Book Image

Kali Linux Intrusion and Exploitation Cookbook

By : Dhruv Shah, Ishan Girdhar
Book Image

Kali Linux Intrusion and Exploitation Cookbook

By: Dhruv Shah, Ishan Girdhar

Overview of this book

With the increasing threats of breaches and attacks on critical infrastructure, system administrators and architects can use Kali Linux 2.0 to ensure their infrastructure is secure by finding out known vulnerabilities and safeguarding their infrastructure against unknown vulnerabilities. This practical cookbook-style guide contains chapters carefully structured in three phases – information gathering, vulnerability assessment, and penetration testing for the web, and wired and wireless networks. It's an ideal reference guide if you’re looking for a solution to a specific problem or learning how to use a tool. We provide hands-on examples of powerful tools/scripts designed for exploitation. In the final section, we cover various tools you can use during testing, and we help you create in-depth reports to impress management. We provide system engineers with steps to reproduce issues and fix them.

Related Content you might be interested in

Current Title:

Small book image
Kali Linux Intrusion and Exploitation Cookbook
Dhruv Shah | Ishan Girdhar
Apr, 2017 | 512 pages
Small book image
Machine Learning with Spark
Manpreet Singh Ghotra | Rajdeep Dua
Apr, 2017 | 532 pages
Small book image
Kali Linux 2018: Assuring Security by Penetration Testing
Lee Allen | Alex Samm | Shakeel Ali | Damian Boodoo | Tedi Heriyanto | Gerard Johansen | Shiva V N Parasram
Oct, 2018 | 528 pages
Small book image
Kali Linux - An Ethical Hacker's Cookbook
Himanshu Sharma
Oct, 2017 | 376 pages
Table of Contents (18 chapters)
Title Page
Title Page
Credits
Credits
About the Authors
About the Authors
About the Reviewers
About the Reviewers
www.PacktPub.com
www.PacktPub.com
Customer Feedback
Customer Feedback
Preface
Preface
Free Chapter
1
Getting Started - Setting Up an Environment
Getting Started - Setting Up an Environment
Introduction
Installing Kali Linux on Cloud - Amazon AWS
Installing Kali Linux on Docker
Installing NetHunter on OnePlus One
Installing Kali Linux on a virtual machine
Customizing Kali Linux for faster package updates
Customizing Kali Linux for faster operations
Configuring remote connectivity services - HTTP, TFTP, and SSH
Configuring Nessus and Metasploit
Configuring third-party tools
Installing Docker on Kali Linux
2
Network Information Gathering
Network Information Gathering
Introduction
Discovering live servers over the network
Bypassing IDS/IPS/firewall
Discovering ports over the network
Using unicornscan for faster port scanning
Service fingerprinting
Determining the OS using nmap and xprobe2
Service enumeration
Open-source information gathering
3
Network Vulnerability Assessment
Network Vulnerability Assessment
Introduction
Using nmap for manual vulnerability assessment
Integrating nmap with Metasploit
Walkthrough of Metasploitable assessment with Metasploit
Vulnerability assessment with OpenVAS framework
4
Network Exploitation
Network Exploitation
Introduction
Gathering information for credential cracking
Cracking FTP login using custom wordlist
Cracking SSH login using custom wordlist
Cracking HTTP logins using custom wordlist
Cracking MySql and PostgreSQL login using custom wordlist
Cracking Cisco login using custom wordlist
Exploiting vulnerable services (Unix)
Exploiting vulnerable services (Windows)
Exploiting services using exploit-db scripts
5
Web Application Information Gathering
Web Application Information Gathering
Introduction
Setting up API keys for recon-ng
Using recon-ng for reconnaissance
Gathering information using theharvester
Using DNS protocol for information gathering
Web application firewall detection
HTTP and DNS load balancer detection
Discovering hidden files/directories using DirBuster
CMS and plugins detection using WhatWeb and p0f
Finding SSL cipher vulnerabilities
6
Web Application Vulnerability Assessment
Web Application Vulnerability Assessment
Introduction
Running vulnerable web applications in Docker
Using W3af for vulnerability assessment
Using Nikto for web server assessment
Using Skipfish for vulnerability assessment
Using Burp Proxy to intercept HTTP traffic
Using Burp Intruder for customized attack automation
Using Burp Sequencer to test the session randomness
7
Web Application Exploitation
Web Application Exploitation
Introduction
Using Burp for active/passive scanning
Using sqlmap to find SQL Injection on the login page
Exploiting SQL Injection on URL parameters using SQL Injection
Using Weevely for file upload vulnerability
Exploiting Shellshock using Burp
Using Metasploit to exploit Heartbleed
Using the FIMAP tool for file inclusion attacks (RFI/LFI)
8
System and Password Exploitation
System and Password Exploitation
Introduction
Using local password-attack tools
Cracking password hashes
Using Social-Engineering Toolkit
Using BeEF for browser exploitation
Cracking NTLM hashes using rainbow tables
9
Privilege Escalation and Exploitation
Privilege Escalation and Exploitation
Introduction
Using WMIC to find privilege-escalation vulnerabilities
Sensitive-information gathering
Unquoted service-path exploitation
Service permission issues
Misconfigured software installations/insecure file permissions
Linux privilege escalation
10
Wireless Exploitation
Wireless Exploitation
Introduction
Setting up a wireless network
Bypassing MAC address filtering
Sniffing network traffic
Cracking WEP encryption
Cracking WPA/WPA2 encryption
Cracking WPS
Denial-of-service attacks
Pen Testing 101 Basics
Pen Testing 101 Basics
Introduction
What is penetration testing?
What is vulnerability assessment
Penetration testing versus vulnerability assessment
Objectives of penetration testing
Types of penetration testing
Who should be doing penetration testing?
What is the goal here?
General penetration testing phases
Conclusion

Finding SSL cipher vulnerabilities

In this recipe, we will to use tools to scan for vulnerable SSL ciphers and SSL-related vulnerabilities.

Getting ready

For this recipe, you will require an Internet connection.

How to do it...

  1. Open the terminal and launch the SSLScan tool, as shown in the following screenshot:

  1. To scan your target using SSLScan, run the following command:
sslscan demo.testfire.net
  1. SSLScan will test the certificate for the all the ciphers it supports. Weak ciphers will be shown in red and yellow. Strong ciphers will be shown in green:
root@Intrusion-Exploitation:~# sslscan demo.testfire.net
Version: -static
OpenSSL 1.0.1m-dev xx XXX xxxx

Testing SSL server demo.testfire.net on port 443

  TLS renegotiation:
Secure session renegotiation supported

  TLS Compression:
Compression disabled

  Heartbleed:
TLS 1.0 not vulnerable to heartbleed
TLS 1.1 not vulnerable to heartbleed
TLS 1.2 not vulnerable to heartbleed

  Supported Server Cipher(s):
Accepted  SSLv3    128 bits  RC4...
Previous Section
End of Chapter 5
Next Chapter