Introduction

Appendix A looks at some of the tools security analyst's can use to help test and secure their networks. For the exam, it is important to be comfortable with using tools that test systems and protect them from exploitation.

Note 

You do not need to know how to use these tools for the exam; however, you should know how to use them if you work in the security field.

Following are some of the terms used in this appendix:

• White Hat  As functional security analyst's working to defend and protect the systems they administer from attack and exploitation, White Hats test hacking tools in a controlled environment. Think of a White Hat as a "good guy" when it comes to network security.

• Black Hat  Black Hats create tools to manipulate weaknesses within running systems for the purpose of causing harm. Black Hats are usually highly skilled in networking and programming and can create most of the tools they use themselves. These are the most dangerous of the "bad guys" in network security.

• Gray Hat  Falling somewhere in the middle of White Hats and Black Hats, Gray Hats are hackers who are not as malicious as Black Hats, but do not necessarily share the White Hat's beliefs that security breaches should be reported to vendors for repair.

• Script Kiddies  Script Kiddies are Black Hat wannabe's who find tools online to use to cause harm to networks. Most of the "hacker" population today falls under this category.

• Click Kiddies  Click Kiddies are the newest version of Script Kiddies who use simple tools that are pre-canned and ready to be executed via the click of a mouse. As more pre-made Malware programs become available online, the number of Click Kiddies will grow.

Note 

Be aware that as a Microsoft Certified Professional (MCP) operating under good, solid ethics, you should be a White Hat-type of security analyst.

It is important to learn how to use tools of this nature in a controlled environment so that you can learn how to defend against them. Each section of this appendix shows a tool, how to get it, its basic configuration, and why you should be aware of its existence. This information will also help you understand many of the concepts learned within the book such as Public Key Infrastructure (PKI), encryption, ports, and exploitable services that are not shut down or disabled. Exam-specific content is indicated throughout this appendix.

The following sections look at how to test a system's vulnerability with specific tools made to scan and sniff systems and networks looking for exploitable vulnerabilities.

Note 

It is imperative that you do not run these tools on a production network without receiving permission from management first. You never know what will happen so you must be very careful when using these tools, especially if downloading and using them for the first time.

The testing tools covered are:

• LANguard Network Scanner (vulnerability scanner)

• NmapWin (port scanner)

• Ethereal (packet sniffer/protocol analyzer)

There are also tools available that can be used to protect systems from attack and exploitation. Most times, you are using services on the network from the Transmission Control Protocol/Internet Protocol (TCP/IP) protocol suite such as Telnet, and SMTP for e-mail. Because of the massive vulnerabilities that exist with these protocols (such as credentials like username and password being sent in cleartext instead of protected ciphertext), you might want to use alternative tools and services to help remove or diminish the possibility of attack. These tools are:

• Secure Shell (SSH) (encryption for in band terminal emulation)

• Pretty Good Privacy (PGP) (encryption for e-mail protection)

Lastly, it is important to understand that downloading freeware tools from the Internet incurs its own set of possible risks. You may inadvertently download a Trojan or virus. One solution is to connect an old machine to the Internet to download the tools to. Then run antiviral software on the tools to make sure they are clean and then burn them to CD-ROM. Once on CD-ROM, the tools can be used anywhere. Also, the virus definitions on the target machine should be updated so that the most current signatures are available.

Note 

Some virus scanning tools will flag a possible tool as a virus although it is not affecting the machine. For example, when downloading and testing BackOrifice 2000 (see Chapter 11) on a test lab, most antivirus solutions flag the actual executable (such as Bo.exe) as a Trojan/virus, so you may have to take your chances. Hence why I left tools of this nature out of this appendix.