Sophisticated Client-side Attacks | Mastering Metasploit

Sign In Start Free Trial

Book Overview & Buying
Table Of Contents

Mastering Metasploit

By : Nipun Jaswal

4.7 (15)

Mastering Metasploit

4.7 (15)

By: Nipun Jaswal

Overview of this book

A comprehensive and detailed, step by step tutorial guide that takes you through important aspects of the Metasploit framework. If you are a penetration tester, security engineer, or someone who is looking to extend their penetration testing skills with Metasploit, then this book is ideal for you. The readers of this book must have a basic knowledge of using Metasploit. They are also expected to have knowledge of exploitation and an indepth understanding of object-oriented programming languages.

Mastering Metasploit

Mastering Metasploit

Credits

Credits

About the Author

About the Author

About the Reviewers

About the Reviewers

www.PacktPub.com

www.PacktPub.com

Preface

Preface

Free Chapter

Approaching a Penetration Test Using Metasploit

Approaching a Penetration Test Using Metasploit

Setting up the environment

Mounting the environment

Conducting a penetration test with Metasploit

The dominance of Metasploit

Summary

Reinventing Metasploit

Reinventing Metasploit

Ruby – the heart of Metasploit

Developing custom modules

Breakthrough meterpreter scripting

Working with RailGun

Summary

The Exploit Formulation Process

The Exploit Formulation Process

The elemental assembly primer

The joy of fuzzing

Building up the exploit base

Finalizing the exploit

The fundamentals of a structured exception handler

Summary

Porting Exploits

Porting Exploits

Porting a Perl-based exploit

Porting a Python-based exploit

Porting a web-based exploit

Summary

Offstage Access to Testing Services

Offstage Access to Testing Services

The fundamentals of SCADA

SCADA torn apart

Securing SCADA

Database exploitation

VOIP exploitation

Post-exploitation on Apple iDevices

Summary

Virtual Test Grounds and Staging

Virtual Test Grounds and Staging

Performing a white box penetration test

Generating manual reports

Performing a black box penetration test

Summary

Sophisticated Client-side Attacks

Sophisticated Client-side Attacks

Exploiting browsers

File format-based exploitation

Compromising XAMPP servers

Compromising the clients of a website

Bypassing AV detections

Conjunction with DNS spoofing

Attacking Linux with malicious packages

Summary

The Social Engineering Toolkit

The Social Engineering Toolkit

Explaining the fundamentals of the social engineering toolkit

Attacking with SET

Providing additional features and further readings

Summary

Speeding Up Penetration Testing

Speeding Up Penetration Testing

Introducing automated tools

Fast Track MS SQL attack vectors

Automated exploitation in Metasploit

Fake updates with the DNS-spoofing attack

Summary

Visualizing with Armitage

Visualizing with Armitage

The fundamentals of Armitage

Scanning networks and host management

Exploitation with Armitage

Post-exploitation with Armitage

Attacking on the client side with Armitage

Scripting Armitage

Summary

Further reading

Index

Index

Chapter 7. Sophisticated Client-side Attacks

Covering the coding part of the Metasploit framework and the penetration testing numerous environments, we are now set to introduce client-side exploitation. Throughout this and a couple of more chapters, we will detail client-side exploitation. Let's check what we have in store in this chapter. We will focus on client-based exploitation with Metasploit, which will be covered through the following key points:

Attacking the victim's browsers
Sophisticated attack vectors to trick the client
Attacking web servers
Bypassing antivirus detections
Attacking Linux with malicious packages
Injecting payloads into various files

Client-based exploitation requires some help from the client in order to execute properly. Help can be in the form of visiting a malicious URL, opening and executing a file, and so on. This means we need the help of the victims to exploit their system successfully. Therefore, the dependency on the victim is a critical factor in client-side...

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Mastering Metasploit

Search

Your notes and bookmarks