book

Mastering Kali Linux for Advanced Penetration Testing - Fourth Edition

Name: Mastering Kali Linux for Advanced Penetration Testing - Fourth Edition
Author: Vijay Kumar Velu
ISBN: 9781801819770

by Vijay Kumar Velu

February 2022

Intermediate to advanced

572 pages

13h 16m

English

Packt Publishing

Read now

Unlock full access

Preface
Who this book is forWhat this book coversTo get the most out of this bookGet in touch
Goal-Based Penetration Testing
Different types of threat actors Conceptual overview of security testingCommon pitfalls of vulnerability assessments, penetration testing, and red team exercisesObjective-based penetration testingThe testing methodologyIntroduction to Kali Linux featuresThe role of Kali in red team tacticsInstalling and updating Kali LinuxUsing as a portable deviceInstalling Kali on a Raspberry Pi 4Installing Kali on a VMVMware Workstation PlayerVirtualBoxInstalling to a Docker applianceKali on AWS CloudKali on Google Cloud Platform (GCP)Kali on Android (non-rooted phones)Organizing Kali LinuxConfiguring and customizing Kali LinuxResetting the default passwordConfiguring network services and secure communicationsAdjusting network proxy settingsAccessing the secure shell remotelySpeeding up Kali operationsSharing folders with the host operating systemUsing Bash scripts to customize KaliBuilding a verification labInstalling defined targetsLab NetworkActive Directory and Domain ControllerInstalling Microsoft Exchange Server 2016 Metasploitable3MutillidaeCloudGoat Managing collaborative penetration testing using FaradaySummary
Open-Source Intelligence and Passive Reconnaissance
Basic principles of reconnaissanceOSINTOffensive OSINTGather domain informationMaltegoOSRFrameworkWeb archivesPassive TotalScrapingGathering usernames and email addressesObtaining user informationTinEyeOnline search portals SpiderFootOther commercial toolsGoogle Hacking DatabaseUsing dork scripts to query GoogleData dump sitesDefensive OSINTDark webSecurity breachesPublic recordsThreat intelligenceProfiling users for password listsCreating custom wordlists for cracking passwordsUsing CeWL to map a websiteExtracting words from Twitter using twofiSummary
Active Reconnaissance of External and Internal Networks
Stealth scanning techniquesAdjusting source IP stack and tool identification settingsModifying packet parametersUsing proxies with anonymity networksDNS reconnaissance and route mappingThe whois command (post GDPR)Employing comprehensive reconnaissance applicationsThe recon-ng frameworkIPv4IPv6Using IPv6-specific toolsMapping the route to the targetIdentifying the external network infrastructureMapping beyond the firewallIDS/IPS identificationEnumerating hostsLive host discoveryPort, operating system, and service discoveryPort scanningWriting your own port scanner using netcatFingerprinting the operating systemDetermining active servicesLarge-scale scanningDHCP informationIdentification and enumeration of internal network hostsNative MS Windows commandsARP broadcastingPing sweepUsing scripts to combine masscan and nmap scansTaking advantage of SNMPWindows account information via SMB sessionsLocating network sharesReconnaissance of active directory domain serversEnumerating the Microsoft Azure environment Using comprehensive tools (Legion)Using machine learning for reconnaissanceSummary
Vulnerability Assessment
Vulnerability nomenclatureLocal and online vulnerability databasesVulnerability scanning with NmapIntroduction to Lua scriptingCustomizing NSE scriptsWeb application vulnerability scannersNiktoCustomizing Nikto OWASP ZAPVulnerability scanners for mobile applicationsThe OpenVAS network vulnerability scannerCustomizing OpenVASCommercial vulnerability scannersNessusQualysSpecialized scannersThreat modelingSummary
Advanced Social Engineering and Physical Security
Command methodology and TTPsTechnologyComputer-basedMobile-basedPeople-basedPhysical attacksVoice-basedPhysical attacks at the consolesamdump2 and chntpwSticky KeysCreating a rogue physical deviceMicrocomputer or USB-based attack agentsThe Raspberry PiMalDuino: the BadUSBThe Social Engineering Toolkit (SET)Social-engineering attacksCredential harvester web attack methodMulti-attack web attack methodHTA web attack methodUsing the PowerShell alphanumeric shellcode injection attackHiding executables and obfuscating the attacker’s URLEscalating an attack using DNS redirectionSpear phishing attackEmail phishing using GophishLaunching a phishing attack using GophishUsing bulk transfer as phishing to deliver payloadsSummary
Wireless and Bluetooth Attacks
Introduction to wireless and Bluetooth technologiesConfiguring Kali for wireless attacksWireless reconnaissanceBypassing a hidden SSIDBypassing MAC address authentication and open authenticationAttacking WPA and WPA2Brute-force attacksAttacking wireless routers with ReaverDenial of Service (DoS) attacks against wireless communicationsCompromising enterprise implementations of WPA2Working with bettercapEvil Twin attack using WifiphisherWPA3Bluetooth attacksSummary
Exploiting Web-Based Applications
Web application hacking methodologyThe hacker’s mind mapReconnaissance of web appsDetection of web application firewall and load balancersFingerprinting a web application and CMSMirroring a website from the command lineClient-side proxiesBurp ProxyWeb crawling and directory brute-force attacksWeb service-specific vulnerability scannersApplication-specific attacksBrute-forcing access credentialsOS command injection using commixsqlmapXML injectionBit-flipping attackMaintaining access with web shellsThe Browser Exploitation Framework (BeEF)Installing and configuring BeEFUnderstanding the BeEF browserUsing BeEF as a tunneling proxySummary
Cloud Security Exploitation
Introduction to cloud servicesVulnerability scanning and application exploitation in an EC2 instance Testing for S3 bucket misconfigurationExploiting security permission flawsObfuscating CloudTrail logsSummary
Bypassing Security Controls
Bypassing Network Access Control (NAC)Pre-admission NACAdding new elementsIdentifying the rulesDisabling endpoint securityPost-admission NACBypassing isolationDetecting a honeypotBypassing application-level controlsTunneling past client-side firewalls using SSHInbound to outboundBypassing URL filtering mechanismsOutbound to inboundBypassing the antivirus with filesUsing the Veil frameworkUsing ShellterGoing fileless and evading antivirusBypassing Windows operating system controlsUser Account Control (UAC)Using fodhelper to bypass UAC in Windows 10Using Disk Cleanup to bypass UAC in Windows 10Obfuscating the PowerShell and using fileless techniquesOther Windows-specific operating system controlsAccess and authorizationEncryptionSystem securityCommunications securityAuditing and loggingSummary

