Libro: Offensive Security Lab Exercises

Me he encontrado con un libro bastante bueno, Offensive Security Lab Exercises, el cual es una suerte de bitácora donde enseñan con ejercicios como usar las herramientas que trae Backtrack. Es bastante claro e ilustrativo, aquí dejo el index para que vean los temas que trata:

1. Module 1 - BackTrack Basics
1.1 Finding your way around the tools
1.1.1 Exercise 1
1.2 Basic Services
1.2.1 DHCP
1.2.2 Static IP assignment
1.2.3 Apache
1.2.4 SSHD
1.2.5 Tftpd
1.2.6 VNC Server
1.2.7 Exercise 2
1.3 Basic Bash Environment Overview
1.3.1 Simple Bash Scripting
1.3.2 Exercise 3
1.3.3 Possible Solution for ICQ Exercise
1.3.4 Exercise 4
1.4 Netcat The Almighty Overview
1.4.1 Connecting to a TCP/UDP port with Netcat
1.4.2 Listening on a TCP/UDP port with Netcat
1.4.3 Transferring files with Netcat
1.4.4 Remote Administration with Netcat
1.4.4.1 Scenario 1 – Bind Shell
1.4.4.2 Scenario 2 – Reverse Shell
1.4.5 Exercise 5
1.5 Using WireShark (Ethereal) Overview
1.5.1 Peeking at a Sniffer
1.5.2 Capture filters
1.5.3 Following TCP Streams
1.5.4 Exercise 6
2. Module 2- Information Gathering Techniques A note from the authors
2.1 Open Web Information Gathering Overview
2.1.1 Google Hacking
2.1.1.1 Advanced Google Operators
2.1.1.2 Searching within a Domain
2.1.1.3 Nasty Example #1
2.1.1.4 Nasty Example #2
2.1.1.5 Email Harvesting
2.1.1.6 Finding Vulnerable Servers using Google
2.1.1.7 Google API
2.2. Miscellaneous Web Resources
2.2.1 Other search engines
2.2.2 Netcraft
2.2.3 Whois Reconnaissance
2.3 Exercise 7
3. Module 3- Open Services Information Gathering A note from the authors
3.1 DNS Reconnaissance
3.1.1 Interacting with a DNS server
3.1.1.1 MX Queries
3.1.1.2 NS Queries
3.1.2 Automating lookups
3.1.3 Forward lookup bruteforce
3.1.4 Reverse lookup bruteforce
3.1.5 DNS Zone Transfers
3.1.6 Exercise 8
3.2 SNMP reconnaissance
3.2.1 Enumerating Windows Users
3.2.2 Enumerating Running Services
3.2.3 Enumerating open TCP ports
3.2.4 Enumerating installed software
3.2.5 Exercise 9
3.3 SMTP reconnaissance
3.3.1 Exercise 10
3.4 Microsoft Netbios Information Gathering
3.4.1 Null sessions
3.4.2 Scanning for the Netbios Service
3.4.3 Enumerating Usernames
3.4.4 Exercise 11
4. Module 4- Port Scanning A note from the authors
4.1 TCP Port Scanning Basics
4.2 UDP Port Scanning Basics
4.3 Port Scanning Pitfalls
4.4 Nmap
4.5 Scanning across the network
4.5.1 Exercise 11
4.6 Unicornscan
5. Module 5- ARP Spoofing A note from the authors
5.1 The Theory
5.2 Doing it the hard way
5.2.1 Victim Packet
5.2.2 Gateway Packet
5.3 Ettercap
5.3.1 DNS Spoofing.
5.3.2 Fiddling with traffic
5.3.3 Exercise 12

