Kali Linux - An Ethical Hacker's Cookbook

Kali Linux - An Ethical Hacker's Cookbook

By : Himanshu Sharma

Buy this Book

Kali Linux - An Ethical Hacker's Cookbook

By: Himanshu Sharma

Buy this Book

Overview of this book

With the current rate of hacking, it is very important to pentest your environment in order to ensure advanced-level security. This book is packed with practical recipes that will quickly get you started with Kali Linux (version 2016.2) according to your needs, and move on to core functionalities. This book will start with the installation and configuration of Kali Linux so that you can perform your tests. You will learn how to plan attack strategies and perform web application exploitation using tools such as Burp, and Jexboss. You will also learn how to perform network exploitation using Metasploit, Sparta, and Wireshark. Next, you will perform wireless and password attacks using tools such as Patator, John the Ripper, and airoscript-ng. Lastly, you will learn how to create an optimum quality pentest report! By the end of this book, you will know how to conduct advanced penetration testing thanks to the book’s crisp and task-oriented recipes.

Title Page

Credits

Disclaimer

About the Author

About the Reviewer

www.PacktPub.com

Customer Feedback

Preface

Free Chapter

Kali – An Introduction

Introduction

Configuring Kali Linux

Configuring the Xfce environment

Configuring the Mate environment

Configuring the LXDE environment

Configuring the e17 environment

Configuring the KDE environment

Prepping up with custom tools

Pentesting VPN's ike-scan

Setting up proxychains

Going on a hunt with Routerhunter

Gathering Intel and Planning Attack Strategies

Introduction

Getting a list of subdomains

Using Shodan for fun and profit

Shodan Honeyscore

Shodan plugins

Using Nmap to find open ports

Bypassing firewalls with Nmap

Searching for open directories

Performing deep magic with DMitry

Hunting for SSL flaws

Exploring connections with intrace

Digging deep with theharvester

Finding the technology behind web apps

Scanning IPs with masscan

Sniffing around with Kismet

Testing routers with firewalk

Vulnerability Assessment

Introduction

Using the infamous Burp

Exploiting WSDLs with Wsdler

Using Intruder

Web app pentest with Vega

Exploring SearchSploit

Exploiting routers with RouterSploit

Using Metasploit

Automating Metasploit

Writing a custom resource script

Databases in Metasploit

Web App Exploitation – Beyond OWASP Top 10

Introduction

Exploiting XSS with XSS Validator

Injection attacks with sqlmap

Owning all .svn and .git repositories

Winning race conditions

Exploiting JBoss with JexBoss

Exploiting PHP Object Injection

Backdoors using web shells

Backdoors using meterpreters

Network Exploitation on Current Exploitation

Introduction

Man in the middle with hamster and ferret

Exploring the msfconsole

Railgun in Metasploit

Using the paranoid meterpreter

A tale of a bleeding heart

Redis exploitation

Say no to SQL – owning MongoDBs

Embedded device hacking

Elasticsearch exploit

Good old Wireshark

This is Sparta!

Wireless Attacks – Getting Past Aircrack-ng

Introduction

Password Attacks – The Fault in Their Stars

Introduction

Identifying different types of hash in the wild!

Using hash-identifier

Cracking with patator

Cracking hashes online

Playing with John the ripper

Johnny Bravo!

Using cewl

Generating word list with crunch

Have Shell Now What?

Introduction

Spawning a TTY Shell

Looking for weakness

Horizontal escalation

Vertical escalation

Node hopping – pivoting

Privilege escalation on Windows

Using PowerSploit

Pulling plaintext passwords with mimikatz

Dumping other saved passwords from the machine

Pivoting into the network

Backdooring for persistence

Buffer Overflows

Introduction

Exploiting stack-based buffer overflows

Exploiting buffer overflow on real software

SEH bypass

Exploiting egg hunters

An overview of ASLR and NX bypass

Playing with Software-Defined Radios

Introduction

Radio frequency scanners

Hands-on with RTLSDR scanner

Playing around with gqrx

Kalibrating device for GSM tapping

Decoding ADS-B messages with Dump1090

Kali in Your Pocket – NetHunters and Raspberries

Introduction

Installing Kali on Raspberry Pi

Installing NetHunter

Superman typing – HID attacks

Can I charge my phone?

Setting up an evil access point

Writing Reports

Introduction

Generating reports using Dradis

Using MagicTree

Customer Reviews

5 star

4 star

3 star

2 star

1 star

Getting a list of subdomains

We don't always we have a situation where a client has defined a full detailed scope of what needs to be pentested. So we will use the following mentioned recipes to gather as much information as we can to perform a pentest.

Fierce

We start with jumping into Kali's Terminal and using the first and most widely used tool fierce.

How to do it...

The following steps demonstrate the use of fierce:

To launch fierce, we type fierce -h to see the help menu:

To perform a subdomain scan we use the following command:

        fierce -dns host.com -threads 10

The following screenshot shows the output of the preceding command:

DNSdumpster

This is a free project by Hacker Target to look up subdomains. It relies on https://scans.io/ for its results. It can also be used to get the subdomains of a website. We should always prefer to use more than one tool for subdomain enumeration as we may get something from other tools that the first one failed to pick.

How to do it...

It is pretty simple...

Kali Linux - An Ethical Hacker's Cookbook

By : Himanshu Sharma

Kali Linux - An Ethical Hacker's Cookbook

By: Himanshu Sharma

Overview of this book

Related Content you might be interested in

Current Title:

Kali Linux - An Ethical Hacker's Cookbook

Kali Linux 2018: Assuring Security by Penetration Testing

Kali Linux Intrusion and Exploitation Cookbook

Mastering Kali Linux for Advanced Penetration Testing

Getting a list of subdomains

Fierce

How to do it...

DNSdumpster

How to do it...