book

Python: Penetration Testing for Developers

Name: Python: Penetration Testing for Developers
ISBN: 9781787128187

by Christopher Duffy, Mohit, Cameron Buchanan, Terry Ip, Andrew Mabbitt, Benjamin May, Dave Mound

October 2016

Beginner to intermediate

650 pages

14h 43m

English

Packt Publishing

Read now

Unlock full access

Python: Penetration Testing for Developers
Table of Contents
Python: Penetration Testing for Developers
Python: Penetration Testing for Developers
Credits
Preface
What this learning path covers
What you need for this learning path
Who this learning path is for
Reader feedback
Customer support
Downloading the example codeErrataPiracyQuestions

1. Module 1
1. Understanding the Penetration Testing Methodology
An overview of penetration testing
Understanding what penetration testing is not
Vulnerability assessmentsReverse engineering engagementsHacking
Assessment methodologies
The penetration testing execution standard
Pre-engagement interactionsWhite Box TestingGrey Box TestingBlack Box TestingDouble Blind TestingIntelligence gatheringThreat modelingVulnerability analysisExploitationPost exploitationReportingAn example engagement
Penetration testing tools
NMAPMetasploitVeilBurp SuiteHydraJohn the RipperCracking Windows passwords with JohnoclHashcatOphcrackMimikatz and IncognitoSMBexecCewlRespondertheHarvester and Recon-NGpwdump and fgdumpNetcatSysinternals tools
Summary
2. The Basics of Python Scripting
Understanding the difference between interpreted and compiled languages
Python – the good and the bad
A Python interactive interpreter versus a script
Environmental variables and PATH
Understanding dynamically typed languages
The first Python script
Developing scripts and identifying errors
Reserved words, keywords, and built-in functionsGlobal and local variablesUnderstanding a namespaceModules and imports
Python formatting
Indentation
Python variables
Debugging variable valuesString variablesNumber variablesConverting string and number variablesList variablesTuple variablesDictionary variablesUnderstanding default values and constructorsPassing a variable to a string
Operators
Comparison operatorsAssignment operatorsArithmetic operatorsLogical and membership operators
Compound statements
The if statementsPython loopsThe while loopThe for loopThe break conditionConditional handlers
Functions
The impact of dynamically typed languages on functions on functionsCurly bracketsHow to comment your code
The Python style guide
ClassesFunctionsVariables and instance names
Arguments and options
Your first assessor script
Summary
3. Identifying Targets with Nmap, Scapy, and Python
Understanding how systems communicateThe Ethernet frame architectureLayer 2 in Ethernet networksLayer 2 in wireless networksThe IP packet architectureThe TCP header architectureUnderstanding how TCP worksThe TCP three-way handshakeThe UDP header architectureUnderstanding how UDP works
Understanding Nmap
Inputting the target ranges for NmapExecuting the different scan typesExecuting TCP full connection scansExecuting SYN scansExecuting ACK scansExecuting UDP scansExecuting combined UDP and TCP scansSkipping the operating system scansDifferent output typesUnderstanding the Nmap Grepable outputUnderstanding the Nmap XML outputThe Nmap scripting engineBeing efficient with Nmap scansDetermining your interface details with the netifaces library
Nmap libraries for Python
The Scapy library for Python
Summary
4. Executing Credential Attacks with Python
The types of credential attacksDefining the online credential attackDefining the offline credential attack
Identifying the target
Creating targeted usernames
Generating and verifying usernames with help from the U.S. censusGenerating the usernames
Testing for users using SMTP VRFY
Creating the SMTP VRFY script
Summary
5. Exploiting Services with Python
Understanding the new age of service exploitation
Understanding the chaining of exploits
Checking for weak, default, or known passwordsGaining root access to the systemUnderstanding the cracking of Linux hashesTesting for the synchronization of account credentials
Automating the exploit train with Python
Summary
6. Assessing Web Applications with Python
Identifying live applications versus open ports
Identifying hidden files and directories with Python
Credential attacks with Burp Suite
Using twill to walk through the source
Understanding when to use Python for web assessments
Understanding when to use specific librariesBeing efficient during web assessments
Summary
7. Cracking the Perimeter with Python
Understanding today's perimeterClear-text protocolsWeb applicationsEncrypted remote access servicesVirtual Private Networks (VPNs)Mail servicesDomain Name Service (DNS)User Datagram Protocol (UDP) services
Understanding the link between accounts and services
Cracking inboxes with Burp Suite
Identifying the attack path
Understanding the limitations of perimeter scanningDownloading backup files from a TFTP serverDetermining the backup filenamesCracking Cisco MD5 hashes
Gaining access through websites
