Advanced Penetration Testing with Kali Linux: Unlocking industry-oriented VAPT tactics

Cover....2 Title Page....3 Copyright Page....4 Dedication Page....5 About the Author....6 About the Reviewer....8 Acknowledgement....9 Preface....10 Table of Contents....16 1. Beginning with Advanced Pen Testing....27 Introduction....27 Structure....28 Objectives....28 Fundamentals of VAPT....29 Vulnerability Assessment....30 Penetration Testing....30 Advanced penetration testing techniques and strategies....31 Business and compliance requirements for VAPT....32 Industrial approach and methodology in VAPT....33 Goals and objectives....34 Kickoff call....34 Intelligence gathering....35 Passive intelligence....35 Active intelligence....35 Threat modeling....35 Vulnerability assessment....36 Automated VA scan....36 Manual VA scan....37 Penetration testing....37 Post exploitation....37 Reporting....38 Security posture: Executive summary....38 Detailed technical report....38 Vulnerability management tracker....38 Security audit standards and frameworks: Best practices....39 Open web application security project standard....39 CWE/SANS Top 25....39 Penetration Testing Execution Standard....40 Open-source security testing methodology manual....40 NIST Cybersecurity Framework....41 ISO 27001 standards....41 CIS benchmarks....42 ISACA standards and guidelines....43 MITRE framework....43 Pre-engagement interaction with customers....43 Define audit scope....44 Exercise nature....44 Testing method....45 Black box....45 Grey box....45 White box....46 Environment selection....46 Approach and methodology selection....46 Exercise time selection....46 Project timeline....46 Rules of engagement....47 Deliverables....47 Designing the Scope of Work for security audits....47 Project planning and governance in VAPT....48 Project planning....48 Project management....49 Project governance....51 Delivery and customer success tactics in VAPT....51 Conclusion....52 References....53 2. Setting up the VAPT Lab....54 Introduction....54 Structure....54 Initiating with Kali Linux....55 Kali Linux features....55 Establishing the virtualization landscape....56 How is it useful in VAPT....57 Deploying Kali Linux 2023.2....57 Installing Kali Linux on VMware workstation....58 Installing Kali Linux on VirtualBox....61 Arranging network services....64 Enabling ProxyChains....66 Use cases of ProxyChains....68 Personalizing Kali Linux....68 Changing the desktop environment....68 Installing additional applications....69 Modifying system settings....69 Changing the login screen....70 Refreshing Kali Linux....71 Enabling third-party VAPT tools....72 MobSF framework....73 Trivy....78 Setting up vulnerable machines and applications....79 Setting up Metasploitable 2....79 Setting Up BWAPP....81 Conclusion....84 3. Active and Passive Reconnaissance Tactics....85 Introduction....85 Structure....85 What is reconnaissance....86 Why is reconnaissance so important....87 Types of reconnaissance....87 Passive reconnaissance....88 Active reconnaissance....88 Passive reconnaissance tools and tactics....88 WHOIS....88 DNS reconnaissance....91 IP reconnaissance....94 Shodan....96 Route mapping....99 Email address....101 Name and number....102 Password or breach data dump....102 Active reconnaissance tools and tactics....103 Host discovery....103 Port scanning....106 Port scanning techniques....106 Running services and version detection....108 OS fingerprinting....109 Directory enumeration....110 Hard-coded information....111 Additional resources for reconnaissance....112 Maltego....112 SPARTA....115 Conclusion....117 4. Vulnerability Assessment and Management....119 Introduction....119 Structure....119 Overview of vulnerability assessment....120 Vulnerability nomenclature....122 Vulnerability management life cycle....122 Vulnerability assessment....123 Web application....123 OWASP ZAP....123 Burp suite....127 Computer network....131 Nessus....131 Legion....136 NMAP....138 Mobile application....143 MobSF....143 Container....147 Trivy....148 Vulnerability management....152 Application security....153 Conclusion....154 5. Exploiting Computer Network....155 Introduction....155 Structure....155 Objectives....156 Understanding network pen testing....156 Introduction to Metasploit....157 Metasploit database and workspace management....158 Integrating NMAP scans with Metasploit....161 Metasploit automation....164 Starting with auxiliary and exploits....166 Auxiliary modules....166 Exploit modules....166 Post-exploitation modules....166 Manual exploitation....171 Exploitation using Armitage....173 Setting up Armitage....173 Conclusion....179 6. Exploiting Web Application....181 Introduction....181 Structure....181 Objectives....182 What is web application pen testing....182 Web application pen testing approach....183 Web application pen testing attack vectors....183 OWASP top 10 for web application....184 Web application pen testing threat modeling....185 Web application pen testing mind map....186 Detecting web app firewalls and load balancers....188 Exploiting application-specific vulnerabilities....189 SQL injection....189 PHP code execution....194 