Advanced Penetration Testing for Highly-Secured Environments - Second Edition

Lee Allen, Kevin Cardwell, Kevin Cardwell

• Publisher: Packt Publishing
• Year: 2016
• eBook ISBN: 9781784392024
• Edition: 2
• Topic: Computer Science
• Subtopic: Operating Systems
• Index: Computer Science

Employ the most advanced pentesting techniques and tools to build highly-secured systems and environmentsAbout This Book• Learn how to build your own pentesting lab environment to practice advanced techniques• Customize your own scripts, and learn methods to exploit 32-bit and 64-bit programs• Explore a vast variety of stealth techniques to bypass a number of protections when penetration testingWho This Book Is ForThis book is for anyone who wants to improve their skills in penetration testing. As it follows a step-by-step approach, anyone from a novice to an experienced security tester can learn effective techniques to deal with highly secured environments.Whether you are brand new or a seasoned expert, this book will provide you with the skills you need to successfully create, customize, and plan an advanced penetration test.What You Will Learn• A step-by-step methodology to identify and penetrate secured environments• Get to know the process to test network services across enterprise architecture when defences are in place• Grasp different web application testing methods and how to identify web application protections that are deployed• Understand a variety of concepts to exploit software• Gain proven post-exploitation techniques to exfiltrate data from the target• Get to grips with various stealth techniques to remain undetected and defeat the latest defences• Be the first to find out the latest methods to bypass firewalls• Follow proven approaches to record and save the data from tests for analysisIn DetailThe defences continue to improve and become more and more common, but this book will provide you with a number or proven techniques to defeat the latest defences on the networks. The methods and techniques contained will provide you with a powerful arsenal of best practices to increase your penetration testing successes.The processes and methodology will provide you techniques that will enable you to be successful, and the step by step instructions of information gathering and intelligence will allow you to gather the required information on the targets you are testing. The exploitation and post-exploitation sections will supply you with the tools you would need to go as far as the scope of work will allow you. The challenges at the end of each chapter are designed to challenge you and provide real-world situations that will hone and perfect your penetration testing skills. You will start with a review of several well respected penetration testing methodologies, and following this you will learn a step-by-step methodology of professional security testing, including stealth, methods of evasion, and obfuscation to perform your tests and not be detected!The final challenge will allow you to create your own complex layered architecture with defences and protections in place, and provide the ultimate testing range for you to practice the methods shown throughout the book. The challenge is as close to an actual penetration test assignment as you can get!Style and approachThe book follows the standard penetration testing stages from start to finish with step-by-step examples. The book thoroughly covers penetration test expectations, proper scoping and planning, as well as enumeration and foot printing

Advanced Penetration Testing for Highly-Secured Environments Second Edition

---

Table of Contents

Advanced Penetration Testing for Highly-Secured Environments Second Edition

Credits

About the Authors

About the Reviewer

www.PacktPub.com

eBooks, discount offers, and more

Why subscribe?

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Downloading the color images of this book

Errata

Piracy

Questions

1. Penetration Testing Essentials

Methodology defined

Example methodologies

Penetration testing framework

Penetration Testing Execution Standard

Pre-engagement interactions

Intelligence gathering

Threat modeling

Vulnerability analysis

Exploitation

Post-exploitation

Reporting

Abstract methodology

Final thoughts

Summary

2. Preparing a Test Environment

Introducing VMware Workstation

Why VMware Workstation?

Installing VMware Workstation

Network design

VMnet0

VMnet1

VMnet8

Folders

Understanding the default architecture

Installing Kali Linux

Creating the switches

Putting it all together

Installing Ubuntu LTS

Installing Kioptrix

Creating pfSense VM

Summary

3. Assessment Planning

Introducing advanced penetration testing

Vulnerability assessments

Penetration testing

Advanced penetration testing

Before testing begins

Determining scope

Setting limits – nothing lasts forever

Rules of Engagement documentation

Planning for action

Configuring Kali

Updating the applications and operating system

Installing LibreOffice

Effectively managing your test results

Introduction to MagicTree

Starting MagicTree

Adding nodes

Data collection

Report generation

Introduction to the Dradis framework

Exporting a project template

Importing a project template

Preparing sample data for import

Importing your Nmap data

Exporting data into HTML

Dradis Category field

Changing the default HTML template

Summary

4. Intelligence Gathering

Introducing reconnaissance

Reconnaissance workflow

DNS recon

nslookup – it's there when you need it

Default output

Changing nameservers

Creating an automation script

What did we learn?

Domain information groper

Default output

Zone transfers using Dig

Advanced features of Dig

Shortening the output

Listing the bind version

Reverse DNS lookup using Dig

Multiple commands

Tracing the path

Batching with dig

DNS brute-forcing with fierce

Default command usage

Creating a custom word list

Gathering and validating domain and IP information

Gathering information with Whois

Specifying which registrar to use

Where in the world is this IP?

Defensive measures

Using search engines to do your job for you

Shodan

Filters

Understanding banners

HTTP banners

Finding specific assets

Finding people (and their documents) on the web

Google hacking database

Google filters

Searching the Internet for clues

Creating network baselines with scanPBNJ

Metadata collection

Extracting metadata from photos using exiftool

Summary

5. Network Service Attacks

Configuring and testing our lab clients

Kali – manual ifconfig

Ubuntu – manual ifconfig

Verifying connectivity

Maintaining IP settings after reboot

Angry IP Scanner

Nmap – getting to know you

Commonly seen Nmap scan types and options

Basic scans – warming up

Other Nmap techniques

Remaining stealthy

Taking your time

Trying different scan types

SYN scan

Null scan

ACK scan

Conclusion

Shifting blame – the zombies did it!

IDS rules and how to avoid them

Using decoys

Adding custom Nmap scripts to your arsenal

Deciding if a script is right for you

Adding a new script to the database

Zenmap – for those who want the GUI

SNMP – a goldmine of information just waiting to be discovered

When the SNMP community string is NOT "public"

Network baselines with scanPBNJ

Setting up MySQL for PBNJ

Preparing the PBNJ database

First scan

Reviewing the data

Enumeration avoidance techniques

Naming conventions

Port knocking

Intrusion detection and avoidance systems

Trigger points

SNMP lockdown

Reader challenge

Summary

6. Exploitation

Exploitation – why bother?

Manual exploitation

Enumerating services

Quick scans with unicornscan

Full scanning with Nmap

Banner grabbing with Netcat and Ncat

Banner grabbing with Netcat

Banner grabbing with Ncat

Banner grabbing with smbclient

Searching Exploit-DB

Exploit-DB at hand

Compiling the code

Compiling proof-of-concept code

Troubleshooting the code

What are all of these ^M characters and why won't they go away?

Broken strings – the reunion

Running the exploit

Getting files to and from victim machines

Starting a TFTP server on Kali

Installing and configuring pure-ftpd

Starting pure-ftpd

Passwords – something you know…

Cracking the hash

Brute-forcing passwords

Metasploit – learn it and love it

Databases and Metasploit

Performing an nmap scan from within Metasploit

Using auxiliary modules

Using Metasploit to exploit Kioptrix

Reader challenge

Summary

7. Web Application Attacks

Practice makes perfect

Creating a KioptrixVM Level 3 clone

Installing and configuring Mutillidae on the Ubuntu virtual machine

Configuring pfSense

Configuring the pfSense DHCP server

Starting the virtual lab

pfSense DHCP – Permanent ...

Table of contents

• Advanced Penetration Testing for Highly-Secured Environments Second Edition