Metasploit for Beginners

Metasploit for Beginners

by Sagar Rahalkar
Released July 2017
Publisher(s): Packt Publishing
ISBN: 9781788295970

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

An easy to digest practical guide to Metasploit covering all aspects of the framework from installation, configuration, and vulnerability hunting to advanced client side attacks and anti-forensics.

About This Book

  • Carry out penetration testing in highly-secured environments with Metasploit
  • Learn to bypass different defenses to gain access into different systems.
  • A step-by-step guide that will quickly enhance your penetration testing skills.

Who This Book Is For

If you are a penetration tester, ethical hacker, or security consultant who wants to quickly learn the Metasploit framework to carry out elementary penetration testing in highly secured environments then, this book is for you.

What You Will Learn

  • Get to know the absolute basics of the Metasploit framework so you have a strong foundation for advanced attacks
  • Integrate and use various supporting tools to make Metasploit even more powerful and precise
  • Set up the Metasploit environment along with your own virtual testing lab
  • Use Metasploit for information gathering and enumeration before planning the blueprint for the attack on the target system
  • Get your hands dirty by firing up Metasploit in your own virtual lab and hunt down real vulnerabilities
  • Discover the clever features of the Metasploit framework for launching sophisticated and deceptive client-side attacks that bypass the perimeter security
  • Leverage Metasploit capabilities to perform Web application security scanning

In Detail

This book will begin by introducing you to Metasploit and its functionality. Next, you will learn how to set up and configure Metasploit on various platforms to create a virtual test environment. You will also get your hands on various tools and components used by Metasploit.

Further on in the book, you will learn how to find weaknesses in the target system and hunt for vulnerabilities using Metasploit and its supporting tools. Next, you'll get hands-on experience carrying out client-side attacks. Moving on, you'll learn about web application security scanning and bypassing anti-virus and clearing traces on the target system post compromise. This book will also keep you updated with the latest security techniques and methods that can be directly applied to scan, test, hack, and secure networks and systems with Metasploit.

By the end of this book, you'll get the hang of bypassing different defenses, after which you'll learn how hackers use the network to gain access into different systems.

Style and approach

This tutorial is packed with step-by-step instructions that are useful for those getting started with Metasploit. This is an easy-to-read guide to learning Metasploit from scratch that explains simply and clearly all you need to know to use this essential IT power tool.

Table of contents

  1. Preface
    1. What this book covers
    2. What you need for this book
    3. Who this book is for
    4. Conventions
    5. Reader feedback
    6. Customer support
    7. Errata
    8. Piracy
    9. Questions
  2. Introduction to Metasploit and Supporting Tools
    1. The importance of penetration testing
    2. Vulnerability assessment versus penetration testing
    3. The need for a penetration testing framework
    4. Introduction to Metasploit
    5. When to use Metasploit?
    6. Making Metasploit effective and powerful using supplementary tools
      1. Nessus
      2. NMAP
      3. w3af
      4. Armitage
    7. Summary
    8. Exercises
  3. Setting up Your Environment
    1. Using the Kali Linux virtual machine - the easiest way
    2. Installing Metasploit on Windows
    3. Installing Metasploit on Linux
    4. Setting up exploitable targets in a virtual environment
    5. Summary
    6. Exercises
  4. Metasploit Components and Environment Configuration
    1. Anatomy and structure of Metasploit
    2. Metasploit components
      1. Auxiliaries
      2. Exploits
      3. Encoders
      4. Payloads
      5. Post
    3. Playing around with msfconsole
    4. Variables in Metasploit
    5. Updating the Metasploit Framework
    6. Summary
    7. Exercises
  5. Information Gathering with Metasploit
    1. Information gathering and enumeration
      1. Transmission Control Protocol
      2. User Datagram Protocol
      3. File Transfer Protocol
      4. Server Message Block
      5. Hypertext Transfer Protocol
      6. Simple Mail Transfer Protocol
      7. Secure Shell
      8. Domain Name System
      9. Remote Desktop Protocol
    2. Password sniffing
    3. Advanced search with shodan
    4. Summary
    5. Exercises
  6. Vulnerability Hunting with Metasploit
    1. Managing the database
      1. Work spaces
      2. Importing scans
      3. Backing up the database
    2. NMAP
      1. NMAP scanning approach
    3. Nessus
      1. Scanning using Nessus from msfconsole
    4. Vulnerability detection with Metasploit auxiliaries
    5. Auto exploitation with db_autopwn
    6. Post exploitation
      1. What is meterpreter?
      2. Searching for content
      3. Screen capture
      4. Keystroke logging
      5. Dumping the hashes and cracking with JTR
      6. Shell command
      7. Privilege escalation
    7. Summary
    8. Exercises
  7. Client-side Attacks with Metasploit
    1. Need of client-side attacks
      1. What are client-side attacks?
        1. What is a Shellcode?
        2. What is a reverse shell?
        3. What is a bind shell?
        4. What is an encoder?
    2. The msfvenom utility
      1. Generating a payload with msfvenom
    3. Social Engineering with Metasploit
      1. Generating malicious PDF
      2. Creating infectious media drives
    4. Browser Autopwn
    5. Summary
    6. Exercises
  8. Web Application Scanning with Metasploit
    1. Setting up a vulnerable application
    2. Web application scanning using WMAP
    3. Metasploit Auxiliaries for Web Application enumeration and scanning
    4. Summary
    5. Exercises
  9. Antivirus Evasion and Anti-Forensics
    1. Using encoders to avoid AV detection
      1. Using packagers and encrypters
      2. What is a sandbox?
    2. Anti-forensics
      1. Timestomp
      2. clearev
    3. Summary
    4. Exercises
  10. Cyber Attack Management with Armitage
    1. What is Armitage?
    2. Starting the Armitage console
    3. Scanning and enumeration
    4. Find and launch attacks
    5. Summary
    6. Exercises
  11. Extending Metasploit and Exploit Development
    1. Exploit development concepts
      1. What is a buffer overflow?
      2. What are fuzzers?
    2. Exploit templates and mixins
      1. What are Metasploit mixins?
    3. Adding external exploits to Metasploit
    4. Summary
    5. Exercises

Product information

  • Title: Metasploit for Beginners
  • Author(s): Sagar Rahalkar
  • Release date: July 2017
  • Publisher(s): Packt Publishing
  • ISBN: 9781788295970