Table of Contents for
Kali Linux 2018: Assuring Security by Penetration Testing - Fourth Edition

Version ebook / Retour

Cover image for bash Cookbook, 2nd Edition Kali Linux 2018: Assuring Security by Penetration Testing - Fourth Edition by Shakeel Ali Published by Packt Publishing, 2018
  1. Kali Linux Assuring Security by Penetration Testing, Fourth Edition
  2. Title Page
  3. Copyright and Credits
  4. Kali Linux 2018: Assuring Security by Penetration Testing Fourth Edition
  5. Dedication
  6. Packt Upsell
  7. Why subscribe?
  8. Packt.com
  9. Contributors
  10. About the authors
  11. About the reviewers
  12. Packt is searching for authors like you
  13. Table of Contents
  14. Preface
  15. Who this book is for
  16. What this book covers
  17. To get the most out of this book
  18. Conventions used
  19. Get in touch
  20. Reviews
  21. Installing and Configuring Kali Linux
  22. Technical requirements
  23. Kali Linux tool categories
  24. Downloading Kali Linux
  25. Using Kali Linux
  26. Running Kali using a Live DVD
  27. Installing on a hard disk
  28. Installing Kali on a physical machine
  29. Installing Kali on a virtual machine
  30. Installing Kali on a virtual machine from the ISO image
  31. Installing Kali Linux on a virtual machine using the Kali Linux VM image provided
  32. Saving or moving the virtual machine
  33. Installing Kali on a USB disk
  34. Configuring the virtual machine
  35. VirtualBox guest additions
  36. Setting up networking
  37. Setting up a wired connection
  38. Setting up a wireless connection
  39. Updating Kali Linux
  40. Setting up Kali Linux AMI on Amazon AWS Cloud
  41. Summary
  42. Questions
  43. Further reading
  44. Setting Up Your Test Lab
  45. Technical requirements
  46. Physical or virtual?
  47. Setting up a Windows environment in a VM
  48. Installing vulnerable servers
  49. Setting up Metasploitable 2 in a VM
  50. Setting up Metasploitable 3 in a VM
  51. Installing Packer
  52. Installing Vagrant
  53. Pre-built Metasploit 3
  54. Setting up BadStore in a VM
  55. Installing additional tools in Kali Linux
  56. Network services in Kali Linux
  57. HTTP
  58. MySQL
  59. SSH
  60. Additional labs and resources
  61. Summary
  62. Questions
  63. Further reading
  64. Penetration Testing Methodology
  65. Technical requirements
  66. Penetration testing methodology
  67. OWASP testing guide
  68. PCI penetration testing guide
  69. Penetration Testing Execution Standard
  70. NIST 800-115
  71. Open Source Security Testing Methodology Manual 
  72. General penetration testing framework
  73. Reconnaissance
  74. Scanning and enumeration
  75. Scanning
  76. ARP scanning
  77. The network mapper (Nmap)
  78. Nmap port scanner/TCP scan
  79. Nmap half-open/stealth scan
  80. Nmap OS-detection
  81. Nmap service-detection
  82. Nmap ping sweeps
  83. Enumeration
  84. SMB shares
  85. DNS zone transfer
  86. DNSRecon
  87. SNMP devices
  88. Packet captures
  89. tcpdump
  90. Wireshark
  91. Gaining access
  92. Exploits
  93. Exploits for Linux
  94. Exploits for Windows
  95. Escalating privileges
  96. Maintaining access
  97. Covering your tracks
  98. Reporting
  99. Summary
  100. Footprinting and Information Gathering
  101. Open Source Intelligence
  102. Using public resources
  103. Querying the domain registration information
  104. Analyzing the DNS records
  105. Host
  106. dig
  107. DMitry
  108. Maltego
  109. Getting network routing information
  110. tcptraceroute
  111. tctrace
  112. Utilizing the search engine
  113. SimplyEmail
  114. Google Hacking Database (GHDB)
  115. Metagoofil
  116. Automated footprinting and information gathering tools
  117. Devploit
  118. Red Hawk v2
  119. Using Shodan to find internet connected devices
  120. Search queries in Shodan
  121. Blue-Thunder-IP-Locator
  122. Summary
  123. Questions
  124. Further reading
  125. Scanning and Evasion Techniques
  126. Technical requirements
  127. Starting off with target discovery
  128. Identifying the target machine
  129. ping
  130. fping
  131. hping3
  132. OS fingerprinting
  133. p0f
  134. Introducing port scanning
  135. Understanding TCP/IP protocol
  136. Understanding TCP and UDP message formats
  137. The network scanner
  138. Nmap
  139. Nmap target specification
  140. Nmap TCP scan options
  141. Nmap UDP scan options
  142. Nmap port specification
  143. Nmap output options
  144. Nmap timing options
  145. Useful Nmap options
  146. Service version detection
  147. Operating system detection
  148. Disabling host discovery
  149. Aggressive scan
  150. Nmap for scanning the IPv6 target
  151. The Nmap scripting engine
  152. Nmap options for firewall/IDS evasion
  153. Scanning with Netdiscover
  154. Automated scanning with Striker
  155. Anonymity using Nipe
  156. Summary
  157. Questions
  158. Further Reading
  159. Vulnerability Scanning
  160. Technical requirements
  161. Types of vulnerabilities
  162. Local vulnerability
