book

Mastering Metasploit - Fourth Edition

Name: Mastering Metasploit - Fourth Edition
Author: Nipun Jaswal
ISBN: 9781838980078

by Nipun Jaswal

June 2020

Intermediate to advanced

502 pages

10h

English

Packt Publishing

Read now

Unlock full access

Mastering Metasploit
Fourth EditionWhy subscribe?ContributorsAbout the authorAbout the reviewersPackt is searching for authors like you
Preface
Who this book is forWhat this book coversTo get the most out of this bookDownload the example code filesDownload the color imagesConventions usedGet in touchReviews
Section 1 – Preparation and Development
Chapter 1: Approaching a Penetration Test Using Metasploit
Technical requirementsOrganizing a penetration testPreinteractionsIntelligence gathering/reconnaissance phaseThreat modelingVulnerability analysisExploitation and post-exploitationReportingMounting the environmentSetting up Metasploit in a virtual environmentThe fundamentals of MetasploitConducting a penetration test with MetasploitRecalling the basics of MetasploitBenefits of penetration testing using MetasploitOpen sourceSupport for testing large networks and natural naming conventionsSmart payload generation and switching mechanismCleaner exitsCase study – reaching the domain controllerGathering intelligenceUsing databases in MetasploitConducting a port scan with MetasploitModeling threatsVulnerability analysisExploitation and gaining accessPost-exploitation kung fuRevisiting the case studySummary
Chapter 2: Reinventing Metasploit
Technical requirementsRuby – the heart of MetasploitCreating your first Ruby programVariables and data types in RubyNumbers and conversions in RubyConversions in RubyRanges in RubyArrays in RubyMethods in RubyDecision-making operatorsLoops in RubyRegular expressionsObject-oriented programming with RubyWrapping up with Ruby basicsUnderstanding Metasploit modulesMetasploit module building in a nutshellUnderstanding the file structureWorking with existing Metasploit modulesDisassembling the existing HTTP server scanner moduleDeveloping an auxiliary – the FTP scanner moduleLibraries and functionsUsing msftidyDeveloping an auxiliary—the SSH brute force moduleRephrasing the equationDeveloping post-exploitation modulesThe Credential Harvester moduleThe Windows Defender exception harvesterThe drive-disabler modulePost-exploitation with RailGunManipulating Meterpreter through Interactive Ruby ShellUnderstanding RailGun objects and finding functionsAdding custom DLLs to RailGunSummary
Chapter 3: The Exploit Formulation Process
Technical requirementsThe absolute basics of exploitationThe basicsSystem architectureExploiting a stack overflow vulnerability with MetasploitAn application crashCalculating the crash offsetGaining EIP controlFinding the JMP/CALL addressGaining access to a Windows 10 machineExploiting SEH-based buffer overflows with MetasploitUsing the Mona.py script for pattern generationUnderstanding SEH frames and their exploitationBuilding the exploit baseThe SEH chainsLocating POP/POP/RET sequencesExploiting the vulnerabilityBypassing DEP in Metasploit modulesUsing ROP to bypass DEPUsing msfrop to find ROP gadgetsUsing Mona.py to create ROP chainsOther protection mechanismsSummary
Chapter 4: Porting Exploits
Technical requirementsImporting a stack-based buffer overflow exploitGathering the essentialsGenerating a Metasploit moduleExploiting the target application with MetasploitImplementing a check method for exploits in MetasploitImporting a web-based RCE exploit into MetasploitGathering the essentialsGrasping the important web functionsThe essentials of the GET/POST methodImporting an HTTP exploit into MetasploitImporting TCP server/browser-based exploits into MetasploitGathering the essentialsGenerating the Metasploit moduleSummary
Section 2 – The Attack Phase
Chapter 5: Testing Services with Metasploit
Technical requirementsThe fundamentals of testing SCADA systemsThe fundamentals of industrial control systems and their componentsExploiting HMI in SCADA serversSCADA-based exploitsAttacking the Modbus protocolSecuring SCADADatabase exploitationSQL serverScanning MSSQL with Metasploit modulesBrute forcing passwordsLocating/capturing server passwordsBrowsing the SQL serverPost-exploiting/executing system commandsTesting VOIP servicesVOIP fundamentalsFingerprinting VOIP servicesScanning VOIP servicesSpoofing a VOIP callExploiting VOIPSummary
Chapter 6: Virtual Test Grounds and Staging
Technical requirementsPerforming a penetration test with integrated Metasploit servicesInteracting with the employees and end usersGathering intelligenceModeling the threat areasGaining access to the targetMaintaining access to ADGenerating manual reportsThe format of the reportThe executive summaryMethodology/network admin-level reportAdditional sectionsSummary

