Kali Linux Web Penetration Testing Cookbook

Kali Linux Web Penetration Testing Cookbook

By : Gilberto Najera-Gutierrez

Buy this Book

Kali Linux Web Penetration Testing Cookbook

By: Gilberto Najera-Gutierrez

Buy this Book

Overview of this book

Web applications are a huge point of attack for malicious hackers and a critical area for security professionals and penetration testers to lock down and secure. Kali Linux is a Linux-based penetration testing platform and operating system that provides a huge array of testing tools, many of which can be used specifically to execute web penetration testing. This book will teach you, in the form step-by-step recipes, how to detect a wide array of vulnerabilities, exploit them to analyze their consequences, and ultimately buffer attackable surfaces so applications are more secure, for you and your users. Starting from the setup of a testing laboratory, this book will give you the skills you need to cover every stage of a penetration test: from gathering information about the system and the application to identifying vulnerabilities through manual testing and the use of vulnerability scanners to both basic and advanced exploitation techniques that may lead to a full system compromise. Finally, we will put this into the context of OWASP and the top 10 web application vulnerabilities you are most likely to encounter, equipping you with the ability to combat them effectively. By the end of the book, you will have the required skills to identify, exploit, and prevent web application vulnerabilities.

Kali Linux Web Penetration Testing Cookbook

Credits

About the Author

About the Reviewers

www.PacktPub.com

Preface

Free Chapter

Setting Up Kali Linux

Introduction

Updating and upgrading Kali Linux

Installing and running OWASP Mantra

Setting up the Iceweasel browser

Installing VirtualBox

Creating a vulnerable virtual machine

Creating a client virtual machine

Configuring virtual machines for correct communication

Getting to know web applications on a vulnerable VM

Reconnaissance

Introduction

Scanning and identifying services with Nmap

Identifying a web application firewall

Watching the source code

Using Firebug to analyze and alter basic behavior

Obtaining and modifying cookies

Taking advantage of robots.txt

Finding files and folders with DirBuster

Password profiling with CeWL

Using John the Ripper to generate a dictionary

Finding files and folders with ZAP

Crawlers and Spiders

Introduction

Downloading a page for offline analysis with Wget

Downloading the page for offline analysis with HTTrack

Using ZAP's spider

Using Burp Suite to crawl a website

Repeating requests with Burp's repeater

Using WebScarab

Identifying relevant files and directories from crawling results

Finding Vulnerabilities

Introduction

Using Hackbar add-on to ease parameter probing

Using Tamper Data add-on to intercept and modify requests

Using ZAP to view and alter requests

Using Burp Suite to view and alter requests

Identifying cross-site scripting (XSS) vulnerabilities

Identifying error based SQL injection

Identifying a blind SQL Injection

Identifying vulnerabilities in cookies

Obtaining SSL and TLS information with SSLScan

Looking for file inclusions

Identifying POODLE vulnerability

Automated Scanners

Introduction

Scanning with Nikto

Finding vulnerabilities with Wapiti

Using OWASP ZAP to scan for vulnerabilities

Scanning with w3af

Using Vega scanner

Finding Web vulnerabilities with Metasploit's Wmap

Exploitation – Low Hanging Fruits

Introduction

Abusing file inclusions and uploads

Exploiting OS Command Injections

Exploiting an XML External Entity Injection

Brute-forcing passwords with THC-Hydra

Dictionary attacks on login pages with Burp Suite

Obtaining session cookies through XSS

Step by step basic SQL Injection

Finding and exploiting SQL Injections with SQLMap

Attacking Tomcat's passwords with Metasploit

Using Tomcat Manager to execute code

Advanced Exploitation

Introduction

Searching Exploit-DB for a web server's vulnerabilities

Exploiting Heartbleed vulnerability

Exploiting XSS with BeEF

Exploiting a Blind SQLi

Using SQLMap to get database information

Performing a cross-site request forgery attack

Executing commands with Shellshock

Cracking password hashes with John the Ripper by using a dictionary

Cracking password hashes by brute force using oclHashcat/cudaHashcat

Man in the Middle Attacks

Introduction

Setting up a spoofing attack with Ettercap

Being the MITM and capturing traffic with Wireshark

Modifying data between the server and the client

Setting up an SSL MITM attack

Obtaining SSL data with SSLsplit

Performing DNS spoofing and redirecting traffic

Client-Side Attacks and Social Engineering

Introduction

Creating a password harvester with SET

Using previously saved pages to create a phishing site

Creating a reverse shell with Metasploit and capturing its connections

Using Metasploit's browser_autpwn2 to attack a client

Attacking with BeEF

Tricking the user to go to our fake site

Mitigation of OWASP Top 10

Introduction

A1 – Preventing injection attacks

A2 – Building proper authentication and session management

A3 – Preventing cross-site scripting

A4 – Preventing Insecure Direct Object References

A5 – Basic security configuration guide

A6 – Protecting sensitive data

A7 – Ensuring function level access control

A8 – Preventing CSRF

A9 – Where to look for known vulnerabilities on third-party components

A10 – Redirect validation

Index

Customer Reviews

5 star

4 star

3 star

2 star

1 star

Scanning and identifying services with Nmap

Nmap is probably the most used port scanner in the world. It can be used to identify live hosts, scan TCP and UDP open ports, detect firewalls, get versions of services running in remote hosts, and even, with the use of scripts, find and exploit vulnerabilities.

In this recipe, we will use Nmap to identify all the services running on our target application's server and their versions. We will do this in several calls to Nmap for learning purposes, but it can be done using a single command.

Getting ready

All we need is to have our vulnerable_vm running.

How to do it...

First, we want to see if the server is answering to a ping or if the host is up:
```
nmap -sn 192.168.56.102
```
Now that we know that it's up, let's see which ports are open:
```
nmap 192.168.56.102
```
Now, we will tell Nmap to ask the server for the versions of services it is running and to guess the operating system based on that.
```
nmap -sV -O 192.168.56.102
```
We can see that our vulnerable_vm has Linux...

Kali Linux Web Penetration Testing Cookbook

By : Gilberto Najera-Gutierrez

Kali Linux Web Penetration Testing Cookbook

By: Gilberto Najera-Gutierrez

Overview of this book

Related Content you might be interested in

Current Title:

Kali Linux Web Penetration Testing Cookbook

Scanning and identifying services with Nmap

Getting ready

How to do it...