Kali Linux Intrusion and Exploitation Cookbook

Kali Linux Intrusion and Exploitation Cookbook

By : Dhruv Shah, Ishan Girdhar

Buy this Book

Kali Linux Intrusion and Exploitation Cookbook

By: Dhruv Shah, Ishan Girdhar

Buy this Book

Overview of this book

With the increasing threats of breaches and attacks on critical infrastructure, system administrators and architects can use Kali Linux 2.0 to ensure their infrastructure is secure by finding out known vulnerabilities and safeguarding their infrastructure against unknown vulnerabilities. This practical cookbook-style guide contains chapters carefully structured in three phases – information gathering, vulnerability assessment, and penetration testing for the web, and wired and wireless networks. It's an ideal reference guide if you’re looking for a solution to a specific problem or learning how to use a tool. We provide hands-on examples of powerful tools/scripts designed for exploitation. In the final section, we cover various tools you can use during testing, and we help you create in-depth reports to impress management. We provide system engineers with steps to reproduce issues and fix them.

Title Page

Credits

About the Authors

About the Reviewers

www.PacktPub.com

Customer Feedback

Preface

Free Chapter

Getting Started - Setting Up an Environment

Introduction

Installing Kali Linux on Cloud - Amazon AWS

Installing Kali Linux on Docker

Installing NetHunter on OnePlus One

Installing Kali Linux on a virtual machine

Customizing Kali Linux for faster package updates

Customizing Kali Linux for faster operations

Configuring remote connectivity services - HTTP, TFTP, and SSH

Configuring Nessus and Metasploit

Configuring third-party tools

Installing Docker on Kali Linux

Network Information Gathering

Introduction

Discovering live servers over the network

Bypassing IDS/IPS/firewall

Discovering ports over the network

Using unicornscan for faster port scanning

Service fingerprinting

Determining the OS using nmap and xprobe2

Service enumeration

Open-source information gathering

Network Vulnerability Assessment

Introduction

Using nmap for manual vulnerability assessment

Integrating nmap with Metasploit

Walkthrough of Metasploitable assessment with Metasploit

Vulnerability assessment with OpenVAS framework

Network Exploitation

Introduction

Gathering information for credential cracking

Cracking FTP login using custom wordlist

Cracking SSH login using custom wordlist

Cracking HTTP logins using custom wordlist

Cracking MySql and PostgreSQL login using custom wordlist

Cracking Cisco login using custom wordlist

Exploiting vulnerable services (Unix)

Exploiting vulnerable services (Windows)

Exploiting services using exploit-db scripts

Web Application Information Gathering

Introduction

Setting up API keys for recon-ng

Using recon-ng for reconnaissance

Gathering information using theharvester

Using DNS protocol for information gathering

Web application firewall detection

HTTP and DNS load balancer detection

Discovering hidden files/directories using DirBuster

CMS and plugins detection using WhatWeb and p0f

Finding SSL cipher vulnerabilities

Web Application Vulnerability Assessment

Introduction

Running vulnerable web applications in Docker

Using W3af for vulnerability assessment

Using Nikto for web server assessment

Using Skipfish for vulnerability assessment

Using Burp Proxy to intercept HTTP traffic

Using Burp Intruder for customized attack automation

Using Burp Sequencer to test the session randomness

Web Application Exploitation

Introduction

Using Burp for active/passive scanning

Using sqlmap to find SQL Injection on the login page

Exploiting SQL Injection on URL parameters using SQL Injection

Using Weevely for file upload vulnerability

Exploiting Shellshock using Burp

Using Metasploit to exploit Heartbleed

Using the FIMAP tool for file inclusion attacks (RFI/LFI)

System and Password Exploitation

Introduction

Using local password-attack tools

Cracking password hashes

Using Social-Engineering Toolkit

Using BeEF for browser exploitation

Cracking NTLM hashes using rainbow tables

Privilege Escalation and Exploitation

Introduction

Using WMIC to find privilege-escalation vulnerabilities

Sensitive-information gathering

Unquoted service-path exploitation

Service permission issues

Misconfigured software installations/insecure file permissions

Linux privilege escalation

Wireless Exploitation

Introduction

Setting up a wireless network

Bypassing MAC address filtering

Sniffing network traffic

Cracking WEP encryption

Cracking WPA/WPA2 encryption

Cracking WPS

Denial-of-service attacks

Pen Testing 101 Basics

Introduction

What is penetration testing?

