Book Image

Kali Linux 2018: Assuring Security by Penetration Testing - Fourth Edition

By : Shiva V. N. Parasram, Alex Samm, Damian Boodoo, Gerard Johansen, Lee Allen, Tedi Heriyanto, Shakeel Ali
Book Image

Kali Linux 2018: Assuring Security by Penetration Testing - Fourth Edition

By: Shiva V. N. Parasram, Alex Samm, Damian Boodoo, Gerard Johansen, Lee Allen, Tedi Heriyanto, Shakeel Ali

Overview of this book

Kali Linux is a comprehensive penetration testing platform with advanced tools to identify, detect, and exploit the vulnerabilities uncovered in the target network environment. With Kali Linux, you can apply the appropriate testing methodology with defined business objectives and a scheduled test plan, resulting in successful penetration testing project engagement. This fourth edition of Kali Linux 2018: Assuring Security by Penetration Testing starts with the installation of Kali Linux. You will be able to create a full test environment to safely practice scanning, vulnerability assessment, and exploitation. You’ll explore the essentials of penetration testing by collecting relevant data on the target network with the use of several footprinting and discovery tools. As you make your way through the chapters, you’ll focus on specific hosts and services via scanning and run vulnerability scans to discover various risks and threats within the target, which can then be exploited. In the concluding chapters, you’ll apply techniques to exploit target systems in order to gain access and find a way to maintain that access. You’ll also discover techniques and tools for assessing and attacking devices that are not physically connected to the network, including wireless networks. By the end of this book, you will be able to use NetHunter, the mobile version of Kali Linux, and write a detailed report based on your findings.

Related Content you might be interested in

Current Title:

Small book image
Kali Linux 2018: Assuring Security by Penetration Testing - Fourth Edition
Shiva V. N. Parasram | Alex Samm | Damian Boodoo | Gerard Johansen | Lee Allen | Tedi Heriyanto | Shakeel Ali
Oct, 2018 | 528 pages
Small book image
Hands-On Penetration Testing with Kali NetHunter
Glen D Singh | SeanPhilip Oriyano
Feb, 2019 | 302 pages
Small book image
Learn Penetration Testing
Rishalin Pillay
May, 2019 | 424 pages
Small book image
Learn Kali Linux 2019
Glen D Singh
Nov, 2019 | 550 pages
Table of Contents (17 chapters)
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Get in touch
Free Chapter
1
Installing and Configuring Kali Linux
Installing and Configuring Kali Linux
Technical requirements
Kali Linux tool categories
Downloading Kali Linux
Using Kali Linux
Configuring the virtual machine
Updating Kali Linux
Setting up Kali Linux AMI on Amazon AWS Cloud
Summary
Questions
Further reading
2
Setting Up Your Test Lab
Setting Up Your Test Lab
Technical requirements
Physical or virtual?
Setting up a Windows environment in a VM
Installing vulnerable servers
Installing additional tools in Kali Linux
Network services in Kali Linux
Additional labs and resources
Summary
Questions
Further reading
3
Penetration Testing Methodology
Penetration Testing Methodology
Technical requirements
Penetration testing methodology
General penetration testing framework
Summary
4
Footprinting and Information Gathering
Footprinting and Information Gathering
Open Source Intelligence
Using public resources
Querying the domain registration information
Analyzing the DNS records
Getting network routing information
Utilizing the search engine
Google Hacking Database (GHDB)
Metagoofil
Automated footprinting and information gathering tools
Summary
Questions
Further reading
5
Scanning and Evasion Techniques
Scanning and Evasion Techniques
Technical requirements
Starting off with target discovery
Identifying the target machine
OS fingerprinting
Introducing port scanning
Understanding TCP/IP protocol
Understanding TCP and UDP message formats
The network scanner
Scanning with Netdiscover
Automated scanning with Striker
Anonymity using Nipe
Summary
Questions
Further Reading
6
Vulnerability Scanning
Vulnerability Scanning
Technical requirements
Types of vulnerabilities
Vulnerability taxonomy
Automated vulnerability scanning
Summary
Questions
Further reading
7
Social Engineering
Social Engineering
Technical requirements
Modeling human psychology
Attack process
Attack methods
Social Engineering Toolkit
Summary
8
Target Exploitation
Target Exploitation
Vulnerability research
Vulnerability and exploit repositories
Advanced exploitation toolkit
MSFConsole
MSFCLI
Ninja 101 drills
Writing exploit modules
Summary
9
Privilege Escalation and Maintaining Access
Privilege Escalation and Maintaining Access
Technical requirements
Privilege-escalation
Password-attack tools
Maintaining access
Summary
10
Web Application Testing
Web Application Testing
Technical requirements
Web analysis
Cross-Site Scripting
SQL injection
Command-execution, directory-traversal, and file-inclusion
Summary
Further reading
11
Wireless Penetration Testing
Wireless Penetration Testing
Technical requirements
Wireless networking
Wireless network reconnaissance
Wireless testing tools
Post cracking
Sniffing wireless traffic
Summary
12
Mobile Penetration Testing with Kali NetHunter
Mobile Penetration Testing with Kali NetHunter
Technical requirements
Kali NetHunter
Installing Kali NetHunter
NetHunter icons
NetHunter tools
Third-party Android applications
Wireless attacks
HID attacks
Summary
Questions
Further reading
13
PCI DSS Scanning and Penetration Testing
PCI DSS Scanning and Penetration Testing
PCI DSS v3.2.1 requirement 11.3
Scoping the PCI DSS penetration test
Tools for executing the PCI DSS penetration test
Summary
Questions
Further reading
14
Tools for Penetration Testing Reporting
Tools for Penetration Testing Reporting
Technical requirements
Documentation and results verification
Types of reports
Network penetration testing report
Using the Dradis framework for penetration testing reporting
Penetration testing reporting tools
Summary
Questions
Further reading
15
Assessments
Assessments
Chapter 1 – Assessment answers
Chapter 2 – Assessment answers
Chapter 4 – Assessment answers
Chapter 5 – Assessment answers
Chapter 6 – Assessment answers
Chapter 12 – Assessment answers
Chapter 13 – Assessment answers
Chapter 14 – Assessment answers
16
Other Books You May Enjoy
Other Books You May Enjoy
Leave a review - let other readers know what you think

Tools for executing the PCI DSS penetration test

The PCI DSS states that yearly assessments are to be performed by ASVs, while self-assessments can be done quarterly by qualified and experienced professionals. Qualified persons should have multiple years' experience in penetration testing and possess one or more of the following certifications:

  • Certified Ethical Hacker (CEH)
  • Offensive Security Certified Professional (OSCP)
  • CREST penetration testing certifications
  • Global Information Assurance (GIAC), for example, GPEN, GWAPT, and GXPN.

The tools used by professionals for the PCI DSS assessment can be commercial or open source, as long as they generate a high level of accuracy. In this book, we have used many tools, some of which not only perform multiple functions, but do so in an automated manner, usually once all IP information has been specified.

In Chapter 6, Vulnerability...

Previous Section
End of Section 4
Next Section