Exploitation
The Metasploit FrameworkLibrariesREXFramework coreFramework baseInterfacesModulesDatabase setup and configurationExploiting targets using MSFSingle targets using a simple reverse shellExploiting multiple targets using MSF resource filesUsing public exploitsLocating and verifying publicly available exploitsCompiling and using exploitsCompiling C files and executing exploitsAdding the exploits that are written using the MSF as a baseDeveloping a Windows exploitIdentify the vulnerability through fuzzingDebug and replicate the crash Control the application executionIdentify the right bad characters and generate shellcodeObtain the shellPowerShell Empire frameworkSummary
Action on the Objective and Lateral Movement
Activities on the compromised local systemConducting rapid reconnaissance of a compromised systemFinding and taking sensitive data – pillaging the targetCreating additional accountsPost-exploitation toolsThe Metasploit Framework – MeterpreterThe PowerShell Empire project CrackMapExecHorizontal escalation and lateral movementCompromising domain trusts and sharesPsExec, WMIC, and other toolsWMICWindows Credentials EditorLateral movement using servicesPivoting and port forwardingUsing ProxyChainsSummary
Privilege Escalations
Overview of the common escalation methodologyEscalating from domain user to system administratorLocal system escalationEscalating from administrator to systemDLL injectionCredential harvesting and escalation attacksPassword sniffersResponderPerforming a MiTM attack on LDAP over TLSEscalating access rights in Active DirectoryCompromising Kerberos – a golden-ticket attackSummary
Command and Control
PersistenceUsing persistent agentsEmploying Netcat as a persistent agentUsing schtasks to configure a persistent taskMaintaining persistence with the Metasploit frameworkUsing the post exploit persistence moduleCreating a standalone persistent agent with MetasploitPersistence using online file storage cloud servicesDropboxMicrosoft OneDriveCovenant PoshC2Domain frontingUsing Amazon CloudFront for C2Exfiltration of dataUsing existing system services (Telnet, RDP, and VNC)Using the ICMP protocolHiding evidence of an attackSummary
Embedded Devices and RFID Hacking
Embedded systems and hardware architectureEmbedded system basic architectureUnderstanding firmwareDifferent types of firmwareUnderstanding bootloadersCommon toolsFirmware unpacking and updatingIntroduction to RouterSploit FrameworkUARTCloning RFID using ChameleonMiniOther toolsSummary
Other Books You May Enjoy
Index

Content preview from Mastering Kali Linux for Advanced Penetration Testing - Fourth Edition

11 Action on the Objective and Lateral Movement

If exploiting a system is the definition of what a penetration test is, it is the action on the objective after the exploitation that gives the test its real purpose. This step demonstrates the severity of the exploit and the impact that it could have on the organization. This chapter will focus on the immediate post-exploit activities, as well as the aspect of horizontal privilege escalation—the process of using an exploited system as a starting point to jump on to other systems on the network.

By the end of this chapter, you will have learned about the following topics:

Local privilege escalation
Post-exploitation tools
Lateral movement within the target networks
Compromising domain trusts

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Mastering Kali Linux for Advanced Penetration Testing - Third Edition

Publisher Resources

ISBN: 9781801819770

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Mastering Kali Linux for Advanced Penetration Testing - Fourth Edition

by Vijay Kumar Velu

11

Action on the Objective and Lateral Movement

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.