Host Integrity Monitoring Using Osiris and Samhain

Host Integrity Monitoring Using Osiris and Samhain
Brian Wotring | 2005-07-17 00:00:00 | Syngress | 450 | Hacking
This book will walk the reader through the process of preparing and deploying open source host integrity monitoring software, specifically, Osiris and Samhain. From the configuration and installation to maintenance, testing, and fine-tuning, this book will cover everything needed to correctly deploy a centralized host integrity monitoring solution. The domain includes home networks on up to large-scale enterprise environments.


Throughout the book, realistic and practical configurations will be provided for common server and desktop platforms. By the end of the book, the reader will not only understand the strengths and limitations of host integrity tools, but also understand how to effectively make use of them in order to integrate them into a security policy.

* Brian Wotring is the creator of Osiris. He speaks and writes frequently on Osiris for major magazines, Web sites, and trade shows. And, the book can be prominently marketed from the Osiris Web site

* This is the first book published on host integrity monitoring, despite the widespread deployment of
Osiris and Samhain

* Host Integrity Monitoring is the only way to accurately determine if a malicious attacker has successfully compromised the security measures of your network
Reviews
This is a solid introduction to Samhain and Osiris. It stars slow with an introduction to the topic and some chapters on process and specification that feel more management level in style. Then there are the chapters that cover the monitoring tools from installation through setup and continued use. The book is well written, but it could use some more illustrations. In particular in the tools chapters which are really at the heart of the book.
Reviews
The information necessary for you to understand the what, why, and how of host integrity monitoring, can be found in this book. Authors Brian Wotring, Bruce Potter, Rainer Wichmann and Marcus Ranum, have done an outstanding job of providing you with a book that walks you through the entire process of establishing host integrity monitoring, including the fundamentals, understanding threats, planning, deployment, administration and response.



Wotring, Potter, Wichmann and Ranum begin by revealing everything that is involved in maintaining the integrity of your hosts. Next, the authors explore the many areas of the host environment with respect to establishing an effective host integrity monitoring system (HIMS). Then, they examine some of the most common threats to the integrity of a host environment. The authors continue by walking you through the process of planning the deployment of a HIMS. In addition, the authors next introduce you to Osiris and Samhain. They also provide in-depth practical information about how to properly deploy, configure, and administer the Osiris HIMS. The authors next deal with life after deployment. Finally, they outline some progressive techniques that can be used to strengthen and fine-tune your host integrity monitoring deployment.



With the preceding in mind, the authors have done an excellent job of providing the readership with a book that shows what is involved in planning and deploying an effective host integrity monitoring system. At the end of the day, you'll learn the importance of monitoring various elements of the host environment, how to plan for deployment, and how to interpret and respond to integrity violations.


Reviews
Host integrity monitoring is the process by which system and network administrators validate and enforce the security of their systems. This can be a complex suite of approaches, tools, and methodologies, and it can be as simple as looking at loggin output. In the past, tools like Tripwire were used to check the configurations on hosts. The freeware version of this tool was limited in its manageability, which was available mainly in the commercial version.



Tools like Osiris and Samhain came along to fill the gap and have since evolved into mature projects themselves. Like any existing software tool out there, any new book should be evaluated not only on its own but also in he context of the existing documentation. Both Osiris and Samhain have decent amounts of documentation available already (Samhain seems to have a larger user documentation repository online than the Osiris tool does), and the book contributes to these docs quite well.



Host Integrity Monitoring shows you how to set up these tools and put them into production on Windows, UNIX, and OS X. Wotring's writing is fairly good, and his examples are usually pretty clear. The pace of the material is good, and there's not a whole lot of domain-specific expertise beyond system administration skills required to make use of the book. At times some of the formatting of the text gets in the way, but that's trivial compared to the quality of writing (which is pretty good).



Overall the material in the book is decent. The book opens with an overview of what host integrity monitoring is, why you should use it, and some of the basic premises. Then it goes on to discuss Samhain and Osiris, starting with their basic installation and then on to their advanced usage. They differ enough that each project merits its own pieces of documentation, even though they're similar in spirit. You'll learn how to schedule scans, integrate with other tools like Swatch, and in general administer a site installation.



