Table of Contents for
Kali Linux 2 – Assuring Security by Penetration Testing - Third Edition
Kali Linux 2 – Assuring Security by Penetration Testing - Third Edition
Published by
Packt Publishing, 2016
- Cover
- Table of Contents
- Kali Linux 2 – Assuring Security by Penetration Testing Third Edition
- Kali Linux 2 – Assuring Security by Penetration Testing Third Edition
- Credits
- Disclaimer
- About the Authors
- About the Reviewer
- www.PacktPub.com
- Preface
- What you need for this book
- Who this book is for
- Conventions
- Reader feedback
- Customer support
- 1. Beginning with Kali Linux
- Kali Linux tool categories
- Downloading Kali Linux
- Using Kali Linux
- Configuring the virtual machine
- Updating Kali Linux
- Network services in Kali Linux
- Installing a vulnerable server
- Installing additional weapons
- Summary
- 2. Penetration Testing Methodology
- Vulnerability assessment versus penetration testing
- Security testing methodologies
- General penetration testing framework
- Information gathering
- The ethics
- Summary
- 3. Target Scoping
- Preparing the test plan
- Profiling test boundaries
- Defining business objectives
- Project management and scheduling
- Summary
- 4. Information Gathering
- Using public resources
- Querying the domain registration information
- Analyzing the DNS records
- Getting network routing information
- Utilizing the search engine
- Metagoofil
- Accessing leaked information
- Summary
- 5. Target Discovery
- Identifying the target machine
- OS fingerprinting
- Summary
- 6. Enumerating Target
- Understanding the TCP/IP protocol
- Understanding the TCP and UDP message format
- The network scanner
- Unicornscan
- Zenmap
- Amap
- SMB enumeration
- SNMP enumeration
- VPN enumeration
- Summary
- 7. Vulnerability Mapping
- Vulnerability taxonomy
- Automated vulnerability scanning
- Network vulnerability scanning
- Web application analysis
- Fuzz analysis
- Database assessment tools
- Summary
- 8. Social Engineering
- Attack process
- Attack methods
- Social Engineering Toolkit
- Summary
- 9. Target Exploitation
- Vulnerability and exploit repositories
- Advanced exploitation toolkit
- MSFConsole
- MSFCLI
- Ninja 101 drills
- Writing exploit modules
- Summary
- 10. Privilege Escalation
- Password attack tools
- Network spoofing tools
- Network sniffers
- Summary
- 11. Maintaining Access
- Working with tunneling tools
- Creating web backdoors
- Summary
- 12. Wireless Penetration Testing
- Wireless network recon
- Wireless testing tools
- Post cracking
- Sniffing wireless traffic
- Summary
- 13. Kali Nethunter
- Installing Kali Nethunter
- Nethunter icons
- Nethunter tools
- Third-party applications
- Wireless attacks
- HID attacks
- Summary
- 14. Documentation and Reporting
- Types of reports
- The executive report
- The management report
- The technical report
- Network penetration testing report (sample contents)
- Preparing your presentation
- Post-testing procedures
- Summary
- A. Supplementary Tools
- Web application tools
- Network tool
- Summary
- B. Key Resources
- Paid incentive programs
- Reverse engineering resources
- Penetration testing learning resources
- Exploit development learning resources
- Penetration testing on a vulnerable environment
- Online web application challenges
- Virtual machines and ISO images
- Network ports
- Index
Network routing information is useful for penetration testers in a number of ways. First, they can identify different devices in between the penetration tester's machine and the target. The penetration tester could also glean information about how the network operates and how traffic is routed between the target and the tester's machine. Finally, the penetration tester would also be able to determine if there was an intermediate barrier such as a firewall or proxy server between the tester and the target.
Kali Linux has a number of tools that provides network routing information.
A supplement to the traceroute command found in Linux distributions is the tcptraceroute tool. The normal traceroute command sends either a UDP or ICMP echo request packet to the target house with a Time to Leave (TTL) set to one. This TTL is increased by one for each host it reaches until the packet reaches the target host. The major difference between traceroute and the tcptraceroute tool is that the tcptraceroute tools use a TCP SYN packet to the target host.
