Metasploit Penetration Testing Cookbook

Metasploit Penetration Testing Cookbook - Third Edition

By : Daniel Teixeira, Abhinav Singh, Nipun Jaswal, Monika Agarwal

Buy this Book

Metasploit Penetration Testing Cookbook - Third Edition

By: Daniel Teixeira, Abhinav Singh, Nipun Jaswal, Monika Agarwal

Buy this Book

Overview of this book

Metasploit is the world's leading penetration testing tool and helps security and IT professionals find, exploit, and validate vulnerabilities. Metasploit allows penetration testing automation, password auditing, web application scanning, social engineering, post exploitation, evidence collection, and reporting. Metasploit's integration with InsightVM (or Nexpose), Nessus, OpenVas, and other vulnerability scanners provides a validation solution that simplifies vulnerability prioritization and remediation reporting. Teams can collaborate in Metasploit and present their findings in consolidated reports. In this book, you will go through great recipes that will allow you to start using Metasploit effectively. With an ever increasing level of complexity, and covering everything from the fundamentals to more advanced features in Metasploit, this book is not just for beginners but also for professionals keen to master this awesome tool. You will begin by building your lab environment, setting up Metasploit, and learning how to perform intelligence gathering, threat modeling, vulnerability analysis, exploitation, and post exploitation—all inside Metasploit. You will learn how to create and customize payloads to evade anti-virus software and bypass an organization's defenses, exploit server vulnerabilities, attack client systems, compromise mobile phones, automate post exploitation, install backdoors, run keyloggers, highjack webcams, port public exploits to the framework, create your own modules, and much more.

Title Page

Contributors

Packt Upsell

Preface

Free Chapter

Metasploit Quick Tips for Security Professionals

Introduction

Installing Metasploit on Windows

Installing Linux and macOS

Installing Metasploit on macOS

Using Metasploit in Kali Linux

Setting up a penetration-testing lab

Setting up SSH connectivity

Connecting to Kali using SSH

Configuring PostgreSQL

Creating workspaces

Using the database

Using the hosts command

Understanding the services command

Information Gathering and Scanning

Introduction

Passive information gathering with Metasploit

Active information gathering with Metasploit

Port scanning—the Nmap way

Port scanning—the db_nmap way

Host discovery with ARP Sweep

UDP Service Sweeper

SMB scanning and enumeration

Detecting SSH versions with the SSH Version Scanner

WinRM scanning and brute forcing

Integrating with Nessus

Integrating with NeXpose

Integrating with OpenVAS

Server-Side Exploitation

Introduction

Exploiting a Linux server

SQL injection

Types of shell

Exploiting a Windows Server machine

Exploiting common services

MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption

MS17-010 EternalRomance/EternalSynergy/EternalChampion

Installing backdoors

Denial of Service

Meterpreter

Introduction

Understanding the Meterpreter core commands

Understanding the Meterpreter filesystem commands

Understanding Meterpreter networking commands

Understanding the Meterpreter system commands

Setting up multiple communication channels with the target

Meterpreter anti-forensics

The getdesktop and keystroke sniffing

Using a scraper Meterpreter script

Scraping the system using winenum

Automation with AutoRunScript

Meterpreter resource scripts

Meterpreter timeout control

Meterpreter sleep control

Meterpreter transports

Interacting with the registry

Loading framework plugins

Meterpreter API and mixins

Railgun—converting Ruby into a weapon

Adding DLL and function definitions to Railgun

Injecting the VNC server remotely

Enabling Remote Desktop

Post-Exploitation

Introduction

Post-exploitation modules

Bypassing UAC

Dumping the contents of the SAM database

Passing the hash

Incognito attacks with Meterpreter

Using Mimikatz

Setting up a persistence with backdoors

Becoming TrustedInstaller

Backdooring Windows binaries

Pivoting with Meterpreter

Port forwarding with Meterpreter

Credential harvesting

Enumeration modules

Autoroute and socks proxy server

Analyzing an existing post-exploitation module

Writing a post-exploitation module

Using MSFvenom

Introduction

Payloads and payload options

Encoders

Output formats

Templates

Meterpreter payloads with trusted certificates

Client-Side Exploitation and Antivirus Bypass

Introduction

Exploiting a Windows 10 machine

Bypassing antivirus and IDS/IPS

Metasploit macro exploits

Human Interface Device attacks

HTA attack

Backdooring executables using a MITM attack

Creating a Linux trojan

Creating an Android backdoor

Social-Engineer Toolkit

Introduction

Getting started with the Social-Engineer Toolkit

Working with the spear-phishing attack vector

Website attack vectors

Working with the multi-attack web method

Infectious media generator

Working with Modules for Penetration Testing

Introduction

Working with auxiliary modules

DoS attack modules

Post-exploitation modules

Understanding the basics of module building

Analyzing an existing module

Building your own post-exploitation module

Building your own auxiliary module

Exploring Exploits

Introduction

Common exploit mixins

Exploiting the module structure

Using MSFvenom to generate shellcode

Converting an exploit to a Metasploit module

Porting and testing the new exploit module

Fuzzing with Metasploit

Writing a simple fuzzer

Wireless Network Penetration Testing

Introduction

Metasploit and wireless

Understanding an evil twin attack

Configuring Karmetasploit

Wireless MITM attacks

SMB relay attacks

Cloud Penetration Testing

Introduction

Metasploit in the cloud

Metasploit PHP Hop

Phishing from the cloud

Setting up a cloud penetration testing lab

Best Practices

Introduction

Best practices

Using Metasploit over the Tor network

Metasploit logging

Documentation

Cleaning up

Other Books You May Enjoy

Leave a review - let other readers know what you think

Index

Customer Reviews

5 star

4 star

3 star

2 star

1 star

Writing a simple fuzzer

In the last recipe, we used an HTTP fuzzer that sent a series of HTTP GET requests with incrementing URL lengths until the service crashed. Now, we will learn how it worked and build our own small HTTP fuzzer that can be used against Disk Sorter Enterprise.

How to do it...

The basic template to build a fuzzer will be similar to the one we discussed for the development of an auxiliary module, which should look as follows:

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::Tcp
  include Msf::Auxiliary::Fuzzer

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'HTTP Fuzzer',
      'Description' => %q{Simple HTTP GET Request Fuzzer},
      'Author' => [ 'Daniel Teixeira' ],
      'License' => MSF_LICENSE
    ))
    register_options([
      Opt::RPORT(80),
      OptInt.new("MAXLENGTH", [true, "Maximum string length", 20000] )
    ])
  end

Now that we have imported the MSF libraries, created a class, and defined the...

Metasploit Penetration Testing Cookbook - Third Edition

By : Daniel Teixeira, Abhinav Singh, Nipun Jaswal, Monika Agarwal

Metasploit Penetration Testing Cookbook - Third Edition

By: Daniel Teixeira, Abhinav Singh, Nipun Jaswal, Monika Agarwal

Overview of this book

Related Content you might be interested in

Current Title:

Metasploit Penetration Testing Cookbook - Third Edition

Mastering Metasploit

Metasploit for Beginners

Industrial Cybersecurity

Writing a simple fuzzer

How to do it...