Foreword |
|
xvii | |
Acknowledgments |
|
xix | |
Introduction |
|
xxi | |
|
Part I Hacking 802.11 Wireless Technology |
|
|
|
Case Study: Wireless Hacking for Hire |
|
|
2 | (5) |
|
|
2 | (1) |
|
|
2 | (1) |
|
|
3 | (1) |
|
|
4 | (3) |
|
1 Introduction to 802.11 Hacking |
|
|
7 | (34) |
|
|
8 | (5) |
|
|
8 | (1) |
|
Addressing in 802.11 Packets |
|
|
9 | (1) |
|
|
9 | (4) |
|
|
13 | (8) |
|
|
21 | (19) |
|
A Note on the Linux Kernel |
|
|
21 | (1) |
|
Chipsets and Linux Drivers |
|
|
22 | (2) |
|
Modern Chipsets and Drivers |
|
|
24 | (2) |
|
|
26 | (7) |
|
|
33 | (4) |
|
|
37 | (1) |
|
|
38 | (2) |
|
|
40 | (1) |
|
2 Scanning and Enumerating 802.11 Networks |
|
|
41 | (38) |
|
Choosing an Operating System |
|
|
42 | (1) |
|
|
42 | (1) |
|
|
42 | (1) |
|
|
43 | (1) |
|
|
43 | (7) |
|
|
44 | (4) |
|
|
48 | (2) |
|
Windows Sniffing/Injection Tools |
|
|
50 | (11) |
|
NDIS 6.0 Monitor Mode Support (NetMon) |
|
|
50 | (4) |
|
|
54 | (2) |
|
|
56 | (5) |
|
|
61 | (6) |
|
|
61 | (6) |
|
|
67 | (1) |
|
|
67 | (6) |
|
|
67 | (6) |
|
|
73 | (2) |
|
Online Mapping Services (WIGLE and Skyhook) |
|
|
75 | (2) |
|
|
77 | (2) |
|
3 Attacking 802.11 Wireless Networks |
|
|
79 | (36) |
|
|
80 | (1) |
|
Security Through Obscurity |
|
|
80 | (8) |
|
|
88 | (16) |
|
|
88 | (16) |
|
Bringing It All Together: Cracking a Hidden Mac-Filtering WEP-Encrypted Network |
|
|
104 | (7) |
|
Keystream Recovery Attacks Against WEP |
|
|
107 | (4) |
|
Attacking the Availability of Wireless Networks |
|
|
111 | (2) |
|
|
113 | (2) |
|
4 Attacking WPA-Protected 802.11 Networks |
|
|
115 | (39) |
|
Breaking Authentication: WPA-PSK |
|
|
116 | (13) |
|
Breaking Authentication: WPA Enterprise |
|
|
129 | (12) |
|
Obtaining the EAP Handshake |
|
|
129 | (2) |
|
|
131 | (2) |
|
|
133 | (3) |
|
|
136 | (1) |
|
|
137 | (2) |
|
|
139 | (2) |
|
Breaking Encryption: TKIP |
|
|
141 | (5) |
|
|
146 | (5) |
|
|
151 | (3) |
|
Part II Hacking 802.11 Clients |
|
|
|
Case Study: Riding the Insecure Airwaves |
|
|
154 | (1) |
|
5 Attack 802.11 Wireless Clients |
|
|
155 | (48) |
|
Attacking the Application Layer |
|
|
157 | (4) |
|
Attacking Clients Using an Evil DNS Server |
|
|
161 | (4) |
|
Ettercap Support for Content Modification |
|
|
165 | (2) |
|
Dynamically Generating Rogue APs and Evil Servers with Karmetasploit |
|
|
167 | (5) |
|
Direct Client Injection Techniques |
|
|
172 | (10) |
|
Injecting Data Packets with AirPWN |
|
|
172 | (3) |
|
Generic Client-side Injection with airtun-ng |
|
|
175 | (2) |
|
Munging Software Updates with IPPON |
|
|
177 | (5) |
|
Device Driver Vulnerabilities |
|
|
182 | (5) |
|
Fingerprinting Device Drivers |
|
|
186 | (1) |
|
|
187 | (14) |
|
Hacking DNS via XSRF Attacks Against Routers |
|
|
197 | (4) |
|
|
201 | (2) |
|
6 Taking It All The Way: Bridging the Airgap from OS X |
|
|
203 | (36) |
|
|
204 | (13) |
|
|
204 | (5) |
|
|
209 | (1) |
|
Performing Initial Reconnaissance |
|
|
210 | (1) |
