Violent Python: A Cookbook for Hackers, Forensic Analysts, Penetration Testers and Security Engineers (32 page)

Read Violent Python: A Cookbook for Hackers, Forensic Analysts, Penetration Testers and Security Engineers Online

Authors: TJ O'Connor

BOOK: Violent Python: A Cookbook for Hackers, Forensic Analysts, Penetration Testers and Security Engineers
12.12Mb size Format: txt, pdf, ePub
Index

Note
: Page numbers followed by “f” and “t” indicate figures and tables respectively

A

Administrative network share (ADMINS),
67
ADMINS.
See
Administrative network share
airmon-ng start wlan
0 command,
172
Anonymous email,
236
–
237
crafting,
237
,
239
–
241
local email server,
238
–
239
malicious spam email sending,
241
–
242
phishing with Smtplib,
239
using Smtplib,
237
–
238
Application artifact investigation,
100
See also
Python
Firefox sqlite3 databases,
108
–
116
Skype database queries,
108
using Python to,
102
using sqlite3 to,
102
,
107
–
108
Skype sqlite3 database,
100
–
102

B

BackTrack distribution,
4
BeautifulSoup, image downloading with,
96
–
97
BlueBug attack,
208
BlueBugging phone,
208
–
209
Bluetooth
worm,
208
installing Python Bluetooth packages,
173
–
174
Paris Hilton not hacked by,
208
Bluetooth RFCOMM channel scanning
Bluetooth service discovery profile,
206
dubbed BlueBug,
205
RFCOMM connections,
206
unauthenticated channels,
205
–
206
Bridging FTP and web
anonymous FTP server with Python,
57
infected server,
56
k985ytv attack,
56
user credentials
bruteLogin() function,
58
finding account with password guest,
59
web page malicious injection,
60
index.html page downloading,
62
injectPage() function,
61
vulnerable client,
60
–
61
wrapping entire attack
attack() function,
62
fake Antivirus propagation,
66
k985ytv infection,
62
–
65
script against vulnerable FTP,
65
Brute force
password brute force,
48
remote process execution,
71
Built-in OS module,
18
–
20
Built-in sys module,
17
–
18
Butler, Max Ray,
171
–
172

C

Cabir,
208
C-style shellcode,
247
–
248
Cambridge Silicon Radio (CSR),
174
Catching Wordpress cookie reuse,
199
–
201
Conficker,
66
See also
Morris worm
Python interaction with Metasploit
Meterpreter process,
70
using Nmap-Python module,
69
remote process execution brute force,
71
Windows SMB service attacking
using Metasploit,
67
–
68
system exploitation,
68
–
69
wrapping entire script,
71
–
74
Conficker’s domain flux,
150
detection with Scapy,
153
–
154
consolidated.db
,
116
–
117
cookies.sqlite
,
109
–
110
Crafting 802.11 frames
emergency-land command,
194
–
195
injectCmd() method,
193
–
194
IP length field,
192
–
194
using Scapy,
192
Crypt() function,
22
CSR.
See
Cambridge Silicon Radio
ctypes,
247
–
248
Cuckoo’s Egg, The,
20
–
21
Cyber Fast Track program,
24
Cyber-attack
evading antivirus programs
C-style shellcode,
247
–
248
Metasploit framework,
246
–
247
Pyinstaller,
248
–
249
TCP port 1337,
249
evasion verification
using default Metasploit encoder,
254
–
255
malicious file,
250
printing detection rate string,
252
–
254
using Python,
255
uploaded file analysis,
250
–
251
Flame,
245
–
246

D

datetime()
method,
101
–
102
DDoS.
See
Distributed denial of service
De-cloaking hidden 802.11 networks,
188
–
189
Dictionaries,
9
discover_devices()
function,
201
Distributed denial of service (DDoS),
93
DNS.
See
Domain name service
DNS Question Record (DNSQR),
150
–
151
DNS Resource Record (DNSRR),
150
–
151
Domain name service (DNS),
149
downloads.sqlite
file,
108
–
109

E

Exception handling,
10
–
12
Exchange image file format (Exif),
95
–
96
Exif.
See
Exchange image file format
Exif metadata,
95
–
96
reading,
97
–
100