  163. Remote vulnerability
  164. Vulnerability taxonomy
  165. Automated vulnerability scanning
  166. Vulnerability scanning with Nessus 7
  167. Installing the Nessus vulnerability scanner
  168. Vulnerability scanning with OpenVAS
  169. Linux vulnerability scanning with Lynis
  170. Vulnerability scanning and enumeration using SPARTA
  171. Summary
  172. Questions
  173. Further reading
  174. Social Engineering
  175. Technical requirements
  176. Modeling human psychology
  177. Attack process
  178. Attack methods
  179. Impersonation
  180. Reciprocation
  181. Influential authority
  182. Scarcity
  183. Social relationships
  184. Curiosity
  185. Social Engineering Toolkit
  186. Anonymous USB attack
  187. Credential-harvesting
  188. Malicious Java applet
  189. Summary
  190. Target Exploitation
  191. Vulnerability research
  192. Vulnerability and exploit repositories
  193. Advanced exploitation toolkit
  194. MSFConsole
  195. MSFCLI
  196. Ninja 101 drills
  197. Scenario 1
  198. Scenario 2
  199. SMB usernames
  200. VNC blank authentication scanners
  201. PostGRESQL logins
  202. Scenario 3
  203. Bind shells
  204. Reverse shells
  205. Meterpreters
  206. Writing exploit modules
  207. Summary
  208. Privilege Escalation and Maintaining Access
  209. Technical requirements
  210. Privilege-escalation
  211. Local escalation
  212. Password-attack tools
  213. Offline attack tools
  214. John the Ripper
  215. Ophcrack
  216. samdump2
  217. Online attack tools
  218. CeWL
  219. Hydra
  220. Mimikatz
  221. Maintaining access
  222. Operating-system backdoors
  223. Cymothoa
  224. The Meterpreter backdoor
  225. Summary
  226. Web Application Testing
  227. Technical requirements
  228. Web analysis
  229. Nikto
  230. OWASP ZAP
  231. Burp Suite
  232. Paros proxy
  233. W3AF
  234. WebScarab
  235. Cross-Site Scripting
  236. Testing for XSS
  237. SQL injection
  238. Manual SQL injection
  239. Automated SQL injection
  240. sqlmap
  241. Command-execution, directory-traversal, and file-inclusion
  242. Directory-traversal and file-inclusion
  243. Command execution
  244. Summary
  245. Further reading
  246. Wireless Penetration Testing
  247. Technical requirements
  248. Wireless networking
  249. Overview of 802.11
  250. The Wired Equivalent Privacy standard
  251. Wi-Fi Protected Access (WPA)
  252. Wireless network reconnaissance
  253. Antennas
  254. Iwlist
  255. Kismet
  256. WAIDPS
  257. Wireless testing tools
  258. Aircrack-ng
  259. WPA pre-shared key-cracking
  260. WEP-cracking
  261. PixieWPS
  262. Wifite
  263. Fern Wifi-Cracker
  264. Evil Twin attack
  265. Post cracking
  266. MAC-spoofing
  267. Persistence
  268. Sniffing wireless traffic
  269. Sniffing WLAN traffic
  270. Passive sniffing
  271. Summary
  272. Mobile Penetration Testing with Kali NetHunter
  273. Technical requirements
  274. Kali NetHunter
  275. Deployment
  276. Network deployment
  277. Wireless deployment
  278. Host deployment
  279. Installing Kali NetHunter
  280. NetHunter icons
  281. NetHunter tools
  282. Nmap
  283. Metasploit
  284. MAC changer
  285. Third-party Android applications
  286. The NetHunter Terminal Application
  287. DriveDroid
  288. USB Keyboard
  289. Shodan
  290. Router Keygen
  291. cSploit
  292. Wireless attacks
  293. Wireless scanning
  294. WPA/WPA2 cracking
  295. WPS cracking
  296. Evil AP attack
  297. Mana evil AP
  298. HID attacks
  299. DuckHunter HID attacks
  300. Summary
  301. Questions
  302. Further reading
  303. PCI DSS Scanning and Penetration Testing
  304. PCI DSS v3.2.1 requirement 11.3
  305. Scoping the PCI DSS penetration test
  306. Gathering client requirements
  307. Creating the customer requirements form
  308. Preparing the test plan
  309. The test plan checklist
  310. Profiling test boundaries
  311. Defining business objectives
  312. Project management and scheduling
  313. Tools for executing the PCI DSS penetration test
  314. Summary
  315. Questions
  316. Further reading
  317. Tools for Penetration Testing Reporting
  318. Technical requirements
  319. Documentation and results verification
  320. Types of reports
  321. The executive report
  322. The management report
  323. The technical report
  324. Network penetration testing report
  325. Preparing your presentation
  326. Post-testing procedures
  327. Using the Dradis framework for penetration testing reporting
  328. Penetration testing reporting tools
  329. Faraday IDE
  330. MagicTree
  331. Summary
  332. Questions
  333. Further reading
  334. Assessments
  335. Chapter 1 – Assessment answers
  336. Chapter 2 – Assessment answers
  337. Chapter 4 – Assessment answers
  338. Chapter 5 – Assessment answers
  339. Chapter 6 – Assessment answers
  340. Chapter 12 – Assessment answers
  341. Chapter 13 – Assessment answers
  342. Chapter 14 – Assessment answers
  343. Other Books You May Enjoy
  344. Leave a review - let other readers know what you think

