Traditional vs Generative AI Pentesting: A Hands-On Approach to Hacking

Cover....1 Half Title....2 Title Page....4 Copyright Page....5 Dedication....6 Table of Contents....8 Preface....9 About the author....11 Chapter 1: Foundations of pentesting: Methodologies, frameworks, and AI integration....12 Introduction....12 What is PT?....13 Benefits of conducting a PT....13 Comparison of security audit vulnerability assessment and PT....14 Pentesting vs ethical hacking....15 Pentesting benefits....15 PT strategies....16 Black-box penetration testing....16 White-box penetration testing....17 Gray-box penetration testing....17 Pentesting vs red teaming....17 Common areas of penetration testing....18 PT process....19 Code of good practice....19 Legal framework: Rules of Engagement (RoE)....20 Legal framework: Non-disclosure agreement (NDA)....21 Understanding the restrictions....21 Characteristics of a good PT....23 When should a PT be conducted?....23 Pentester ethics....23 PT methodologies....23 OSSTMM methodology....23 Phase I: Regulatory....24 Phase II: Definitions....24 Phase III: Information phase....24 Phase IV: Interactive control test phase....24 Advantages....24 Limits....24 PTES methodology....25 The stages of the PTES methodology....25 Pre-commitment interactions....25 Information gathering....25 Threat modeling....25 Vulnerability analysis....25 Operation....25 Post-op....26 Reports....26 Benefits....27 Limits....27 NIST methodology SP 800-115....27 The ISSAF (Information Systems Security Assessment Framework)....27 OWASP methodology....28 The OWASP phases....29 Benefits of OWASP....29 Limits of OWASP....29 Cyber kill chain methodology....30 MITRE ATT&CK....31 Adversary profile....33 Contribution of MITRE....33 Tools for pentesting according to MITRE ATT&CK....33 Challenges in penetration testing....37 AI-driven penetration testing....38 Key features of AI-driven penetration testing....39 Benefits of AI-driven penetration testing....39 Tools for AI-driven penetration testing....39 Challenges and ethical considerations....40 Overreliance on AI....40 Ethical and legal concerns....41 Inherent bias in AI models....41 Skill gap in using AI tools....41 Risks associated with generative AI in penetration testing....41 Escalation of cyber threats....41 Advanced persistent threats (APTs)....42 Autonomous and self-propagating attacks....42 Uncontrolled AI development....42 Conclusion....42 References....42 Chapter 2: Building a modern penetration testing lab with generative AI....45 Technical requirements....45 Set up a virtual PT laboratory....45 Your security....45 Understanding virtualization technology....46 Target machines....47 Metasploitable 2....47 Step 1: Download and install VirtualBox on your PC....47 Step 2: Install Kali Linux on VirtualBox....47 Kali Linux basic commands....51 PT tools....52 PT platform....52 Information gathering....52 Vulnerability scanner Nessus and Openvas....54 Web application testing platforms....54 Examples of training platforms....54 Generative AI in penetration testing....55 Conclusion....60 References....60 Chapter 3: GenAI-driven reconnaissance for effective penetration testing....61 Reconnaissance....61 Objectives of reconnaissance and footprinting....61 Types of footprinting....61 Passive footprinting....61 Methods of Passive Footprinting:....61 Active footprinting....62 Methods of active footprinting....62 Importance of reconnaissance....62 Types of information collected during footprinting....62 Organizational information....62 Network information....63 System information....63 Footprinting methodology....63 Key sources for information gathering....63 Methodological approach....64 Footprinting through search engines....64 Information extracted through search engines....64 Applications in footprinting....66 Google....66 Example of using google operators....66 Metasearch engines....69 Footprinting using advanced Google hacking techniques with AI....70 Example of AI-powered Google hacking....70 Advanced Google hacking with shell command....71 VPN footprinting through Google hacking....72 Automating VPN footprinting with AI....72 NetCraft: Website search engine....74 Social media....75 Example: LinkedIn....75 Example: Facebook....78 OSINT automation tools....79 Finding the target’s domain and subdomains....79 Fingerprinting the target using Shodan....82 Recon-ng: An OSINT tool Web....84 TheHarvester....84 Metagoofil (http://www.edge-security.com)....88 SpiderFoot: An OSINT tool recognition....90 OSINT framework....93 Maltego: A framework for collecting information....96 OSINT with DNS querying....98 Perform Whois lookups....98 APNIC Whois lookup (source: https://www.oonic.net)....99 ARIN WhOIS.RIS (source: http://whois.arin.net)....100 Dnsenum (https://github.com)....100 Nslookup (source: https://docs.microsoft.com)....101 