Table of Contents
Detecting Malice: Preface ... 13
User Disposition ... 14
Deducing Without Knowing ... 15
Book Overview ... 16
Who Should Read This Book? ... 16
Why Now? ... 16
A Note on Style ... 17
Working Without a Silver Bullet... 17
Special Thanks ... 18
Chapter 1 - DNS and TCP: The Foundations of Application Security .......................................................... 19
In the Beginning Was DNS ... 20
Same-Origin Policy and DNS Rebinding .............................................................................................. 22
DNS Zone Transfers and Updates ... 29
DNS Enumeration ... 30
TCP/IP ... 31
Spoofing and the Three-Way Handshake ........................................................................................... 31
Passive OS Fingerprinting with pOf ... 33
TCP Timing Analysis... 33
Network DoS and DDoS Attacks... 34
Attacks Against DNS ... 34
TCP DoS ... 35
Low Bandwidth DoS ... 36
Using DoS As Self-Defense ... 37
Motives for DoS Attacks ... 37
DoS Conspiracies ... 38
Port Scanning ... 39
With That Out of the Way... ... 42
Chapter 2 - IP Address Forensics... 43
What Can an IP Address Tell You? ... 44
Reverse DNS Resolution ... 44
3
WHOIS Database ... 45
Geolocation ... 46
Real-Time Block Lists and IP Address Reputation ............................................................................... 48
Related IP Addresses ... 49
When IP Address Is A Server ... 50
Web Servers as Clients ... 50
Dealing with Virtual Hosts... 51
Proxies and Their Impact on IP Address Forensics ................................................................................. 53
Network-Level Proxies ... 53
HTTP Proxies ... 54
AOL Proxies ... 55
Anonymization Services ... 56
Tor Onion Routing ... 57
Obscure Ways to Hide IP Address ... 59
IP Address Forensics ... 60
To Block or Not? ... 61
Chapter 3 - Time... 64
Traffic Patterns... 65
Event Correlation ... 68
Daylight Savings ... 69
Forensics and Time Synchronization... 71
Humans and Physical Limitations ... 72
Gold Farming ... 73
CAPTCHA Breaking ... 74
Holidays and Prime Time ... 77
Risk Mitigation Using Time Locks ... 78
The Future is a Fog ... 78
Chapter 4 - Request Methods and HTTP Protocols .................................................................................... 80
Request Methods ... 81
GET ... 81
POST ... 81
PUT and DELETE ... 83
4
OPTIONS ... 84
CONNECT... 85
HEAD ... 86
TRACE ... 87
Invalid Request Methods ... 88
Random Binary Request Methods ... 88
Lowercase Method Names ... 88
Extraneous White Space on the Request Line .................................................................................... 89
HTTP Protocols ... 90
Missing Protocol Information ... 90
HTTP 1.0 vs. HTTP 1.1... 90
Invalid Protocols and Version Numbers.............................................................................................. 91
Newlines and Carriage Returns ... 91
Summary ... 95
Chapter 5 - Referring URL ... 96
Referer Header... 97
Information Leakage through Referer ... 98
Disclosing Too Much ... 98
Spot the Phony Referring URL... 99
Third-Party Content Referring URL Disclosure.................................................................................... 99
What Lurks in Your Logs ... 101
Referer and Search Engines ... 102
Language, Location, and the Politics That Comes With It................................................................. 102
Google Dorks ... 103
Natural Search Strings... 105
Vanity Search ... 105
Black Hat Search Engine Marketing and Optimization ......................................................................... 106
Referring URL Availability ... 107
Direct Page Access ... 107
Meta Refresh... 108
Links from SSL/TLS Sites ... 108
Links from Local Pages ... 108
5
Users’ Privacy Concerns ... 109
Determining Why Referer Isn’t There ............................................................................................... 110
Referer Reliability... 110
Redirection ... 110
Impact of Cross-Site Request Forgery ............................................................................................... 111
Is the Referring URL a Fake? ... 113
Referral Spam... 115
Last thoughts... 116
Chapter 6 - Request URL ... 117
What Does A Typical HTTP Request Look Like? .................................................................................... 118