The author of the book, Brian Wotring, is also the author of Osiris and is clearly more familiar with Osiris than he is with Samhain. More material (100 pages) is devoted to using Osiris than is given to Samhain (60 pages), which is to be expected. The coverage of both is sufficient, though, and fills the major parts of the book.



There are three major strengths to this book over the existing docs. The first is seeing not just the tools themselves covered but also the threats they cover in place. The second is having the two tools covered side by side, allowing you to see how to accomplish the same task with each. And thirdly, there are two appendices that are true gems of this book. The first covers how to get your Linksys Linux based AP device monitored using the Osiris tool, which isn't a small feat. The second is how to write your own modules for Osiris and Samhain, for which this appears to be the only documentation for Osiris (Samhain's website has a How To on writing modules). Again, these add value to the book over the freely available documentation.



I would have liked to have seen the chapters devoted specifically to Osiris and Samhain, chapters 6 (Osiris) and 7 (Samhain) broken up into two or three chapters covering their installation and use. The length of these chapters can make finding some material difficult at times. I would have also have liked to see the use of the "bold is input, normal text is output" technical book convention. In many examples finding the user input text can be challenging.



Host Integrity Monitoring Using Osiris and Samhain is not only about these tools but about how to accomplish host integrity monitoring on the cheap (since the code is freely available). While you can find docs on each project, this book complements those docs nicely and provides a nicely wrapped package about how to get the most out of each tool. If you've been thinking about how to ensure that no one is tampering with your system, these tools, and this book, should definitely make your solutions list.
Reviews
Host Integrity Monitoring Using Osiris and Samhain (HIM) is an excellent book on a frequently overlooked security discipline. Most people who hear about host integrity monitoring nod their heads and agree that performing it is a good idea. These same people usually don't implement HIM, and frequently cannot count the number of hosts, operating systems, and applications working in their enterprise. Thankfully, HIM provides a way to use open source tools to help remedy this situation. Consistent with the Visible Ops methodology, HIM provides guidance on how to keep track of host integrity.



When writing HIM, author Brian Wotring could have easily concentrated on the program he coded -- Osiris. Luckily for readers, Brian chose to address his program and another open source host integrity monitor -- Samhain. By comparing and contrasting these two programs, readers learn more about each and understand the capabilities and limitations of each application's approach to the HIM problem. Consistent with this dual methodology, Brian explains how to install Osiris on both Unix and Windows platforms. (Samhain is mainly a Unix solution.)



The first third of the book provides background information on HIM rationales and planning. I was initially inclined to skip ahead, but I found the explanations of monitoring various system elements to be helpful. Brian's view of security closely mirrors my own, but he approaches it from a host-centric view. He still accepts that prevention eventually fails and that preparation for incident response is a necessity, not a luxury. Brian also correctly uses the term "threat" and recognizes threats are not vulnerabilities. Bravo.



The middle third and some of the final third of the book deal exclusively with installing and configuring Osiris and Samhain. The instructions are wise and very thorough. I was impressed by guidance on how to compile and install Osiris on Windows from source, using MinGW and MSYS. I also liked the book's frequent use of FreeBSD as a Unix reference platform.



I found a few minor issues with HIM, and one major drawback that prevented a five star review. First, I disagree with the statement on p 19 that "most attacks originate from within the network by authorized users." The annual CSI/FBI study has repeatedly shown this to not be true; rather, insider attacks, when they do occur, are typically more damaging that those perpetrated by outsiders. Second, I found some minor rough editing, e.g. "Nimbda" repeatedly used in place of "Nimda." Third, and most important, it would have been extremely helpful to have shown case studies of Osiris and Samhain in action when detecting configuration changes and/or intrusions. I left the book with a lot of ideas on installation and configuration, but it would have been helpful to see case studies on using host-based data to identify intrusions.



I am adding HIM to my recommended reading list for system administrators. HIM gives administrators the documentation and theory they need to add another critical tool to their security arsenal. I would like to see a second edition that adds case studies, and perhaps chapters on using Radmind for open source change management.
Reviews
What a breath of fresh air! Wotring and Potter take the reader from a definition of integrity monitoring and fundamental principles to the pragmatic "how to" implement a monitoring capability - step by step. They clearly have a wealth of experience shown by their tips on what to do and what not to do. If you are considering Osiris or Samhain, this book is invaluable! The time you save and the capability you develop will pay for the book many times over!

Download this book!

