tailieunhanh - Hacking FOR DUMmIES phần 8

TCP cổng 111 nếu bạn muốn lọc tất cả lưu lượng truy cập RPC. • Hãy chắc chắn rằng / etc / xuất khẩu và / etc / file được cấu hình đúng cách để giữ cho thế giới bên ngoài mạng của Linux, các loại tập tin đặc biệt cho phép các chương trình để chạy với quyền của chủ sở hữu tập tin của: | Chapter 14 Malware 245 Two great Web sites I refer to a lot when I want to see how a particular piece of malware works are the following trojans is a comprehensive listing of Trojan horses. PestPatrol s catalog of pests at PestInfo . Manual assessment It helps to know your systems what software is installed and what services are running. Document your baseline environment if you haven t already by using the same methods I describe in this chapter. If you suspect that one of your systems may be infected by malware or you want to see which applications are loaded on your system there are tools and techniques you can use. The key here is to search for things that just don t look right. Windows Because most malware affects Windows there are various tests specific to that platform you can carry out to test for malware infections. Odd file names If you re unsure what a specific file does or want more details on file-format and header information you have a couple of options for information Check Wotsit s Format at for information on file formats and headers. Search for the filename in Google with both Web and Groups searches. Netstat Run netstat -an at a command prompt. The a option displays all connections and listening ports. The n option displays IP addresses and port numbers in numeric form to make them easier to read. You see something similar to the following list 246 Part V Application Hacking Active Connections Proto Local Address Foreign Address State TCP 80 0 LISTENING TCP 135 0 LISTENING TCP 445 0 LISTENING TCP 139 0 LISTENING TCP 1044 80 CLOSE_WAIT TCP 2099 139 ESTABLISHED TCP 2100 139 TIME_WAIT UDP 445 UDP 137 UDP 138 The preceding example shows several Microsoft NetBIOS networking ports 135 137