EC-Counci= l | ECSA/LPT Certification Bootcamp

ECSA/LPT is a security = class like no=20 other! Providing real world hands on experience, it is the = only=20 in-depth Advanced Hacking and Penetration Testing class = available=20 that covers testing in all modern infrastructures, operating = systems=20 and application environments.

EC-Council=92s Certified = Security=20 Analyst/LPT program is a highly interactive 5-day security = class=20 designed to teach Security Professionals the advanced uses = of the=20 LPT methodologies, tools and techniques required to perform=20 comprehensive information security tests. Students will = learn=20 how to design, secure and test networks to protect your = organization=20 from the threats hackers and crackers pose. By teaching the = tools=20 and ground breaking techniques for security and penetration = testing,=20 this class will help you perform the intensive assessments = required=20 to effectively identify and mitigate risks to the security = of your=20 infrastructure. As students learn to identify security = problems,=20 they also learn how to avoid and eliminate them, with the = class=20 providing complete coverage of analysis and network = security-testing=20 topics.

Who Should=20 Attend
Network server administrators, = Firewall=20 Administrators, Security Testers, System Administrators and = Risk=20 Assessment professionals.

Duration:
5 days (9:00 =96 5:00)=20 Certification

Exam
The ECSA=20 certification exam will be conducted on the last day of = training.=20 Students need to pass the online Prometric exam 412-79 to = receive=20 the ECSA certification. The Student also will be = prepared for=20 the LPT certification.

Course Outline=20 v4

Module 1: = The Need for=20 Security Analysis

What Are We = Concerned=20 About?
So What Are You = Trying To=20 Protect?
Why Are = Intrusions So Often=20 Successful?
What Are The = Greatest=20 Challenges?
Environmental=20 Complexity
New=20 Technologies
New Threats, New=20 Exploits
Limited=20 Focus
Limited=20 Expertise
Authentication
Authorization
Confidentiality
Integrity
Availability
Nonrepudiation
We Must Be=20 Diligento:p>
Threat=20 Agents
Assessment=20 Questions
How Much Security = is=20 Enough?
Risk =
Simplifying=20 Risk
Risk=20 Analysis
Risk Assessment = Answers Seven=20 Questions
Steps of Risk = Assessment=20
Risk Assessment=20 Values
Information = Security=20 Awareness
Security=20 policies
Types of=20 Policies
Promiscuous=20 Policy
Permissive=20 Policy
Prudent=20 Policy
Paranoid=20 Policy
Acceptable-Use=20 Policy
User-Account=20 Policy
Remote-Access=20 Policy
Information-Protection=20 Policy
Firewall-Management=20 Policy
Special-Access=20 Policy
Network-Connection=20 Policy
Business-Partner=20 Policy
Other Important=20 Policies
Policy=20 Statements
Basic Document = Set of=20 Information Security Policies
ISO=20 17799
Domains of ISO=20 17799
No Simple=20 Solutions
U.S.=20 Legislation
California SB = 1386=20
Sarbanes-Oxley=20 2002
Gramm-Leach-Bliley Act (GLBA)=20
Health Insurance = Portability=20 and Accountability Act (HIPAA)
USA Patriot Act = 2001=20
U.K.=20 Legislation
How Does This Law = Affect a=20 Security Officer?
The Data = Protection Act 1998=20
The Human Rights = Act=20 1998
Interception of=20 Communications
The Freedom of = Information=20 Act 2000
The Audit = Investigation and=20 Community Enterprise Act 2005

