Kali Linux CTF Blueprints is a six chapter book where each chapter details a different kind of Capture the Flag style challenges. Each chapter will deal with a number of basic setups while suggesting a variety of different alternatives to allow reuse of fundamental concepts. The book is designed to allow individuals to create their own challenging environments to push their colleagues, friends, and own skills to the next level of testing prowess.
Chapter 1, Microsoft Environments, contains instructions to create vulnerable servers and desktops, covers the most prevalent vulnerabilities, and contains suggestions on more complicated scenarios for advanced users of Microsoft environments.
Chapter 2, Linux Environments, similar to the first chapter, is focused on generating generic vulnerabilities in Linux environments, providing the basic concepts of CTF creation along with suggestions for more advanced setups.
Chapter 3, Wireless and Mobile, contains projects targeting Wi-Fi-enabled devices, including a section specifically targeting portable devices such as tablets and smartphones.
Chapter 4, Social Engineering, contains scenarios ranging from the creation of XSS attackable pages to unmask online personas through social media and e-mail accounts.
Chapter 5, Cryptographic Projects, contains attacks against encryption deployments such as flawed encryption, deciphering encoded text, and replication of the well-known Heartbleed attack.
Chapter 6, Red Teaming, contains two full-scale vulnerable deployments designed to test all areas covered in the previous chapters, mimicking corporate environments encountered across the world.
Appendix, covers references to various books for further reading, blogs, competitions, conferences, and so on.
The requirements for individual projects are detailed in their setup sections; however, it is assumed that you have the following:
A copy of Kali Linux
At least one machine or virtual machine that can be set up as a target
Kali Linux CTF Blueprints is aimed at individuals who are aware of the concepts of penetration testing, ideally with some practice with one or more types of tests. It is also suitable for testers with years of experience who want to explore a new field or educate their colleagues. The assumption will be that these projects are being created to be completed by other penetration testers and will contain exploitation guides to each project. If you are setting these challenges for yourself, try and exploit them without reading the exploitation methods first. The suggested methods are just that; there are many ways to climb a tree.
Each chapter of this book is split into four major sections:
Opening discussion, theory, and general setup
All the processes to set up the challenges
All the processes to exploit the challenges
A closing summary and discussion
This book is based around the creation of vulnerable machines that are to be exploited in controlled environments. The methods contained for exploitation are of industry standard and are therefore well known. Please follow the ensuing rules:
Do not host any vulnerable software on Internet-facing machines; you will get pregnant and you will die.
Do not use a computer that is used for daily usage as a target. Exploitation can permanently damage machines and personal files can be lost. Your parents/spouse/children will not forgive you easily if you lose their cherished documents.
Do not use personal passwords or credentials on test devices. Even without being the target, they can be inadvertently exposed to testers and used for mischievous or malicious purposes.
In this book, you will find a number of styles of text that distinguish between different kinds of information. Here are some examples of these styles, and an explanation of their meaning.
Code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles are shown as follows: "Type ifconfig eth0 10.0.0.124 or whichever local subnet you wish to use."
A block of code is set as follows:
[global] workgroup = Kanto server string = Oaktown map to guest = Bad User log file = /var/log/samba.%m
Any command-line input or output is written as follows:
ifconfig at0 up ifconfig at0 10.0.0.1 netmask 255.255.255.0
New terms and important words are shown in bold. Words that you see on the screen, in menus or dialog boxes for example, appear in the text like this: "Select the Management tools – Basic option—everything else is unnecessary."
Feedback from our readers is always welcome. Let us know what you think about this book—what you liked or may have disliked. Reader feedback is important for us to develop titles that you really get the most out of.
To send us general feedback, simply send an e-mail to <[email protected]>, and mention the book title via the subject of your message.
If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, see our author guide on www.packtpub.com/authors.
Now that you are the proud owner of a Packt book, we have a number of things to help you to get the most from your purchase.
You can download the example code files for all Packt books you have purchased from your account at http://www.packtpub.com. If you purchased this book elsewhere, you can visit http://www.packtpub.com/support and register to have the files e-mailed directly to you.
Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you find a mistake in one of our books—maybe a mistake in the text or the code—we would be grateful if you would report this to us. By doing so, you can save other readers from frustration and help us improve subsequent versions of this book. If you find any errata, please report them by visiting http://www.packtpub.com/submit-errata, selecting your book, clicking on the errata submission form link, and entering the details of your errata. Once your errata are verified, your submission will be accepted and the errata will be uploaded on our website, or added to any list of existing errata, under the Errata section of that title. Any existing errata can be viewed by selecting your title from http://www.packtpub.com/support.
Piracy of copyright material on the Internet is an ongoing problem across all media. At Packt, we take the protection of our copyright and licenses very seriously. If you come across any illegal copies of our works, in any form, on the Internet, please provide us with the location address or website name immediately so that we can pursue a remedy.
Please contact us at <[email protected]> with a link to the suspected pirated material.
We appreciate your help in protecting our authors, and our ability to bring you valuable content.
You can contact us at <[email protected]> if you are having a problem with any aspect of the book, and we will do our best to address it.