The main advantage with using tcptraceroute is when you have the possibility of encountering a firewall between the testing machine and the target. Firewalls are often configured to filter out ICMP and UDP traffic associated with the traceroute command. As a result, the traceroute information will not be useful to you. Using tcptraceroute allows us to use the TCP connection on a specific port, which the firewall will allow you to pass through, thereby allowing you to enumerate the network routing path through the firewall.
The tcptraceroute command makes use of the TCP three-way handshake to determine if the patch through the firewall is allowed. If the port is open, you will receive a SYN/ACK packet. If the port is closed, you will receive a RST packet. To start tcptraceroute, type the following into the command line:
# tcptraceroute
This command will show the different functions related to the command.
The simplest usage is running the command against a domain. For this demonstration, we will run the traceroute command to trace the network route to the domain the example.com:
# traceroute www.example.com
The redacted output for traceroute is as follows:
traceroute to www.example.com (192.168.10.100), 30 hops max, 40 byte packets 1 192.168.1.1 (192.168.1.1) 8.382 ms 12.681 ms 24.169 ms 2 1.static.192.168.xx.xx.isp (192.168.2.1) 47.276 ms 61.215 ms 61.057 ms 3 * * * 4 74.subnet192.168.xx.xx.isp (192.168.4.1) 68.794 ms 76.895 ms 94.154 ms 5 isp2 (192.168.5.1) 122.919 ms 124.968 ms 132.380 ms ... 15 * * * ... 30 * * *
As you can see, there are several steps that are indicated and others that appear as ***. If we look at the output, by hop 15, we see that there is no information available. This is indicative of a filtering device between the tester machine and the host, example.com.
To counter this filtering, we will try to determine the route using the tcptraceroute command. As we know that example.com has a web server, we will set the command to try the TCP port 80, which is the HTTP port. Here is the command:
# tcptraceroute www.example.com
The output is as follows:
Selected device eth0, address 192.168.1.107, port 41884 for outgoing packets Tracing the path to www.example.com (192.168.10.100) on TCP port 80 (www), 30 hops max 1 192.168.1.1 55.332 ms 6.087 ms 3.256 ms 2 1.static.192.168.xx.xx.isp (192.168.2.1) 66.497 ms 50.436 ms 85.326 ms 3 * * * 4 74.subnet192.168.xx.xx.isp (192.168.4.1) 56.252 ms 28.041 ms 34.607 ms 5 isp2 (192.168.5.1) 51.160 ms 54.382 ms 150.168 ms 6 192.168.6.1 106.216 ms 105.319 ms 130.462 ms 7 192.168.7.1 140.752 ms 254.555 ms 106.610 ms ... 14 192.168.14.1 453.829 ms 404.907 ms 420.745 ms 15 192.168.15.1 615.886 ms 474.649 ms 432.609 ms 16 192.168.16.1 [open] 521.673 ms 474.778 ms 820.607 ms
As we can see from the tcptraceroute output, the request has reached our target system and has given us the hops that the request took to get to the target.
Another tool that makes use of the same use of the TCP hand-shake is tctrace. Much like tcptraceroute, tctrace sends a SYN packet to a specific host and if the reply is a SYN/ACK, the port is open. A RST packet indicates a closed port.
To start tctrace, enter the following command:
# tctrace -i<device> -d<targethost>
The –i <device> is the network interface on the target and -d <taget host> is the target.
For this example, we are going to run tctrace against the www.example.com domain:
# tctrace -i eth0 -d www.example.com
The following output is obtained:
1(1) [172.16.43.1] 2(1) [172.16.44.1] 3(all) Timeout 4(3) [172.16.46.1] 5(1) [172.16.47.1] 6(1) [172.16.48.1] 7(1) [] ... 14(1) [172.16.56.1] 15(1) [172.16.57.1] 16(1) [198.148.81.137] (reached; open)