Penetration testing: a complete pentesting guide facilitating smooth backtracking for working hackers: a course in three modules

Cover......Page 1
Copyright......Page 3
Credits......Page 4
Preface......Page 6
Table of Contents......Page 12
Module 1: Kali Linux 2: Windows Penetration Testing......Page 18
Chapter 1: Sharpening the Saw......Page 20
 Installing Kali Linux to an encrypted USB drive......Page 21
 Running Kali from the live CD......Page 41
 Installing and configuring applications......Page 43
 Setting up and configuring OpenVAS......Page 45
 Reporting the tests......Page 52
 Running services on Kali Linux......Page 54
 Exploring the Kali Linux Top 10 and more......Page 55
 Summary......Page 56
 Footprinting the network......Page 58
 Where can you find instructions on this thing?......Page 73
 A return to OpenVAS......Page 78
 Using Maltego......Page 84
 Using Unicorn-Scan......Page 91
 Monitoring resource use with Htop......Page 96
 Monkeying around the network......Page 97
 Summary......Page 98
 Choosing the appropriate time and tool......Page 100
 Choosing the right version of Metasploit......Page 102
 Starting Metasploit......Page 103
 Creating workspaces to organize your attack......Page 108
 Using the hosts and services commands......Page 110
 Using advanced footprinting......Page 111
 Using the pivot......Page 123
 Creating the attack path......Page 125
 Summary......Page 140
 Surveying the webscape......Page 142
 Arm yourself with Armitage......Page 149
 Zinging Windows servers with OWASP ZAP......Page 161
 Search and destroy with Burp Suite......Page 173
 Summary......Page 181
Chapter 5: Sniffing and Spoofing......Page 182
 Sniffing and spoofing network traffic......Page 183
 Sniffing network traffic......Page 184
 Spoofing network traffic......Page 210
 Summary......Page 224
Chapter 6: Password Attacks......Page 226
 Password attack planning......Page 228
 My friend Johnny......Page 235
 John the Ripper (command line)......Page 242
 xHydra......Page 245
 Adding a tool to the main menu in Kali 2.x......Page 257
 Summary......Page 260
 Gaining access with Metasploit......Page 262
 Replacing the executable......Page 265
 Local privilege escalation with a standalone tool......Page 275
 Escalating privileges with physical access......Page 280
 Weaseling in with Weevely......Page 289
 Summary......Page 300
 Maintaining access......Page 302
 Maintaining access with Ncat......Page 307
 The Dropbox......Page 322
 Cracking the NAC (Network Access Controller)......Page 323
 Creating a Spear-Phishing Attack with the Social Engineering Toolkit......Page 326
 Using Backdoor-Factory to Evade Antivirus......Page 337
 Summary......Page 340
Chapter 9: Reverse Engineering and Stress Testing......Page 342
 Setting up a test environment......Page 344
 Reverse engineering theory......Page 345
 Working with Boolean logic......Page 347
 Practicing reverse engineering......Page 354
 Stresstesting Windows......Page 371
 Summary......Page 376
Chapter 10: Forensics......Page 378
 Exploring Guymager......Page 379
 Diving into Autopsy......Page 388
 Mounting image files......Page 412
 Summary......Page 413
Module 2: Web Penetration Testing with Kali LinuxSecond Edition......Page 414
Chapter 1: Introduction to Penetration Testing and Web Applications......Page 416
 Proactive security testing......Page 417
 Rules of engagement......Page 420
 The limitations of penetration testing......Page 423
 The need for testing web applications......Page 424
 Social engineering attacks......Page 427
 A web application overview for penetration testers......Page 428
 Summary......Page 440
 Kali Linux......Page 442
 Important tools in Kali Linux......Page 451
 Using Tor for penetration testing......Page 461
 Summary......Page 467
Chapter 3: Reconnaissance and Profiling the Web Server......Page 468
 Reconnaissance......Page 469
 Scanning – probing the target......Page 480
 Summary......Page 508
Chapter 4: Major Flaws in Web Applications......Page 510
 Information leakage......Page 511
 Authentication issues......Page 514
 Path traversal......Page 518
 Injection-based flaws......Page 521
 Cross-site scripting......Page 524
 Cross-site request forgery......Page 527
 Session-based flaws......Page 528