Module 2: = Advanced=20 Googling

Site Operator=20
intitle:index.of
error |=20 warning
login |=20 logon
username | userid = |=20 employee.ID | =93your username is=94
password | = passcode | =93your=20 password is=94
admin |=20 administrator
admin=20 login
=96ext:html = =96ext:htm =96ext:shtml=20 =96ext:asp =96ext:php
inurl:temp | = inurl:tmp |=20 inurl:backup | inurl:bak
intranet |=20 help.desk
Locating Public = Exploit=20 Sites
Locating Exploits = Via Common=20 Code Strings
Searching for = Exploit Code=20 with Nonstandard Extensions
Locating Source = Code with=20 Common Strings
Locating=20 Vulnerable Targets
Locating Targets = Via=20 Demonstration Pages
=93Powered by=94 = Tags Are Common=20 Query Fodder for Finding Web Applications =
Locating Targets = Via Source=20 Code
Vulnerable Web = Application=20 Examples
Locating Targets = Via CGI=20 Scanning
A = Single CGI=20 Scan-Style Query =
Directory=20 Listings
Finding IIS 5.0=20 Servers
Web Server = Software Error=20 Messages
IIS=20 HTTP/1.1 Error Page Titles =
=93Object Not = Found=94 Error=20 Message Used to Find IIS 5.0
Apache Web=20 Server
Apache 2.0 Error=20 Pages
Application = Software Error=20 Messages
ASP Dumps Provide = Dangerous=20 Details
Many Errors = Reveal Pathnames=20 and Filenames
CGI Environment = Listings=20 Reveal Lots of Information
Default=20 Pages
A Typical Apache = Default Web=20 Page
Locating Default=20 Installations of IIS 4.0 on Windows NT=20 4.0/OP
Default Pages = Query for Web=20 Server
Outlook Web = Access Default=20 Portal
Searching for=20 Passwords
Windows Registry = Entries Can=20 Reveal Passwords
Usernames, = Cleartext=20 Passwords, and Hostnames!

Module 3: = TCP/IP=20 Packet Analysis

TCP/IP=20 Model
Application=20 Layer
Transport=20 Layer
Internet=20 Layer
Network Access=20 Layer
Comparing OSI=20 and TCP/IP
Addressing
IPv4=20 Addresses
IP Classes of=20 Addresses
Reserved IP=20 Addresses
Private=20 Addresses
Subnetting
IPv4 and=20 IPv6
Transport=20 Layer
Flow=20 Control
Three-Way=20 Handshake
TCP/IP=20 Protocols
TCP=20 Header
IP=20 Header
IP Header: = Protocol=20 Field
UDP
TCP and UDP Port=20 Numbers
Port=20 Numbers
TCP=20 Operation
Synchronization = or 3-way=20 Handshake
Denial of Service = (DoS)=20 Attacks
DoS Syn Flooding=20 Attack
Windowing
Acknowledgement
Windowing and = Window=20 Sizes
Simple=20 Windowing
Sliding=20 Windows
Sequencing=20 Numbers
Positive = Acknowledgment and=20 Retransmission (PAR)
UDP=20 Operation
Port Numbers = Positioning=20 between Transport and Application Layer (TCP and=20 UDP)
Port=20 Numbers
http://www.iana.org/assignments/port-numbers
What Makes Each = Connection=20 Unique?
Internet Control = Message=20 Protocol (ICMP)
Error Reporting = and Error=20 Correction
ICMP Message=20 Delivery
Format of an ICMP = Message
Unreachable=20 Networks
Destination = Unreachable=20 Message
ICMP Echo = (Request) and Echo=20 Reply
Detecting = Excessively Long=20 Routes
IP Parameter=20 Problem
ICMP Control=20 Messages
ICMP=20 Redirects
Clock = Synchronization and=20 Transit Time Estimation
Information = Requests and=20 Reply Message Formats
Address=20 Masks
Router = Solicitation and=20 Advertisement

