Book Image

Learn Penetration Testing

By : Rishalin Pillay
Book Image

Learn Penetration Testing

By: Rishalin Pillay

Overview of this book

Sending information via the internet is not entirely private, as evidenced by the rise in hacking, malware attacks, and security threats. With the help of this book, you'll learn crucial penetration testing techniques to help you evaluate enterprise defenses. You'll start by understanding each stage of pentesting and deploying target virtual machines, including Linux and Windows. Next, the book will guide you through performing intermediate penetration testing in a controlled environment. With the help of practical use cases, you'll also be able to implement your learning in real-world scenarios. By studying everything from setting up your lab, information gathering and password attacks, through to social engineering and post exploitation, you'll be able to successfully overcome security threats. The book will even help you leverage the best tools, such as Kali Linux, Metasploit, Burp Suite, and other open source pentesting tools to perform these techniques. Toward the later chapters, you'll focus on best practices to quickly resolve security threats. By the end of this book, you'll be well versed with various penetration testing techniques so as to be able to tackle security threats effectively
Table of Contents (21 chapters)
Free Chapter
1
Section 1: The Basics
4
Section 2: Exploitation
12
Section 3: Post Exploitation
16
Section 4: Putting It All Together

To get the most out of this book

In order to gain the most benefit from the practical aspects of this book, you will need to have a virtualization environment set up. This can be set up using VMware or VirtualBox. Hyper-V will work, but there is a restriction that does not allow you to link a wireless card directly to the virtual machine. This prevents you from performing wireless attacks if you have a compatible wireless card.

The penetration testing operating system of choice is Kali Linux. Having some basic Linux knowledge is not mandatory, but would be beneficial. Kali Linux contains hundreds of tools. We do not focus on all of them, but only on the tools that would get the job done. Occasionally, we will look at tools that are available on the internet, but the installation and setup steps are clearly defined within the book.

The target systems used in this book are predominantly freely available, such as Metasploitable and OWASP BWA. We will work with Windows Server and Windows 10 as a target operating system in some chapters; the evaluation editions of these operating systems will suffice. Having knowledge of how to set up Active Directory would be beneficial.

Finally, this book does not focus on a specific target operating system, instead focusing on teaching you how to use various techniques, methodologies, and tools to obtain the results you need. Your knowledge will increase over time as you continue to apply what you have learned and gain experience by practicing your skills with various other vulnerable machines found on the internet.

Download the color images

Conventions used

There are a number of text conventions used throughout this book.

CodeInText: Indicates code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles. Here is an example: "We will leverage the pip command to install the required shodan files."

A block of code is set as follows:

#!/bin/bash 
cat shodan-iis.txt | while read line
do
nmap -sS -sV $line
done

When we wish to draw your attention to a particular part of a code block, the relevant lines or items are set in bold:

#include<stdio.h>
#include<string.h>

unsigned char buf[] =
"\xbd\xa1\xe2\xe6\x8b\xd9\xeb\xd9\x74\x24\xf4\x5f\x2b\xc9\x66"

Any command-line input or output is written as follows:

sudo apt-get update && sudo apt-get install python2.7

Bold: Indicates a new term, an important word, or words that you see on screen. For example, words in menus or dialog boxes appear in the text like this. Here is an example: "You will notice that the interval is 0.102400 [Seconds]."

Warnings or important notes appear like this.
Tips and tricks appear like this.