CEH v12 Certified Ethical Hacker Study Guide with 750 Practice Test Questions

ABOUT THE AUTHOR RIC MESSIER, CEH, GCIH, GSEC, CISSP, CCSP, is a consultant, educator, and author of numerous books on information security and digital forensics. With decades of experience in information technology and information security, Ric has held the varied roles of programmer, system administrator, network engineer, security engineering manager, VoIP engineer, consultant, and professor and he is currently a Principal Consultant with Mandiant.

• Introduction xviiAssessment Test xxvChapter 1 Ethical Hacking 1Overview of Ethics 2Overview of Ethical Hacking 5Attack Modeling 6Cyber Kill Chain 7Attack Lifecycle 8MITRE ATT&CK Framework 10Methodology of Ethical Hacking 12Reconnaissance and Footprinting 12Scanning and Enumeration 12Gaining Access 13Maintaining Access 14Covering Tracks 14Summary 15Chapter 2 Networking Foundations 17Communications Models 19Open Systems Interconnection 20TCP/IP Architecture 23Topologies 24Bus Network 24Star Network 25Ring Network 26Mesh Network 27Hybrid 28Physical Networking 29Addressing 29Switching 30IP 31Headers 32Addressing 34Subnets 35TCP 37UDP 40Internet Control Message Protocol 41Network Architectures 42Network Types 43Isolation 44Remote Access 45Cloud Computing 46Storage as a Service 47Infrastructure as a Service 48Platform as a Service 49Software as a Service 51Internet of Things 53Summary 54Review Questions 56Chapter 3 Security Foundations 59The Triad 61Confidentiality 61Integrity 63Availability 64Parkerian Hexad 65Information Assurance and Risk 66Policies, Standards, and Procedures 69Security Policies 69Security Standards 70Procedures 71Guidelines 72Organizing Your Protections 72Security Technology 75Firewalls 76Intrusion Detection Systems 80Intrusion Prevention Systems 83Endpoint Detection and Response 84Security Information and Event Management 86Being Prepared 87Defense in Depth 87Defense in Breadth 89Defensible Network Architecture 90Logging 91Auditing 93Summary 95Review Questions 96Chapter 4 Footprinting and Reconnaissance 101Open Source Intelligence 103Companies 103People 112Social Networking 115Domain Name System 129Name Lookups 130Zone Transfers 136Passive DNS 138Passive Reconnaissance 142Website Intelligence 145Technology Intelligence 150Google Hacking 150Internet of Things (IoT) 152Summary 154Review Questions 157Chapter 5 Scanning Networks 161Ping Sweeps 163Using fping 163Using MegaPing 165Port Scanning 167nmap 168masscan 184MegaPing 186Metasploit 188Vulnerability Scanning 190OpenVAS 192Nessus 203Looking for Vulnerabilities with Metasploit 209Packet Crafting and Manipulation 210hping 211packETH 214fragroute 217Evasion Techniques 218Evasion with nmap 221Protecting and Detecting 223Summary 224Review Questions 226Chapter 6 Enumeration 231Service Enumeration 233Countermeasures 236Remote Procedure Calls 236SunRPC 237Remote Method Invocation 239Server Message Block 242Built- in Utilities 243nmap Scripts 247NetBIOS Enumerator 249Metasploit 250Other Utilities 254Countermeasures 257Simple Network Management Protocol 258Countermeasures 259Simple Mail Transfer Protocol 260Countermeasures 263Web- Based Enumeration 264Countermeasures 271Summary 272Review Questions 274Chapter 7 System Hacking 279Searching for Exploits 281System Compromise 285Metasploit Modules 286Exploit- DB 290Gathering Passwords 292Password Cracking 295John the Ripper 296Rainbow Tables 298Kerberoasting 300Client- Side Vulnerabilities 305Living Off the Land 307Fuzzing 308Post Exploitation 313Evasion 313Privilege Escalation 314Pivoting 319Persistence 322Covering Tracks 326Summary 332Review Questions 334Chapter 8 Malware 339Malware Types 341Virus 341Worm 342Trojan 344Botnet 344Ransomware 345Dropper 347Fileless Malware 348Polymorphic