Advanced Penetration Testing

Advanced Penetration Testing

by Wil Allsopp
Released March 2017
Publisher(s): Wiley
ISBN: 9781119367680

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

Build a better defense against motivated, organized, professional attacks

Advanced Penetration Testing: Hacking the World's Most Secure Networks takes hacking far beyond Kali linux and Metasploit to provide a more complex attack simulation. Featuring techniques not taught in any certification prep or covered by common defensive scanners, this book integrates social engineering, programming, and vulnerability exploits into a multidisciplinary approach for targeting and compromising high security environments. From discovering and creating attack vectors, and moving unseen through a target enterprise, to establishing command and exfiltrating data—even from organizations without a direct Internet connection—this guide contains the crucial techniques that provide a more accurate picture of your system's defense. Custom coding examples use VBA, Windows Scripting Host, C, Java, JavaScript, Flash, and more, with coverage of standard library applications and the use of scanning tools to bypass common defensive measures.

Typical penetration testing consists of low-level hackers attacking a system with a list of known vulnerabilities, and defenders preventing those hacks using an equally well-known list of defensive scans. The professional hackers and nation states on the forefront of today's threats operate at a much more complex level—and this book shows you how to defend your high security network.

  • Use targeted social engineering pretexts to create the initial compromise
  • Leave a command and control structure in place for long-term access
  • Escalate privilege and breach networks, operating systems, and trust structures
  • Infiltrate further using harvested credentials while expanding control

Today's threats are organized, professionally-run, and very much for-profit. Financial institutions, health care organizations, law enforcement, government agencies, and other high-value targets need to harden their IT infrastructure and human capital against targeted advanced attacks from motivated professionals. Advanced Penetration Testing goes beyond Kali linux and Metasploit and to provide you advanced pen testing for high security networks.

Table of contents

  1. Cover
  2. Title Page
  3. Introduction
    1. Coming Full Circle
    2. Advanced Persistent Threat (APT)
    3. Next Generation Technology
    4. “Hackers”
    5. Forget Everything You Think You Know About Penetration Testing
    6. How This Book Is Organized
  4. Chapter 1: Medical Records (In)security
    1. An Introduction to Simulating Advanced Persistent Threat
    2. Background and Mission Briefing
    3. Payload Delivery Part 1: Learning How to Use the VBA Macro
    4. Command and Control Part 1: Basics and Essentials
    5. The Attack
    6. Summary
    7. Exercises
  5. Chapter 2: Stealing Research
    1. Background and Mission Briefing
    2. Payload Delivery Part 2: Using the Java Applet for Payload Delivery
    3. Notes on Payload Persistence
    4. Command and Control Part 2: Advanced Attack Management
    5. The Attack
    6. Summary
    7. Exercises
  6. Chapter 3: Twenty-First Century Heist
    1. What Might Work?
    2. Nothing Is Secure
    3. Organizational Politics
    4. APT Modeling versus Traditional Penetration Testing
    5. Background and Mission Briefing
    6. Command and Control Part III: Advanced Channels and Data Exfiltration
    7. Payload Delivery Part III: Physical Media
    8. The Attack
    9. Summary
    10. Exercises
  7. Chapter 4: Pharma Karma
    1. Background and Mission Briefing
    2. Payload Delivery Part IV: Client-Side Exploits 1
    3. Command and Control Part IV: Metasploit Integration
    4. The Attack
    5. Summary
    6. Exercises
  8. Chapter 5: Guns and Ammo
    1. Background and Mission Briefing
    2. Payload Delivery Part V: Simulating a Ransomware Attack
    3. Command and Control Part V: Creating a Covert C2 Solution
    4. New Strategies in Stealth and Deployment
    5. The Attack
    6. Summary
    7. Exercises
  9. Chapter 6: Criminal Intelligence
    1. Payload Delivery Part VI: Deploying with HTA
    2. Privilege Escalation in Microsoft Windows
    3. Command and Control Part VI: The Creeper Box
    4. The Attack
    5. Summary
    6. Exercises
  10. Chapter 7: War Games
    1. Background and Mission Briefing
    2. Payload Delivery Part VII: USB Shotgun Attack
    3. Command and Control Part VII: Advanced Autonomous Data Exfiltration
    4. The Attack
    5. Summary
    6. Exercises
  11. Chapter 8: Hack Journalists
    1. Briefing
    2. Advanced Concepts in Social Engineering
    3. C2 Part VIII: Experimental Concepts in Command and Control
    4. Payload Delivery Part VIII: Miscellaneous Rich Web Content
    5. The Attack
    6. Summary
    7. Exercises
  12. Chapter 9: Northern Exposure
    1. Overview
    2. Operating Systems
    3. North Korean Public IP Space
    4. The North Korean Telephone System
    5. Approved Mobile Devices
    6. The “Walled Garden”: The Kwangmyong Intranet
    7. Audio and Video Eavesdropping
    8. Summary
    9. Exercises
  13. End User License Agreement

Product information

  • Title: Advanced Penetration Testing
  • Author(s): Wil Allsopp
  • Release date: March 2017
  • Publisher(s): Wiley
  • ISBN: 9781119367680