What is vulnerability assessment

Penetration testing versus vulnerability assessment

Objectives of penetration testing

Types of penetration testing

Who should be doing penetration testing?

What is the goal here?

General penetration testing phases

Conclusion

Customer Reviews

5 star

4 star

3 star

2 star

1 star

Configuring remote connectivity services - HTTP, TFTP, and SSH

During penetration testing and auditing, we will be required to deliver payload on target machines from our Linux. For that purpose, we will leverage basic network services such as HTTP, FTP, and SSH. Services such as and SSH are installed by default in Kali Linux but Kali does not enable any network services to minimize detection.

In this recipe, we will show you to configure and start running services securely:

Getting ready

For this recipe, you will need a to the Internet with a valid IP address.

How to do it...

Perform the following steps for this recipe:

Let's begin with starting an Apache webserver. To start the Apache service, use the following command:

      service apache2 start

You can verify that the service is by to the localhost using a as shown in the screenshot:

To start the SSH service, SSH keys needs to be generated. Back in Backtrack r5, you used to generate SSH keys using the sshd-generate command, which is not available in Kali Linux. Using default SSH keys is a security risk and therefore a new SSH key should be generated. To generate SSH keys, you can either delete or backup your default keys generated by Kali Linux:

      # cd /etc/ssh
      # mkdir default_kali_keys
      # mv ssh_host_* default_kali_keys/
      # cd /root/

First, we need remove run levels for SSH by issuing the following command:

      # update-rc.d -f ssh remove

Now we need to the SSH run by issuing the command:

      # update-rc.d -f ssh defaults

Regenerate the keys:

      # dpkg-reconfigure openssh-server 
      Creating SSH2 RSA key; this may take some time ...
      Creating SSH2 DSA key; this may take some time ...
      Creating SSH2 ECDSA key; this may take some time ...
      insserv: warning: current start runlevel(s) (empty) of script 
      `ssh' overrides LSB defaults (2 3 4 5).
      insserv: warning: current stop runlevel(s) (2 3 4 5) of script 
      `ssh' overrides LSB defaults (empty).

You can check whether the SSH key hashes are different now:

Start the SSH service using the following command:

      service ssh start

You can verify the service is using the netstat command:

      netstat - antp | grep ssh

Start the FTP server using the command:

      service pure-ftpd start

To verify that the service is running, use the following command:

      netstat -ant | grep ftp

To stop any service, you can the following command:

      service <servicename> stop

Here, <servicename> is the name of service required to terminate:

      service ssh stop

How it works...

In this recipe, we have configured and started basic network services, which we will be using to deliver payloads to our victim machines depending on the scenario. We have started HTTP service, FTP service, and we have backed up default SSH keys and generated new SSH keys, and started the SSH service.

Kali Linux Intrusion and Exploitation Cookbook

By : Dhruv Shah, Ishan Girdhar

Kali Linux Intrusion and Exploitation Cookbook

By: Dhruv Shah, Ishan Girdhar

Overview of this book

Related Content you might be interested in

Current Title:

Kali Linux Intrusion and Exploitation Cookbook

Machine Learning with Spark

Kali Linux 2018: Assuring Security by Penetration Testing

Kali Linux - An Ethical Hacker's Cookbook

Configuring remote connectivity services - HTTP, TFTP, and SSH

Getting ready

How to do it...

How it works...