What does a non-authoritative answer mean?....101 Lookup DNS records for the domain....103 Reverse domain name search....104 Find a website’s domain name from its IP address....104 Finding a company’s Top-Level Domains (TLDs) and subdomains with AI....104 Example 1: Enumerate subdomains with Sublist3r....104 Reverse DNS Lookup....106 Performing DNS enumeration with DNSRecon....106 DNSdumpster....108 Draw a network diagram using traceroute analysis....109 Traceroute....109 Example of AI-enhanced tracerouting....109 AI-powered OSINT tools....110 Key use cases of AI in OSINT....110 Benefits of AI in OSINT....111 Notable AI-powered OSINT tools....111 Footprinting using AI script....111 Automating domain footprinting with AI....111 Documentation of result....112 Conclusion....112 References....113 Chapter 4: GenAI-enhanced scanning and sniffing....114 Introduction....114 Nmap: Network mapper....115 Installation of Nmap....116 Installing on Linux....116 Installation on Windows....116 Install on macOS....116 Using Nmap....117 Basic syntax....117 Examples of use....117 Scan options....117 Output options....118 Identification options....118 Port options....118 Attack options....118 Examples of advanced use....118 Nmap: TCP Connect Scan sT....118 Nmap: TCP SYN Scan sS (Stealth)....119 Nmap: UDP Scan sU....120 Nmap: The scripts....120 NMAP: Examples....120 NMAP Scanning with AI....121 Example #1....121 Example #2....121 Example #3....121 Example #4....123 Firewall Evasion....123 Example....123 Nmap to fragment....124 Example....124 Script to automate network scanning tasks with AI....125 Hping3....125 Key features....126 Advanced applications....126 Syntax....126 Hping commands....128 Hping Scan with AI....128 Example 2....129 Metasploit....130 Network sniffing....131 How a sniffer works....131 Types of sniffing....132 Sniffing passive....132 Sniffing active....132 Protocols vulnerable to sniffing....133 Get Wireshark....134 Demer's Wireshark....134 Packet color coding....137 Packet filtering in Wireshark....137 Attack and defend with Wireshark....139 How do you catch a network scan attack?....139 How do I detect running local services (accessible to the web)?....139 Creating firewall rules....141 Packet capture....141 HTTP traffic....141 Traffic FTP....145 Traffic HTTPS....146 Conclusion....153 References....153 Chapter 5: Vulnerability assessment: Tools, techniques, and GenAI integration....155 Introduction....155 Background....156 Vulnerability....156 Vulnerability classification....156 Vulnerability research....157 What is vulnerability assessment?....158 Characteristics of a good vulnerability assessment solution....158 Vulnerability assessment systems and databases....159 Types of scanners....159 General-purpose scanners....159 Web application scanners....159 Specific application scanners....159 Scanner types by authentication....160 Unauthenticated scanners....160 Authenticated scanners....160 Agent-based scanners....160 Resources for vulnerability research....160 Vulnerability assessment tools....160 Nessus....160 Installation....161 Scan console....162 Start a scan....162 Run a basic scan....163 Run a web scan....164 Web Scan Results (Figure 5.9)....166 Rapid7 Nexpo....167 Running Vulnerability Scanning....167 OpenVAS....170 Nikto (Source: https://cirt.net)....175 Characteristics....177 OWASP Zap (https://www.zaproxy.org)....177 Automated scanning....177 Alerts....177 Generate a report....180 Scan web servers and applications for vulnerabilities using Nikto....181 Scan wordpress sites with WPscan....183 Wordpress scan through AI....185 Vulnerability assessment using AI....186 Example usage....186 Explanation....187 Explanation....187 Vulnerability scanning using Nmap with AI....187 Command example....188 Vulnerability assessment using Python script and AI....188 Concept and approach....188 Skipfish vulnerability scanning with AI....189 Database vulnerability assessment....189 Vulnerability assessment reports....191 Structure of vulnerability assessment reports....191 Components of a vulnerability assessment report....191 Classification of reports....192 Conclusion....192 References....192 Chapter 6: AI-driven social engineering and penetration testing....194 Introduction....194 Social engineering concepts....195 PT by social engineering: An overview....195 Black box or white box test?....196 Types of social engineering....196 Human-based social engineering....196 Computer-based social engineering....196 Example of social engineering by e-mail....197 Mobile-based social engineering....197 Methods of influence....201 The importance of phishing campaigns....201 Phishing tools....201 Launch a phishing campaign....202 Social engineering using different techniques....202 The social engineering toolkit....202 Using setoolkit for attacks phishing....202 Socialphish phishing....205 Installation....207 Uses....208 Detecting a phishing attack....210 Objectives of the Lab....210 Detecting phishing with Netcraft....210 Detecting phishing with PhishTank....213 Audit organization’s security for phishing attacks....214 Gophish (​https://​getgophish.