Penetration Testing with the Bash shell

Keith Makan

• Publisher: Packt Publishing
• Year: 2014
• eBook ISBN: 9781849695107
• Edition: 1
• Topic: Computer Science
• Subtopic: Programming in C
• Index: Computer Science

In Detail

This book teaches you to take your problem solving capabilities to the next level with the Bash shell, to assess network and application level security by leveraging the power of the command-line tools available with Kali Linux.

The book begins by introducing some of the fundamental bash scripting and information processing tools. Building on this, the next few chapters focus on detailing ways to customize your Bash shell using functionalities such as tab completion and rich text formatting. After the fundamental customization techniques and general purpose tools have been discussed, the book breaks into topics such as the command-line-based security tools in the Kali Linux operating system. The general approach in discussing these tools is to involve general purpose tools discussed in previous chapters to integrate security assessment tools. This is a one stop solution to learn Bash and solve information security problems.

Approach

An easy-to-understand, step-by-step practical guide that shows you how to use the Linux Bash terminal tools to solve information security problems.

Who this book is for

If you are a penetration tester, system administrator, or developer who would like an enriching and practical introduction to the Bash shell and Kali Linux command-line-based tools, this is the book for you.

Penetration Testing with the Bash shell

---

Table of Contents

Penetration Testing with the Bash shell

Credits

Disclaimer

About the Author

About the Reviewers

www.PacktPub.com

Support files, eBooks, discount offers, and more

Why subscribe?

Free access for Packt account holders

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Downloading the example code

Errata

Piracy

Questions

1. Getting to Know Bash

Getting help from the man pages

Navigating and searching the filesystem

Navigating directories

Listing directory contents

Searching the filesystem

Directory traversal options

File testing options

File action options

Using I/O redirection

Redirecting output

Redirecting input

Using pipes

Getting to know grep

Regular expression language – a crash course

Regular expression matcher selection options

Regular expression matching control options

Output control options

File selection options

Summary

Further reading

2. Customizing Your Shell

Formatting the terminal output

The prompt string

Prompt string customizations

Aliases

Customizing the command history

Protecting sensitive information from leakage

Customizing tab completion

Summary

Further reading

3. Network Reconnaissance

Interrogating the Whois servers

Interrogating the DNS servers

Using Dig

Using dnsmap

Enumerating targets on the local network

Host discovery with Arping

Target enumeration with Nmap

Summary

Further reading

4. Exploitation and Reverse Engineering

Using the Metasploit command-line interface

Getting started with msfcli

Using invocation modes with msfcli

Bash hacks and msfcli

Preparing payloads with Metasploit

Creating and deploying a payload

Disassembling binaries

Disassembling with Objdump

A note about the reverse engineering assembler code

Debugging binaries for dynamic analysis

Getting started with GDB

Setting execution breakpoints and watch points

Inspecting registers, memory values, and runtime information

Summary

Further reading

5. Network Exploitation and Monitoring

MAC and ARP abuse

Spoofing MAC addresses

Abusing address resolution

Man-in-the-middle attacks

Ettercap DNS spoofing

Interrogating servers

SNMP interrogation

SMTP server interrogation

Brute-forcing authentication

Using Medusa

Traffic filtering with TCPDump

Getting started with TCPDump

Using the TCPDump packet filter

Assessing SSL implementation security

Using SSLyze

Bash hacks and SSLyze

Automated web application security assessment

Scanning with SkipFish

Scanning with Arachni

Summary

Further reading

Index

Penetration Testing with the Bash shell

Copyright © 2014 Packt Publishing

All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.

Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book.

Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.

First published: May 2014

Production Reference: 1200514

Published by Packt Publishing Ltd.

Livery Place

35 Livery Street

Birmingham B3 2PB, UK.

ISBN 978-1-84969-510-7

www.packtpub.com

Cover Image by ^©iStock.com/DeborahMaxemow

Credits

Author

Keith Makan

Reviewers

Sébastien De Bollivier

David Huttleston Jr

Jorge Armin Garcia Lopez

Acquisition Editor

Meeta Rajani

Content Development Editor

Anila Vincent

Technical Editors

Anand Singh

Rohit Kumar Singh

Copy Editors

Roshni Banerjee

Mradula Hegde

Project Coordinator

Melita Lobo

Proofreaders

Simran Bhogal

Stephen Copestake

Maria Gould

Paul Hindle

Indexer

Tejal Soni

Production Coordinator

Melwyn D'sa

Cover Work

Melwyn D'sa

Disclaimer

The content within this book is for educational purposes only. It is designed to help users test their own system against information security threats and protect their IT infrastructure from similar attacks. Packt Publishing and the author of this book take no responsibility for actions resulting from the inappropriate usage of learning materials contained within this book.

About the Author

Keith Makan is the lead author of Android Security Cookbook, Packt Publishing. He is an avid computer security enthusiast and a passionate security researcher. Keith has published numerous vulnerabilities in Android applications, WordPress plugins, and popular browser security software such as Firefox's NoScript and Google Chrome's XSS Auditor. His research has also won him numerous listings on the Google Application Security Hall of Fame. Keith has been working as a professional security assessment specialist, penetration tester, and security advisory for over 2 years.

About the Reviewers

Sébastien De Bollivier loved to play with computers since he was 5 years old, but couldn't figure out how to make the computer do what he wanted. After completing his master's degree in Computer Science, he chose to create his own company, RunSoft, with two associates.

Their purpose is mainly to help customers who are struggling to find a web developer who understands their busi...

Table of contents

• Penetration Testing with the Bash shell