Hacking: The Next Generation P1

To successfully execute an attack against an organization, the attacker must first performreconnaissance to gather as much intelligence about the organization as possible.Many traditional methods for gaining intelligence about targets still work today, suchas dumpster diving, querying public databases, and querying search engines. However,new methods that rely on gathering information from technologies such as social networkingapplications are becoming more commonplace. In this chapter, we will discussthe traditional methods as well as how the new generation of attackers is able to abusenew technologies to gather information....
Nội dung trích xuất từ tài liệu:
Hacking: The Next Generation P1Download at WoWeBook.ComHacking: The Next Generation Download at WoWeBook.ComDownload at WoWeBook.ComHacking: The Next Generation Nitesh Dhanjani, Billy Rios, and Brett Hardin Beijing • Cambridge • Farnham • Köln • Sebastopol • Taipei • Tokyo Download at WoWeBook.ComHacking: The Next Generationby Nitesh Dhanjani, Billy Rios, and Brett HardinCopyright © 2009 Nitesh Dhanjani. All rights reserved.Printed in the United States of America.Published by O’Reilly Media, Inc., 1005 Gravenstein Highway North, Sebastopol, CA 95472.O’Reilly books may be purchased for educational, business, or sales promotional use. Online editionsare also available for most titles (http://my.safaribooksonline.com). For more information, contact ourcorporate/institutional sales department: (800) 998-9938 or corporate@oreilly.com.Editor: Mike Loukides Indexer: Seth MaislinProduction Editor: Loranah Dimant Cover Designer: Karen MontgomeryCopyeditor: Audrey Doyle Interior Designer: David FutatoProofreader: Sada Preisch Illustrator: Robert RomanoPrinting History: September 2009: First Edition.Nutshell Handbook, the Nutshell Handbook logo, and the O’Reilly logo are registered trademarks ofO’Reilly Media, Inc. Hacking: The Next Generation, the image of a pirate ship on the cover, and relatedtrade dress are trademarks of O’Reilly Media, Inc.Many of the designations used by manufacturers and sellers to distinguish their products are claimed astrademarks. Where those designations appear in this book, and O’Reilly Media, Inc. was aware of atrademark claim, the designations have been printed in caps or initial caps.While every precaution has been taken in the preparation of this book, the publisher and authors assumeno responsibility for errors or omissions, or for damages resulting from the use of the information con-tained herein. TM This book uses RepKover™, a durable and flexible lay-flat binding.ISBN: 978-0-596-15457-8[M]1251474150 Download at WoWeBook.Com Table of ContentsPreface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix 1. Intelligence Gathering: Peering Through the Windows to Your Organization . . . . . . 1 Physical Security Engineering 1 Dumpster Diving 2 Hanging Out at the Corporate Campus 3 Google Earth 5 Social Engineering Call Centers 6 Search Engine Hacking 7 Google Hacking 7 Automating Google Hacking 8 Extracting Metadata from Online Documents 9 Searching for Source Code 11 Leveraging Social Networks 12 Facebook and MySpace 13 Twitter 15 Tracking Employees 16 Email Harvesting with theHarvester 16 Resumés 18 Job Postings 19 Google Calendar 21 What Information Is Important? 22 Summary 23 2. Inside-Out Attacks: The Attacker Is the Insider . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Man on the Inside 26 Cross-Site Scripting (XSS) 26 Stealing Sessions ...