​com)....218 Creating phishing emails with ChatGPT....226 Handwriting style for identity theft....226 Writing style for identity theft (example)....227 Identity theft using AI: Creation of Deepfake videos....228 Purpose of Deepfakes....229 Technologies and tools used....229 Conclusion....230 References....230 Chapter 7: GenAI-driven exploitation testing techniques....231 Technical requirements....231 Why consider exploiting a target machine during a test?....231 Reverse vs bind shell....232 Staged vs non-staged payloads....234 Exploiting vulnerabilities: Categories of exploits....234 Exploiting vulnerabilities....234 Metasploit....235 Useful Metasploit user interfaces....236 Metasploit modules....236 Meterpreter....237 Basic commands in Meterpreter....237 Process commands....238 File System Commands....238 Networking Commands....238 User Interface Functionalities....238 Feat-db: searchsploit....238 Find modules....240 Feat-DB....240 Rapid7 exploits database....240 0day.today....242 Preparing the Metasploit environment....242 Identifying the target of the attack....242 Identify the target’s vulnerabilities....242 Vsftpd Backdoor v2.3.4....242 Launch attacks using the Metasploit framework....242 Exploit FTP Backdoor through GenAI....247 Exploit with the UnreaIRCD IRC backdoor....247 Metasploit options, shells, and payloads....249 Feat SMB on Windows via EternalBlue....250 Finding a vulnerable target....251 Find a module to use....251 Shells....252 Verify that the target is compromised....253 Lab: Penetration testing with Metasploit....253 Exploit Steps....254 Payload and exploit generation....264 Perform system hacking using ShellGPT....264 Generate a payload....265 Conclusion....266 References....267 Chapter 8: Post-exploitation techniques and AI-driven privilege escalation....268 Introduction....268 Post-exploitation techniques....268 File transfer techniques: Push vs pull....269 File transfer services....269 Alternative methods for file transfer....270 Alternative file transfer methods....270 Looting files....271 File transfer....271 Evasion tactics....271 Pivoting and cracking....272 The primacy of passwords....272 Password guessing vs. password cracking....272 Synchronized passwords....273 Dictionaries for password cracking....273 Improving speed in password cracking....273 Passwords without cracking....274 Attention to information leaks....274 Best practices for handling passwords....274 Post-test analysis and reporting....275 Dumping hashes with Meterpreter....275 Dumping credentials with Mimikatz....275 Why pivot?....276 Pivoting using metasploit’s route command....276 SSH local port forwarding....276 SSH remote port forwarding....276 SSH dynamic port forwarding....277 Port forwarding via a Meterpreter session....277 Meterpreter sessions via MSF route....277 SSH local and dynamic port forwarding....278 Cracking passwords with John the ripper....279 Multithreaded and GPU cracking with Hashcat....279 Elevation of privilege....279 Elevation of privilege: The enumeration....280 User enumeration....280 Elevation of privilege: The enumeration....281 Host name enumeration....283 Enumerating the OS version and architecture....284 Automating enumeration with GENAI tools....285 Exploit kernel vulnerabilities through AI....287 Identify the kernel version....287 Elevation of privilege: sudo....288 Elevation of privilege: SUID/GUID....289 Search and use of SUID files....289 SUID....289 Example of SUID operation....289 Lateral movements....290 Example 1....290 Persistence....291 Backdoor....291 Example 2: Creating a backdoor with msfvenom....292 Example 3: Sticky keys persistence....292 Example 4: Automating the process with a script....292 Privilege escalation to collect the Hashdump using Mimikatz....293 Conclusion....302 References....302 Chapter 9: GenAI for automating and enhancing penetration testing reports....303 Introduction....303 Risk ranking....304 General findings....305 Strategic roadmap....305 Technical report....306 Tools used....306 Information gathering....306 Vulnerability assessment and exploitation....306 Post-op....307 Conclusion....308 Appendices....308 Use Case: Automating PT reports with generative AI and Dradis....308 Pentest findings....308 Evaluation of findings....309 Report-writing through GenIA tools....309 Executive summary....309 Test methodology....310 Detailed findings....310 Recommendations....311 Conclusion....311 Submission of PT report....311 Report retention....312 Closing document....312 Conclusion....312 References....312 Index....314