Book Image

Hands-On Web Penetration Testing with Metasploit

By : Harpreet Singh, Himanshu Sharma
Book Image

Hands-On Web Penetration Testing with Metasploit

By: Harpreet Singh, Himanshu Sharma

Overview of this book

Metasploit has been a crucial security tool for many years. However, there are only a few modules that Metasploit has made available to the public for pentesting web applications. In this book, you'll explore another aspect of the framework – web applications – which is not commonly used. You'll also discover how Metasploit, when used with its inbuilt GUI, simplifies web application penetration testing. The book starts by focusing on the Metasploit setup, along with covering the life cycle of the penetration testing process. Then, you will explore Metasploit terminology and the web GUI, which is available in the Metasploit Community Edition. Next, the book will take you through pentesting popular content management systems such as Drupal, WordPress, and Joomla, which will also include studying the latest CVEs and understanding the root cause of vulnerability in detail. Later, you'll gain insights into the vulnerability assessment and exploitation of technological platforms such as JBoss, Jenkins, and Tomcat. Finally, you'll learn how to fuzz web applications to find logical security vulnerabilities using third-party tools. By the end of this book, you'll have a solid understanding of how to exploit and validate vulnerabilities by working with various tools and techniques.

Related Content you might be interested in

Current Title:

Small book image
Hands-On Web Penetration Testing with Metasploit
Harpreet Singh | Himanshu Sharma
May, 2020 | 544 pages
Small book image
Metasploit 5.0 for Beginners
Sagar Rahalkar
Apr, 2020 | 246 pages
Small book image
Hands-On Red Team Tactics
Harpreet Singh | Himanshu Sharma
Sep, 2018 | 480 pages
Small book image
Metasploit for Beginners
Sagar Rahalkar
Jul, 2017 | 190 pages
Table of Contents (23 chapters)
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Disclaimer
Get in touch
1
Introduction
Introduction
Free Chapter
2
Introduction to Web Application Penetration Testing
Introduction to Web Application Penetration Testing
What is a penetration test?
Types of penetration test
Stages of penetration testing
Important terminologies
Penetration testing methodologies
Common Weakness Enumeration (CWE)
Summary
Questions
Further reading
3
Metasploit Essentials
Metasploit Essentials
Technical requirements
Introduction to Metasploit Framework
Metasploit Framework terminology
Installing and setting up Metasploit
Getting started with Metasploit Framework
Summary
Questions
Further reading
4
The Metasploit Web Interface
The Metasploit Web Interface
Technical requirements
Introduction to the Metasploit web interface
Installing and setting up the web interface
Getting started with the Metasploit web interface
Summary
Questions
Further reading
5
The Pentesting Life Cycle with Metasploit
The Pentesting Life Cycle with Metasploit
6
Using Metasploit for Reconnaissance
Using Metasploit for Reconnaissance
Technical requirements
Introduction to reconnaissance
Active reconnaissance
Passive reconnaissance
Summary
Questions
Further reading
7
Web Application Enumeration Using Metasploit
Web Application Enumeration Using Metasploit
Technical requirements
Introduction to enumeration
Enumerating files
Summary
Questions
Further reading
8
Vulnerability Scanning Using WMAP
Vulnerability Scanning Using WMAP
Technical requirements
Understanding WMAP
The WMAP scanning process
WMAP module execution order
Adding a module to WMAP
Clustered scanning using WMAP
Summary
Questions
Further reading
9
Vulnerability Assessment Using Metasploit (Nessus)
Vulnerability Assessment Using Metasploit (Nessus)
Technical requirements
Introduction to Nessus
Basic commands
Performing a Nessus scan via Metasploit
Summary
Questions
Further reading
10
Pentesting Content Management Systems (CMSes)
Pentesting Content Management Systems (CMSes)
11
Pentesting CMSes - WordPress
Pentesting CMSes - WordPress
Technical requirements
Introduction to WordPress
WordPress reconnaissance and enumeration
Vulnerability assessment for WordPress
WordPress exploitation part 1 – WordPress Arbitrary File Deletion
WordPress exploitation part 2 – unauthenticated SQL injection
WordPress exploitation part 3 – WordPress 5.0.0 Remote Code Execution
Going the extra mile – customizing the Metasploit exploit
Summary
Questions
Further reading
12
Pentesting CMSes - Joomla
Pentesting CMSes - Joomla
Technical requirements
An introduction to Joomla
The Joomla architecture
Reconnaissance and enumeration
Enumerating Joomla plugins and modules using Metasploit
Performing vulnerability scanning with Joomla
Joomla exploitation using Metasploit
Joomla shell upload
Summary
Questions
Further reading
13
Pentesting CMSes - Drupal
Pentesting CMSes - Drupal
Technical requirements
Introduction to Drupal and its architecture
Drupal reconnaissance and enumeration
Drupal vulnerability scanning using droopescan
Exploiting Drupal
Summary
Questions
Further reading
14
Performing Pentesting on Technological Platforms
Performing Pentesting on Technological Platforms
15
Penetration Testing on Technological Platforms - JBoss
Penetration Testing on Technological Platforms - JBoss
Technical requirements
An introduction to JBoss
Reconnaissance and enumeration
Performing a vulnerability assessment on JBoss AS
JBoss exploitation
Summary
Questions
Further reading
16
Penetration Testing on Technological Platforms - Apache Tomcat
Penetration Testing on Technological Platforms - Apache Tomcat
Technical requirements
An introduction to Tomcat
The Apache Tomcat architecture
Files and their directory structures
Detecting Tomcat installations
Version detection
Exploiting Tomcat
An introduction to Apache Struts
Summary
Questions
Further reading
17
Penetration Testing on Technological Platforms - Jenkins
Penetration Testing on Technological Platforms - Jenkins
Technical requirements
Introduction to Jenkins
Jenkins terminology
Jenkins reconnaissance and enumeration
Exploiting Jenkins
Summary
Questions
Further reading
18
Logical Bug Hunting
Logical Bug Hunting
19
Web Application Fuzzing - Logical Bug Hunting
Web Application Fuzzing - Logical Bug Hunting
Technical requirements
What is fuzzing?
Fuzzing terminology
Fuzzing attack types
Introduction to web app fuzzing
Identifying web application attack vectors
Summary
Questions
Further reading
20
Writing Penetration Testing Reports
Writing Penetration Testing Reports
Technical requirements
Introduction to report writing
Introduction to Dradis Framework
Working with Serpico
Summary
Questions
Further reading
21
Assessment
Assessment
Chapter 1
Chapter 2
Chapter 3
Chapter 4
Chapter 5
Chapter 6
Chapter 7
Chapter 8
Chapter 9
Chapter 10
Chapter 11
Chapter 12
Chapter 13
Chapter 14
Chapter 15
22
Other Books You May Enjoy
Other Books You May Enjoy
Leave a review - let other readers know what you think

WMAP module execution order

WMAP runs loaded modules in a specific order. The order is defined by a numeric value. By default, the first module to run for web scanning is http_version, which has the OrderID=0 and open_proxy module with OrderID=1. This also means that the http_version module will execute first and open_proxy will run after that. A tester can change the default behavior of the module execution by changing the OrderID accordingly:

  1. The module execution order can be changed according to our needs. We can obtain the OrderID by executing the wmap_modules -l command.

The following screenshot shows the output of the preceding command:

  1. The OrderID is set in the Metasploit module code. Let's see the OrderID for the http_version module:

The execution order for WMAP modules can be adjusted using the register_wmap_options() method.

  1. Let's use this method to...
Previous Section
End of Section 5
Next Section