Kali Linux Penetration Testing Bible

Information Gathering 89 Passive Footprinting and Reconnaissance 90 Internet Search Engines 90 Shodan 91 Google Queries 92 Information Gathering Using Kali Linux 94 Whois Database 95 TheHarvester 97 DMitry 99 Maltego 99 Summary 103 Chapter 5 Social Engineering Attacks 105 Spear Phishing Attacks 105 Sending an E-mail 106 The Social Engineer Toolkit 106 Sending an E-mail Using Python 108 Stealing Credentials 109 Payloads and Listeners 110 Bind Shell vs. Reverse Shell 111 Bind Shell 111 Reverse Shell 112 Reverse Shell Using SET 113 Social Engineering with the USB Rubber Ducky 115 A Practical Reverse Shell Using USB Rubber Ducky and PowerShell 117 Generating a PowerShell Script 118 Starting a Listener 118 Hosting the PowerShell Script 119 Running PowerShell 120 Download and Execute the PS Script 120 Reverse Shell 121 Replicating the Attack Using the USB Rubber Ducky 122 Summary 122 Chapter 6 Advanced Enumeration Phase 125 Transfer Protocols 126 FTP (Port 21) 126 Exploitation Scenarios for an FTP Server 126 Enumeration Workflow 127 Service Scan 127 Advanced Scripting Scan with Nmap 128 More Brute-Forcing Techniques 129 SSH (Port 22) 130 Exploitation Scenarios for an SSH Server 130 Advanced Scripting Scan with Nmap 131 Brute-Forcing SSH with Hydra 132 Advanced Brute-Forcing Techniques 133 Telnet (Port 23) 134 Exploitation Scenarios for Telnet Server 135 Enumeration Workflow 135 Service Scan 135 Advanced Scripting Scan 136 Brute-Forcing with Hydra 136 E-mail Protocols 136 SMTP (Port 25) 137 Nmap Basic Enumeration 137 Nmap Advanced Enumeration 137 Enumerating Users 138 POP3 (Port 110) and IMAP4 (Port 143) 141 Brute-Forcing POP3 E-mail Accounts 141 Database Protocols 142 Microsoft SQL Server (Port 1433) 142 Oracle Database Server (Port 1521) 143 MySQL (Port 3306) 143 CI/CD Protocols 143 Docker (Port 2375) 144 Jenkins (Port 8080/50000) 145 Brute-Forcing a Web Portal Using Hydra 147 Step 1: Enable a Proxy 148 Step 2: Intercept the Form Request 149 Step 3: Extracting Form Data and Brute-Forcing with Hydra 150 Web Protocols 80/443 151 Graphical Remoting Protocols 152 RDP (Port 3389) 152 RDP Brute-Force 152 VNC (Port 5900) 153 File Sharing Protocols 154 SMB (Port 445) 154 Brute-Forcing SMB 156 SNMP (Port UDP 161) 157 SNMP Enumeration 157 Summary 159 Chapter 7 Exploitation Phase 161 Vulnerabilities Assessment 162 Vulnerability Assessment Workflow 162 Vulnerability Scanning with OpenVAS 164 Installing OpenVAS 164 Scanning with OpenVAS 165 Exploits Research 169 SearchSploit 171 Services Exploitation 173 Exploiting FTP Service 173 FTP Login 173 Remote Code Execution 174 Spawning a Shell 177 Exploiting SSH Service 178 SSH Login 178 Telnet Service Exploitation 179 Telnet Login 179 Sniffing for Cleartext Information 180 E-mail Server Exploitation 183 Docker Exploitation 185 Testing the Docker Connection 185 Creating a New Remote Kali Container 186 Getting a Shell into the Kali Container 187 Docker Host Exploitation 188 Exploiting Jenkins 190 Reverse Shells 193 Using Shells with Metasploit 194 Exploiting the SMB Protocol 196 Connecting to SMB Shares 196 SMB Eternal Blue Exploit 197 Summary 198 Chapter 8 Web Application Vulnerabilities 199 Web Application Vulnerabilities 200 Mutillidae Installation 200 Apache Web Server Installation 200 Firewall Setup 201 Installing PHP 201 Database Installation and Setup 201 Mutillidae Installation 202 Cross-Site Scripting 203 Reflected XSS 203 Stored XSS 204 Exploiting XSS Using the Header 205 Bypassing JavaScript Validation 207 SQL Injection 208 Querying