Penetration Testing

Penetration Testing
A Hands-on Introduction to Hacking

  • Part I: The Basics
Chapter 0
                       we start out with some basic definitions of the phases of penetration testing.

Chapter 1
                       we build our small practice laboratory, which we will use to work through the exercises in this book. With many books, it’s possible to just download a few programs onto your existing platform but to simulate a penetration test, our approach is a bit more involved. I recommend that u take the time to set up your lab and work through the hands-on examples with me. Though this book can serve as a reference and reminder n the field, I believe it is best to first practice your pentesting skills at home.

Chapter 2
                       we start with the basics of using Kali Linux and Linux operating systems in general. Next,

Chapter 3
                   covers the basics of programming. Some readers may already have a working knowledge in these areas and can skip past them. When I first started out, I had some programming experience in C and Java, but I didn’t have a background in scripting and had practically no background in Linux—a skillset that was assumed by most of the hacking tutorials I encountered. Thus, I have provided a primer ere. If you are new to these areas, please do continue your studies outside f this book. Linux-based operating systems are becoming more and more prevalent as the platforms for mobile devices and web services, so skills in his area will benefit you even if you don’t pursue a career in information security. Likewise, knowing how to script your common tasks can only make
your life easier, regardless of your career. e look at the basics of using the Metasploit Framework, a tool we will everage throughout this book,

Chapter 4
                       Though we will also learn to perform many tasks without Metasploit, it is a go-to tool for many testers in the field and is constantly evolving to include the latest threats and techniques.

  • Part II: Assessments

Next, we start working through a simulated penetration test.

Chapter 5
                   we begin by gathering data about our target—both by searching freely available information online and by engaging our target systems. We then start searching for vulnerabilities using a combination of querying the systems and research

Chapter 6. Chapter 7
we look at techniques to capture traffic that might include sensitive data.

  • Part III: Attacks


Chapter 8
                  we look at exploiting the vulnerabilities we found on the network with a variety of tools and techniques, including Metasploit and purely manual exploitation. We then look at methods for attacking what is often the weakest link in a network’s security—password management—in

Chapter 9
                    We next look at some more advanced exploitation techniques. Not all vulnerabilities are in a service listening on the network. Web browsers, DF readers, Java, Microsoft Office—they all have been subject to security issues. As clients work harder to secure their networks, attacking client-side software may be the key to getting a foothold in the network. We look xviii Introduction t leveraging client-side attacks

Chapter 10. In Chapter 11
                                               we combine client-side attacks with a look at social engineering or attacking the human element—the part of the environment that cannot be patched. After all, with client-side attacks, the software in question must open a malicious file of some sort, so we must convince the user to help us out.

Chapter 12
                    we look at some methods of bypassing antivirus software, as many of your clients will deploy it. If you have high enough privileges on a system, you may e able to just turn antivirus programs off, but a better solution is to breeze right past antivirus programs undetected, which can be done even if you are saving malicious programs to the hard drive.

Chapter 13
                    we pick up with the next phase of our penetration test, ost exploitation. Some say the pentest truly begins after exploitation. This s where you leverage your access to find additional systems to attack, sensitive information to steal, and so on. If you continue your penetration testing studies, you will spend a good deal of time working on the latest and greatest post-exploitation techniques. After post-exploitation, we look at a few additional skills you will need
to be a well-rounded penetration tester. We will take a brief look at assessing the security of custom web applications

Chapter 14
                      Everyone has a website these days, so it’s a good skill to cultivate. Next, we will look at assessing the security of wireless networks

Chapter 15
                      looking at methods for racking commonly deployed cryptographic systems.

  • Part IV: Exploit Development

Chapters 16, 17, 18, and 19
                                               discuss the basics of writing your own exploits. e will look at finding vulnerabilities, exploiting them with common techniques, and even writing our own Metasploit module. Up until these chapters, weave relied on tools and publicly available exploits for a lot of our exercises. As you advance in infosec, you may want to find new bugs (called ero-days) and report them to vendors for a possible bounty. You can then release a public exploit and/or Metasploit module to help other pentesters est their customers’ environments for the issue you discovered.

  • Part V: Mobile Hacking


Chapter 20
we close with a relatively new area of penetration testing—assessing the security of mobile devices. We look at my own tool, the Smartphone Pentest Framework. Perhaps after mastering the skills in this book, you will endeavor to develop and release a security tool of your own. f course, this book doesn’t cover every single facet of information security, nor every tool or technique. If it did, this book would have been several times longer and come out a good deal later, and I need to get back
to my research. So here you have it: a hands-on introduction to hacking. It is n honor to be with you on this important step on your journey into information security. I hope that you learn a lot from this book and that it inspires you to continue your studies and become an active member of this exciting
and rapidly developing field.

Also, Subscribe to my youtube channel