Table of Contents for
Kali Linux 2 – Assuring Security by Penetration Testing - Third Edition

Version ebook / Retour

Cover image for bash Cookbook, 2nd Edition Kali Linux 2 – Assuring Security by Penetration Testing - Third Edition by Gerard Johansen Published by Packt Publishing, 2016
  1. Cover
  2. Table of Contents
  3. Kali Linux 2 – Assuring Security by Penetration Testing Third Edition
  4. Kali Linux 2 – Assuring Security by Penetration Testing Third Edition
  5. Credits
  6. Disclaimer
  7. About the Authors
  8. About the Reviewer
  9. www.PacktPub.com
  10. Preface
  11. What you need for this book
  12. Who this book is for
  13. Conventions
  14. Reader feedback
  15. Customer support
  16. 1. Beginning with Kali Linux
  17. Kali Linux tool categories
  18. Downloading Kali Linux
  19. Using Kali Linux
  20. Configuring the virtual machine
  21. Updating Kali Linux
  22. Network services in Kali Linux
  23. Installing a vulnerable server
  24. Installing additional weapons
  25. Summary
  26. 2. Penetration Testing Methodology
  27. Vulnerability assessment versus penetration testing
  28. Security testing methodologies
  29. General penetration testing framework
  30. Information gathering
  31. The ethics
  32. Summary
  33. 3. Target Scoping
  34. Preparing the test plan
  35. Profiling test boundaries
  36. Defining business objectives
  37. Project management and scheduling
  38. Summary
  39. 4. Information Gathering
  40. Using public resources
  41. Querying the domain registration information
  42. Analyzing the DNS records
  43. Getting network routing information
  44. Utilizing the search engine
  45. Metagoofil
  46. Accessing leaked information
  47. Summary
  48. 5. Target Discovery
  49. Identifying the target machine
  50. OS fingerprinting
  51. Summary
  52. 6. Enumerating Target
  53. Understanding the TCP/IP protocol
  54. Understanding the TCP and UDP message format
  55. The network scanner
  56. Unicornscan
  57. Zenmap
  58. Amap
  59. SMB enumeration
  60. SNMP enumeration
  61. VPN enumeration
  62. Summary
  63. 7. Vulnerability Mapping
  64. Vulnerability taxonomy
  65. Automated vulnerability scanning
  66. Network vulnerability scanning
  67. Web application analysis
  68. Fuzz analysis
  69. Database assessment tools
  70. Summary
  71. 8. Social Engineering
  72. Attack process
  73. Attack methods
  74. Social Engineering Toolkit
  75. Summary
  76. 9. Target Exploitation
  77. Vulnerability and exploit repositories
  78. Advanced exploitation toolkit
  79. MSFConsole
  80. MSFCLI
  81. Ninja 101 drills
  82. Writing exploit modules
  83. Summary
  84. 10. Privilege Escalation
  85. Password attack tools
  86. Network spoofing tools
  87. Network sniffers
  88. Summary
  89. 11. Maintaining Access
  90. Working with tunneling tools
  91. Creating web backdoors
  92. Summary
  93. 12. Wireless Penetration Testing
  94. Wireless network recon
  95. Wireless testing tools
  96. Post cracking
  97. Sniffing wireless traffic
  98. Summary
  99. 13. Kali Nethunter
  100. Installing Kali Nethunter
  101. Nethunter icons
  102. Nethunter tools
  103. Third-party applications
  104. Wireless attacks
  105. HID attacks
  106. Summary
  107. 14. Documentation and Reporting
  108. Types of reports
  109. The executive report
  110. The management report
  111. The technical report
  112. Network penetration testing report (sample contents)
  113. Preparing your presentation
  114. Post-testing procedures
  115. Summary
  116. A. Supplementary Tools
  117. Web application tools
  118. Network tool
  119. Summary
  120. B. Key Resources
  121. Paid incentive programs
  122. Reverse engineering resources
  123. Penetration testing learning resources
  124. Exploit development learning resources
  125. Penetration testing on a vulnerable environment
  126. Online web application challenges
  127. Virtual machines and ISO images
  128. Network ports
  129. Index

Utilizing the search engine

Aside from routing and domain information, Kali Linux has other tools that can provide a great deal of OSINT to penetration testers. These tools act as search engines that have the ability to cull a variety of resources such as Google or social networking sites for e-mail addresses, documents, and domain information. One of the advantages of using these tools is that they do not directly search websites, but rather use other search engines to provide OSINT. This limits the penetration tester's fingerprints on a target system.

Some of these tools are built in to Kali Linux and others have to be installed. The following present a good subset of the tools that will aid you in the vast majority of information collection cases.

theharvester

theharvester is an information gathering tool that has the ability to search the Internet for e-mail addresses, domains, and hostnames. As of version 2.6, the harvester is able to gather open source information from the following sites:

  • Google
  • Google profiles
  • GoogleCSE
  • GooglePlus
  • Bing
  • Bingapi
  • pgp
  • Linkedin
  • people123
  • jigsaw
  • Twitter

theharvester is accessed through the Kali Linux command line by entering the following command:

# theharvester

Let's say, for example, I want find all the available e-mail addresses for the www.example.com domain. In addition, I want all the host names that are associated with that domain. We can input the following into the command line:

# theharvester -d example.com -l 100 -b google

–d denotes the domain name we are searching, –l limits the amount of information to 100 lines (very helpful if you are just doing a limited scope to demonstrate the amount of OSINT an organization has out on the Internet) and finally, –b is the search engine we want to use. In this example, we limited our search to Google. In the event that you want to use all available resources, use the –b all command.