the Database 208 Bypassing the Login Page 211 Execute Database Commands Using SQLi 211 SQL Injection Automation with SQLMap 215 Testing for SQL Injection 216 Command Injection 217 File Inclusion 217 Local File Inclusion 218 Remote File Inclusion 219 Cross-Site Request Forgery 220 The Attacker Scenario 221 The Victim Scenario 222 File Upload 223 Simple File Upload 223 Bypassing Validation 225 Encoding 227 OWASP Top 10 228 Summary 229 Chapter 9 Web Penetration Testing and Secure Software Development Lifecycle 231 Web Enumeration and Exploitation 231 Burp Suite Pro 232 Web Pentest Using Burp Suite 232 More Enumeration 245 Nmap 246 Crawling 246 Vulnerability Assessment 247 Manual Web Penetration Testing Checklist 247 Common Checklist 248 Special Pages Checklist 248 Secure Software Development Lifecycle 250 Analysis/Architecture Phase 251 Application Threat Modeling 251 Assets 251 Entry Points 252 Third Parties 252 Trust Levels 252 Data Flow Diagram 252 Development Phase 252 Testing Phase 255 Production Environment (Final Deployment) 255 Summary 255 Chapter 10 Linux Privilege Escalation 257 Introduction to Kernel Exploits and Missing Configurations 258 Kernel Exploits 258 Kernel Exploit: Dirty Cow 258 SUID Exploitation 261 Overriding the Passwd Users File 263 CRON Jobs Privilege Escalation 264 CRON Basics 265 Crontab 265 Anacrontab 266 Enumerating and Exploiting CRON 266 sudoers 268 sudo Privilege Escalation 268 Exploiting the Find Command 268 Editing the sudoers File 269 Exploiting Running Services 270 Automated Scripts 270 Summary 271 Chapter 11 Windows Privilege Escalation 273 Windows System Enumeration 273 System Information 274 Windows Architecture 275 Listing the Disk Drives 276 Installed Patches 276 Who Am I? 276 List Users and Groups 277 Networking Information 279 Showing Weak Permissions 282 Listing Installed Programs 283 Listing Tasks and Processes 283 File Transfers 284 Windows Host Destination 284 Linux Host Destination 285 Windows System Exploitation 286 Windows Kernel Exploits 287 Getting the OS Version 287 Find a Matching Exploit 288 Executing the Payload and Getting a Root Shell 289 The Metasploit PrivEsc Magic 289 Exploiting Windows Applications 293 Running As in Windows 295 PSExec Tool 296 Exploiting Services in Windows 297 Interacting with Windows Services 297 Misconfigured Service Permissions 297 Overriding the Service Executable 299 Unquoted Service Path 299 Weak Registry Permissions 301 Exploiting the Scheduled Tasks 302 Windows PrivEsc Automated Tools 302 PowerUp 302 WinPEAS 303 Summary 304 Chapter 12 Pivoting and Lateral Movement 305 Dumping Windows Hashes 306 Windows NTLM Hashes 306 SAM File and Hash Dump 307 Using the Hash 308 Mimikatz 308 Dumping Active Directory Hashes 310 Reusing Passwords and Hashes 310 Pass the Hash 311 Pivoting with Port Redirection 312 Port Forwarding Concepts 312 SSH Tunneling and Local Port Forwarding 314 Remote Port Forwarding Using SSH 315 Dynamic Port Forwarding 316 Dynamic Port Forwarding Using SSH 316 Summary 317 Chapter 13 Cryptography and Hash Cracking 319 Basics of Cryptography 319 Hashing Basics 320 One-Way Hash Function 320 Hashing Scenarios 321 Hashing Algorithms 321 Message Digest 5 321 Secure Hash Algorithm 323 Hashing Passwords 323 Securing Passwords with Hash 324 Hash-Based Message Authenticated Code 325 Encryption Basics 326 Symmetric Encryption 326 Advanced Encryption Standard 326 Asymmetric Encryption 328 Rivest Shamir Adleman 329 Cracking Secrets with Hashcat 331 Benchmark Testing 332 Cracking Hashes in Action 334 Attack Modes 336 Straight