tailieunhanh - hack attacks testing how to conduct your own security phần 7

bán dẫn được sản xuất vào các vi mạch máy tính. Một phần quan trọng của cấu hình xử lý sự cố là thông tin được ghi lại trong CMOS Nội dung, chẳng hạn như các đặc điểm, địa chỉ, và yêu cầu ngắt (IRQs) của các thiết bị. Thành phần này là hữu ích khi thông tin được | hping 2 319 As can be seen from the following logs the attack began with suspicious probes from a privileged root account on . Remember the attacker s intent is to locate an initial target with some form of internal network trust relationship. As Shi-momura pointed out it s obvious from the particular service probes that Mitnick was seeking an exploitable trust relationship here 14 09 32 finger -l @target 14 10 21 finger -l @server 14 10 50 finger -l root@server 14 11 07 finger -l @x-terminal 14 11 38 showmount -e x-terminal 14 11 49 rpcinfo -p x-terminal 14 12 05 finger -l root@x-terminal Fingering an account -l for long or extensive output returns useful discovery information about that account. Although the information returned varies from daemon to daemon and account to account some systems finger reports whether the user is currently in session. Other systems return information that includes user s full name address and or telephone number s . The finger process is relatively simple A finger client issues an active open to this port and sends a one-line query with login data. The server processes the query returns the output and closes the connection. The output received from port 79 is considered very sensitive as it can reveal detailed information on users. The second command displayed in the foregoing log excerpt is showmount with the -e option it is typically used to show how an NFS server is exporting its file systems. It also works over the network indicating exactly what an NFS client is being offered. The rpcinfo command with -p option is a Portmap query. The Portmap daemon converts RPC program numbers into port numbers. When an RPC server starts up it registers with the Portmap daemon. The server tells the daemon to which port number it is listening and which RPC program numbers it serves. Therefore the Portmap daemon knows the location of every registered port on the host and .