Kali Linux Web Penetration Testing Cookbook

Kali Linux Web Penetration Testing Cookbook

By : Gilberto Najera-Gutierrez

Buy this Book

Kali Linux Web Penetration Testing Cookbook

By: Gilberto Najera-Gutierrez

Buy this Book

Overview of this book

Web applications are a huge point of attack for malicious hackers and a critical area for security professionals and penetration testers to lock down and secure. Kali Linux is a Linux-based penetration testing platform and operating system that provides a huge array of testing tools, many of which can be used specifically to execute web penetration testing. This book will teach you, in the form step-by-step recipes, how to detect a wide array of vulnerabilities, exploit them to analyze their consequences, and ultimately buffer attackable surfaces so applications are more secure, for you and your users. Starting from the setup of a testing laboratory, this book will give you the skills you need to cover every stage of a penetration test: from gathering information about the system and the application to identifying vulnerabilities through manual testing and the use of vulnerability scanners to both basic and advanced exploitation techniques that may lead to a full system compromise. Finally, we will put this into the context of OWASP and the top 10 web application vulnerabilities you are most likely to encounter, equipping you with the ability to combat them effectively. By the end of the book, you will have the required skills to identify, exploit, and prevent web application vulnerabilities.

Kali Linux Web Penetration Testing Cookbook

Credits

About the Author

About the Reviewers

www.PacktPub.com

Preface

Free Chapter

Setting Up Kali Linux

Introduction

Updating and upgrading Kali Linux

Installing and running OWASP Mantra

Setting up the Iceweasel browser

Installing VirtualBox

Creating a vulnerable virtual machine

Creating a client virtual machine

Configuring virtual machines for correct communication

Getting to know web applications on a vulnerable VM

Reconnaissance

Introduction

Scanning and identifying services with Nmap

Identifying a web application firewall

Watching the source code

Using Firebug to analyze and alter basic behavior

Obtaining and modifying cookies

Taking advantage of robots.txt

Finding files and folders with DirBuster

Password profiling with CeWL

Using John the Ripper to generate a dictionary

Finding files and folders with ZAP

Crawlers and Spiders

Introduction

Downloading a page for offline analysis with Wget

Downloading the page for offline analysis with HTTrack

Using ZAP's spider

Using Burp Suite to crawl a website

Repeating requests with Burp's repeater

Using WebScarab

Identifying relevant files and directories from crawling results

Finding Vulnerabilities

Introduction

Using Hackbar add-on to ease parameter probing

Using Tamper Data add-on to intercept and modify requests

Using ZAP to view and alter requests

Using Burp Suite to view and alter requests

Identifying cross-site scripting (XSS) vulnerabilities

Identifying error based SQL injection

Identifying a blind SQL Injection

Identifying vulnerabilities in cookies

Obtaining SSL and TLS information with SSLScan

Looking for file inclusions

Identifying POODLE vulnerability

Automated Scanners

Introduction

Scanning with Nikto

Finding vulnerabilities with Wapiti

Using OWASP ZAP to scan for vulnerabilities

Scanning with w3af

Using Vega scanner

Finding Web vulnerabilities with Metasploit's Wmap

Exploitation – Low Hanging Fruits

Introduction

Abusing file inclusions and uploads

Exploiting OS Command Injections

Exploiting an XML External Entity Injection

Brute-forcing passwords with THC-Hydra

Dictionary attacks on login pages with Burp Suite

Obtaining session cookies through XSS

Step by step basic SQL Injection

Finding and exploiting SQL Injections with SQLMap

Attacking Tomcat's passwords with Metasploit

Using Tomcat Manager to execute code

Advanced Exploitation

Introduction

Searching Exploit-DB for a web server's vulnerabilities

Exploiting Heartbleed vulnerability

Exploiting XSS with BeEF

Exploiting a Blind SQLi

Using SQLMap to get database information

Performing a cross-site request forgery attack

Executing commands with Shellshock

Cracking password hashes with John the Ripper by using a dictionary

Cracking password hashes by brute force using oclHashcat/cudaHashcat

Man in the Middle Attacks

Introduction

Setting up a spoofing attack with Ettercap

Being the MITM and capturing traffic with Wireshark

Modifying data between the server and the client

Setting up an SSL MITM attack

Obtaining SSL data with SSLsplit

Performing DNS spoofing and redirecting traffic

Client-Side Attacks and Social Engineering

Introduction

Creating a password harvester with SET

Using previously saved pages to create a phishing site

Creating a reverse shell with Metasploit and capturing its connections

Using Metasploit's browser_autpwn2 to attack a client

Attacking with BeEF

Tricking the user to go to our fake site

Mitigation of OWASP Top 10

Introduction

A1 – Preventing injection attacks

A2 – Building proper authentication and session management

A3 – Preventing cross-site scripting

A4 – Preventing Insecure Direct Object References

A5 – Basic security configuration guide

A6 – Protecting sensitive data

A7 – Ensuring function level access control

A8 – Preventing CSRF

A9 – Where to look for known vulnerabilities on third-party components

A10 – Redirect validation

Index

Customer Reviews

5 star

4 star

3 star

2 star

1 star

Setting up an SSL MITM attack

If we try to sniff on an HTTPS session using what we have seen so far, we won't be able to get very much from it as all communication is encrypted.

In order to intercept, read and alter SSL and TLS connections, we need to do a series of preparatory steps to set up our SSL proxy. SSLsplit works by using two certificates, one to tell the server that it is the client so that it can receive and decrypt server responses and one to tell the client that it is the server. For this second certificate, if we are going to supplant a site which possesses its own domain name, and its certificates have been signed by a Certificate Authority (CA) we need to have a CA to issue a root certificate for us and, as we are acting as attackers, we need to do it ourselves.

In this recipe, we will configure our own Certificate Authority and a few IP forwarding rules to carry out SSL Man In The Middle attacks.

How to do it...

Firstly, we are going to create a CA private key on the Kali...

Kali Linux Web Penetration Testing Cookbook

By : Gilberto Najera-Gutierrez

Kali Linux Web Penetration Testing Cookbook

By: Gilberto Najera-Gutierrez

Overview of this book

Related Content you might be interested in

Current Title:

Kali Linux Web Penetration Testing Cookbook

Setting up an SSL MITM attack

How to do it...