Network Protocols for Security Professionals : Probe and Identify Network-Based Vulnerabilities and Safeguard Against Network Protocol Breaches

Network Protocols for Security Professionals Probe and Identify Network-Based Vulnerabilities and Safeguard Against Network Protocol Breaches

Get to grips with network-based attacks and learn to defend your organization's network and network devices Key Features Exploit vulnerabilities and use custom modules and scripts to crack authentication protocols Safeguard against web, mail, database, DNS, voice, video, and collaboration serve...

Descripción completa

Detalles Bibliográficos
Autor principal: Orzach, Yoram (-)
Otros Autores: Khanna, Deepanshu
Formato: Libro electrónico
Idioma:Inglés
Publicado: Birmingham : Packt Publishing, Limited 2022.
Edición:1st ed
Materias:
Computer networks > Security measures.
Computer network protocols.
Ver en Biblioteca Universitat Ramon Llull:https://discovery.url.edu/permalink/34CSUC_URL/1im36ta/alma991009701334206719
Tabla de Contenidos:
  • Cover
  • Title Page
  • Copyright and credits
  • Contributors
  • About the reviewers
  • Table of Contents
  • Preface
  • Part 1: Protecting the Network - Technologies, Protocols, Vulnerabilities, and Tools
  • Chapter 1: Data Centers and the Enterprise Network Architecture and its Components
  • Exploring networks and data flows
  • The data center, core, and user networks
  • Switching (L2) and routing (L3) topologies
  • Switching (L2) and routing (L3)
  • L2 and L3 architectures
  • L2 and L3 architecture data flow
  • L2 and L3 architecture data flow with redundancy
  • L2 and L3 topologies with firewalls
  • L2 and L3 topologies with overlays
  • The network perimeter
  • The data, control, and management planes
  • The data plane
  • The control plane
  • The management plane
  • SDN and NFV
  • Software-defined networking (SDN)
  • Network function virtualization (NFV)
  • Cloud connectivity
  • Type of attacks and where they are implemented
  • Attacks on the internet
  • Attacks from the internet targeting organizational networks
  • Attacks on firewalls
  • Attacks on servers
  • Attacks on local area networks (LANs)
  • Attacks on network routers and routing protocols
  • Attacks on wireless networks
  • Summary
  • Questions
  • Chapter 2: Network Protocol Structures and Operations
  • Data network protocols and data structures
  • Layer 2 protocols - STP, VLANs, and security methods
  • The Ethernet protocols
  • LAN switching
  • VLANs and VLAN tagging
  • Spanning tree protocols
  • Layer 3 protocols - IP and ARP
  • Routers and routing protocols
  • Routing operations
  • Routing protocols
  • Layer 4 protocols - UDP, TCP, and QUIC
  • UDP
  • TCP
  • QUIC
  • Vulnerabilities in layer 4 protocols
  • Encapsulation and tunneling
  • Summary
  • Questions
  • Chapter 3: Security Protocols and Their Implementation
  • Security pillars - confidentiality, integrity, and availability.
  • Encryption basics and protocols
  • Services provided by encryption
  • Stream versus block ciphers
  • Symmetric versus asymmetric encryption
  • Public key infrastructure and certificate authorities
  • Authentication basics and protocols
  • Authentication types
  • Username/password with IP address identification authentication
  • Encrypted username/password authentication
  • Extensible authentication protocol (EAP)
  • Authorization and access protocols
  • Hash functions and message digests
  • IPSec and key management protocols
  • VPNs
  • IPSec principles of operation
  • IPSec tunnel establishment
  • IPSec modes of operation
  • IPSec authentication and encryption protocols
  • IPSec AH protocol
  • IPSec ESP protocol
  • SSL/TLS and proxies
  • Protocol basics
  • The handshake protocol
  • Network security components - RADIUS/TACACS+, FWs, IDS/IPSs, NAC, and WAFs
  • Firewalls
  • RADIUS, NAC, and other authentication features
  • Web application firewalls (WAFs)
  • Summary
  • Questions
  • Chapter 4: Using Network Security Tools, Scripts, and Code
  • Commercial, open source, and Linux-based tools
  • Open source tools
  • Commercial tools
  • Information gathering and packet analysis tools
  • Basic network scanners
  • Network analysis and management tools
  • Protocol discovery tools
  • Vulnerability analysis tools
  • Nikto
  • Legion
  • Exploitation tools
  • The Metasploit Framework (MSF)
  • Stress testing tools
  • Windows tools
  • Kali Linux tools
  • Network forensics tools
  • Wireshark and packet capture tools
  • Summary
  • Questions
  • Chapter 5: Finding Protocol Vulnerabilities
  • Black box, white box, and gray box testing
  • Black box and fuzzing
  • Enterprise networks testing
  • Provider networks testing
  • Fuzzing phases
  • Common vulnerabilities
  • Layer 2-based vulnerabilities
  • Layer 3-based vulnerabilities
  • Layer 4-based vulnerabilities.
  • Layer 5-based vulnerabilities
  • Layer 6-based vulnerabilities
  • Layer 7-based vulnerabilities
  • Fuzzing tools
  • Basic fuzzing
  • Breaking usernames and passwords (brute-force attacks)
  • Fuzzing network protocols
  • Crash analysis - what to do when we find a bug
  • Summary
  • Questions
  • Part 2: Network, Network Devices, and Traffic Analysis-Based Attacks
  • Chapter 6: Finding Network-Based Attacks
  • Planning a network-based attack
  • Gathering information from the network
