The Ultimate Kali Linux Book: Perform advanced penetration testing using Nmap, Metasploit, Aircrack-ng, and Empire, 2nd Edition

Cover
Title page
Copyright and Credits
Dedications
Contributors
Table of Contents
Preface
Section 1: Getting Started with Penetration Testing
Chapter 1: Introduction to Ethical Hacking
	Identifying threat actors and their intent
	Understanding what matters to threat actors
		Time
		Resources
		Financial factors
		Hack value
	Discovering cybersecurity terminologies
	Exploring the need for penetration testing and its phases
		Creating a penetration testing battle plan
	Understanding penetration testing approaches
		Types of penetration testing
	Exploring hacking phases
		Reconnaissance or information gathering
		Scanning and enumeration
		Gaining access
		Maintaining access
		Covering your tracks
	Understanding the Cyber Kill Chain framework
		Reconnaissance
		Weaponization
		Delivery
		Exploitation
		Installation
		Command and Control (C2)
		Actions on objectives
	Summary
	Further reading
Chaprer 2: Building a Penetration Testing Lab
	Technical requirements
	Understanding the lab overview and its technologies
	Setting up a hypervisor and virtually isolated networks
		Part 1 – deploying the hypervisor
		Part 2 – creating virtually isolated networks
	Setting up and working with Kali Linux
		Part 1 – setting up Kali Linux as a virtual machine
		Part 2 – customizing the Kali Linux virtual machine and network adapters
		Part 3 – getting started with Kali Linux
		Part 4 – updating sources and packages
	Deploying Metasploitable 2 as a target system
		Part 1 – deploying Metasploitable 2
		Part 2 – configuring networking settings
	Implementing Metasploitable 3 using Vagrant
		Part 1 – setting up the Windows version
		Part 2 – setting up the Linux version
	Setting up vulnerability web application systems
		Part 1 – deploying OWASP Juice Shop
		Part 2 – setting up OWASP Broken Web Applications
	Summary
	Further reading
Chapter 3: Setting Up for Advanced Hacking Techniques
	Technical requirements
	Building an AD red team lab
		Part 1 – installing Windows Server 2019
		Part 2 – installing Windows 10 Enterprise
		Part 2 – setting up AD services
		Part 3 – promoting to a DC
		Part 4 – creating domain users and administrator accounts
		Part 5 – disabling antimalware protection and the domain firewall
		Part 6 – setting up for file sharing and service authentication attacks
		Part 7 – joining clients to the AD domain
		Part 8 – setting up for local account takeover and SMB attacks
	Setting up a wireless penetration testing lab
		Implementing a RADIUS server
	Summary
	Further reading
Section 2: Reconnaissance and Network Penetration Testing
Chapter 4: Reconnaissance and Footprinting
	Technical requirements
	Understanding the importance of reconnaissance
		Footprinting
	Understanding passive information gathering
	Exploring open source intelligence
	Using OSINT strategies to gather intelligence
		Importance of a sock puppet
		Anonymizing your traffic
		Profiling a target organization's IT infrastructure
		Gathering employees' data
		Social media reconnaissance
		Gathering a company's infrastructure data
	Summary
	Further reading
Chapter 5: Exploring Active Information Gathering
	Technical requirements
	Understanding active reconnaissance
	Exploring Google hacking strategies
	Exploring DNS reconnaissance
		Performing DNS enumeration
		Checking for DNS zone transfer misconfiguration
		Automating OSINT
	Enumerating subdomains
		Working with DNSmap
		Exploring Sublist3r
	Profiling websites using EyeWitness
	Exploring active scanning techniques
		Spoofing MAC addresses
		Discovering live systems on a network
		Probing open service ports, services, and operating systems
		Working with evasion techniques
	Enumerating common network services
		Scanning using Metasploit
		Enumerating SMB
		Enumerating SSH
	Performing user enumeration through noisy authentication controls
	Finding data leaks in the cloud
	Summary
	Further reading
Chapter 6: Performing Vulnerability Assessments
	Technical requirements
	Nessus and its policies
		Setting up Nessus
		Scanning with Nessus
		Analyzing Nessus results
		Exporting Nessus results
	Vulnerability discovery using Nmap
	Working with Greenbone Vulnerability Manager
	Using web application scanners
		WhatWeb
		Nmap
		Metasploit
		Nikto
		WPScan
	Summary
	Further reading
Chapter 7: Understanding Network Penetration Testing
	Technical requirements
	Introduction to network penetration testing
	Working with bind and reverse shells
		Remote shells using Netcat
		Creating a bind shell
		Creating a reverse shell
	Antimalware evasion techniques
		Using MSFvenon to encode payloads
		Creating payloads using Shellter
	Working with wireless adapters
		Connecting a wireless adapter to Kali Linux
		Connecting a wireless adapter with an RTL8812AU chipset
	Managing and monitoring wireless modes
		Configuring monitor mode manually
		Using Aircrack-ng to enable monitor mode
	Summary
	Further reading
Chapter 8: Performing Network Penetration Testing
	Technical requirements
	Discovering live systems
	Profiling a target system
	Exploring password-based attacks
		Exploiting Windows Remote Desktop Protocol
		Creating wordlists using keywords
		Crunching those wordlists
	Identifying and exploiting vulnerable services
		Exploiting a vulnerable service on a Linux system
		Exploiting SMB in Microsoft Windows
		Passing the hash