The execution of file inclusion attacksVerifying an RFI vulnerabilityExploiting the hosts through RFI
Summary
8. Exploit Development with Python, Metasploit, and Immunity
Getting started with registersUnderstanding general purpose registersThe EAXThe EBXThe ECXThe EDXUnderstanding special purpose registersThe EBPThe EDIThe EIPThe ESP
Understanding the Windows memory structure
Understanding the stack and the heapUnderstanding the program image and dynamic-link librariesUnderstanding the process environment blockUnderstanding the thread environment blockKernel
Understanding memory addresses and endianness
Understanding the manipulation of the stack
Understanding immunity
Understanding basic buffer overflow
Writing a basic buffer overflow exploit
Understanding stack adjustments
Understanding the purpose of local exploits
Understanding other exploit scripts
Exploiting standalone binaries by executing scriptsExploiting systems by TCP serviceExploiting systems by UDP service
Reversing Metasploit modules
Understanding protection mechanisms
Summary
9. Automating Reports and Tasks with Python
Understanding how to parse XML files for reports
Understanding how to create a Python class
Creating a Python script to parse an Nmap XMLCreating a Python script to generate Excel spreadsheets
Summary
10. Adding Permanency to Python Tools
Understanding logging within Python
Understanding the difference between multithreading and multiprocessing
Creating a multithreaded script in PythonCreating a multiprocessing script in Python
Building industry-standard tools
Summary
2. Module 2
1. Python with Penetration Testing and Networking
Introducing the scope of pentestingThe need for pentestingComponents to be testedQualities of a good pentesterDefining the scope of pentesting
Approaches to pentesting
Introducing Python scripting
Understanding the tests and tools you'll need
Learning the common testing platforms with Python
Network sockets
Server socket methods
Client socket methods
General socket methods
Moving on to the practical
Socket exceptionsUseful socket methods
Summary
2. Scanning Pentesting
How to check live systems in a network and the concept of a live systemPing sweepThe TCP scan concept and its implementation using a Python scriptHow to create an efficient IP scanner
What are the services running on the target machine?
The concept of a port scannerHow to create an efficient port scanner
Summary
3. Sniffing and Penetration Testing
Introducing a network snifferPassive sniffingActive sniffing
Implementing a network sniffer using Python
Format characters
Learning about packet crafting
Introducing ARP spoofing and implementing it using Python
The ARP requestThe ARP replyThe ARP cache
Testing the security system using custom packet crafting and injection
Network disassociationA half-open scanThe FIN scanACK flag scanningPing of death
Summary
4. Wireless Pentesting
Wireless SSID finding and wireless traffic analysis by PythonDetecting clients of an AP
Wireless attacks
The deauthentication (deauth) attacksThe MAC flooding attackHow the switch uses the CAM tablesThe MAC flood logic
Summary
5. Foot Printing of a Web Server and a Web Application
The concept of foot printing of a web server
Introducing information gathering
Checking the HTTP header
Information gathering of a website from SmartWhois by the parser BeautifulSoup
Banner grabbing of a website
Hardening of a web server
Summary
6. Client-side and DDoS Attacks
Introducing client-side validation
Tampering with the client-side parameter with Python
Effects of parameter tampering on business
Introducing DoS and DDoS
Single IP single portSingle IP multiple portMultiple IP multiple portDetection of DDoS
Summary
7. Pentesting of SQLI and XSS
Introducing the SQL injection attack
Types of SQL injections
Simple SQL injectionBlind SQL injection
Understanding the SQL injection attack by a Python script
Learning about Cross-Site scripting
Persistent or stored XSSNonpersistent or reflected XSS
Summary
3. Module 3
1. Gathering Open Source Intelligence
Introduction
Gathering information using the Shodan API
Getting readyHow to do it…How it works…There's more…
Scripting a Google+ API search
Getting readyHow to do it…How it works…See also…There's more…
Downloading profile pictures using the Google+ API
How to do itHow it works
Harvesting additional results from the Google+ API using pagination
How to do itHow it works
Getting screenshots of websites with QtWebKit
Getting readyHow to do it…How it works…There's more…
Screenshots based on a port list
Getting readyHow to do it…How it works…There's more…
Spidering websites
Getting readyHow to do it…How it works…There's more…
2. Enumeration
Introduction
Performing a ping sweep with Scapy
How to do it…How it works…
Scanning with Scapy
How to do it…How it works…There's more…
Checking username validity
Getting readyHow to do it…How it works…There's more…See also
Brute forcing usernames
Getting readyHow to do it…How it works…See also
Enumerating files
Getting readyHow to do it…How it works…
Brute forcing passwords
