chapters will talk in depth about the network architectures and how are they designed or monitored. In later chapters, the corresponding attacks on network protocols (such as routing protocols and ARP), device-based attacks (such as on routers or switches), attacks on various technologies such as VOIP and email gateways, web-based attacks, CnC, and data ex-filtrations over network protocols (such as DNS) are demonstrated practically. At the end of each chapter, the steps to protect against such attacks are given.
Who this book is for
This book is written for network security professionals or network administrators, security analysts, system administrators, and quality assurance personnel who are planning to change their profession from network to security. We have kept the language of this book as simple as we can so that any reader can understand it in a much simpler way and can implement security in their environment. This book is also for those who have cleared the CCNA and CCNP certifications and now are planning to advance their career in network security.
What this book covers
Chapter 1, Data Centers and the Enterprise Network Architecture and its Components, provides a preview of the data network structure and its weaknesses, describing the hardware, software, and protocols involved in the network and their potential vulnerabilities. In the chapter, we will start with traditional enterprise data centers and enterprise networks, talk about connectivity to the cloud, and end with Software Defined Networks (SDNs), Network Function Virtualization (NFV), and potential breaches.
Chapter 2, Network Protocol Structures and Operations, introduces networking protocols, from Layer 2 up to application protocols, including the way each layer is structured, encapsulated, and, in some cases, tunneled. We will describe the networking protocols that work in and between the network components, understand their objectives and operation, and what the risks are when they are compromised.
Chapter 3, Security Protocols and Their Implementation, will teach us about encryption, authorization and authentication principles, protocols, and security components. We talk about the practical aspects of the protocols and which parts of the network can be used in order to establish a secure network.
Chapter 4, Using Network Security Tools, Scripts, and Codes, provides the practice for network security tools, Linux scripts, and programming skills for testing and securing communication networks. The chapter describes tool families, functionality, and recommendations of what to work with.
Chapter 5, Finding Protocol Vulnerabilities, details the tools and scripts for discovering protocol vulnerabilities, using data injection on network protocols, and trying to find bugs that will allow us to modify or hijack information. The tools and scripts provided here will be used in each one of the protocols in the following chapters.
Chapter 6, Finding Network-Based Attacks, talks about how networks can be tampered with and various types of network-based attacks and explains and provides examples for each type.
Chapter 7, Detecting Device-Based Attacks, explains attacks that can be performed on the hardware and software of network devices. The chapter talks about the structure of these devices and how they can be compromised.
Chapter 8, Network Traffic Analysis and Eavesdropping, covers how we can listen to the network, gather information through passive and active actions, perform man-in-the-middle operations to attract traffic in our direction, and decode the data at our disposal.
Chapter 9, Using Behavior Analysis and Anomaly Detection, explores how, due to the evolution of the IoT and industrial networks, behavior analysis is becoming common for threat analysis. This chapter talks about behavior analysis as a method of collecting data from network traffic and how to identify any threat patterns in this traffic. We also talk about methods, tools, and scripts that can be used to analyze this data.
Chapter 10, Discovering LAN, IP, and TCP/UDP-Based Attacks, talks about Layer-2- and 3-based attacks - that is, Ethernet LANs and ARP- and IP-based attacks and how to generate, identify, and protect against them. This chapter also talks about TCP and UDP client and server programs and their vulnerabilities, what the common attacks on them are, and how to generate, discover, and protect against them in the places they accrue.
Chapter 11, Implementing Wireless Network Security, describes wireless (as in, Wi-Fi) networks and protocols with an emphasis on security, providing the tools and methods for hacking and protecting them.
Chapter 12, Attacking Routing Protocols, talks about Interior Gateway routing protocols, including RIP, OSPF, and ISIS, how they work, what the threats and common attacks against them are, how to identify them, and how to configure our routers to protect against them.
Chapter 13, DNS Security, details the Domain Name Service (DNS) protocol, attacks against it, how it is used to break into users' networks, and how to discover these attacks and protect against them.
