Book Image

Building Virtual Pentesting Labs for Advanced Penetration Testing - Second Edition

By : Kevin Cardwell
Book Image

Building Virtual Pentesting Labs for Advanced Penetration Testing - Second Edition

By: Kevin Cardwell

Overview of this book

Security flaws and new hacking techniques emerge overnight – security professionals need to make sure they always have a way to keep . With this practical guide, learn how to build your own virtual pentesting lab environments to practice and develop your security skills. Create challenging environments to test your abilities, and overcome them with proven processes and methodologies used by global penetration testing teams. Get to grips with the techniques needed to build complete virtual machines perfect for pentest training. Construct and attack layered architectures, and plan specific attacks based on the platforms you’re going up against. Find new vulnerabilities for different kinds of systems and networks, and what these mean for your clients. Driven by a proven penetration testing methodology that has trained thousands of testers, Building Virtual Labs for Advanced Penetration Testing, Second Edition will prepare you for participation in professional security teams.
Table of Contents (20 chapters)
Building Virtual Pentesting Labs for Advanced Penetration Testing - Second Edition
Credits
About the Author
Acknowledgments
About the Reviewer
www.PacktPub.com
Preface

Readers' challenge


Throughout this chapter, we have identified a number of testing methods for web applications. Your challenge is as follows:

  • Review the information in the web services testing, and expand on this and experiment with the different tools you can discover based on this. As a reference, look at the SoapUI tool. An example of the website of the tool is shown in the following screenshot:

  • We have discussed the ModSecurity tool. For this challenge, install the tool and practice different types of evasion techniques; additionally, attempt to detect the WAF. See if either of the two methods that we have discussed in this chapter can detect it. Another method of detection is to compare the headers when you intercept them with a proxy. Experiment with and explore it. A quick example of how to install the software is shown in the following screenshot:

This challenge will allow you to explore the testing of Web Services, as well as practice the evasion methods against one of the most popular...