Book Image

Building Virtual Pentesting Labs for Advanced Penetration Testing - Second Edition

By : Kevin Cardwell
Book Image

Building Virtual Pentesting Labs for Advanced Penetration Testing - Second Edition

By: Kevin Cardwell

Overview of this book

Security flaws and new hacking techniques emerge overnight – security professionals need to make sure they always have a way to keep . With this practical guide, learn how to build your own virtual pentesting lab environments to practice and develop your security skills. Create challenging environments to test your abilities, and overcome them with proven processes and methodologies used by global penetration testing teams. Get to grips with the techniques needed to build complete virtual machines perfect for pentest training. Construct and attack layered architectures, and plan specific attacks based on the platforms you’re going up against. Find new vulnerabilities for different kinds of systems and networks, and what these mean for your clients. Driven by a proven penetration testing methodology that has trained thousands of testers, Building Virtual Labs for Advanced Penetration Testing, Second Edition will prepare you for participation in professional security teams.
Table of Contents (20 chapters)
Building Virtual Pentesting Labs for Advanced Penetration Testing - Second Edition
Credits
About the Author
Acknowledgments
About the Reviewer
www.PacktPub.com
Preface

Security Incident and Event Management (SIEM)


Now that we have looked at deploying the Snort IDS, let us turn our attention to deploying a SIEM. These are very popular with enterprises; therefore, we need to build one into our lab to test our attacks against this type of architecture. The SIEM we will deploy here is the Security Onion tool. You will need to download the Security Onion tool: open a browser and enter https://github.com/Security-Onion-Solutions/security-onion/releases.

In short, Security Onion is a Network Security Monitor (NSM) integration tool. The tool provides the following components:

  • Full packet capture

  • Snort or Suricata rule-driven intrusion detection

  • Bro event-driven intrusion detection

  • OSSEC host-based intrusion detection

Security Onion provides us all of these tools integrated into the machine seamlessly. Well, for the most part! Is anything really ever seamless in software? Even the commercial tools will have bugs!

Once you have downloaded the tool, you need to create a...