Getting readyHow to do it…How it works…See also
Generating e-mail addresses from names
Getting readyHow to do it…How it works…There's more…See also
Finding e-mail addresses from web pages
Getting readyHow to do it…How it works…There's more…See also
Finding comments in source code
How to do it…How it works…There's more…
3. Vulnerability Identification
Introduction
Automated URL-based Directory Traversal
Getting readyHow to do it…How it works…There's more
Automated URL-based Cross-site scripting
How to do it…How it works…There's more…
Automated parameter-based Cross-site scripting
How to do it…How it works…There's more…
Automated fuzzing
Getting readyHow to do it…How it works…There's more…See also
jQuery checking
How to do it…How it works…There's more…
Header-based Cross-site scripting
Getting readyHow to do it…How it works…See also
Shellshock checking
Getting readyHow to do it…How it works…
4. SQL Injection
Introduction
Checking jitter
How to do it…How it works…There's more…
Identifying URL-based SQLi
How to do it…How it works…There's more…
Exploiting Boolean SQLi
How to do it…How it works…There's more…
Exploiting Blind SQL Injection
How to do it…How it works…There's more…
Encoding payloads
How to do it…How it works…There's more…
5. Web Header Manipulation
Introduction
Testing HTTP methods
How to do it…How it works…There's more…
Fingerprinting servers through HTTP headers
How to do it…How it works…There's more…
Testing for insecure headers
Getting readyHow to do it…How it works…
Brute forcing login through the Authorization header
Getting readyHow to do it…How it works…There's more…See also
Testing for clickjacking vulnerabilities
How to do it…How it works…
Identifying alternative sites by spoofing user agents
How to do it…How it works…See also
Testing for insecure cookie flags
How to do it…How it works…There's more…
Session fixation through a cookie injection
Getting readyHow to do it…How it works…There's more…
6. Image Analysis and Manipulation
Introduction
Hiding a message using LSB steganography
Getting readyHow to do it…How it works…There's more…See also
Extracting messages hidden in LSB
How to do it…How it works…There's more…
Hiding text in images
How to do it…How it works…There's more…
Extracting text from images
How to do it…How it works…There's more…
Enabling command and control using steganography
Getting readyHow to do it…How it works…
7. Encryption and Encoding
Introduction
Generating an MD5 hash
Getting readyHow to do it…How it works…
Generating an SHA 1/128/256 hash
Getting readyHow to do it…How it works…
Implementing SHA and MD5 hashes together
Getting readyHow to do it…How it works…
Implementing SHA in a real-world scenario
Getting readyHow to do it…How it works…
Generating a Bcrypt hash
Getting readyHow to do it…How it works…
Cracking an MD5 hash
Getting readyHow to do it…How it works…
Encoding with Base64
Getting readyHow to do it…How it works…
Encoding with ROT13
Getting readyHow to do it…How it works…
Cracking a substitution cipher
Getting readyHow to do it…How it works…
Cracking the Atbash cipher
Getting readyHow to do it…How it works…
Attacking one-time pad reuse
Getting readyHow to do it…How it works…
Predicting a linear congruential generator
Getting readyHow to do it…How it works…
Identifying hashes
Getting readyHow to do it…How it works…
8. Payloads and Shells
Introduction
Extracting data through HTTP requests
Getting ReadyHow to do it…How it works…
Creating an HTTP C2
Getting StartedHow to do it…How it works…
Creating an FTP C2
Getting StartedHow to do it…How it works…
Creating an Twitter C2
Getting StartedHow to do it…How it works…
Creating a simple Netcat shell
How to do it…How it works…
9. Reporting
Introduction
Converting Nmap XML to CSV
Getting readyHow to do it…How it works…
Extracting links from a URL to Maltego
How to do it…How it works…There’s more…
Extracting e-mails to Maltego
How to do it…How it works…
Parsing Sslscan into CSV
How to do it…How it works…
Generating graphs using plot.ly
Getting readyHow to do it…How it works…
A. Bibliography
Index

Content preview from Python: Penetration Testing for Developers

Finding e-mail addresses from web pages

Instead of generating your own e-mail list, you may find that a target organisation will have some that exist on their web pages. This may prove to be of higher value than e-mail addresses you have generated yourself as the likelihood of e-mail addresses on a target organisation's website being valid will be much higher than ones you have tried to guess.

Getting ready

For this recipe, you will need a list of pages you want to parse for e-mail addresses. You may want to visit the target organization's website and search for a sitemap. A sitemap can then be parsed for links to pages that exist within the website.

How to do it…

The following code will parse through responses from a list of URLs for instances of ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Learning Penetration Testing with Python

Publisher Resources

ISBN: 9781787128187Purchase Link

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills