Ya está disponible la segunda edición de Nmap: Network Exploration and Security Auditing Cookbook

Esta semana se ha publicado la esperada segunda edición de “Nmap: Network Exploration and Security Auditing Cookbook” de nuestro equipo. La primera edición fue publicada en el 2012 y usada por diferentes cursos de ethical hacking y seguridad informática en diferentes universidades en lugares desde Estados Unidos hasta Praga. ¡Inclusive se publicó la traducción en coreano!

En esta nueva edición, Paulino ha actualizado todas las tareas incluidas en la primera edición y agregado dos capítulos totalmente nuevos que cubren escaneos a equipos Microsoft Windows y sistemas ICS/SCADA. Además de eso, el libro está lleno de tips que seguro les servirán durante sus escaneos. Esta publicación es altamemente recomendada para cualquier persona en la industría de la seguridad informática y en especial, para todas las personas que quieran aprender todo sobre Nmap y las poderosas tareas que se pueden realizar con esta herramienta.

¿Dondé lo puedo adquirir?

Nmap: Network Exploration and Security Auditing Cookbook on Amazon

Nmap: Network Exploration and Security Auditing Cookbook on PacktPub

Contenido

La lista completa de capítulos y tareas es la siguiente:

Chapter 1: Nmap fundamentals

• Building Nmap’s source code
• Finding live hosts in your network
• Listing open ports on a target host
• Fingerprinting OS and services running on a target host
• Using NSE scripts against a target host
• Reading targets from a file
• Scanning IP address ranges
• Scanning random targets on the Internet
• Collecting signatures of web servers
• Monitoring servers remotely with Nmap and Ndiff
• Crafting ICMP Echo replies with Nping
• Managing multiple scanning profiles with Zenmap
• Running Lua scripts against a network connection with Ncat
• Discovering systems with weak passwords with Ncrack
• Launching Nmap scans remotely from a web browser with Rainmap Lite

Chapter 2: Network Exploration

• Discovering hosts with TCP SYN ping scans
• Discovering hosts with TCP ACK ping scans
• Discovering hosts with UDP ping scans
• Discovering hosts with SCTP INIT ping scans
• Discovering hosts with IP protocol ping scans
• Discovering hosts with ARP ping scans
• Performing advanced ping scans
• Discovering hosts with broadcast ping scans
• Scanning IPv6 addresses
• Gathering network information with broadcast scripts
• Scanning through proxies
• Spoofing the origin IP of a scan

Chapter 3: Reconnaissance Tasks

• Performing IP address geolocation
• Getting information from WHOIS records
• Obtaining traceroute geolocation information
• Querying Shodan to obtain target information
• Checking wheter a host is flagged by Google Safe Browsing for malicious activities
• Collecting valid email accounts and IP addresses from web servers
• Discovering hostnames pointing to the same IP address
• Discovering hostnames by brute forcing DNS records
• Obtaining profile information from Google’s People API
• Matching services with public vulnerability advisories

Chapter 4: Scanning web servers

• Listing supported HTTP methods
• Checking whether a web server is an open proxy
• Discovering interesting files and folders in web servers
• Abusing mod_userdir to enumerate user accounts
• Brute forcing HTTP authentication
• Brute forcing web applications
• Detecting web application firewalls
• Detecting possible XST vulnerabilities
• Detecting XSS vulnerabilities
• Finding SQL injection vulnerabilities
• Detecting web servers vulnerable to slowloris denial of service
• Finding web applications with default credentials
• Detecting web applications vulnerable to Shellshock
• Detecting insecure cross-domain policies
• Detecting exposed source code control systems
• Auditing the strength of cipher suites in SSL servers
• Scrapping email accounts from web servers

Chapter 5: Scanning databases

• Listing MySQL databases
• Listing MySQL users
• Listing MySQL variables
• Brute forcing MySQL passwords
• Finding root accounts with an empty password in MySQL servers
• Detecting insecure configurations in MySQL servers
• Brute forcing Oracle passwords
• Brute forcing Oracle SID names
• Retrieving information from MS SQL servers
• Brute forcing MS SQL passwords
• Dumping password hashes of MS SQL servers
• Running commands through xp_cmdshell in MS SQL servers
• Finding system administrator accounts with empty passwords in MS SQL servers
• Obtaining information from MS SQL servers with NTLM enabled
• Retrieving MongoDB server information
• Detecting MongoDB instances with no authentication enabled
• Listing MongoDB databases
• Listing CouchDB databases
• Retrieving CouchDB database statistics
• Detecting Cassandra databases with no authentication enabled
• Brute forcing Redis passwords

Chapter 6: Scanning Mail Servers

• Detecting SMTP open relays
• Brute forcing SMTP passwords
• Detecting suspicious SMTP servers
• Enumerating SMTP usernames
• Brute forcing IMAP passwords
• Retrieving the capabilities of an IMAP server
• Brute forcing POP3 passwords
• Retrieving the capabilities of a POP3 server
• Retrieving information from SMTP servers with NTLM authentication

Chapter 7: Scanning Windows systems

• Obtaining system information from SMB
• Detecting Windows clients with SMB signing disabled
• Detecting IIS web servers that disclose Windows 8.3 names
• Detecting Windows hosts vulnerable to MS08-067
• Retrieving the NetBIOS name and MAC address of a host
• Enumerating users accounts of Windows hosts
• Enumerating shared folders
• Enumerating SMB sessions
• Finding domain controllers
• Detecting Shadow Broker’s DOUBLEPULSAR SMB implants

Chapter 8: Scanning ICS/SCADA systems

• Finding common ports used in ICS SCADA systems
• Finding HMI systems
• Enumerating Siemens SIMATIC S7 PLCs
• Enumerating Modbus devices
• Enumerating BACnet devices
• Enumerating Ethernet/IP devices
• Enumerating Niagara Fox devices
• Enumerating ProConOS devices
• Enumerating Omron PLC devices
• Enumerating PCWorx devices

Chapter 9: Optimizing scans

• Skipping phases to speed up scans
• Selecting the correct timing template
• Adjusting timing parameters
• Adjusting performance parameters
• Distributing a scan among several clients using Dnmap

Chapter 10: Generating Scan Reports

• Saving scan results in a normal format
• Saving scan results in XML format
• Saving scan results to a SQLite database
• Saving scan results in grepable format
• Generating a network topology graph with Zenmap
• Generating HTML reports
• Reporting vulnerability checks
• Generating PDF reports with fop
• Saving NSE reports in ElasticSearch

Chapter 11: Writing your own NSE scripts

• Making HTTP requests to identify vulnerable Supermicro IPMI/BMC devices
• Sending UDP payloads using NSE sockets
• Generating vulnerability reports in NSE scripts
• Exploiting path traversal vulnerabilities with NSE
• Write brute force password auditing scripts
• Crawling web servers to detect vulnerabilities
• Working with NSE threads, condition variables, and mutexes in NSE
• Writing a new NSE library in Lua
• Writing a new NSE library in C/C++
• Getting your scripts ready for submission

Appendix A: HTTP, pipelining and web crawling

Appendix B: Brute force password auditing options

Appendix C: NSE debugging

Appendix D: Additional output options

Appendix E: Introduction to Lua

Appendix F: References and additional readings.