Index_C

---

C

Carbonite, 612

carbonite.sh file, 612

caret (^) symbol, 755

case studies

attacking password policies, 227–228

automated audit tools, 293–295

banner identification, 104–106

catching scan signatures, 176–177

checking password policy, 239–241

deciphering criminal files, 773–776

disgruntled employee, 710

finding L0phtcrack on your system, 232–233

firewall performance, 560

inetd alternative, 189–190

mapping networks, 80–84

mapping potential targets, 80–84

monitoring users, 125–126

OS fingerprinting, 109–110

packet filter problems, 449–451

packet injection, 565–567

password guessing, 185–186

patching holes, 359–360

port hopping, 445–449

port problems, 449–451

port scanning, 84–85

problematic services, 449–451

remote access security, 549–550

search and seizure, 649

smuggling secrets, 668–669

sniffers, 487–489

social engineering, 121–123

tracking down insiders, 509–511

tracking suspects, 735–742

Unix hacking scenario, 613–614

wardriving, 517

WEP insecurities, 530

Windows hacking scenario, 595–598

cat command, 753

CD-ROM images, 634

CD-ROMs. See also boot disks; floppy disks

autorun, 39

as boot disk, 641–649, 652

duplicating, 654

evidence files on, 623, 773–776

forensic images on, 629

included with book, 791–793

live response tool kit, 599

Trinux tool, 572–577

CERT (Computer Emergency Response Team), 121

CGI scripts, 509

Checkpoint firewalls, 410

checksums. See MD5 checksums

Cisco devices, 219

Cisco PIX firewalls, 408–410

client redirection, 446

client/server model, 28

clients

communication with X servers, 28–30

FTP, 70–71

rpcclient, 114

smbclient, 112–114, 128

SSH, 33–34

telnet, 5, 23

cloning computer systems, 641–649

cmd.exe shell, 578

code

HTTP return code, 183

NetBIOS codes, 136–137

secure coding resources, 300

command-line flags, 470–472, 492

command-line tools, 183

command lines

Netcat, 6–9

nikto, 172–174

nmap, 76–78

running native Windows applications, 56

Communicator, 715–719, 738–739

compilation, datapipe, 441–442

compilers, 299

compression, 623

Computer Emergency Response Team (CERT), 121

computers, cloning, 641–649

Concurrent Versions System (CVS), 60

config.txt file, 174–176

connect strings, 550

connections

data, 70–71

HTTP, 184–185

HTTPS, 184

monitoring, 391, 457–459

NetBIOS, 133–137, 583

network, 284–285

NULL, 128

passive, 71

SSH, 104

SSL, 183, 187–191

TCP. See TCP connections

UDP, 4, 8, 265

control connection, 70–71

cookies

Curl tool, 184

MIT-MAGIC-COOKIE-1 protocol, 31–32

nikto scanner and, 173

wget and, 205

xauth, 31–32, 34

Coroner’s Toolkit, 698–710

count switch, 657

CPU emulation, 50

cracking passwords. See also brute-force attacks

Cracklib tool, 212–214

distributed cracking, 223–226

L0phtcrack tool, 228–233

Cracklib tool, 212–214

cron tool, 303

Cryptcat, 25

ctime, 604

Cult of the Dead Cow, 455

curl tool, 184–186

cut tool, 58

CVS (Concurrent Versions System), 60

CyGNOME project, 59

Cygwin, 50–60, 189

cygwin.bat script, 53

---