Chapter 14, Securing Web and Email Services, talks about HTTP and HTTPS, attacks against HTTP and HTTPS servers and services, and how to generate, discover, or protect against them. Another part of the chapter talks about web-based attacks such as SQLI, XSS, buffer overflows and email gateways, and exchange-related vulnerabilities.
Chapter 15, Enterprise Applications Security - Databases and Filesystems, explains how there are various applications in every enterprise network: databases, Active Directory servers and services, filesystems, file servers, and more. In this chapter, we will introduce these application behaviors, potential hacks, how to discover them, and how to protect against them
Chapter 16, IP Telephony and Collaboration Services Security, covers the fact that voice and video over IP, along with collaboration applications, have become a critical part of every organization. In this chapter, we explain the protocols involved, their vulnerabilities, how attacks are done, and how to defend against attacks and penetration attempts to these applications.
Download the color images
We also provide a PDF file that has color images of the screenshots and diagrams used in this book. You can download it here: https://packt.link/NzMIA.
Conventions used
There are a number of text conventions used throughout this book.
Code in text: Indicates code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles. Here is an example: "Mount the downloaded WebStorm-10*.dmg disk image file as another disk in your system."
A block of code is set as follows:
html, body, #map { height: 100%; margin: 0; padding: 0 }When we wish to draw your attention to a particular part of a code block, the relevant lines or items are set in bold:
[default] exten => s,1,Dial(Zap/1|30) exten => s,2,Voicemail(u100) exten => s,102,Voicemail(b100) exten => i,1,Voicemail(s0)Any command-line input or output is written as follows:
$ mkdir css
$ cd css
Bold: Indicates a new term, an important word, or words that you see onscreen. For instance, words in menus or dialog boxes appear in bold. Here is an example: "Select System info from the Administration panel."
Tips or important notes
Appear like this.
Get in touch
Feedback from our readers is always welcome.
General feedback: If you have questions about any aspect of this book, email us at customercare@packtpub.com and mention the book title in the subject of your message.
Errata: Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you have found a mistake in this book, we would be grateful if you would report this to us. Please visit www.packtpub.com/support/errata and fill in the form.
Piracy: If you come across any illegal copies of our works in any form on the internet, we would be grateful if you would provide us with the location address or website name. Please contact us at copyright@packt.com with a link to the material.
If you are interested in becoming an author: If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, please visit authors.packtpub.com.
Share your thoughts
Once you've read Network Protocols for Security Professionals, we'd love to hear your thoughts! Please click here to go straight to the...
System requirements
File format: ePUB
Copy protection: Adobe-DRM (Digital Rights Management)
System requirements:
- Computer (Windows; MacOS X; Linux): Install the free reader Adobe Digital Editions prior to download (see eBook Help).
- Tablet/smartphone (Android; iOS): Install the free app Adobe Digital Editions or the app PocketBook before downloading (see eBook Help).
- E-reader: Bookeen, Kobo, Pocketbook, Sony, Tolino and many more (not Kindle).
The file format ePub works well for novels and non-fiction books – i.e., „flowing” text without complex layout. On an e-reader or smartphone, line and page breaks automatically adjust to fit the small displays.
This eBook uses Adobe-DRM, a „hard” copy protection. If the necessary requirements are not met, unfortunately you will not be able to open the eBook. You will therefore need to prepare your reading hardware before downloading.
Please note: We strongly recommend that you authorise using your personal Adobe ID after installation of any reading software.
For more information, see our ebook Help page.
File format: ePUB
Copy protection: without DRM (Digital Rights Management)
System requirements:
- Computer (Windows; MacOS X; Linux): Use a reader that can handle the file format ePUB, such as Adobe Digital Editions or FBReader – both free (see eBook Help).
- Tablet/Smartphone (Android; iOS): Install the free app Adobe Digital Editions or the app PocketBook (see eBook Help).
- E-reader: Bookeen, Kobo, Pocketbook, Sony, Tolino and many more (not Kindle).
The file format ePUB works well for novels and non-fiction books – i.e., 'flowing' text without complex layout. On an e-reader or smartphone, line and page breaks automatically adjust to fit the small displays.
This eBook does not use copy protection or Digital Rights Management
For more information, see our eBook Help page.