Watching For Things That Don’t Belong ............................................................................................... 119
Domain Name in the Request Field .................................................................................................. 119
Proxy Access Attempts ... 119
Anchor Identifiers ... 120
Common Request URL Attacks ... 120
Remote File Inclusion ... 120
SQL Injection ... 121
HTTP Response Splitting ... 123
NUL Byte Injection ... 125
Pipes and System Command Execution ............................................................................................ 126
Cross-Site Scripting ... 126
Web Server Fingerprinting ... 127
Invalid URL Encoding ... 127
Well-Known Server Files ... 128
Easter Eggs ... 128
Admin Directories ... 128
Automated Application Discovery ... 129
Well-Known Files... 130
Crossdomain.xml... 130
Robots.txt ... 130
Google Sitemaps ... 131
Summary ... 131
6
Chapter 7 - User-Agent Identification ... 132
What is in a User-Agent Header?... 133
Malware and Plugin Indicators ... 134
Software Versions and Patch Levels ................................................................................................. 136
User-Agent Spoofing ... 136
Cross Checking User-Agent against Other Headers .......................................................................... 137
User-Agent Spam ... 138
Indirect Access Services ... 140
Google Translate ... 140
Traces of Application Security Tools ................................................................................................. 140
Common User-Agent Attacks... 141
Search Engine Impersonation ... 144
Summary ... 148
Chapter 8 - Request Header Anomalies ... 149
Hostname ... 150
Requests Missing Host Header ... 150
Mixed-Case Hostnames in Host and Referring URL Headers ............................................................ 151
Cookies ... 152
Cookie Abuse... 153
Cookie Fingerprinting ... 153
Cross Site Cooking ... 154
Assorted Request Header Anomalies ................................................................................................... 155
Expect Header XSS ... 155
Headers Sent by Application Vulnerability Scanners ........................................................................ 156
Cache Control Headers ... 157
Accept CSRF Deterrent ... 158
Language and Character Set Headers ............................................................................................... 160
Dash Dash Dash... 162
From Robot Identification ... 163
Content-Type Mistakes ... 164
Common Mobile Phone Request Headers ........................................................................................ 165
X-Moz Prefetching... 166
7
Summary ... 167
Chapter 9 - Embedded Content ... 169
Embedded Styles... 170
Detecting Robots... 170
Detecting CSRF Attacks ... 171
Embedded javascript ... 173
Embedded Objects ... 175
Request Order ... 176
Cookie Stuffing ... 177
Impact of Content Delivery Networks on Security ............................................................................... 178
Asset File Name Versioning... 179
Summary ... 180
Chapter 10 - Attacks Against Site Functionality ........................................................................................ 181
Attacks Against Sign-In... 182
Brute-Force Attacks Against Sign-In.................................................................................................. 182
Phishing Attacks ... 184
Registration ... 184
Username Choice ... 185
Brute Force Attacks Against Registration ......................................................................................... 186
Account Pharming ... 187
What to Learn from the Registration Data ....................................................................................... 187
Fun With Passwords... 189
Forgot Password ... 189
Password DoS Attacks ... 190
Don’t Show Anyone Their Passwords ............................................................................................... 192
User to User Communication... 192
Summary ... 192
Chapter 11 - History ... 193
Our Past... 194
History Repeats Itself ... 194
Cookies ... 194
javascript Database ... 195
8
Internet Explorer Persistence ... 196
Flash Cookies... 197
CSS History ... 199
Refresh ... 201