Mode 336 Combinator 337 Mask and Brute-Force Attacks 339 Brute-Force Attack 342 Hybrid Attacks 342 Cracking Workflow 343 Summary 344 Chapter 14 Reporting 345 Overview of Reports in Penetration Testing 345 Scoring Severities 346 Common Vulnerability Scoring System Version 3.1 346 Report Presentation 349 Cover Page 350 History Logs 350 Report Summary 350 Vulnerabilities Section 350 Summary 351 Chapter 15 Assembly Language and Reverse Engineering 353 CPU Registers 353 General CPU Registers 354 Index Registers 355 Pointer Registers 355 Segment Registers 355 Flag Registers 357 Assembly Instructions 358 Little Endian 360 Data Types 360 Memory Segments 361 Addressing Modes 361 Reverse Engineering Example 361 Visual Studio Code for C/C++ 362 Immunity Debugger for Reverse Engineering 363 Summary 368 Chapter 16 Buffer/Stack Overflow 369 Basics of Stack Overflow 369 Stack Overview 370 PUSH Instruction 370 POP Instruction 371 C Program Example 371 Buffer Analysis with Immunity Debugger 372 Stack Overflow 376 Stack Overflow Mechanism 377 Stack Overflow Exploitation 378 Lab Overview 379 Vulnerable Application 379 Phase 1: Testing 379 Testing the Happy Path 379 Testing the Crash 381 Phase 2: Buffer Size 382 Pattern Creation 382 Offset Location 382 Phase 3: Controlling EIP 383 Adding the JMP Instruction 384 Phase 4: Injecting the Payload and Getting a Remote Shell 386 Payload Generation 386 Bad Characters 386 Shellcode Python Script 387 Summary 388 Chapter 17 Programming with Python 389 Basics of Python 389 Running Python Scripts 390 Debugging Python Scripts 391 Installing VS Code on Kali 391 Practicing Python 392 Python Basic Syntaxes 393 Python Shebang 393 Comments in Python 393 Line Indentation and Importing Modules 394 Input and Output 394 Printing CLI Arguments 395 Variables 395 Numbers 395 Arithmetic Operators 397 Strings 397 String Formatting 397 String Functions 398 Lists 399 Reading Values in a List 399 Updating List Items 399 Removing a list item 400 Tuples 400 Dictionary 400 More Techniques in Python 400 Functions 400 Returning Values 401 Optional Arguments 401 Global Variables 402 Changing Global Variables 402 Conditions 403 if/else Statement 403 Comparison Operators 403 Loop Iterations 404 while Loop 404 for Loop 405 Managing Files 406 Exception Handling 407 Text Escape Characters 407 Custom Objects in Python 408 Summary 409 Chapter 18 Pentest Automation with Python 411 Penetration Test Robot 411 Application Workflow 412 Python Packages 414 Application Start 414 Input Validation 415 Code Refactoring 417 Scanning for Live Hosts 418 Ports and Services Scanning 420 Attacking Credentials and Saving the Results 423 Summary 426 Appendix A Kali Linux Desktop at a Glance 427 Downloading and Running a VM of Kali Linux 428 Virtual Machine First Boot 428 Kali Xfce Desktop 429 Kali Xfce Menu 430 Search Bar 430 Favorites Menu Item 430 Usual Applications 432 Other Menu Items 433 Kali Xfce Settings Manager 433 Advanced Network Configuration 435 Appearance 436 Desktop 439 Display 441 File Manager 442 Keyboard 445 MIME Type Editor 447 Mouse and Touchpad 448 Panel 449 Workspaces 450 Window Manager 451 Practical Example of Desktop Customization 454 Edit the Top Panel 454 Adding a New Bottom Panel 454 Changing the Desktop Look 457 Installing Kali Linux from Scratch 458 Summary 466 Appendix B Building a Lab Environment Using Docker 467 Docker Technology 468 Docker Basics 468 Docker Installation 468 Images and Registries 469 Containers 470 Dockerfile 472 Volumes 472 Networking 473 Mutillidae Docker Container 474 Summary 475 Index 477