Book Image

Building Virtual Pentesting Labs for Advanced Penetration Testing

By : Kevin Cardwell
Book Image

Building Virtual Pentesting Labs for Advanced Penetration Testing

By: Kevin Cardwell

Overview of this book

Related Content you might be interested in

Current Title:

Small book image
Building Virtual Pentesting Labs for Advanced Penetration Testing
Kevin Cardwell
Jun, 2014 | 430 pages
No titles found
Table of Contents (20 chapters)
Building Virtual Pentesting Labs for Advanced Penetration Testing
Building Virtual Pentesting Labs for Advanced Penetration Testing
Credits
Credits
About the Author
About the Author
About the Reviewers
About the Reviewers
www.PacktPub.com
www.PacktPub.com
Preface
Preface
Free Chapter
1
Introducing Penetration Testing
Introducing Penetration Testing
Security testing
Abstract testing methodology
Myths and misconceptions of pen testing
Summary
2
Choosing the Virtual Environment
Choosing the Virtual Environment
Open source and free environments
Commercial environments
Image conversion
Converting from a physical to virtual environment
Summary
3
Planning a Range
Planning a Range
Planning
Identifying vulnerabilities
Summary
4
Identifying Range Architecture
Identifying Range Architecture
Building the machines
Selecting network connections
Choosing range components
Summary
5
Identifying a Methodology
Identifying a Methodology
The OSSTMM
CHECK
NIST SP-800-115
Summary
6
Creating an External Attack Architecture
Creating an External Attack Architecture
Establishing layered architectures
Configuring firewall architectures
iptables
Summary
7
Assessment of Devices
Assessment of Devices
Assessing routers
Evaluating switches
Attacking the firewall
Identifying the firewall rules
Tricks to penetrate filters
Summary
8
Architecting an IDS/IPS Range
Architecting an IDS/IPS Range
Deploying a network-based IDS
Implementing the host-based IDS and endpoint security
Working with virtual switches
Evasion
Summary
9
Assessment of Web Servers and Web Applications
Assessment of Web Servers and Web Applications
Analyzing the OWASP Top Ten attacks
Identifying web application firewalls
Penetrating web application firewalls
Tools
Summary
10
Testing Flat and Internal Networks
Testing Flat and Internal Networks
The role of Vulnerability Scanners
Dealing with host protection
Summary
11
Attacking Servers
Attacking Servers
Common protocols and applications for servers
Database assessment
OS platform specifics
Summary
12
Exploring Client-side Attack Vectors
Exploring Client-side Attack Vectors
Client-side attack methods
Pilfering data from the client
Using the client as a pivot point
Client-side exploitation
Binary payloads
Malicious PDF files
Bypassing antivirus and other protection tools
Obfuscation and encoding
Summary
13
Building a Complete Cyber Range
Building a Complete Cyber Range
Creating the layered architecture
Integrating decoys and honeypots
Attacking the cyber range
Recording the attack data for further training and analysis
Summary
Index
Index

Analyzing the OWASP Top Ten attacks

The Open Web Application Security Project (OWASP) group is one of the best resources we can use for gathering information on not only the different types of attacks but also the ways to defend from them and secure coding guidance. As we are in our testing mode, we will concentrate on the attacks. An excellent reference for this is the OWASP Top Ten attacks. You can download the latest version at https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project.

The OWASP group also has an excellent tutorial called WebGoat. You can find more information about the tutorial at https://www.owasp.org/index.php/OWASP/Training/OWASP_WebGoat_Project.

An advantage of selecting the OWASP Broken Web Application virtual machine is the tools that come with it. Once you have started the OWASP virtual machine, you will have an address assigned for the interface that we need to connect to. For this example in the book, the interface has been assigned the IP address of 10.2...

Previous Section
End of Section 2
Next Section