Chapter 7: Client-Side Exploitation
Technical requirementsExploiting browsers for fun and profitThe browser Autopwn attackThe technology behind the browser Autopwn attackAttacking browsers with Metasploit browser autopwnCompromising the clients of a websiteInjecting malicious web scriptsHacking the users of a websiteUsing Kali NetHunter with browser exploitsMetasploit and Arduino – the deadly combinationFile format-based exploitationPDF-based exploitsWord-based exploitsAttacking Android with MetasploitSummary
Section 3 – Post-Exploitation and Evasion
Chapter 8: Metasploit Extended
Technical requirementsBasic Windows post-exploitation commandsThe help menuThe get_timeouts and set_timeouts commandsThe transport commandFile operation commandsPeripheral manipulation commandsWindows versus Linux basic post-exploitation commandsThe missing Linux screenshot moduleMuting Linux volume for screenshotsAdvanced Windows post-exploitation modulesGathering wireless SSIDs with MetasploitGathering Wi-Fi passwords with MetasploitGathering Skype passwordsGathering USB historySearching files with MetasploitWiping logs from the target with the clearev commandAdvanced multi-OS extended features of MetasploitUsing the pushm and popm commandsSpeeding up development using the reload, edit, and reload_all commandsMaking use of resource scriptsSniffing traffic with MetasploitPrivilege escalation with MetasploitEscalation of privileges on Windows-based systemsEscalation of privileges on Linux systemsSummary
Chapter 9: Evasion with Metasploit
Technical requirementsEvading Meterpreter detection using C wrappers and custom encodersWriting a custom Meterpreter encoder/decoder in CEvading Meterpreter with PythonEvading intrusion detection systems with MetasploitUsing random cases for fun and profitUsing fake relatives to fool IDS systemsBypassing Windows firewall blocked portsUsing the reverse Meterpreter on all portsSummary
Chapter 10: Metasploit for Secret Agents
Technical requirementsMaintaining anonymity in Meterpreter sessions using proxy and HOP payloadsMaintaining access using search order hijacking in standard softwareDLL search order hijackingUsing code caves for hiding backdoorsHarvesting files from target systemsUsing Venom for obfuscationCovering tracks with anti-forensics modulesSummary
Chapter 11: Visualizing Metasploit
Technical requirementsKage for Meterpreter sessionsAutomated exploitation using ArmitageGetting startedTouring the user interfaceManaging the workspaceScanning networks and host managementModeling out vulnerabilitiesExploitation with ArmitagePost-exploitation with ArmitageRed teaming with the Armitage team serverScripting ArmitageThe fundamentals of CortanaControlling MetasploitPost-exploitation with CortanaSummary
Chapter 12: Tips and Tricks
Technical requirementsAutomation using the Minion scriptUsing connect instead of NetcatShell upgrades and background sessionsNaming conventionsChanging the prompt and making use of database variablesSaving configurations in MetasploitUsing inline handler and renaming jobs Running commands on multiple MeterpretersAutomating the Social Engineering ToolkitCheat sheets for Metasploit and penetration testingSummaryFurther reading
Other Books You May Enjoy
Leave a review - let other readers know what you think

Content preview from Mastering Metasploit - Fourth Edition

Chapter 5: Testing Services with Metasploit

Having gathered exploit development experience in Metasploit, let's now talk about testing various specialized services. It is likely that, during your career as a penetration tester, you will come across a testable environment that only requires testing to be performed within a service such as databases, Voice Over Internet Protocol (VOIP), or Supervisory Control and Data Acquisition (SCADA). In this chapter, we will look at the various developing strategies to use when carrying out penetration tests on these services. In this chapter, we will cover the following topics:

The fundamentals of testing SCADA systems
Database exploitation
Testing VOIP services

Service-based penetration testing requires ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781838980078

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Mastering Metasploit - Fourth Edition

by Nipun Jaswal

Chapter 5: Testing Services with Metasploit

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.