%PDF-1.4 % 5 0 obj << /S /GoTo /D (chapter.1) >> endobj 8 0 obj (Introduction) endobj 9 0 obj << /S /GoTo /D (section.1.1) >> endobj 12 0 obj (Abstract) endobj 13 0 obj << /S /GoTo /D (section.1.2) >> endobj 16 0 obj (Background) endobj 17 0 obj << /S /GoTo /D (section.1.3) >> endobj 20 0 obj (Author Bio - HD Moore) endobj 21 0 obj << /S /GoTo /D (section.1.4) >> endobj 24 0 obj (Author Bio - Valsmith) endobj 25 0 obj << /S /GoTo /D (section.1.5) >> endobj 28 0 obj (Acknowledgements) endobj 29 0 obj << /S /GoTo /D (chapter.2) >> endobj 32 0 obj (The Tactical Approach) endobj 33 0 obj << /S /GoTo /D (section.2.1) >> endobj 36 0 obj (Vulnerabilties) endobj 37 0 obj << /S /GoTo /D (section.2.2) >> endobj 40 0 obj (Competition) endobj 41 0 obj << /S /GoTo /D (chapter.3) >> endobj 44 0 obj (Information Discovery) endobj 45 0 obj << /S /GoTo /D (section.3.1) >> endobj 48 0 obj (Personnel Discovery) endobj 49 0 obj << /S /GoTo /D (subsection.3.1.1) >> endobj 52 0 obj (Search Engines) endobj 53 0 obj << /S /GoTo /D (subsection.3.1.2) >> endobj 56 0 obj (Paterva's Evolution) endobj 57 0 obj << /S /GoTo /D (section.3.2) >> endobj 60 0 obj (Network Discovery) endobj 61 0 obj << /S /GoTo /D (subsection.3.2.1) >> endobj 64 0 obj (Discovery Services) endobj 65 0 obj << /S /GoTo /D (subsection.3.2.2) >> endobj 68 0 obj (Bounce Messages) endobj 69 0 obj << /S /GoTo /D (subsection.3.2.3) >> endobj 72 0 obj (Virtual Hosting) endobj 73 0 obj << /S /GoTo /D (subsection.3.2.4) >> endobj 76 0 obj (Outbound DNS) endobj 77 0 obj << /S /GoTo /D (subsection.3.2.5) >> endobj 80 0 obj (Direct Contact) endobj 81 0 obj << /S /GoTo /D (section.3.3) >> endobj 84 0 obj (Firewalls and IPS) endobj 85 0 obj << /S /GoTo /D (subsection.3.3.1) >> endobj 88 0 obj (Firewall Identification) endobj 89 0 obj << /S /GoTo /D (subsection.3.3.2) >> endobj 92 0 obj (IPS Identification) endobj 93 0 obj << /S /GoTo /D (section.3.4) >> endobj 96 0 obj (Application Discovery) endobj 97 0 obj << /S /GoTo /D (subsection.3.4.1) >> endobj 100 0 obj (Slow and Steady wins the Deface) endobj 101 0 obj << /S /GoTo /D (subsection.3.4.2) >> endobj 104 0 obj (Finding Web Apps with W3AF) endobj 105 0 obj << /S /GoTo /D (subsection.3.4.3) >> endobj 108 0 obj (Metasploit 3 Discovery Modules) endobj 109 0 obj << /S /GoTo /D (section.3.5) >> endobj 112 0 obj (Client Application Discovery) endobj 113 0 obj << /S /GoTo /D (subsection.3.5.1) >> endobj 116 0 obj (Browser Fingerprinting) endobj 117 0 obj << /S /GoTo /D (subsection.3.5.2) >> endobj 120 0 obj (Mail Client Fingerprinting) endobj 121 0 obj << /S /GoTo /D (subsection.3.5.3) >> endobj 124 0 obj (SMB Client Fingerprinting) endobj 125 0 obj << /S /GoTo /D (section.3.6) >> endobj 128 0 obj (Process Discovery) endobj 129 0 obj << /S /GoTo /D (subsection.3.6.1) >> endobj 132 0 obj (Traffic Monitoring with IP IDs) endobj 133 0 obj << /S /GoTo /D (subsection.3.6.2) >> endobj 136 0 obj (Web Site Monitoring with HTTP) endobj 137 0 obj << /S /GoTo /D (subsection.3.6.3) >> endobj 140 0 obj (Usage Monitoring with MS FTP) endobj 141 0 obj << /S /GoTo /D (chapter.4) >> endobj 144 0 obj (Information Exploitation) endobj 145 0 obj << /S /GoTo /D (section.4.1) >> endobj 148 0 obj (Introduction) endobj 149 0 obj << /S /GoTo /D (section.4.2) >> endobj 152 0 obj (External Networks) endobj 153 0 obj << /S /GoTo /D (subsection.4.2.1) >> endobj 156 0 obj (Attacking File Transfers) endobj 157 0 obj << /S /GoTo /D (subsection.4.2.2) >> endobj 160 0 obj (Attacking Mail Services) endobj 161 0 obj << /S /GoTo /D (subsection.4.2.3) >> endobj 164 0 obj (Attacking Web Servers) endobj 165 0 obj << /S /GoTo /D (subsection.4.2.4) >> endobj 168 0 obj (Attacking DNS Servers) endobj 169 0 obj << /S /GoTo /D (subsection.4.2.5) >> endobj 172 0 obj (Attacking Database Servers) endobj 173 0 obj << /S /GoTo /D (subsection.4.2.6) >> endobj 176 0 obj (Attacking NTLM Authentication) endobj 177 0 obj << /S /GoTo /D (subsection.4.2.7) >> endobj 180 0 obj (Free Hardware) endobj 181 0 obj << /S /GoTo /D (section.4.3) >> endobj 184 0 obj (Internal Networks) endobj 185 0 obj << /S /GoTo /D (subsection.4.3.1) >> endobj 188 0 obj (Web Proxy Auto-Discovery Protocol) endobj 189 0 obj << /S /GoTo /D (subsection.4.3.2) >> endobj 192 0 obj (Microsoft DNS Servers) endobj 193 0 obj << /S /GoTo /D (subsection.4.3.3) >> endobj 196 0 obj (Microsoft WINS Servers) endobj 197 0 obj << /S /GoTo /D (subsection.4.3.4) >> endobj 200 0 obj (Exploiting NTLM Relays) endobj 201 0 obj << /S /GoTo /D (subsection.4.3.5) >> endobj 204 0 obj (SMB and Samba) endobj 205 0 obj << /S /GoTo /D (section.4.4) >> endobj 208 0 obj (Trust Relationships) endobj 209 0 obj << /S /GoTo /D (subsection.4.4.1) >> endobj 212 0 obj (NFS Home Directories) endobj 213 0 obj << /S /GoTo /D (subsection.4.4.2) >> endobj 216 0 obj (Hijacking SSH) endobj 217 0 obj << /S /GoTo /D (subsection.4.4.3) >> endobj 220 0 obj (Hijacking Kerberos) endobj 221 0 obj << /S /GoTo /D (chapter.5) >> endobj 224 0 obj (Conclusion) endobj 225 0 obj << /S /GoTo /D [226 0 R /Fit ] >> endobj 228 0 obj << /Length 562 /Filter /FlateDecode >> stream xڍTMo@WzZ