Module 4: = Advanced=20 Sniffing Techniques

What is=20 Wireshark?
Wireshark:=20 Filters
IP Display=20 Filters
Example
Wireshark:=20 Tshark
Wireshark:=20 Editcap
Wireshark:=20 Mergecap
Wireshark:=20 Text2pcap
Using = Wireshark=20 for Network=20 Troubleshooting
Network = Troubleshooting=20 Methodology
Using Wireshark=20 for System Administration
ARP=20 Problems
ICMP Echo = Request/Reply=20 Header Layout
TCP=20 Flags
TCP SYN Packet=20 Flags Bit Field =
Capture Filter=20 Examples
Scenario 1: SYN = no=20 SYN+ACK
Scenario 2: SYN=20 Immediate Response RST =
Scenario 3: SYN=20 SYN+ACK ACK =
=A7 =20 Using Wireshark for Security=20 Administration
Detecting = Internet Relay Chat=20 Activity
Wireshark as a = Detector for=20 Proprietary Information Transmission
Sniffer=20 Detection
Wireless Sniffing = with=20 Wireshark
AirPcap
Using Channel=20 Hopping
Interference and=20 Collisions
Recommendations = for Sniffing=20 Wireless
Analyzing = Wireless=20 Traffic
IEEE 802.11=20 Header
IEEE 802.11 = Header=20 Fields
Filters
Filtering on = Source MAC=20 Address and BSSID
Filtering on=20 BSSID
Filter on=20 SSID
Wireless Frame = Types=20 Filters
Unencrypted Data=20 Traffic
Identifying = Hidden=20 SSIDs
Revealed=20 SSID
Identifying EAP=20 Authentication Failures
Identifying the = EAP=20 Type
Identifying Key = Negotiation=20 Properties
EAP Identity=20 Disclosure
Identifying=20 WEP
Identifying TKIP = and=20 CCMP
Identifying=20 IPSec/VPN
Decrypting=20 Traffic
Scanning
TCP Connect=20 Scan
SYN=20 Scan
XMAS=20 Scan
Null=20 Scan
Remote Access=20 Trojans
NetBus=20 Analysis
Trojan Analysis = Example=20 NetBus Analysis

Module 5:=20 Vulnerability Analysis with = Nessus

Nessus
Features of=20 Nessus
Nessus Assessment = Process
Nessus:=20 Scanning
Nessus:=20 Enumeration
Nessus: = Vulnerability=20 Detection
Configuring=20 Nessus
Updating Nessus=20 Plug-Ins
Using the Nessus=20 Client
Starting a Nessus = Scan
Generating=20 Reports
Data=20 Gathering
Host=20 Identification
Port Scan=20
SYN=20 scan
Timing
Port Scanning = Rules of=20 Thumb
Plug-in=20 Selection
Dangerous=20 plugins
Scanning Rules of=20 Thumb =
Report=20 Generation
Reports:=20 Result
Identifying False = Positives=20
Suspicious=20 Signs
False=20 Positives
Examples of False = Positives=20
Writing Nessus=20 Plugins
Writing a=20 Plugin
Installing and = Running the=20 Plugin
Nessus Report = with output=20 from our plugin
Security Center=20 http://www.tenablesecurity.com =

