Book Image

Network Vulnerability Assessment

By : Sagar Rahalkar
Book Image

Network Vulnerability Assessment

By: Sagar Rahalkar

Overview of this book

The tech world has been taken over by digitization to a very large extent, and so it’s become extremely important for an organization to actively design security mechanisms for their network infrastructures. Analyzing vulnerabilities can be one of the best ways to secure your network infrastructure. Network Vulnerability Assessment starts with network security assessment concepts, workflows, and architectures. Then, you will use open source tools to perform both active and passive network scanning. As you make your way through the chapters, you will use these scanning results to analyze and design a threat model for network security. In the concluding chapters, you will dig deeper into concepts such as IP network analysis, Microsoft Services, and mail services. You will also get to grips with various security best practices, which will help you build your network security mechanism. By the end of this book, you will be in a position to build a security framework fit for an organization.

Related Content you might be interested in

Current Title:

Small book image
Network Vulnerability Assessment
Sagar Rahalkar
Aug, 2018 | 254 pages
Small book image
Metasploit for Beginners
Sagar Rahalkar
Jul, 2017 | 190 pages
Small book image
Metasploit 5.0 for Beginners
Sagar Rahalkar
Apr, 2020 | 246 pages
Small book image
Learn Kali Linux 2019
Glen D Singh
Nov, 2019 | 550 pages
Table of Contents (15 chapters)
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Get in touch
Disclaimer
Free Chapter
1
Vulnerability Management Governance
Vulnerability Management Governance
Security basics
Understanding the need for security assessments
Business drivers for vulnerability management
Calculating ROIs
Setting up the context
Policy versus procedure versus standard versus guideline
Penetration testing standards
Industry standards
Summary
Exercises
2
Setting Up the Assessment Environment
Setting Up the Assessment Environment
Setting up a Kali virtual machine
Basics of Kali Linux
Environment configuration and setup
List of tools to be used during assessment
Summary
3
Security Assessment Prerequisites
Security Assessment Prerequisites
Target scoping and planning
Gathering requirements
Deciding upon the type of vulnerability assessment
Estimating the resources and deliverables
Preparing a test plan
Getting approval and signing NDAs
Summary
4
Information Gathering
Information Gathering
What is information gathering?
Passive information gathering
Active information gathering
Summary
5
Enumeration and Vulnerability Assessment
Enumeration and Vulnerability Assessment
What is enumeration?
Enumerating services
Using Nmap scripts
Vulnerability assessments using OpenVAS
Summary
6
Gaining Network Access
Gaining Network Access
Gaining remote access
Cracking passwords
Creating backdoors using Backdoor Factory
Exploiting remote services using Metasploit
Hacking embedded devices using RouterSploit
Social engineering using SET
Summary
7
Assessing Web Application Security
Assessing Web Application Security
Importance of web application security testing
Application profiling
Common web application security testing tools
Authentication
Authorization
Session management
Input validation
Security misconfiguration
Business logic flaws
Auditing and logging
Cryptography
Testing tools
Summary
8
Privilege Escalation
Privilege Escalation
What is privilege escalation?
Horizontal versus vertical privilege escalation
Privilege escalation on Windows
Privilege escalation on Linux
Summary
9
Maintaining Access and Clearing Tracks
Maintaining Access and Clearing Tracks
Maintaining access
Clearing tracks and trails
Anti-forensics
Summary
10
Vulnerability Scoring
Vulnerability Scoring
Requirements for vulnerability scoring
Vulnerability scoring using CVSS
CVSS calculator
Summary
11
Threat Modeling
Threat Modeling
What is threat modeling?
Benefits of threat modeling
Threat modeling terminology
How to model threats?
Threat modeling techniques
Threat modeling tools
Summary
12
Patching and Security Hardening
Patching and Security Hardening
Defining patching?
Patch enumeration
Security hardening and secure configuration reviews
Summary
13
Vulnerability Reporting and Metrics
Vulnerability Reporting and Metrics
Importance of reporting
Type of reports
Reporting tools
Collaborative vulnerability management with Faraday v2.6
Metrics
Summary
14
Other Books You May Enjoy
Other Books You May Enjoy
Leave a review - let other readers know what you think

Threat modeling techniques

There are various threat modeling techniques and methodologies. STRIDE and DREAD are two of them. We will study the STRIDE and DREAD methodologies in the following sections.

STRIDE

STRIDE is an easy-to-use threat modeling methodology developed by Microsoft. STRIDE helps in identifying threats and is an abbreviation for the following terms:

  • S—spoofing: Threats in the spoofing category include an adversary creating and exploiting confusion about the identity of someone or something.

For example, an adversary sends an email to a user pretending to be someone else.

  • T—tampering: A tampering threat involves an adversary making modifications in data while in storage or in transit.

For...

Previous Section
End of Section 6
Next Section