Index_A

---

A

access

to DOS shell, 9–11

remote. See remote access

to root user, 283–284

to shells, 9–12

to Unix tools, 58

via Netcat, 9–12

via social engineering, 121–123

access points (APs), 514, 516–517

Achilles tool, 195–197

ACK flags, 477

ACK packets, 433

ACK scans, 68–69

activate rules, 502

Active Directory network type, 138

active transfers, 71

Address Resolution Protocol. See ARP

ADMIN$ share, 158

administration

passwords, 144–145, 147, 154, 161

remote, 147

twadmin utility, 345

AFS (Andrew File System), 118

AiroPeek program, 518–520

alert rules, 502

Allison, Jeremy, 234

amap utility, 85–90

amapcrap utility, 87

America Online (AOL), 720–724

analysis, forensic

The Coroner’s Toolkit (TCT), 698–710

EnCase tool, 684–698, 710

Forensic Toolkit (FTK), 672–684, 710

toolkits for, 651–698

web activity, 711–742

Andrew File System (AFS), 118

antenna, high-gain, 514–515, 520

AOL (America Online), 720–724

Apache Web server, 15–16, 219

applications

building in Windows, 57

control of, 22–23

Cygwin and, 56–58

log files, 591–592

native Windows, 56

obtaining output, 21–22

vulnerabilities, 302

web. See web applications

APs (access points), 514, 516–517

ARP (Address Resolution Protocol)

arpspoof tool, 489–490

Unix systems, 602

Windows systems, 583–584

ARP-based sniffing, 498

ARP headers, 781

ARP poisoning, 498

arpspoof tool, 489–490

ASCII characters, 764, 785–789

ASCII dumps, 462

ASCII files, 758, 762–763

ASCII strings, 58, 749, 752, 763

asterisk (*), 132

attachments, 255

attacks. See also hacking

brute-force. See brute-force attacks

buffer overflow. See buffer overflows

FTP bounce, 70–72

sniffing, 147, 497–498

auditing

auditpol utility, 588–589

automated tools for, 293–295

Boolean tests, 294

Flawfinder, 290–295

integer mismatches, 293–294

Internet Security Scanner (ISS), 333–341

mtr 0.46, 298–299

Nessus security scanner, 302–318, 358–359

precompiled binaries, 294–295

PsLogList and, 156

Retina application, 327–332

Rough Auditing Tool for Security (RATS), 295–299

simple source auditing tools, 289–300

STAT Scanner, 318–327

Tripwire tool, 342–358

auditpol utility, 588–589

authentication

HTTP, 205

Kerberos, 33

Pluggable Authentication Module, 210–214

rhosts, 118–119

two-factor, 549

---