Brute force at login....197 Broken authentication....200 Insecure Direct Object Reference....202 XSS using XSS validator....205 Backdoor via unrestricted file upload....210 HTTP parameter pollution....213 Business logic flaws....216 Conclusion....220 7. Exploiting Wireless Network....222 Introduction....222 Structure....222 Objectives....223 Introduction to wireless pentesting....223 Wireless network fundamentals....224 Wireless networks and protocols overview....224 Wireless network topologies and architectures....224 Radio Frequency fundamentals....224 Wireless security threats and standards....225 Common wireless security threats....225 Wireless security overview....225 Wireless pen testing methodology....225 Steps involved in wireless pentesting....225 Approach to wireless pentesting....226 Wireless pen testing tools....227 Overview of wireless pen testing tools....227 Common wireless pen testing tools....228 Configuring Kali Linux for wireless pentesting....228 Configuring Kali Linux for wireless attacks....230 Wireless network exploitation techniques....234 Compromising WPA/WPA2 encryption....234 Man-in-the-middle attacks with rogue access points....238 Bypassing hidden SSIDs....238 Bypassing MAC and open authentication....241 Denial-of-service attacks....243 Advanced wireless attacks....245 Attacking wireless routers with Reaver....245 Conclusion....246 8. Hash Cracking and Post Exploitation....247 Introduction....247 Structure....247 Objectives....248 Exploring hash functions....248 Purpose and properties of modern hash functions....248 Unveiling common hash algorithms....249 Mastering password hashing....250 Art of securing passwords....250 Cutting-edge techniques - Salting and key stretching....251 Unleashing hash cracking techniques....251 Strategic approaches....252 Empowering hash cracking arsenal....252 Elite tools for hash warriors....253 Hash-identifier....253 John the Ripper....254 John the Ripper Jumbo....256 Hashcat....256 Online tools for hash warriors....258 CrackStation....258 Hashes....259 Difference between hashing, encryption and encoding....261 Post exploitation and lateral movement....261 Understanding post exploitation....261 Significance of lateral movement....261 Privilege escalation techniques....262 Privilege escalation on Linux....262 Phase 1: Initial access....262 Phase 2: Preparing for privilege escalation using a Udev exploit....263 Phase 3: Escalating privileges....265 Privilege escalation on Windows....267 Phase 1: Initial access....268 Phase 2: Preparing for privilege escalation using bypass UAC....270 Phase 3: Escalating privileges....271 Exploring network pivoting....272 Pivoting approach....272 Phase 1: Gain (initial) access to Windows 7....273 Phase 2: Network info gathering and pivot connection establishment....274 Phase 3: Network pivoting by exploiting Metasploitable 2 machine....276 Persistence and lateral movement....277 Strategies for persistent access and lateral movement....278 Persistence through hashdump techniques....279 Exploring RDP for lateral movement....280 Unleashing the power of Mimikatz in meterpreter....283 Conclusion....285 9. Bypass Security Controls....287 Introduction....287 Structure....287 Objectives....288 Significance of bypassing security controls....288 Advancements in security controls....289 Cutting-edge technologies....289 Intelligent systems....289 Evolving threat landscape....290 Cloud specific security controls....290 Security control bypass in network recon....290 Source port manipulation....291 IP address spoofing / decoy IP....292 Packet fragmentation....292 Spoofing MAC address....293 Custom packet creation....293 Nmap Scripting Engine scripts....295 Outsmarting Windows Defender....295 Antivirus evasion techniques and tools....304 Antivirus evasion techniques....304 Antivirus evasion tools....305 Harnessing Metasploit templates and custom binaries for antivirus evasion....305 Shellter....316 Unicorn....320 Phantom-Evasion....323 Invoke-Stealth....326 Cutting-edge WAF evasion tactics....329 Evolving social engineering tactics....333 Phishing simulation....335 Phishing approach and methodology....335 Gophish....337 Conclusion....343 10. Revolutionary Approaches to Report Writing....344 Introduction....344 Structure....344 Objectives....345 Overview of report writing....345 Importance of report writing in cybersecurity....345 Integrating reports in comprehensive assessments....346 Components of well-crafted reports....346 Vulnerability Assessment report....364 Penetration Testing report....364 Risk assessment and prioritization....365 Quantifying risks for effective assessment....365 Utilizing CVSS scores....366 Factors influencing CVSS scores....366 Interpreting and applying CVSS scores appropriately....367 Types of cybersecurity assessment reports....370 Executive summary report....370 Detailed technical assessment report....371 Vulnerability management tracker....371 Examples of detailed reports....372 Web application VAPT report writing example....372 Network VAPT report writing example....375 Automated vulnerability management with DefectDojo....379 Conclusion....383 Index....384