		Gaining access by exploiting SSH
		Exploiting Windows Remote Management
		Exploiting ElasticSearch
		Exploiting Simple Network Management Protocol
	Understanding watering hole attacks
	Further reading
Section 3: Red Teaming Techniques
Chapter 9: Advanced Network Penetration Testing — Post-Exploitation
	Technical requirements
	Post-exploitation using Meterpreter
		Core operations
		User interface operations
		File transfers
		Privilege escalation
		Token stealing and impersonation
		Implementing persistence
		Lateral movement and pivoting
		Clearing tracks
	Data encoding and exfiltration
		Encoding executables using exe2hex
		Data exfiltration using PacketWhisper
	Understanding MITM and packet sniffing attacks
		Performing MITM attacks using Ettercap
	Summary
	Further reading
Chapter 10: Working with Active Directory Attacks
	Technical requirements
	Understanding Active Directory
	Enumerating Active Directory
		Working with PowerView
		Exploring Bloodhound
	Leveraging network-based trust
		Exploiting LLMNR and NetBIOS-NS
		Exploiting trust between SMB and NTLMv2 within Active Directory
	Summary
	Further reading
Chapter 11: Advanced Active Directory Attacks
	Technical requirements
	Understanding Kerberos
	Abusing trust on IPv6 with Active Directory
		Part 1: Setting up for the attack
		Part 2: Launching the attack
		Part 3: Taking over the domain
	Attacking Active Directory
		Lateral movement with CrackMapExec
		Vertical movement with Kerberos
		Lateral movement with Mimikatz
	Domain dominance and persistence
		Golden ticket
		Silver ticket
		Skeleton key
	Summary
	Further reading
Chapter 12: Delving into Command and Control Tactics
	Technical requirements
	Understanding C2
	Setting up C2 operations
		Part 1 – setting up Empire
		Part 2 – managing users
	Post-exploitation using Empire
		Part 1 – creating a listener
		Part 2 – creating a stager
		Part 3 – working with agents
		Part 4 – creating a new agent
		Part 5 – improving threat emulation
		Part 6 – setting up persistence
	Working with Starkiller
		Part 1 – starting Starkiller
		Part 2 – user management
		Part 3 – working with modules
		Part 4 – creating listeners
		Part 5 – creating stagers
		Part 6 – interacting with agents
		Part 7 – credentials and reporting
	Summary
	Further reading
Chapter 13: Advanced Wireless Penetration Testing
	Technical requirements
	Introduction to wireless networking
		SISO and MIMO
		Wireless security standards
	Performing wireless reconnaissance
		Determining the associated clients for a specific network
	Compromising WPA and WPA2 networks
	Performing AP-less attacks
	Exploiting enterprise wireless networks
		Part 1 – setting up for the attack
		Part 2 – choosing the target
		Part 3 – starting the attack
		Part 4 – retrieving user credentials
	Creating a Wi-Fi honeypot
	Discovering WPA3 attacks
		Performing a downgrade and dictionary attack
	Securing your wireless network
		SSID management
		MAC filtering
		Power levels for antennas
		Strong passwords
		Securing enterprise wireless networks
	Summary
	Further reading
Section 4: Social Engineering and Web Application Attacks
Chapter 14: Performing Client-Side Attacks – Social Engineering
	Technical requirements
	Fundamentals of social engineering
		Elements of social engineering
	Types of social engineering
		Human-based
		Computer-based
		Mobile-based
		Social networking
	Defending against social engineering
	Planning for each type of social engineering attack
	Exploring social engineering tools and techniques
		Creating a phishing website
		Creating infectious media
	Summary
	Further reading
Chapter 15: Understanding Web Application Security
	Technical requirements
	Understanding web applications
		Fundamentals of HTTP
	Exploring the OWASP Top 10: 2021
	Getting started with FoxyProxy and Burp Suite
		Part one – setting up FoxyProxy
		Part two – setting up Burp Suite
		Part three – getting familiar with Burp Suite
	Understanding injection-based attacks
		Performing a SQL injection attack
	Exploring broken access control attacks
		Exploring broken access control
	Discovering cryptographic failures
		Exploiting cryptographic failures
	Understanding insecure design
	Exploring security misconfiguration
		Exploiting security misconfigurations
	Summary
	Further reading
Chapter 16: Advanced Website Penetration Testing
	Technical requirements
	Identifying vulnerable and outdated components
		Discovering vulnerable components
	Exploiting identification and authentication failures
		Discovering authentication failures
	Understanding software and data integrity failures
	Understanding security logging and monitoring failures
	Performing server-side request forgery
	Automating SQL injection attacks
		Part 1 – discovering databases
		Part 2 – retrieving sensitive information
	Understanding cross-site scripting
		Part 1 – discovering reflected XSS
		Part 2 – discovering stored XSS
	Performing client-side attacks
	Summary
	Further reading
Chapter 17: Best Practices for the Real World
	Technical requirements
	Guidelines for penetration testers
		Gaining written permission
		Being ethical
		Penetration testing contract
		Rules of engagement
	Penetration testing checklist
		Information gathering
		Network scanning
		Enumeration
		Gaining access
		Covering tracks
		Report writing
	Creating a hacker's tool bag
	Setting up remote access
	Next steps ahead
	Summary
	Further reading
Index
About Packt
Other Books You May Enjoy