Module 6: = Advanced=20 Wireless Testing

Wireless=20 Concepts
Wireless=20 Concepts
802.11=20 Types
Core Issues with=20 802.11
What=92s the=20 Difference?
Other Types of=20 Wireless
Spread Spectrum=20 Background
Channels
Access=20 Point
Service Set=20 ID
Default=20 SSIDs
Chipsets
Wi-Fi=20 Equipment
Expedient=20 Antennas
Vulnerabilities = to 802.1x and=20 RADIUS
Wired = Equivalent=20 Privacy
Security=20 - WEP
Wired Equivalent=20 Privacy
Exclusive=20 OR
Encryption=20 Process
Chipping=20 Sequence
WEP=20 Issues
WEP - = Authentication=20 Phase
WEP - Shared Key=20 Authentication =20
WEP - Association = Phase
WEP=20 Flaws
WEP=20 Attack
WEP:=20 Solutions
WEP Solution =96=20 802.11i
Wireless Security=20 Technologies
WPA Interim = 802.11=20 Security
WPA
802.1X = Authentication and=20 EAP
EAP Types=20
Cisco LEAP=20
TKIP (Temporal = Key Integrity=20 Protocol)
Wireless Networks = Testing
Wireless = Communications=20 Testing
Report=20 Recommendations
Wireless Attack=20 Countermeasures
Wireless = Penetration Testing=20 with Windows
Attacks And=20 Tools
War=20 Driving
The=20 Jargon =96 WarChalking
WarPumpkin
Wireless: Tools = of the=20 Trade
Mapping with=20 Kismet
WarDriving with=20 NetStumbler
How NetStumbler=20 Works?
=93Active=94 versus=20 =93Passive=94 WLAN Detection =
Disabling the=20 Beacon
Running=20 NetStumbler
Captured Data = Using=20 NetStumbler
Filtering by=20 Channels
Airsnort=20
WEPCrack=20
Monkey-Jack
How Monkey-Jack=20 Works
Before=20 Monkey-Jack
After=20 Monkey-Jack
AirCrack-ng=20
How Does It=20 Work?
FMS and Korek=20 Attacks
Crack=20 WEP
Available=20 Options
Usage=20 Examples
Cracking WPA/WPA2 = Passphrases
Notes
Determining = Network Topology:=20 Network View
WarDriving and = Wireless=20 Penetration Testing with OS X
What is the = Difference=20 between =93Active" and =93Passive" = Sniffing?
Using a=20 GPS
Attacking WEP = Encryption with=20 KisMAC
Deauthenticating=20 Clients
Attacking WPA = with KisMAC=20
Brute-force = Attacks Against=20 40-bit WEP
Wordlist=20 Attacks
Mapping WarDrives = with=20 StumbVerter
MITM = Attack=20 basics
MITM Attack=20 Design
MITM Attack=20 Variables
Hardware for the = Attack=20 Antennas, Amps, WiFi Cards
Wireless Network=20 Cards
Choosing the = Right=20 Antenna
Amplifying the = Wireless=20 Signal
Identify and = Compromise the=20 Target Access Point
Compromising the=20 Target
Crack the WEP=20 key
Aircrack-ng = Cracked the WEP=20 Key
The MITM Attack = Laptop=20 Configuration
IP Forwarding and = NAT Using=20 Iptables
Installing = Iptables and IP=20 Forwarding
Establishing the = NAT=20 Rules
Dnsmasq=20
Configuring = Dnsmasq=20
Apache Web=20 Servers
Virtual=20 Directories
Clone the Target = Access Point=20 and Begin the Attack
Start the = Wireless=20 Interface
Deauthenticate = Clients=20 Connected to the Target Access Point
Wait for the = Client to=20 Associate to Your Access Point
Spoof the=20 Application
Modify the=20 Page
Example=20 Page
Login/php=20 page
Redirect Web = Traffic Using=20 Dnsmasq

Module 7: = Designing a=20 DMZ

Introduction=20
DMZ Concepts=20
Multitiered = Firewall With a=20 DMZ Flow
DMZ Design = Fundamentals=20
Advanced Design = Strategies=20
Designing Windows = DMZ=20
Designing Windows = DMZ=20
Precautions for = DMZ Setup=20
Security Analysis = for the DMZ=20
Designing Sun = Solaris=20 DMZ
Placement of = Servers=20
Advanced = Implementation of a=20 Solaris DMZ Server
Solaris DMZ = Servers in a=20 Conceptual Highly Available Configuration =
Private and = Public Network=20 Firewall Ruleset
DMA Server = Firewall Ruleset=20
Solaris DMZ = System Design=20
Disk Layout and=20 Considerations
Designing = Wireless=20 DMZ
Placement of = Wireless=20 Equipment
Access to DMZ and = Authentication Considerations
Wireless DMZ = Components=20
Wireless DMZ = Using RADIUS to=20 Authenticate Users
WLAN DMZ Security = Best-Practices
DMZ Router = Security=20 Best-Practice
DMZ Switch = Security=20 Best-Practice
Six Ways to Stop = Data Leaks=20
Reconnex =