6. Module 6- Buffer overflow Exploitation (Win32) A note from the authors Overview
6.1 Looking for the Bugs
6.2 Fuzzing
6.3 Replicating the Crash
6.4 Controlling EIP
6.4.1 Binary Tree analysis
6.4.2 Sending a unique string
6.5 Locating Space for our Shellcode
6.6 Redirecting the execution flow
6.7 Finding a return address
6.7.1 Using OllyDbg
6.8 Getting our shell
6.9 Improving exploit stability
6.9.1 Exercise 13
7. Module 7- Working With Exploits
7.1 Looking for an exploit on BackTrack
7.1.1 RPC DCOM Example
7.1.2 Wingate Example
7.1.3 Exercise 14
7.2 Looking for exploits on the web
7.2.1 Security Focus
7.2.2 Milw0rm.com
8. Module 8- Transferring Files Exercise
8.1 The non interactive shell
8.2 Uploading Files
8.2.1 Using TFTP
8.2.1.1 TFTP Pros
8.2.1.2 TFTP Cons
8.2.2 Using FTP
8.2.3 Inline Transfer - Using echo and DEBUG.exe
8.3 Exercise 15
9. Module 9 – Exploit frameworks
9.1 Metasploit
9.1.1 Metasploit Command Line Interface (MSFCLI)
9.1.2 Metasploit Console (MSFCONSOLE)
9.1.3 Metasploit Web Interface (MSFWEB)
9.1.4 Exercise 16
9.1.5 Interesting Payloads
9.1.5.1 Meterpreter Payload
9.1.5.2 PassiveX Payload
9.1.5.3 Binary Payloads
9.1.6 Exercise 17
9.1.7 Framework v3.0
9.1.7.1 Framework 3 Auxiliary Modules
9.1.8 Framework v3.0 Kung Foo
9.1.8.1 db_autopwn
9.1.8.2 Kernel Payloads
9.1.9 Exercise 18
9.2 Core Impact
9.2.1 Exercise 19
10. Module 10- Client Side Attacks A note from the authors
10.1 Client side attacks
10.2 MS04-028
10.3 MS06-001
10.4 Client side exploits in action
10.5 Exercise 20
11. Module 11- Port Fun A note from the authors
11.1 Port Redirection
11.2 SSL Encapsulation - Stunnel
11.2.1 Exercise 21
11.3 HTTP CONNECT Tunneling
11.4 ProxyTunnel
11.4.1 Exercise 22
11.5 SSH Tunneling
11.6 What about content inspection ?
12. Module 12- Password Attacks A note from the authors
12.1 Online Password Attacks
12.2 Hydra
12.2.1 FTP Bruteforce
12.2.2 POP3 Bruteforce
12.2.3 SNMP Bruteforce
12.2.4 Microsoft VPN Bruteforce
12.2.5 Hydra GTK
12.3 Password profiling
12.3.1 WYD
12.4 Offline Password Attacks
12.4.1 Windows SAM
12.4.2 Windows Hash Dumping – PWDump / FGDump
12.4.3 John The Ripper
12.4.4 Rainbow Tables
12.4.5 Exercise 24
12.5 Physical Access Attacks
12.5.1. Resetting Microsoft Windows
12.5.2 Resetting a password on a Domain Controller
12.5.3 Resetting Linux Systems
12.5.4 Resetting a Cisco Device
13. Module 13 - Web Application Attack vectors
13.1 SQL Injection
13.1.1 Identifying SQL Injection Vulnerabilities
13.1.2 Enumerating Table Names
13.1.3 Enumerating the column types
13.1.4 Fiddling with the Database
13.1.5 Microsoft SQL Stored Procedures
13.1.6 Code execution
13.2 Web Proxies
13.3 Command injection Attacks
13.3.1 Exercise 25
14. Module 14 - Trojan Horses
14.1 Binary Trojan Horses
14.2 Open source Trojan horses
14.2.1 Spybot
14.2.2 Insider
14.3 World domination Trojan horses
14.3.1 Rxbot
15. Module 15 - Windows Oddities.
15.1 Alternate NTFS data Streams
15.1.1 Exercise 26
15.2 Registry Backdoors
15.2.1 Exercise 27
16. Module 16 - Rootkits
16.1 Aphex Rootkit
16.2 HXDEF Rootkit
16.3 Exercise R.I.P
Final Challenges.
Tasks


Descarga Offensive Security Lab Exercises: 
Descarga Directa: 
http://doc.hackbbs.org/Hacking/offensive-security-labs-os-2402.pdf

Fuente del articulo:  blackploit


Saludos
ThDjca