Book Overview & Buying
Table Of Contents

Mastering Kali Linux for Advanced Penetration Testing - Third Edition

By : Vijay Kumar Velu, Robert Beggs

4.4 (8)

Buy this Book

Mastering Kali Linux for Advanced Penetration Testing

4.4 (8)

By: Vijay Kumar Velu, Robert Beggs

Buy this Book

Overview of this book

This book takes you, as a tester or security practitioner, through the reconnaissance, vulnerability assessment, exploitation, privilege escalation, and post-exploitation activities used by pentesters. To start with, you'll use a laboratory environment to validate tools and techniques, along with an application that supports a collaborative approach for pentesting. You'll then progress to passive reconnaissance with open source intelligence and active reconnaissance of the external and internal infrastructure. You'll also focus on how to select, use, customize, and interpret the results from different vulnerability scanners, followed by examining specific routes to the target, which include bypassing physical security and the exfiltration of data using a variety of techniques. You'll discover concepts such as social engineering, attacking wireless networks, web services, and embedded devices. Once you are confident with these topics, you'll learn the practical aspects of attacking user client systems by backdooring with fileless techniques, followed by focusing on the most vulnerable part of the network – directly attacking the end user. By the end of this book, you'll have explored approaches for carrying out advanced pentesting in tightly secured environments, understood pentesting and hacking techniques employed on embedded peripheral devices.

Preface

Who this book is for

What this book covers

To get the most out of this book

Get in touch

Disclaimer

Free Chapter

Goal-Based Penetration Testing

Conceptual overview of security testing

Misconceptions of vulnerability scanning, penetration testing, and red team exercises

Objective-based penetration testing

The testing methodology

Introduction to Kali Linux – features

Installing and updating Kali Linux

Organizing Kali Linux

Building a verification lab

Managing collaborative penetration testing using Faraday

Summary

Open Source Intelligence and Passive Reconnaissance

Basic principles of reconnaissance

Google Hacking Database

Creating custom wordlists for cracking passwords

Summary

Active Reconnaissance of External and Internal Networks

Stealth scanning strategies

DNS reconnaissance and route mapping

Employing comprehensive reconnaissance applications

Identifying the external network infrastructure

Mapping beyond the firewall

IDS/IPS identification

Enumerating hosts

Port, operating system, and service discovery

Writing your own port scanner using netcat

Large-scale scanning

Summary

Vulnerability Assessment

Vulnerability nomenclature

Local and online vulnerability databases

Vulnerability scanning with Nmap

Web application vulnerability scanners

Vulnerability scanners for mobile applications

The OpenVAS network vulnerability scanner

Commercial vulnerability scanners

Specialized scanners

Threat modeling

Summary

Advanced Social Engineering and Physical Security

Methodology and attack methods

Physical attacks at the console

Creating a rogue physical device

The Social Engineering Toolkit (SET)

Hiding executables and obfuscating the attacker's URL

Escalating an attack using DNS redirection

Launching a phishing attack

Using bulk transfer as a mode of phishing

Summary

Wireless Attacks

Configuring Kali for wireless attacks

Wireless reconnaissance

Bypassing a hidden SSID

Bypassing the MAC address authentication and open authentication

Attacking WPA and WPA2

Denial-of-service (DoS) attacks against wireless communications

Compromising enterprise implementations of WPA/WPA2

Working with Ghost Phisher

Summary

Exploiting Web-Based Applications

Web application hacking methodology

The hacker's mind map

Reconnaissance of web apps

Client-side proxies

Application-specific attacks

Summary

Client-Side Exploitation

Backdooring executable files

Attacking a system using hostile scripts

The Cross-Site Scripting framework

The Browser Exploitation Framework (BeEF)

Understanding BeEF Browser

Summary

Bypassing Security Controls

Bypassing Network Access Control (NAC)

Bypassing the antivirus with files

Going fileless and evading antivirus

Bypassing application-level controls

Bypassing Windows operating system controls

Summary

Exploitation

The Metasploit Framework

Exploiting targets using MSF

Exploiting multiple targets using MSF resource files

Exploiting multiple targets with Armitage

Using public exploits

Developing a Windows exploit

Summary

Action on the Objective and Lateral Movement

Activities on the compromised local system

Horizontal escalation and lateral movement

Summary

Privilege Escalation

Overview of the common escalation methodology

Escalating from domain user to system administrator

Local system escalation

Escalating from administrator to system

Credential harvesting and escalation attacks

Escalating access rights in Active Directory

Compromising Kerberos – the golden-ticket attack

Summary

Command and Control

Persistence

Using persistent agents

Domain fronting

Exfiltration of data

Hiding evidence of an attack

Summary

Embedded Devices and RFID Hacking

Embedded systems and hardware architecture

Firmware unpacking and updating

Introduction to RouterSploit Framework

UART

Cloning RFID using Chameleon Mini

Summary

Other Books You May Enjoy

Leave a review - let other readers know what you think

Bypassing Network Access Control (NAC)

NAC works on a basic form of the 802.1X IEEE standard. The majority of corporations implement NAC to protect network nodes such as switches, routers, firewalls, servers, and, more importantly, endpoints. A decent NAC implies the controls that are put in place to prevent the intrusion by policies and also define who can access what. In this section, we will take a deep dive into different types of NAC that attackers or penetration testers encounter during an RTE or penetration test.

There are no specific common criteria or standardization for NAC; it depends on the vendor and the way it is implemented. For example, Cisco provides Cisco Network Admission Control and Microsoft provides Microsoft Network Access Protection. The primary purpose of NAC is to control the devices/elements, which can be connected and then made sure they are tested...

Tech Concepts

Programming languages

Tech Tools