theharvester produces the following output:

* TheHarvester Ver. 2.6                                           
* Coded by Christian Martorella                                   
* Edge-Security Research                                          
* cmartorella@edge-security.com                                   
[-] Searching in Google:
  Searching 0 results...
  Searching 100 results...
[+] Emails found:
------------------
@example.com
john@example.com
july@example.com
user@example.com
you@example.com
account@example.com
recipient@example.com
example@example.com
admin@example.com
shimul_you@example.com
fail2ban@example.com
postmaster@example.com
someone@example.com
alguien@example.com
0199@example.com
address@example.com
sample@example.com
name@example.com
bar@example.com
mozilla@example.com
virusalert@example.com
nobody@example.com
invalid@example.com
noreply@phabricator.example.com
bob@test.example.com
webmaster@example.com
Abc.@example.com
Abc..123@example.com
mark@example.com
hollie@example.com
reply@example.com
Marianne@example.com
friend@example.com
baz@example.com
alice@example.com
mylist@example.com

 [+] Hosts found in search engines:
------------------------------------
[-] Resolving hostnames IPs... 
93.184.216.34:www.example.com
93.184.216.34:Www.example.com

From the preceding result, we notice that we are able to get several e-mail addresses and hostnames from the Google search engine.

If we want to gather more information, let's say we want to collect the username from the target, we can use linkedin.com to do this. The following is the command for that:

# theharvester -d example.com -l 100 -b linkedin

The following is the result:

[-] Searching in Linkedin..
  Searching 100 results..
Users from Linkedin:
====================
John Example
David Example
Judy Example
Michael Example
Forrest Example
Luke Example

The preceding list of usernames collected from LinkedIn will be useful in a penetration testing step later if we want to do an attack, such as a social engineering attack.

SimplyEmail

theharvester is a handy tool to aggregate e-mail addresses and other information that a target may leak. Another tool, SimplyEmail, takes not only e-mail addresses and other information, but also scrubs domains for documents such as text, Word, or Excel spreadsheets. In addition, there are a wide range of different websites and search engines that can be used. These include Reddit, Pastebin, and CanaryBin. One of the best features is that the tool creates a report in HTML, which comes in handy when you are preparing your report.

SimplyEmail is a Python script that has a number of modules. Installing it is fairly easy.

Go through the following steps to install SimplyEm ail:

  1. Navigate to the GitHub site, https://github.com/killswitch-GUI/SimplyEmail.
  2. In the upper-right-hand corner is a box to download the file package as a zip.
  3. Once it is downloaded, extract the files to a file called SimplyEmail. For ease of use, you can put this file on the desktop.
  4. Navigate to the folder via the command line and run the startup script by typing the following command:
    #sh Setup.sh
  5. Once the startup script has completed, you can execute the scripts.

The help menu can be accessed by typing the following command:

  #./SimplyEmail.py –h

Curent Version: v1.0 | Website: CyberSyndicates.com
 ============================================================
 Twitter: @real_slacker007 |  Twitter: @Killswitch_gui
 ============================================================
[-s] [-v]

E-mail enumeration is an important phase of so many operations that a penetration tester or Red Teamer goes through. There are tons of applications that do this, but I wanted a simple yet effective way to get what Recon-Ng gets and theharvester gets (you may want to run -h):

optional arguments:
  -all                 Use all non API methods to obtain Emails
  -e company.com       Set required email addr user, ex ale@email.com
  -l                   List the current Modules Loaded
  -t           html / flickr / google
                       Test individual module (For Linting)
  -s                   Set this to enable 'No-Scope' of the email parsing
  -v                    Set this switch for verbose output of modules

To start a search, type in the following command:

#./SimplyEmail –all –e example.com

The script then runs. Beware that if there is no information, there will be errors in the return. This does not mean you have made an error, but rather that there are no results for the search. While the tool runs, you will see the following output on your screen:

[*] Starting: PasteBin Search for Emails
[*] Starting: Google PDF Search for Emails
[*] Starting: Exalead DOCX Search for Emails
[*] Starting: Exalead XLSX Search for Emails
[*] Starting: HTML Scrape of Taget Website
[*] Starting: Exalead Search for Emails
[*] Starting: Searching PGP
[*] Starting: OnionStagram Search For Instagram Users
[*] HTML Scrape of Taget Website has completed with no Email(s)
[*] Starting: RedditPost Search for Emails
[*] OnionStagram Search For Instagram Users: Gathered 23 Email(s)!
[*] Starting: Ask Search for Emails

After the searches have been conducted, you will receive a request to verify e-mail addresses. This verification process can take some time, but in a targeted attack where you want to socially engineer or phish specific individuals, it may be prudent. A simple Y/N will suffice:

[*] Email reconnaissance has been completed:
    Email verification will allow you to use common methods
    to attempt to enumerate if the email is valid.
    This grabs the MX records, sorts and attempts to check
    if the SMTP server sends a code other than 250 for known bad addresses

 [>] Would you like to verify email(s)?:

After the verification question, the final question is the report generation phase:

[*] Email reconnaissance has been completed:
   File Location:     /root/Desktop/SimplyEmail
   Unique Emails Found:    246
   Raw Email File:    Email_List.txt
   HTML Email File:    Email_List.html
   Domain Performed:    example.com
[>] Would you like to launch the HTML report?:

The report output is an HTML file with the types of search that have been conducted and the data that has been found. If you are good at HTML, you can even brand this report with your own logo and include it in the final penetration test report.