F

Fast-flux,
149
File I/O,
16
–
17
File Transfer Protocol (FTP),
56
,
184
client programs,
57
–
58
searching web pages on,
59
–
60
server,
10
Firefox sqlite3 databases,
108
–
116
FireSheep,
196
–
197
catching Wordpress cookie reuse,
199
–
201
detection,
196
–
197
Wordpress session cookies,
198
–
199
Flame,
245
–
246
Foiling IDS, with scapy,
162
–
168
alerts,
163
–
164
analyzing logs from,
165
–
168
with scapy,
162
Forensic investigations,
81
–
82
application artifacts investigation,
100
automate Skype database queries,
102
–
108
parsing Firefox sqlite3 databases,
108
–
116
Skype sqlite3 database,
100
–
102
deleted item recovery using Python in,
89
using OS module,
90
SID correlation to user,
90
–
93
iTunes mobile backups investigation,
116
–
122
metadata,
93
Exif metadata,
95
–
96
image downloading,
96
–
97
using PyPDF to parse PDF metadata,
93
–
95
reading Exif metadata from,
97
–
100
solving BTK murders,
81
–
82
wireless access points analysis,
82
–
83
MAC address submitting to Wigle,
85
–
89
Windows Registry reading using WinReg,
83
–
85
FTP.
See
File Transfer Protocol
FTP credentials,
184
FTP credential sniffer,
186
intercept FTP logons,
185
–
186
intercepted user credentials,
184
USER and PASS,
184
–
185

G

Geo-location
information,
82
–
83
,
97
–
98
Wi-Fi positioning,
85
Google Earth,
134

H

Hashed password value,
22
haslayer() function,
152
hciconfig
config command,
174
Hidden network 802.11 beacon detection,
187
–
188
Half-open scan.
See
TCP Syn scan

I

Iceman.
See
Butler, Max Ray
IDS.
See
Intrusion detection system
Intercepting traffic,
189
–
192
Internet browsing,
212
–
213
anonymize function,
218
–
219
cookies,
216
Mechanize’s primary class,
212
–
213
proxy servers,
214
–
215
user-agent,
215
–
216
Internet Protocol address (IP address),
126
–
127
Internet Protocol traffic (IP traffic),
126
–
127
using Dpkt,
128
–
129
Scapy packet manipulation,
128
using PyGeoIP,
127
–
128
Internet Relay Chat (IRC),
137
Interpreted and interactive Python relationship
See also
Python
methods and functions,
6
new script,
6
program,
6
Python interpreter,
5
–
6
semantics,
6
statement execution process,
6
Intrusion detection system (IDS),
41
–
42
,
162
alerts,
163
–
164
analyzing logs from,
165
–
168
with scapy,
162
IP address.
See
Internet Protocol address
IP traffic.
See
Internet Protocol traffic
IRC.
See
Internet Relay Chat
iTunes mobile backups investigation
consolidated.db
,
116
–
117
database schema,
118
file characters,
117
using
file
command,
118
using
isMessageTable()
function,
119
messages
table,
118
–
119
mobile backup directory,
118
–
119
mobile directory backup,
117
printMessage()
function,
120
–
122
SQLite database,
118
text message storage,
122
UNIX commands,
117
–
118
user performs,
117

K

Kevin Mitnick
and sequence prediction,
154
–
162
sequence number,
157
–
159
spoofing,
159
–
162
SYN flood,
155
–
156

L

Linux libraries,
5
List data structure in Python,
8
–
9
Listening for 802.11 probe requests,
186
–
187
Low Orbit Ion Cannon (LOIC),
54
,
135
DDoS attack
identification,
139
–
140
,
142
–
143
TCP packets,
138
–
139
download,
135
–
136
operation modes,
135
parsing IRC commands,
137
–
138

M

Mechanize library,
86
–
87
Mechanize’s primary class,
212
–
213
Metadata,
93
anonymous’ metadata fail,
93
BeautifulSoup, image downloading with,
96
–
97
Exif metadata,
95
–
96
reading,
97
–
100
PDF metadata parsing using PyPDF,
93
–
95
Metasploit, Windows SMB service attacking,
67
–
68
Metasploit, Python interaction with
Meterpreter process,
70
using Nmap-Python module,
69
Metasploit encoder, in cyber-attack,
254
–
255
Metasploit framework,
246
–
247
Meterpreter process,
69
–
70
mon0
adapter,
172
Morris worm,
56
–
66

Other books

Destry by Lola Stark
Scandals of an Innocent by Nicola Cornick
Running the Bulls by Cathie Pelletier
Christmas With You by Tracey Alvarez
Olivia by Tim Ewbank
Conspiracy by Black, Dana
Bloodline by Warren Murphy