Module 8: = Snort=20 Analysis

Snort=20 Overview
Modes of=20 Operation
Features of Snort =
Configuring=20 Snort
Variables
Preprocessors
Output Plugins=20
Rules =
Working of=20 Snort
Initializing=20 Snort
Signal=20 Handlers
Parsing the = Configuration=20 File
Decoding=20
Possible=20 Decoders
Preprocessing
Detection
Content=20 Matching
Content-Matching=20 Functions
The Stream4=20 Preprocessor
Inline=20 Functionality
Writing Snort=20 Rules
Snort Rule=20 Header
Snort Rule = Header: Actions=20
Snort Rule = Header: Other=20 Fields
IP Address = Negation=20 Rule
IP Address=20 Filters
Port=20 Numbers
Direction=20 Operator
Rule=20 Options
Activate/Dynamic=20 Rules
Meta-Data Rule = Options: msg=20
Reference=20 Keyword
sid/rev=20 Keyword
Classtype=20 Keyword
Payload Detection = Rule=20 Options: content
Modifier=20 Keywords
Offset/depth=20 Keyword
Uricontent=20 keyword
fragoffset=20 keyword
ttl=20 keyword
id=20 keyword
flags=20 keyword
itype keyword : = icmp=20 id
Writing Good = Snort=20 Rules
Sample Rule to = Catch=20 Metasploit Buffer Overflow Exploit
Tool for writing = Snort rules:=20 IDS Policy Manager
Subscribe to = Snort=20 Rules
Honeynet Security = Console=20 Tool
Key Features=20

Module 9: = Log=20 Analysis

Introduction to=20 Logs
Types of=20 Logs
Events that Need = to be=20 Logged
What to Look Out = For in=20 Logs
W3C Extended Log = File=20 Format
Automated Log = Analysis=20 Approaches
Log=20 Shipping
Analyzing Syslog=20
Syslog
Setting up a=20 Syslog
Syslog:=20 Enabling Message Logging
Main Display=20 Window
Configuring Kiwi = Syslog to=20 Log to a MS SQL Database
Configuring = Ethereal to=20 Capture Syslog Messages
Sending Log Files = via=20 email
Configuring Cisco = Router for=20 Syslog
Configuring DLink = Router for=20 Syslog
Configuring Cisco = PIX for=20 Syslog
Configuring an = Intertex /=20 Ingate/ PowerBit/ SurfinBird ADSL = router
Configuring a = LinkSys=20 wireless VPN Router
Configuring a = Netgear ADSL=20 Firewall Router
Analyzing Web=20 Server Logs
Apache Web Server = Log
AWStats
Configuring = AWStats for=20 IIS
Log Processing in = AWStats
Analyzing Router = Logs=20
Router=20 Logs
Analyzing = Wireless Network=20 Devices Logs
Wireless Traffic = Log=20
Analyzing Windows = Logs=20
Configuring = Firewall Logs in=20 Local Windows System
Viewing Local = Windows=20 Firewall Log
Viewing Windows = Event=20 Log
AAnalyzing Linux = Logs=20
iptables=20
Log Prefixing = with=20 iptables
Firewall Log = Analysis with=20 grep
Analyzing SQL = Server Logs=20
SQL Database=20 Log
ApexSQL=20 Log
Configuring = ApexSQL Log=20
Analyzing VPN = Server Logs=20
VPN Client=20 Log
Analyzing = Firewall Logs=20
Why Firewall Logs = are=20 Important
Firewall Log=20 Sample
ManageEngine = Firewall=20 Analyzer
Installing = Firewall=20 Analyzer
Viewing Firewall = Analyzer=20 Reports
Firewall Analyzer = Log=20 Reports
Analyzing IDS = Logs=20
SnortALog
IDS Log=20 Sample
Analyzing DHCP = Logs=20
DHCP Log=20
NTP Configuration =
Time = Synchronization and=20 Logging
NTP=20 Overview
NTP Client=20 Configuration
Configuring an = NTP client=20 using the Client Manager
Configuring an = NTP=20 Server
NTP: Setting = Local Date and=20 Time
Log Analysis = Tools=20
All-Seeing Eye=20 Tool: Event Log Tracker
Network Sniffer = Interface=20 Test Tool
Syslog Manager=20 2.0.1
Sawmill
WALLWATCHER
Log Alert Tools=20
Network Eagle=20 Monitor
Network Eagle = Monitor:=20 Features
SQL Server = Database Log=20 Navigator
What Log = Navigator=20 does?
How Does Log = Navigator=20 Work?
Snortsnarf
Types of Snort=20 Alarms
ACID (Analysis = Console for=20 Intrusion Databases)