Same Page, Same IP, Different Headers ............................................................................................... 202
Cache and Translation Services... 203
Uniqueness... 204
DNS Pinning Part Two ... 206
Biometrics ... 206
Breakout Fraud ... 209
Summary ... 210
Chapter 12 - Denial of Service... 211
What Are Denial Of Service Attacks? ... 212
Distributed DoS Attacks ... 212
My First Denial of Service Lesson... 213
Request Flooding ... 216
Identifying Reaction Strategies ... 216
Database DoS ... 217
Targeting Search Facilities... 217
Unusual DoS Vectors ... 218
Banner Advertising DoS ... 218
Chargeback DoS ... 220
The Great Firewall of China... 221
Email Blacklisting... 222
Dealing With Denial Of Service Attacks ................................................................................................ 223
Detection... 224
Mitigation... 224
Summary ... 225
Chapter 13 - Rate of Movement ... 226
Rates ... 227
Timing Differences ... 227
CAPTCHAs... 228
9
Click Fraud ... 234
Warhol or Flash Worm ... 237
Samy Worm... 237
Inverse Waterfall... 239
Pornography Duration ... 243
Repetition... 243
Scrapers... 243
Spiderweb ... 246
Summary ... 248
Chapter 14 - Ports, Services, APIs, Protocols and 3rd Parties .................................................................... 250
Ports, Services, APIs, Protocols, 3rd Parties, oh my... ............................................................................ 251
SSL and Man in the middle Attacks... 251
Performance ... 253
SSL/TLS Abuse ... 253
FTP... 254
Webmail Compromise ... 255
Third Party APIs and Web Services ... 256
2nd Factor Authentication and Federation ............................................................................................ 256
Other Ports and Services... 257
Summary ... 258
Chapter 15 - Browser Sniffing ... 259
Browser Detection ... 260
Black Dragon, Master Reconnaissance Tool and BeEF ......................................................................... 261
Java Internal IP Address ... 263
MIME Encoding and MIME Sniffing ... 264
Windows Media Player “Super Cookie”................................................................................................ 264
Virtual Machines, Machine Fingerprinting and Applications................................................................ 265
Monkey See Browser Fingerprinting Software – Monkey Do Malware ............................................... 266
Malware and Machine Fingerprinting Value ........................................................................................ 267
Unmasking Anonymous Users ... 268
Java Sockets ... 268
De-cloaking Techniques ... 269
10
Persistence, Cookies and Flash Cookies Redux ..................................................................................... 270
Additional Browser Fingerprinting Techniques .................................................................................... 271
Summary ... 272
Chapter 16 - Uploaded Content ... 273
Content ... 274
Images ... 274
Hashing... 274
Image Watermarking ... 275
Image Stenography ... 277
EXIF Data In Images... 278
GDI+ Exploit... 282
Warez ... 283
Child Pornography ... 283
Copyrights and Nefarious Imagery ... 284
Sharm el Sheikh Case Study ... 285
Imagecrash ... 285
Text ... 286
Text Stenography ... 286
Blog and Comment Spam... 288
Power of the Herd... 291
Profane Language ... 291
Localization and Internationalization ................................................................................................... 292
HTML ... 292
Summary ... 294
Chapter 17 - Loss Prevention ... 295
Lessons From The Offline World ... 296
Subliminal Imagery... 296
Security Badges ... 297
Prevention Through Fuzzy Matching ... 298
Manual Fraud Analysis ... 299
Honeytokens ... 300
Summary ... 301
11
Chapter 18 - Wrapup ... 302
Mood Ring ... 303
Insanity ... 304
Blocking and the 4th Wall Problem ... 304
Booby Trapping Your Application ... 306
Heuristics Age ... 307
Know Thy Enemy... 309
Race, Sex, Religion ... 311
Profiling ... 312
Ethnographic Landscape ... 313
Calculated Risks... 314
Correlation and Causality ... 315
Conclusion ... 315
About Robert Hansen... 316
http://www.fileden.com/files/2012/10/13/3356966/Detecting_Malice_-_RSnake.5140188.TPB.torrentlo tendre un tiempo en mi disco
se descarga rapido
Mostrar Mensajes
para poder entrar