  • Stealing information from the network
  • Preventing users from using IT resources
  • Active and passive attacks
  • Active attacks
  • Passive attacks
  • Reconnaissance and information gathering
  • Listening to network broadcasts
  • Listening on a single device/port-mirror
  • Network-based DoS/DDoS attacks and flooding
  • Flooding through scanning attacks
  • Random traffic generation flooding
  • Generating and defending against flooding and DoS/DDoS attacks
  • L2-based attacks
  • MAC flooding
  • STP, RSTP, and MST attacks
  • L3- and ARP-based attacks
  • ARP poisoning
  • DHCP starvation
  • Summary
  • Questions
  • Chapter 7: Detecting Device-Based Attacks
  • Network devices' structure and components
  • The functional structure of communications devices
  • The physical structure of communications devices
  • Attacks on the management plane and how to defend against them
  • Brute-force attacks on console, Telnet, and SSH passwords
  • Brute-force attacks against SNMP passwords (community strings)
  • Brute-force attacks against HTTP/HTTPS passwords
  • Attacks on other ports and services
  • SYN-scan and attacks targeting the management plane processes' availability
  • Attacks on the control plane and how to defend against them
  • Control plane-related actions that influence device resources
  • Attacks on the data plane and how to defend against them.
  • Protection against heavy traffic through an interface
  • Attacks on system resources
  • Memory-based attacks, memory leaks, and buffer overflows
  • CPU overload and vulnerabilities
  • Summary
  • Questions
  • Chapter 8: Network Traffic Analysis and Eavesdropping
  • Packet analysis tools - Wireshark, TCPdump, and others
  • Network analyzers
  • Network packets
  • Python/Pyshark for deep network analysis
  • Advanced packet dissection with LUA
  • ARP spoofing, session hijacking, and data hijacking tools, scripts, and techniques
  • ARP protocol
  • ARP poisoning
  • Packet generation and replaying tools
  • Summary
  • Questions
  • Chapter 9: Using Behavior Analysis and Anomaly Detection
  • Collection and monitoring methods
  • SNMP
  • NetFlow and IPFIX
  • Wireshark and network analysis tools
  • Establishing a baseline
  • Small business/home network
  • Medium-size enterprise network
  • Typical suspicious patterns
  • Scanning patterns
  • Summary
  • Questions
  • Part 3: Network Protocols - How to Attack and How to Protect
  • Chapter 10: Discovering LAN, IP, and TCP/UDP-Based Attacks
  • Layer 2 attacks - how to generate them and how to protect against them
  • Attacks on the switching discovery mechanisms
  • Attacks on a VLAN mechanism and VLAN flooding
  • ICMP-based attacks, ping scans, the ping of death, and L3 DDoS
  • Ping scans and L3 DDoS
  • The ping of death and malformed packets
  • IP fragmentation and teardrop attacks
  • Layer 4 TCP and UDP attacks
  • UDP flooding attacks
  • SYN flooding and stealth scan attacks and countermeasures
  • TCP RST (reset) and FIN attacks
  • Various TCP flag combination attacks
  • TCP sequence attacks and session hijacking attacks
  • Summary
  • Questions
  • Chapter 11: Implementing Wireless Network Security
  • Wireless standards, protocols, and encryption standards
  • Wireless standards - IEEE 802.11
  • Wireless lab setup.
  • Sniffing wireless networks
  • Sniffing packets on the target AP
  • Packet injection
  • Discovering hidden SSIDs
  • Compromising open authentication wireless networks
  • WLAN encryptions and their corresponding flaws and attacks
  • Network jamming - DOS/DDOS wireless network attacks
  • Evil twin attack - honeypots
  • Person-in-the-Middle (PITM) attacks
  • Implementing a secure wireless architecture
  • Summary
  • Questions
  • Chapter 12: Attacking Routing Protocols
  • IGP standard protocols - the behaviors RIP (brief), OSPF, and IS-IS
  • RIP protocol behavior
  • OSPF protocol behavior
  • IS-IS protocol behavior
  • Dual IS-IS
  • CLNP
  • IS-IS levels
  • Falsification, overclaiming, and disclaiming
  • DDOS, mistreating, and attacks on the control plane
  • Planes
  • DOS and DDOS
  • Reflection attacks
  • Routing table poisoning and attacks on the management plane
  • Traffic generation and attacks on the data plane
  • Attacks on the data plane
  • How to configure your routers to protect
  • BGP - protocol and operation
  • BGP hijacking
  • BGP mitigation
  • Summary
  • Questions
  • Chapter 13: DNS Security
  • The DNS protocol, behavior, and data structure
  • The DNS protocol
  • DNS behavior and structure
  • DNS attack discovery - tools and analysis
  • DNS enumeration
  • Vulnerability scanning
  • Attacks on DNS resources - DNS flooding, NX records, and subdomains
  • NX record attacks
  • DNS flooding
  • Attacks on a service - domain spoofing and hijacking, or cache poisoning
  • Using DNS to bypass network controls - DNS tunneling
  • DNS protection
  • Summary
  • Questions
  • Chapter 14: Securing Web and Email Services
  • HTTP and HTTP2 protocol behavior, data structure, and analysis
  • HTTP behavior, data structure, and analysis
  • Proxy servers
  • HTTP request formation
  • HTTP versions
  • HTTPS protocol behavior, data structure, and analysis
  • What is HTTPS?.
  • TTP hacking tools - scanners, vulnerability checkers, and others.

Ejemplares similares