Malware 348Malware Analysis 349Static Analysis 350Dynamic Analysis 361Automated Malware Analysis 370Creating Malware 371Writing Your Own 372Using Metasploit 375Obfuscating 381Malware Infrastructure 382Antivirus Solutions 384Persistence 385Summary 386Review Questions 388Chapter 9 Sniffing 393Packet Capture 394tcpdump 395tshark 401Wireshark 403Berkeley Packet Filter 408Port Mirroring/Spanning 410Detecting Sniffers 410Packet Analysis 412Spoofing Attacks 417ARP Spoofing 418DNS Spoofing 422DHCP Starvation Attack 424sslstrip 425Spoofing Detection 426Summary 428Review Questions 430Chapter 10 Social Engineering 435Social Engineering 436Pretexting 438Social Engineering Vectors 440Identity Theft 441Physical Social Engineering 442Badge Access 442Man Traps 444Biometrics 445Phone Calls 446Baiting 447Tailgating 448Phishing Attacks 448Contact Spamming 452Quid Pro Quo 452Social Engineering for Social Networking 453Website Attacks 454Cloning 454Rogue Attacks 457Wireless Social Engineering 458Automating Social Engineering 461Summary 464Review Questions 466Chapter 11 Wireless Security 471Wi- Fi 472Wi- Fi Network Types 474Wi- Fi Authentication 477Wi- Fi Encryption 478Bring Your Own Device 483Wi- Fi Attacks 484Bluetooth 495Scanning 496Bluejacking 498Bluesnarfing 498Bluebugging 498Bluedump 499Bluesmack 499Mobile Devices 499Mobile Device Attacks 500Summary 504Review Questions 506Chapter 12 Attack and Defense 511Web Application Attacks 512OWASP Top 10 Vulnerabilities 514Web Application Protections 524Denial- of- Service Attacks 526Bandwidth Attacks 527Slow Attacks 529Legacy 531Application Exploitation 531Buffer Overflow 532Heap Spraying 534Application Protections and Evasions 535Lateral Movement 536Defense in Depth/Defense in Breadth 538Defensible Network Architecture 540Summary 542Review Questions 544Chapter 13 Cryptography 549Basic Encryption 551Substitution Ciphers 551Diffie–Hellman 553Symmetric Key Cryptography 555Data Encryption Standard 555Advanced Encryption Standard 556Asymmetric Key Cryptography 558Hybrid Cryptosystem 559Nonrepudiation 559Elliptic Curve Cryptography 560Certificate Authorities and Key Management 562Certificate Authority 562Trusted Third Party 565Self- Signed Certificates 566Cryptographic Hashing 569PGP and S/MIME 571Disk and File Encryption 572Summary 576Review Questions 578Chapter 14 Security Architecture and Design 581Data Classification 582Security Models 584State Machine 584Biba 585Bell–LaPadula 586Clark–Wilson Integrity Model 586Application Architecture 587n- tier Application Design 588Service- Oriented Architecture 591Cloud- Based Applications 593Database Considerations 595Security Architecture 598Zero- Trust Model 602Summary 604Review Questions 606Chapter 15 Cloud Computing and the Internet of Things 611Cloud Computing Overview 612Cloud Services 616Shared Responsibility Model 621Public vs. Private Cloud 623Grid Computing 624Cloud Architectures and Deployment 625Responsive Design 629Cloud- Native Design 629Deployment 631Dealing with REST 633Common Cloud Threats 639Access Management 639Data Breach 641Web Application Compromise 642Credential Compromise 643Insider Threat 645Internet of Things 646Fog Computing 651Operational Technology 652The Purdue Model 654Summary 655Review Questions 657Appendix Answers to Review Questions 661Chapter 2: Networking Foundations 662Chapter 3: Security Foundations 663Chapter 4: Footprinting and Reconnaissance 666Chapter 5: Scanning Networks 669Chapter 6: Enumeration 672Chapter 7: System Hacking 675Chapter 8: Malware 678Chapter 9: Sniffing 681Chapter 10: Social Engineering 683Chapter 11: Wireless Security 686Chapter 12: Attack and Defense 688Chapter 13: Cryptography 691Chapter 14: Security Architecture and Design 693Chapter 15: Cloud Computing and the Internet of Things 695Index 699