Free Ebooks Download

Read more..

CEHv6 Module 64 Economic Espionage

CEHv6 Module 64 Economic Espionage

DOWNLOAD LINK: CEHv6 Module 64 Economic Espionage

Read more..

CEHv6 Module 31 Exploit Writing

CEHv6 Module 31 Exploit Writing

DOWNLOAD LINK: CEHv6 Module 31 Exploit Writing

Read more..

CEHv6 Module 28 Writing Virus Codes

 CEHv6 Module 28 Writing Virus Codes


DOWNLOAD LINK: CEHv6 Module 28 Writing Virus Codes

Read more..

CEHv6 Module 10 Sniffers

CEHv6 Module 10 Sniffers

 In common industry usage, a sniffer (with lower case "s") is a program that monitors and analyzes network traffic, detecting bottlenecks and problems. Using this information, a network manager can keep traffic flowing efficiently.
A sniffer can also be used legitimately or illegitimately to capture data being transmitted on a network. A network router reads every packet of data passed to it, determining whether it is intended for a destination within the router's own network or whether it should be passed further along the Internet. A router with a sniffer, however, may be able to read the data in the packet as well as the source and destination addresses. Sniffers are often used on academic networks to prevent traffic bottlenecks caused by file-sharing applications.
The term "sniffer" is occasionally used for a program that analyzes data other than network traffic. For example, a database could be analyzed for certain kinds of duplication

Sniffer (with a capital "S") is a trademark owned by NetScout. The generic term may have originated from Sniffer, which is said to be the first packet capture and decode software that was offered for the purpose of network analysis and troubleshooting.


DOWNLOAD LINK: CEHv6 Module 10 Sniffers

Read more..

CEHv6 Module 11 Social Engineering

CEHv6 Module 11 Social Engineering

Social engineering is the act of manipulating people into performing actions or divulging confidential information, rather than by breaking in or using technical cracking techniques. While similar to a confidence trick or simple fraud, the term typically applies to trickery or deception for the purpose of information gathering, fraud, or computer system access; in most cases the attacker never comes face-to-face with the victim.

"Social engineering" as an act of psychological manipulation was popularized by hacker-turned-consultant Kevin Mitnick. The term had previously been associated with the social sciences, but its usage has caught on among computer professionals.

 DOWNLOAD LINK: CEHv6 Module 11 Social Engineering

Read more..

CEHv6 Module 08 Trojans and Backdoors

CEHv6 Module 08 Trojans and Backdoors

The Trojan Horse got its name from the old mythical story about how the Greeks gave their enemy a huge wooden horse as a gift during the war.

The enemy accepted this gift and they brought it into their kingdom, and during the night, Greek soldiers crept out of the horse and attacked the city, completely overcoming it.
A Trojan horse is an unauthorized program contained within a legitimate program. This unauthorized program performs functions unknown by the user. A legitimate program that has been altered by the placement of unauthorized code within it; this code performs functions unknown by the user.
Working:

Trojans come in two parts, a Client part and a Server part. When the victim runs the server on its machine, the attacker will then use the Client to connect to the Server and start using the Trojan. TCP/IP protocol is the usual protocol type used for communications, but some functions of the Trojans use the UDP protocol as well. When the Server is being run on the victim's computer, it will (usually) try to hide somewhere on the computer, start listening on some port(s) for incoming connections from the attacker, modify the registry and/or use some other auto starting method.
It's necessary for the attacker to know the victim's IP address to connect to his/her machine. Many Trojans have features like mailing the victim's IP, as well as messaging the attacker via ICQ or IRC. This is used when the victim has dynamic IP which means every time you connect to the Internet you get a different IP (most of the dial-up users have this).

Most of the Trojans use Auto-Starting methods so even when you shut down your computer they're able to restart and again give the attacker access to your machine. New auto-starting methods and other tricks are discovered all the time. The variety starts from "joining" the Trojan into some executable file you use very often like explorer.exe, for example, and goes to the known methods like modifying the system files or the Windows Registry. System files are located in the Windows directory and here are short explanations of their abuse by the attackers:

- Auto start Folder - The Auto start folder is located in C:\Windows\Start Menu\Programs\startup and as its name suggests automatically starts everything placed there.

- Win.ini - Windows system file using load=Trojan.exe and run=Trojan.exe to execute the Trojan

- System.ini - Using Shell=Explorer.exe trojan.exe results in execution of every file after Explorer.exe

- Wininit.ini - Setup-Programs use it mostly; once run, it's being auto-deleted, which is very handy for Trojans to restart

- Winstart.bat - Acting as a normal bat file Trojan is added as @trojan.exe to hide its execution from the user

- Autoexec.bat - It's a DOS auto-starting file and it's used as auto-starting method like this -> c:\Trojan.exe

- Config.sys - Could also be used as an auto-starting method for Trojans

- Explorer Startup - Is an auto-starting method for Windows95, 98, ME and if c:\explorer.exe exists, it will be started instead of the usual c:\Windows\Explorer.exe, which is the common path to the file.
Registry is often used in various auto-starting methods.


A key with the value "%1 %*" should be placed there and if there is some executable file placed there, it will be executed each time you open a binary file. It's used like this: trojan.exe "%1 %*"; this would restart the Trojan.

- ICQ Net Detect Method

[HKEY_CURRENT_USER\Software\Mirabilis\ICQ\Agent\Apps\]
This key includes all the files that will be executed if ICQ detects Internet connection. As you can understand, this feature of ICQ is very handy but it's frequently abused by attackers as well.
- ActiveX Component
[HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\KeyName]
StubPath=C:\directory\Trojan.exe

These are the most common Auto-Starting methods using Windows system files, and the Windows registry.
Trojans Variations

1.Remote Access Trojans
These are probably the most publicly used Trojans, just because they give the attackers the power to do more things on the victim's machine than the victim itself, while standing in front of the machine. Most of these Trojans are often a combination of the other variations you'll read below. The idea of these Trojans is to give the attacker a COMPLETE access to someone's machine, and therefore access to files, private conversations, accounting data, etc.

2. Password Sending Trojans
The purpose of these Trojans is to rip all the cached passwords and also look for other passwords you're entering then send them to a specific mail address, without the user noticing anything. Passwords for ICQ, IRC, and FTP, HTTP or any other application that require a user to enter a login password are being sent back to the attacker's e-mail address, which in most cases is located at some free web based e-mail provider. Most of them do not restart when Windows is loaded, as the idea is to gather as much info about the victim's machine as passwords, marc logs, ICQ conversations and mail them; but it depends on the needs of the attacker and the specific situation.

3. Keyloggers
These Trojans are to log the keystrokes of the victim and then let the attacker search for passwords or other sensitive data in the log file. Most of them come with two functions like online and offline recording. Of course they could be configured to
send the log file to a specific e-mail address on a daily basis.

4. Destructive
The only function of these Trojans is to destroy and delete files. This makes them very simple and easy to use. They can automatically delete all your core system files (for example: .dell, .in or .exe files, possibly others) on your machine. The Trojan is being activated by the attacker or sometimes works like A logic bomb and starts on a specific day and at specific hour.

5.Denial Of Service (DoS) Attack Trojans
These Trojans are getting very popular these days, giving the attacker power to start DDoS if having enough victims of course. The main idea is that if you have 200 ADSL users infected and start attacking the victim simultaneously, this will generate a LOT of traffic (more then the victim's bandwidth, in most cases) and its the access to the Internet will be shut down. WinTrinoo is a DDoS tool that has become really popular recently, and if the attacker has infected many ADSL users, major Internet sites could be shut down as a result, as we've seen it happen in the past few months.
Another variation of a DoS trojan is the mail-bomb trojan, whose main aim is to infect as many machines as possible and simultaneously attack specific e-mail address/addresses with random subjects and contents which cannot be filtered.

6.Proxy/Wingate Trojans
Interesting feature implemented in many trojans is turning the victim's computer into a proxy/wingate server available to the whole world or to the attacker only. It's used for anonymous Telnet, ICQ, IRC, etc., and also to register domains with stolen credit cards and for many other illegal activities. This gives the attacker complete anonymity and the chance to do everything from YOUR computer and if he/she gets caught the trace leads back to you.

7.FTP Trojans
These trojans are probably the most simple ones and are kind of outdated as the only thing they do is to open port 21(the port for FTP transfers) and let EVERYONE connect to your machine or just the attacker. Newer versions are password protected so only the one that infected you may connect to your computer.

8.Software Detection Killers
There are such functionalities built into some trojans, but there are also separate programs that will kill ZoneAlarm, Norton Anti-Virus and many other (popular anti-virus/firewall) programs, that protect your machine. When they are disabled, the attacker will have full access to your machine, to perform some illegal activity, use your computer to attack others and often disappear. Even though you may notice that these programs are not working or functioning properly, it will take you some time to remove the trojan, install the new software, configure it and get back online with some sense of security.
How Can I Get Infected

Following are ways to get infected with Trojans:

1 ICQ
2 IRC
3 Attachments
4 Physical Access
5 Browser And E-mail Software Bugs
6 Netbios(FileSharing)

Trojan Programs: Trojans can be classified as :

1.Backdoors
2.General Trojans
3.PSW Trojans
4.Trojan Clickers
5.Trojan Downloaders
6.Trojan Droppers
7.Trojan Proxies
8.Trojan Spies
9.Trojan Notifiers
10.ArcBombs

Backdoors

Today backdoors are the most dangerous type of Trojans and the most widespread. These Trojans are remote administration utilities that open infected machines to external control via a LAN or the Internet. They function in the same way as legal remote administration programs used by system administrators. This makes them difficult to detect.The only difference between a legal administration tool and a backdoor is that backdoors are installed and launched without the knowledge or consent of the user of the victim machine. Once the backdoor is launched, it monitors the local system without the user's knowledge; often the backdoor will not be visible in the log of active programs.
Once a remote administration utilitiy has been successfully installed and launched, the victim machine is wide open.

Backdoor functions can include:

1.Sending/ receiving files
2.Launching/ deleting files
3.Executing files
4.Displaying notification
5.Deleting data
6.Rebooting the machine

In other words, backdoors are used by virus writers to detect and download confidential information, execute malicious code, destroy data, include the machine in bot networks and so forth. In short, backdoors combine the functionality of most other types of Trojans in one package.
Backdoors have one especially dangerous sub-class: variants that can propagate like worms. The only difference is that worms are programmed to propagate constantly, whereas these 'mobile' backdoors spread only after a specific command from the 'master'.

General Trojans

This loose category includes a variety of Trojans that damage victim machines or threaten data integrity, or impair the functioning of the victim machine.
Multi-purpose Trojans are also included in this group, as some virus writers create multi-functional Trojans rather than Trojan packs.

PSW Trojans

This family of Trojans steals passwords, normally system passwords from victim machines. They search for system files, which contain confidential information such as passwords and Internet access telephone numbers and then send this information to an email address coded into the body of the Trojan. It will then be retrieved by the 'master' or user of the illegal program.
Some PSW Trojans steal other types of information such as:
System details (memory, disk space, operating system details)
Local email client
IP-address
Registration details
Passwords for on-line games
Trojan-AOL are PSW Trojans that steal passwords for aol (American Online) They are contained in a sub-groups because they are so numerous.

Trojan Clickers

This family of Trojans redirects victim machines to specified websites or other Internet resources. Clickers either send the necessary commands to the browser or replace system files where standard Internet urls are stored (e.g. the 'hosts' file in MS Windows).
Clickers are used:
1.To raise the hit-count of a specific site for advertising purposes
2.To organize a DoS attack on a specified server or site
3.To lead the victim to an infected resource where the machine will be attacked by other malware (viruses or Trojans)

Trojan Downloaders

This family of Trojans downloads and installs new malware or adware on the victim machine. The downloader then either launches the new malware or registers it to enable autorun according to the local operating system requirements. All of this is done without the knowledge or consent of the user.
The names and locations of malware to be downloaded are either coded into the Trojan or downloaded from a specified website or other Internet location.

Trojan Droppers

These Trojans are used to install other malware on victim machines without the knowledge of the user. Droppers install their payload either without displaying any notification, or displaying a false message about an error in an archived file or in the operating system. The new malware is dropped to a specified location on a local disk and then launched.

DOWNLOAD LINK: CEHv6 Module 08 Trojans and Backdoors

Read more..

CEHv6 Module 66 Security Convergence

CEHv6 Module 66 Security Convergence



DOWNLOAD LINK:  CEHv6 Module 66 Security Convergence

Read more..

CEHv6 Module 67 Identifying the Terrorists

CEHv6 Module 67 Identifying the Terrorists


DOWNLOAD LINK:  CEHv6 Module 67 Identifying the Terrorists

Read more..

CEHv6 Module 15 Session Hijacking

CEHv6 Module 15 Session Hijacking

DOWNLOAD LINK: CEHv6 Module 15 Session Hijacking

Read more..

CEHv6 Module 13 Hacking Email Accounts

CEHv6 Module 13 Hacking Email Accounts

DOWNLOAD LINK: CEHv6 Module 13 Hacking Email Accounts

Read more..

How To 'Hack' a Coca Cola Machine

How To 'Hack' a Coca Cola Machine

Ok... Lets go, It is possible to get ur 'soda' (r0fl) for free

DOWNLOAD LINK: Hacking_a_Coke_Machine.pdf - 117 Kb

Read more..

CEHv6 Module 07 System Hacking

CEHv6 Module 07 System Hacking


DOWNLOAD LINK: CEHv6 Module 07 System Hacking.pdf - 15.1 Mb

Read more..

CEHv6 Module 06 Enumeration

CEHv6 Module 06 Enumeration

DOWNLOAD LINK: CEHv6 Module 06 Enumeration.pdf - 4.0 Mb

Read more..

CEHv6 Module 05 Scanning

CEHv6 Module 05 Scanning


DOWNLOADLINK: CEHv6 Module 05 Scanning.pdf - 16.6 Mb

Read more..

CEHv6 Module 04 Google Hacking

CEHv6 Module 04 Google Hacking

DOWNLOAD LINK: CEHv6 Module 04 Google Hacking.pdf - 4.2 Mb

Read more..

CEHv6 Module 03 Footprinting

CEHv6 Module 03 Footprinting

DOWNLOAD LINK: CEHv6 Module 03 Footprinting.pdf - 10.0 Mb

Read more..

CEHv6 Module 02 Hacking Laws

CEHv6 Module 02 Hacking Laws

DOWNLOAD LINK:  CEHv6 Module 02 Hacking Laws.pdf - 3.6 Mb

Read more..

CEHv6 Module 01 Introduction to Ethical Hacking

 CEHv6 Module 01 Introduction to Ethical Hacking

http://www.ziddu.com/download/12964357/CEHv6Module01IntroductiontoEthicalHacking.pdf.html

Read more..

Ethical Hacking & Countermeasures

Ethical Hacking
The explosive growth of the Internet has brought
rather than just theorizing about programming.
This complimentary description was often extended
many good things: electronic commerce, easy access
to vast stores of reference material, collaborative
computing, e-mail, and new avenues for advertising
and information distribution, to name a few. As with
most technological advances, there is also a dark
side: criminal hackers. Governments, companies,
and private citizens around the world are anxious
to be a part of this revolution, but they are afraid
that some hacker will break into their Web server
and replace their logo with pornography, read
their e-mail, steal their credit card number from
an on-line shopping site, or implant software
that will secretly transmit their organization’s
secrets to the open Internet. With these
concerns and others, the ethical hacker can help.
The term “hacker” has a dual usage in the computer
industry today. Originally, the term was defi ned as:
HACKER noun. 1. A person who enjoys learning
the details of computer systems and how to
stretch their capabilities—as opposed to most
users of computers, who prefer to learn only the
minimum amount necessary. 2. One who programs
enthusiastically or who enjoys programming
to the verb form “hacking,” which was used to describe
the rapid crafting of a new program or the making of
changes to existing, usually complicated software.
Occasionally the less talented, or less careful,
intruders would accidentally bring down a system
or damage its fi les, and the system administrators
would have to restart it or make repairs. Other
times, when these intruders were again denied
access once their activities were discovered, they
would react with purposefully destructive actions.
When the number of these destructive computer
intrusions became noticeable, due to the visibility
of the system or the extent of the damage infl icted,
it became “news” and the news media picked up
on the story. Instead of using the more accurate
term of “computer criminal,” the media began
using the term “hacker” to describe individuals
who break into computers for fun, revenge, or
profi t. Since calling someone a “hacker” was
originally meant as a compliment, computer
security professionals prefer to use the term
“cracker” or “intruder” for those hackers who turn
to the dark side of hacking. There are two types
of hackers “ethical hacker” and “criminal hacker”......

http://www.ziddu.com/download/12261933/EthicalHackingCountermeasures.pdf.html

Read more..