Module 10: = Advanced=20 Exploits and Tools

Common = Vulnerabilities=20
Buffer Overflows=20 Revisited
Smashing the = Stack for Fun=20 and Profit
Smashing the Heap = for Fun and=20 Profit
Format Strings = for Chaos and=20 Mayhem
The Anatomy of an = Exploit
Vulnerable=20 code
Shellcoding =
Shellcode=20 Examples
Delivery=20 Code
Delivery Code:=20 Example
Linux Exploits = Versus=20 Windows
Windows Versus = Linux=20
Tools of the = Trade:=20 Debuggers
Tools of the = Trade:=20 GDB
Tools of the = Trade:=20 Metasploit
Metasploit Frame = work=20
User-Interface=20 Modes
Metasploit:=20 Environment
Environment: = Global=20 Environment
Environment: = Temporary=20 Environment
Metasploit:=20 Options
Metasploit:=20 Commands
Metasploit: = Launching the=20 Exploit
MetaSploit: = Advanced=20 Features
Tools of the = Trade:=20 Canvas
Tools of the = Trade: CORE=20 Impact
IMPACT = Industrializes=20 Penetration Testing
Ways to Use CORE=20 IMPACT
Other IMPACT=20 Benefits
ANATOMY OF A = REAL-WORLD=20 ATTACK
CLIENT SIDE=20 EXPLOITS
Impact Demo=20 Lab

Module 11: Penetration Testing = Methodologies

Module 12: Customers and Legal = Agreements

Module 13: Rules of Engagement

Module 14: Penetration Testing Planning = and=20 Scheduling

Module 15: Pre Penetration Testing = Checklist

Module 16: Information Gathering

Module 17: Vulnerability Analysis

Module 18: External Penetration = Testing

Module 19: Internal Network Penetration = Testing

Module 20: Routers and Switches = Penetration=20 Testing

Module 21: Firewall Penetration = Testing

Module 22: IDS Penetration Testing

Module 23: Wireless Network Penetration = Testing

Module 24: Denial of Service Penetration = Testing

Module 25: Password Cracking Penetration = Testing

Module 26: Social Engineering Penetration=20 Testing

Module 27: Stolen Laptop, PDAs and Cell = phones=20 Penetration Testing

Module 28: Application Penetration = Testing

Module 29: Physical Security Penetration = Testing

Module 30: Database Penetration = testing

Module 31: VoIP Penetration Testing

Module 32: VPN Penetration Testing

Module 33: War Dialing

Module 34: Virus and Trojan Detection

Module 35: Log Management Penetration = Testing

Module 36: File Integrity Checking

Module 37: Blue Tooth and Hand held Device = Penetration Testing

Module 38: Telecommunication and Broadband = Communication Penetration Testing

Module 39: Email Security Penetration = Testing

Module 40: Security Patches Penetration = Testing

Module 41: Data Leakage Penetration = Testing

Module 42: Penetration Testing = Deliverables and=20 Conclusion

Module 43: Penetration Testing Report and=20 Documentation Writing

Module 44: Penetration Testing Report = Analysis

Module 45: Post Testing Actions

Module 46: Ethics of a Licensed = Penetration=20 Tester

Module 47: Standards and=20 Compliance

=A9 2007=20 EC-Council. All rights reserved.
This document is for=20 informational purposes only. EC-Council MAKES NO WARRANTIES, = EXPRESS=20 OR IMPLIED, IN THIS SUMMARY. EC-Council logo is registered=20 trademarks or trademarks of EC-Council in the United States = and/or=20 other=20 = countries.