Installing Kali on a physical machine

Before you install Kali Linux on a physical/real machine, make sure that you install it on an empty hard drive. If your hard drive already has some data on it, that data will be lost during the installation process because the installer will format the hard drive. For the easiest installation, it is recommended that you use the entire hard disk. For more advanced setups, there is the option of installing Kali Linux on a partition of a single logical drive. To do this, you will have to have a primary partition that boots the operating system and another partition for Kali Linux. Take care when doing this because it is easy for the bootable operating system to become corrupted.

The official Kali Linux documentation that describes how to install Kali Linux for the Windows operating system can be found at http://docs.kali.org/installation/dual-boot-kali-with-windows.

There are several tools that can be used to help you perform disk partitioning. In the open source area, the following Linux Live CDs are available:

To use the Linux Live CD, you just need to boot it up and you are ready for disk partitioning. Make sure that you back up your data before you use the Linux Live CD disk-partitioning tool. Even though they are safe for use in our experience, there is nothing wrong with being cautious, especially if you have important data on the hard disk.

After you are done with the disk partitioning (or you just want to use all the hard disk space), you can boot your machine using the Kali Linux Live DVD and select the Install or Graphical install option when you are prompted with the Kali Linux Live CD menu:

The Kali Linux splash screen - choose graphical install

After that, you will see an installation window. You need to set up several things during the installation process:

  1. Set Language: The default is English.
  2. Selection Location: Use the drop-down menu to select your country.
  3. Configure the Keyboard: Select the keyboard that best fits your needs.
  4. Host Name for the system: The default is Kali. For beginners, you can leave the default in place. Host names are often used in enterprise environments where an accounting of all systems connected to the network is necessary.
  5. Set the Domain: For beginners, this should be left blank. This would only be used if the installation was to be part of a network domain.
  6. Set Password: This will be the password for the ROOT account. Choose a strong one, do not share it, and do not forget it.
  7. Configure the clock: Choose your time zone.
  8. Partition Disk: The installer will guide you through the disk partitioning process. If you use an empty hard disk, just select the default Guided - use entire disk option for convenience. If you have some other operating system installed on your machine, you might first want to create a separate partition for Kali Linux and then select Manual in this menu. After you have selected a suitable menu, the installer will create the partition.
  9. The installer will ask you about the partitioning scheme; the default scheme is All files in one partition. Remember that if you want to store files in the home directory, you should select Separate /home partition so that those files won't be deleted if you reinstall the system. The /home partition's size really depends on your needs. If you want to put all your data in that directory, you may want a big partition size (more than 50 GB). For average use, you can go ahead with 10 to 20 GB.
  10. For beginners, it is recommended that you select the Guided - use entire disk option. Then, select the disk that you want to install Kali Linux to. Select All files in one partition.
  1. The installer will display an overview of your currently configured partitions, as shown in the following screenshot:

  1. Make sure Finish partitioning and write changes to disk is selected and then click Continue. Finally, click the Yes radio button and click Continue to write the changes to the disk.
  2. Network Mirror: For beginners, choose no. We will cover updating Kali Linux.
  3. Next, the installer will install the Kali Linux system. The installation will be completed in several minutes and you will have Kali Linux installed on your hard disk afterwards. In our test machine, the installation took around 20 minutes.
  4. After the installation is finished, the installer will ask you to configure the package manager. Next, it will ask you to install GRUB to the Master Boot Record (MBR). You can just choose the default values for these two questions. Beware: if you have some other operating system on the same machine, you should not choose to install GRUB to the MBR.
  1. If you see the following message, it means that your Kali installation is complete:

  1. You can restart the machine to test your new Kali installation by selecting the Continue button. After restarting, you will see the following Kali login screen. You can log in using the credentials that you configured in the installation process. The default username is root:

The default password is toor: