hakin9_06_2008(1).pdf

~ t q w ~

~ t q w ~

~ t q w ~

CONTENTS

team

Dear All,

Here we have the fresh 19th issue of hakin9 magazine! I hope that in spite of

the fact that days are getting shorter and outside is cold and gloomy, you will

enjoy it as much as the other ones. So, please, sit on your couch, have a cup of

tea and relax.

This time, as always, we did our best to prepare a special and unique

magazine for all of you – IT security fans! This issue is focused on Virtualization.

You can read about it in two articles – one written by Rishi Narang describing

the threats which you can run into during your work with Virtual Machines. The

other one, placed in Consumers Test section, will help you to choose the most

suitable VM for you.

Our Basic part this time is taken by Harlan Carvey, the author of great

books, who share with you his knowledge on Windows Registry. I encourage

you to take a deeper look at

our Attack articles as well.

In this section you will find

papers on client-side exploits,

WiFi hacking, SQL Injection

attacks, Oracle auditing, and

Public Key Cryptography. Not

enough? The last but not the

least is the defense article

explaining the Javascript

Obfuscation written by David

Maciejak.

Dear Readers – when

you have enough of reading,

explore our CD and check

out the latest 3 version of

BackTrack which contains a

lot of new applications and

hacking tools.

And finally, I’d like to wish

you all the best and I hope you will have a Merry Christmas.

If you have any suggestions on how to improve hakin9 – please, let me

know. Your feedback is more than appreciated!

Thank you all for creating the magazine as well as helping me out with

everything and... see you next year!

Editor in Chief: Ewa Dudzic ewa.dudzic@hakin9.org

Executive Editor: Monika Drygulska monika.drygulska@hakin9.org

Editorial Advisory Board: Matt Jonkman, Rebecca Wynn, Rishi

Narang, Shyaam Sundhar, Terron Williams, Steve Lape

Editor Assistant: Monika Świątek monika.swiatek@hakin9.org,

DTP: Ireneusz Pogroszewski , Przemysław Banasiewicz,

Art Director: Agnieszka Marchocka agnieszka.marchocka@hakin9.org

Cover’s graphic: Łukasz Pabian

CD: Rafał Kwaśny rafal.kwasny@gmail.com

Proofreaders: Neil Smith, Steve Lape, Michael Munt, Monroe

Dowling, Kevin Mcdonald, John Hunter

Top Betatesters: Joshua Morin, Michele Orru, Clint Garrison, Shon

Robinson, Brandon Dixon, Justin Seitz, Donald Iverson, Matthew Sabin,

Stephen Argent, Aidan Carty, Rodrigo Rubira Branco, Jason Carpenter,

Martin Jenco, Sanjay Bhalerao, Monroe Dowling, Avi Benchimol

Senior Consultant/Publisher: Paweł Marciniak

Production Director: Marta Kurpiewska marta.kurpiewska@hakin9.org

Marketing Director: Ewa Dudzic ewa.dudzic@hakin9.org

Circulation and Distribution Executive: Ewa Dudzic

ewa.dudzic@hakin9.org

Subscription: customer_service@hakin9.org

Publisher: Software Wydawnictwo Sp.z.o.o

02-682 Warszawa, ul. Bokserska 1

Worldwide publishing

Business addres: Software Media LLC

1521 Concord Pike, Suite 301 Brandywine

Executive Center Wilmington, DE 19803 USA

Phone: 1 917 338 3631 or 1 866 225 5956

www.hakin9.org/en

Software Media LLC is looking for partners from all over the World.

If you are interested in cooperating with us,please contact us at:

cooperation@hakin9.org

Print: 101 Studio, Firma Tęgi

Printed in Poland

Distributed in the USA by: Source Interlink Fulfillment Division,

27500 Riverview Centre Boulevard, Suite 400, Bonita Springs, FL

34134, Tel: 239-949-4450.

Distributed in Australia by: Gordon and Gotch, Australia Pty Ltd.,

Level 2, 9 Roadborough Road, Locked Bag 527, NSW 2086 Sydney,

Australia, Phone: + 61 2 9972 8800,

Whilst every effort has been made to ensure the high quality of

the magazine, the editors make no warranty, express or implied,

concerning the results of content usage.

All trade marks presented in the magazine were used only for

informative purposes.

All rights to trade marks presented in the magazine are reserved by

the companies which own them.

To create graphs and diagrams

we used program by

Cover-mount CD’s were tested with AntiVirenKit

by G DATA Software Sp. z o.o

The editors use automatic DTP system

Mathematical formulas created by Design Science MathType™

ATTENTION!

Selling current or past issues of this magazine for

prices that are different than printed on the cover is

– without permission of the publisher – harmful activity

and will result in judicial liability.

Monika Drygulska

monika.drygulska@hakin9.org

hakin9 is also available in: The United States, Australia,

The Netherlands, Singapore, France, Morocco, Belgium,

Luxembourg, Canada, Germany, Austria, Switzerland, Poland

DISCLAIMER!

The techniques described in our articles may only be

used in private, local networks. The editors hold no

responsibility for misuse of the presented techniques

or consequent data loss.

4 HAKIN9 6/2008

~ t q w ~

CONTENTS

BASICS

REGULARS

14 Registry Analysis

HARLAN CARVEY

After reading this article, you will come to know about the basic of the structure

of the Windows Registry.

06 In brief

Selection of news from the IT security

world.

Zinho & www.hackerscenter.com

ATTACK

08 CD Contents

What's new on the latest hakin9.live CD

– a great number of fully functioning

versions and special editions of

commercial applications and an e-book.

hakin9 team

18 Client-side Exploits

ANUSHREE REDDY

In this article you will learn about client-side exploits, attack vectors and

mitigation techniques.

10 Tools

Ad-Aware 2008 Plus

28 Simple WiFi Hacking with Eee Pc

MARCO LISCI

In this article you will see how to hack a WiFi Network with WEP encryption in

less than hour.

Don Iverson

Spam Fighter Professional

Rebeca Wynn

32 SQL Injection in Action

ANTONIO FANELLI

The very useful article which shows how to maintain earlier websites in order to

prevent SQL Injection attacks.

64 Emerging Threats

Hacking Movie Fallacies and Home User

Infections

Matthew Jonkman

40 Oracle Auditing in a Production Enviorment

ADITYA K. SOOD

The paper deals with a hierarchical way of audit in Oracle database in a

production environment. The focus is more towards auditing the database like

a hacker.

66 Consumers Test

Virtual Machines – an integral part of

your security toolkit

Russell Kuhl & hakin9 team

72 Interviews

An interview with Dr. Vladimir Golubev

hakin9 team

An interview with Rene St-Germain

hakin9 team

50 PKCS Potion Number Twelve

ISRAEL TORRES

The paper introduces Public Key Cryptography (PKCS) Number 12, the Personal

Information Exchange Synax Standard in which defines a file format to store

private keys, public key certificates being protected with a password based key.

78 Self Exposure

Michael Kalinischenko, Chris Stoneff

Monika Świątek

DEFENSE

80 Book Review

CISO Leadership: Essential Principles for

Succes

54 Virtualization and Security

RISHI NARANG

This article will show virtualization possibilities and threats which you can run

into during your work with Virtual Machines.

Rishi Narang

Not R oot for You

Nathan Schwartz

60 Javascript Obfuscation Part 1

DAVID MACIEJAK

This article will uncover how ActiveX instantiation could be hidden by malicious

guys using some javascript trics. But from the other hand will show how to use

opensource tools to automate the unobfuscation of malicious Javascript code.

82 Upcoming

Topics that will be brought up in the

upcoming issue of hakin9

Monika Drygulska

6/2008

~ t q w ~

HAKIN9

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika: