Learn Kali Linux 2019: Perform Powerful Penetration Testing Using Kali Linux, Metasploit, Nessus, Nmap, And Wireshark

Cover......Page 1
Title Page......Page 2
Copyright and Credits......Page 3
Dedication......Page 4
About Packt......Page 5
Contributors......Page 6
Table of Contents......Page 8
Preface......Page 17
Section 1: Kali Linux Basics......Page 22
Chapter 1: Introduction to Hacking......Page 23
Types of hackers......Page 24
White hat hacker......Page 25
Suicide hacker......Page 26
Cyber terrorist......Page 27
Threat......Page 28
Vulnerability......Page 29
Zero-day......Page 30
Pre-engagement......Page 31
Information gathering......Page 33
Exploitation......Page 34
Report writing......Page 35
NIST......Page 36
Penetration testing approaches......Page 37
Gray box......Page 38
Mobile application penetration testing......Page 39
Cloud penetration testing......Page 40
Hacking phases......Page 41
Scanning......Page 42
Maintaining access......Page 43
Questions......Page 44
Further reading......Page 45
Technical requirements......Page 46
Virtualization......Page 47
Type 1 hypervisor......Page 50
Type 2 hypervisor......Page 52
Virtual switches......Page 53
Operating systems......Page 54
Building our lab......Page 55
Creating a virtual network......Page 58
Setting up Kali Linux......Page 63
Attaching the virtual network to a virtual machine......Page 67
Installing Nessus......Page 70
Setting up Android emulators......Page 75
Installing Metasploitable 2......Page 78
Further reading......Page 81
Technical requirements......Page 82
Installing Windows as a VM......Page 83
Creating a user account......Page 90
Opting out of automatic updates......Page 91
Setting a static IP address......Page 92
Adding additional interfaces......Page 96
Installing Ubuntu 8.10......Page 99
Creating and using snapshots......Page 106
Troubleshooting Kali Linux......Page 107
Network adapter and USB incompatibility ......Page 108
VM memory problems......Page 110
Further reading......Page 111
Chapter 4: Getting Comfortable with Kali Linux 2019......Page 112
Understanding Kali Linux......Page 113
What's new in Kali Linux 2019?......Page 114
The Terminal and Linux commands......Page 115
Navigating in Kali Linux......Page 117
Updating sources and installing programs......Page 121
The which command......Page 125
The find command......Page 126
Managing Kali Linux services......Page 128
Summary......Page 130
Further reading......Page 131
Section 2: Reconnaissance......Page 132
Chapter 5: Passive Information Gathering......Page 133
Reconnaissance......Page 134
Footprinting......Page 135
Understanding OSINT......Page 137
Maltego......Page 140
Recon-ng......Page 150
theHarvester......Page 160
Shodan......Page 163
OSRFramework......Page 165
Discovering technologies using Shodan......Page 168
The power of Netcraft......Page 170
Recognizing technologies with WhatWeb......Page 172
Finding data leaks in cloud resources......Page 174
Understanding Google hacking and search operators......Page 176
Leveraging whois and copying websites with HTTrack......Page 179
whois......Page 180
HTTrack......Page 181
Finding subdomains using Sublist3r......Page 182
Summary......Page 183
Further reading......Page 184
Chapter 6: Active Information Gathering......Page 185
Understanding active information gathering......Page 186
What is DNS and why do we need it on a network?......Page 187
Performing DNS enumeration and zone transfer using dnsenum......Page 191
Using the host utility to perform DNS analysis......Page 194
Finding subdomains with dnsmap......Page 195
DNS interrogation using Fierce......Page 196
Scanning......Page 197
Nmap......Page 199
Performing a ping sweep with Nmap......Page 201
Obtaining operating system and service versions using Nmap......Page 202
Performing a stealth scan using Nmap......Page 204
Evading detection using Nmap......Page 207
Checking for a stateful firewall......Page 208
NSE scripts......Page 211
Zenmap......Page 212
Hping3......Page 215
SMBmap and SMBclient......Page 217
Enum4linux......Page 219
LDAP enumeration......Page 220
User enumeration through noisy authentication controls......Page 223
Web footprints and enumeration with EyeWitness......Page 225
Metasploit auxiliary modules......Page 227
Summary......Page 228
Further reading......Page 229
Section 3: Vulnerability Assessment and Penetration Testing with Kali Linux 2019......Page 230
Chapter 7: Working with Vulnerability Scanners......Page 231
Nessus and its policies......Page 232
Nessus policies......Page 233
Scanning with Nessus......Page 235
Exporting Nessus results......Page 239
Analyzing Nessus results......Page 242
Using web application scanners......Page 244
Nikto......Page 245
WPScan......Page 246
Burp Suite......Page 251
Using Intruder for brute force......Page 257
Further reading......Page 264
Technical requirements......Page 265
Introduction to network penetration testing......Page 266
Types of penetration test......Page 267
Understanding the MAC address......Page 268
How to spoof the MAC address......Page 270
Connecting a wireless adapter to Kali Linux......Page 271
Managing and monitoring wireless modes......Page 275
Enabling monitor mode manually......Page 276
Enabling monitor mode using airmon-ng......Page 277
Questions......Page 279
Further reading......Page 280
Chapter 9: Network Penetration Testing - Pre-Connection Attacks......Page 281
Getting started with packet sniffing using airodump-ng......Page 282
Targeted packet sniffing using airodump-ng......Page 285
Deauthenticating clients on a wireless network......Page 286
Creating a rogue AP/evil twin......Page 289
Performing a password spraying attack......Page 294
Setting up watering hole attacks......Page 298
Exploiting weak encryption to steal credentials......Page 299
Summary......Page 304
Further reading......Page 305
Chapter 10: Network Penetration Testing - Gaining Access......Page 306
Gaining access......Page 307
WEP cracking......Page 309
WPA cracking......Page 311
Securing your network from the aforementioned attacks......Page 314
SSID management......Page 315
Power levels for antennas......Page 316
Strong passwords......Page 317
Configuring wireless security settings to secure your network......Page 318
Exploiting vulnerable perimeter systems with Metasploit......Page 322
EternalBlue exploitation......Page 327
Citrix penetration testing......Page 331
Breaking into RDP......Page 332
Leveraging user credentials......Page 335
Plugging PWN boxes and other tools directly into a network......Page 337
Bypassing NAC......Page 339
Summary......Page 340
Further reading......Page 341
Chapter 11: Network Penetration Testing - Post-Connection Attacks......Page 342
Scanning using Netdiscover......Page 343
Scanning using AutoScan-Network......Page 345
Scanning using Zenmap......Page 347
MITM attacks......Page 349
ARPspoof......Page 350
MITMf......Page 351
Use cases of MITMf......Page 353
Session hijacking......Page 355
DHCP attacks......Page 365
Exploiting LLMNR and NetBIOS-NS......Page 370
WPAD protocol attacks......Page 374
Basic overview of Wireshark and how to use it in MITM attacks......Page 378
Configuring a SPAN port......Page 380
Configuring a monitor (sniffer) interface on Wireshark......Page 381
Parsing Wireshark packet captures to find the goods......Page 383
Escalating privileges......Page 392
Lateral movement tactics......Page 394
Removing Windows Defender virus definitions......Page 397
Disabling Windows Antimalware Scan Interface......Page 399
Launching a VLAN hopping attack......Page 400
Further reading......Page 402
Technical requirements......Page 403
Using Wireshark to understand ARP......Page 404
Detecting ARP poisoning attacks......Page 405
Detecting suspicious activity......Page 407
Encryption......Page 409
Dynamic ARP inspection......Page 411
Summary......Page 413
Further reading......Page 414
Chapter 13: Client-Side Attacks - Social Engineering......Page 415
Basics of social engineering......Page 416
Types of social engineering......Page 417
Shoulder surfing......Page 418
Phishing......Page 419
Mobile-based social engineering......Page 420
Phone-based social engineering (vishing)......Page 421
Protecting your perimeter security......Page 422
Detecting phishing emails......Page 423
Recon for social engineering (doxing)......Page 425
Planning for each type of social engineering attack......Page 426
Social-Engineer Toolkit......Page 427
Ghost Phisher......Page 430
Questions......Page 433
Further reading......Page 434
Chapter 14: Performing Website Penetration Testing......Page 435
Discovering technologies that are being used on a website......Page 436
Discovering websites on the same server......Page 439
Discovering sensitive files......Page 442
robots.txt......Page 445
Analyzing discovered files......Page 446
Cryptography......Page 448
File upload and file inclusion vulnerabilities......Page 449
XSS......Page 450
CSRF......Page 451
SQLi......Page 452
Insecure deserialization......Page 453
Vulnerable components......Page 454
Exploiting file upload vulnerabilities......Page 455
Exploiting code execution vulnerabilities......Page 459
Exploiting LFI vulnerabilities......Page 461
Preventing vulnerabilities......Page 462
Further reading......Page 463
Technical requirements......Page 464
Bypassing logins using SQL injection......Page 465
SQL injection vulnerabilities and exploitation......Page 469
Discovering SQL injections with POST......Page 476
Detecting SQL injections and extracting data using SQLmap......Page 480
Cross-Site Scripting vulnerabilities......Page 481
Understanding XSS......Page 482
Discovering reflected XSS......Page 483
Discovering stored XSS......Page 484
Exploiting XSS – hooking vulnerable page visitors to BeEF......Page 486
Burp Suite......Page 492
Acunetix......Page 495
OWASP ZAP......Page 501
Further reading......Page 505
Guidelines for penetration testers......Page 506
Being ethical......Page 507
Rules of engagement......Page 508
Web application security blueprints and checklists......Page 509
OWASP......Page 510
Reporting......Page 511
Penetration testing checklist......Page 512
Enumeration......Page 513
Covering tracks......Page 514
Further reading......Page 515
Assessments......Page 517
Other Books You May Enjoy......Page 522
Index......Page 525