 File inclusion vulnerability......Page 532
 HTTP parameter pollution......Page 534
 HTTP response splitting......Page 536
 Summary......Page 538
Chapter 5: Attacking the Server Using Injection-based Flaws......Page 540
 Command injection......Page 541
 SQL injection......Page 558
 Summary......Page 572
Chapter 6: Exploiting Clients Using XSS and CSRF Flaws......Page 574
 The origin of cross-site scripting......Page 575
 An overview of cross-site scripting......Page 577
 Types of cross-site scripting......Page 578
 XSS and JavaScript – a deadly combination......Page 585
 Scanning for XSS flaws......Page 587
 Cross-site request forgery......Page 600
 Summary......Page 604
Chapter 7: Attacking SSL-based Websites......Page 606
 Secure socket layer......Page 607
 Summary......Page 625
Chapter 8: Exploiting the Client Using Attack Frameworks......Page 626
 Social engineering attacks......Page 627
 Social engineering toolkit......Page 629
 Spear-phishing attack......Page 630
 Website attack......Page 632
 Browser exploitation framework......Page 638
 Summary......Page 650
Chapter 9: AJAX and Web Services – Security Issues......Page 652
 Introduction to AJAX......Page 653
 Web services......Page 667
 Summary......Page 672
Chapter 10: Fuzzing Web Applications......Page 674
 Fuzzing basics......Page 675
 Types of fuzzing techniques......Page 676
 Summary......Page 692
Module 3: Hacking Android......Page 694
 Installing the required tools......Page 696
 Android Studio......Page 699
 Setting up an AVD......Page 709
 Configuring the AVD......Page 719
 ADB Primer......Page 737
 Summary......Page 741
 What is rooting?......Page 742
 Locked and unlocked boot loaders......Page 747
 Stock recovery and Custom recovery......Page 753
 Rooting Process and Custom ROM installation......Page 757
 Rooting a Samsung Note 2......Page 763
 Flashing the Custom ROM to the phone......Page 766
 Summary......Page 774
 Basics of Android apps......Page 776
 Android app components......Page 784
 Building DEX files from the command line......Page 790
 What happens when an app is run?......Page 793
 Understanding app sandboxing......Page 794
 Summary......Page 801
Chapter 4: Overview of Attacking Android Apps......Page 802
 Introduction to Android apps......Page 803
 Understanding the app's attack surface......Page 804
 Threats at the client side......Page 806
 Threats at the backend......Page 807
 Guidelines for testing and securing mobile apps......Page 808
 Automated tools......Page 813
 Identifying the attack surface......Page 817
 QARK (Quick Android Review Kit)......Page 821
 Summary......Page 832
 What is data storage?......Page 834
 Shared preferences......Page 839
 SQLite databases......Page 842
 Internal storage......Page 845
 External storage......Page 847
 User dictionary cache......Page 849
 Insecure data storage – NoSQL database......Page 850
 Backup techniques......Page 853
 Summary......Page 862
Chapter 6: Server-Side Attacks......Page 864
 Mobile applications server-side attack surface......Page 865
 Strategies for testing mobile backend......Page 867
 Summary......Page 891
Chapter 7: Client-Side Attacks – Static Analysis Techniques......Page 892
 Attacking application components......Page 893
 Static analysis using QARK:......Page 915
 Summary......Page 919
Chapter 8: Client-Side Attacks – Dynamic Analysis Techniques......Page 920
 Automated Android app assessments using Drozer......Page 921
 Introduction to Cydia Substrate......Page 947
 Runtime monitoring and analysis using Introspy......Page 949
 Hooking using Xposed framework......Page 954
 Dynamic instrumentation using Frida......Page 965
 Logging based vulnerabilities......Page 969
 WebView attacks......Page 972
 Summary......Page 977
Chapter 9: Android Malware......Page 978
 Writing Android malwares......Page 979
 Registering permissions......Page 989
 Malware analysis......Page 1002
 Tools for automated analysis......Page 1016
 Summary......Page 1017
 MitM attacks......Page 1018
 Dangers with apps that provide network level access......Page 1021
 Using existing exploits......Page 1027
 Malware......Page 1031
 Bypassing screen locks......Page 1032
 Pulling data from the sdcard......Page 1039
 Summary......Page 1040
Bibliography......Page 1042