|
Preparing Kismet, Aircrack-ng |
|
|
211 | (2) |
|
|
213 | (1) |
|
Exploiting WordPress to Deliver the Java Exploit |
|
|
214 | (3) |
|
Making the Most of User-level Code Execution |
|
|
217 | (21) |
|
Gathering 802.11 Intel (User-level Access) |
|
|
219 | (1) |
|
Popping Root by Brute-forcing the Keychain |
|
|
220 | (6) |
|
Returning Victorious to the Machine |
|
|
226 | (3) |
|
|
229 | (9) |
|
|
238 | (1) |
|
7 Taking It All the Way: Bridging the Airgap from Windows |
|
|
239 | (31) |
|
|
240 | (1) |
|
|
241 | (7) |
|
Exploiting Hotspot Environments |
|
|
243 | (4) |
|
|
247 | (1) |
|
Local Wireless Reconnaissance |
|
|
248 | (7) |
|
Remote Wireless Reconnaissance |
|
|
255 | (8) |
|
|
256 | (1) |
|
|
257 | (6) |
|
Target Wireless Network Attack |
|
|
263 | (4) |
|
|
267 | (3) |
|
Part III Hacking Additional Wireless Technologies |
|
|
|
|
270 | (3) |
|
8 Bluetooth Scanning and Reconnaissance |
|
|
273 | (42) |
|
Bluetooth Technical Overview |
|
|
274 | (5) |
|
|
275 | (1) |
|
|
275 | (3) |
|
|
278 | (1) |
|
Encryption and Authentication |
|
|
278 | (1) |
|
|
279 | (3) |
|
Selecting a Bluetooth Attack Device |
|
|
279 | (3) |
|
|
282 | (27) |
|
|
282 | (8) |
|
|
290 | (3) |
|
|
293 | (3) |
|
|
296 | (13) |
|
|
309 | (4) |
|
|
313 | (2) |
|
9 Bluetooth Eavesdropping |
|
|
315 | (30) |
|
Commercial Bluetooth Sniffing |
|
|
316 | (10) |
|
Open-Source Bluetooth Sniffing |
|
|
326 | (17) |
|
|
343 | (2) |
|
10 Attacking and Exploiting Bluetooth |
|
|
345 | (54) |
|
|
346 | (14) |
|
|
352 | (8) |
|
|
360 | (14) |
|
Bluetooth Service and Device Class |
|
|
360 | (4) |
|
|
364 | (10) |
|
Abusing Bluetooth Profiles |
|
|
374 | (22) |
|
Testing Connection Access |
|
|
375 | (2) |
|
|
377 | (4) |
|
|
381 | (4) |
|
|
385 | (6) |
|
|
391 | (5) |
|
|
396 | (2) |
|
|
398 | (1) |
|
|
399 | (40) |
|
|
400 | (7) |
|
ZigBee's Place as a Wireless Standard |
|
|
400 | (1) |
|
|
401 | (1) |
|
ZigBee History and Evolution |
|
|
402 | (1) |
|
|
402 | (4) |
|
|
406 | (1) |
|
|
407 | (3) |
|
Rules in the Design of ZigBee Security |
|
|
407 | (1) |
|
|
408 | (1) |
|
|
409 | (1) |
|
|
409 | (1) |
|
|
410 | (20) |
|
Introduction to KillerBee |
|
|
411 | (5) |
|
|
416 | (2) |
|
|
418 | (6) |
|
|
424 | (3) |
|
|
427 | (3) |
|
|
430 | (8) |
|
Network Discovery and Location |
|
|
430 | (2) |
|
Analyzing the ZigBee Hardware |
|
|
432 | (4) |
|
|
436 | (2) |
|
|
438 | (1) |
|
|
439 | (20) |
|
|
440 | (4) |
|
|
441 | (1) |
|
|
441 | (2) |
|
|
443 | (1) |
|
|
444 | (1) |
|
|
444 | (3) |
|
Authentication and Pairing |
|
|
445 | (1) |
|
|
446 | (1) |
|
|
447 | (11) |
|
|
448 | (1) |
|
|
449 | (6) |
|
|
455 | (3) |
|
|
458 | (1) |
|
A Scoping and Information Gathering |
|
|
459 | (12) |
|
|
460 | (9) |
|
|
460 | (2) |
|
Things to Bring to a Wireless Assessment |
|
|
462 | (2) |
|
Conducting Scoping Interviews |
|
|
464 | (1) |
|
Gathering Information via Satellite Imagery |
|
|
465 | (4) |
|
|
469 | (2) |
Index |
|
471 | |