Using web application scanners

As an aspiring penetration tester, you will also be required to perform web application security testing based on the scope of your penetration testing engagements. In this section, you will learn how to use various types of web application scanners to identify and fingerprint web applications on a target server.Let’s get started!

WhatWeb

WhatWeb enables ethical hackers and penetration testers to identify and fingerprint the type of technologies that are running on web application servers. WhatWeb is pre-installed on Kali Linux and should be part of your arsenal of tools during your reconnaissance and vulnerability assessment phase.To profile a targeted web server using WhatWeb, please use the following instructions:

1. Firstly, power-on the Kali Linux and Metasploitable 3 (Windows version) virtual machines.
2. On Kali Linux, open the Terminal and use the following commands to identify whether there’s a web application running on the target:

...

Summary

In this chapter, you have learnt about the importance of discovering security vulnerabilities within an organization and its assets. You also gained hands-on experience and skills with using various tools such as Nessus, Nmap, and GVM to perform security assessments on systems. You also discovered how various tools and techniques can be used to easily identify security flaws on web applications.I trust that the knowledge presented in this chapter has provided you with valuable insights, supporting your path towards becoming an ethical hacker and penetration tester in the dynamic field of cybersecurity. May this newfound understanding empower you in your journey, allowing you to navigate the industry with confidence and make a significant impact. In the next chapter, Understanding Network Penetration Testing, you will focus on how to use various techniques and strategies when performing network penetration testing.

Further Reading

• Understanding Nessus - https://www.techtarget.com/searchnetworking/definition/Nessus
• Nmap Scripting Engine (NSE) - https://nmap.org/book/man-nse.html
• Nmap NSE scripts - https://nmap.org/nsedoc/scripts/
• CVSS scoring system - https://www.first.org/cvss/

Working with bind and reverse shells

Bind shells are commonly used by penetration testers to logically set up a service port in a listening state on a targeted system while binding the listening service port to a native shell such as Bourne Again Shell (Bash) on Linux or Command Prompt on Windows; this is commonly referred to as a listener. Once the penetration tester initiates a connection to the listener and a session is established, the penetration tester will gain access to the targeted system’s native shell, whether it’s Bash on Linux or Command Prompt on a Windows-based system.

Imagine your target is a vulnerable server on the internet with a public IP address, while your attacker machine, such as Kali Linux, is behind a router or firewall with network address translation (NAT) enabled. If there is a firewall between the source and destination, some firewalls are usually configured to allow outbound traffic from their internal network to the internet, but not...

Antimalware evasion techniques

As an aspiring ethical hacker and penetration tester, you will be developing custom payloads that are designed for specific targets, such as systems running Windows and Linux-based operating systems. In addition, if you’re performing mobile penetration testing, you will be creating payloads for mobile-based operating systems such as Android and iOS. The approach and tools used for payload development can significantly vary across these platforms. For example, the tools and vulnerabilities exploited for Android and iOS systems are quite different from those for Windows and Linux.

More importantly, you will need to consider whether your targeted systems are running any antimalware programs that are designed to detect and prevent any malicious code on the host. If a targeted system has an antimalware application installed, either it’s a native application such as Microsoft Defender Antivirus (sometimes referred to as Windows Defender)...

Working with wireless adapters

As an aspiring ethical hacking and penetration tester, you may be assigned to perform wireless penetration testing techniques on a targeted network with the intent of identifying any security vulnerabilities and assessing the attack surface to better understand how an adversary may be able to compromise the wireless network of an organization and gain unauthorized access.

While many ethical hackers and penetration testers prefer to directly install Kali Linux on the local storage drive on their laptops to improve mobility and direct access to the hardware resources, this deployment model isn’t always the best. For instance, the chipset within the wireless network adapter on a laptop may not support Monitoring mode and packet injection. Therefore, it is recommended to acquire a set of external wireless network adapters that do the following:

• They support IEEE 802.11 standards such as 802.11a/b/g/n/ac.
• They operate on the 2...

Managing and Monitoring wireless modes

As an ethical hacker and penetration tester, it is important to have a clear understanding of the various operating modes of a wireless network adapter. Let’s take a look at each operating mode for wireless network adapters:

• Managed: This is the default operating mode for all wireless network adapters. This mode enables a host device such as a computer to connect to a nearby access point or wireless router. However, this mode does not enable ethical hackers and penetration testers to perform any type of wireless penetration testing techniques on a targeted wireless network.
• Monitor: This operating mode enables ethical hackers and penetration testers to scan for Institute of Electrical and Electronics Engineers (IEEE) 802.11 wireless networks within the vicinity, capture wireless frames such as beacons from access points and probes from wireless clients, and perform packet injection attacks on a targeted wireless network...

Summary

Having completed this chapter, you have learned about the importance of network penetration testing and how it helps organizations improve their cyber defenses and strategies to prevent future cyberattacks and threats. In addition, you have discovered how to set up and work with both bind and reverse shells between different systems over a network. Furthermore, you have exploited how to set up wireless network adapters for performing wireless penetration testing in later chapters.

I trust that the knowledge presented in this chapter has provided you with valuable insights, supporting your path toward becoming an ethical hacker and penetration tester in the dynamic field of cybersecurity. May this newfound understanding empower you in your journey, allowing you to navigate the industry with confidence and make a significant impact. In the next chapter, Performing Network Penetration Testing, you will learn how to perform network penetration testing to identify security...

Further reading

• To learn about aircrack-ng, go to https://www.aircrack-ng.org/doku.php?id=Main.

Join our community on Discord

Join our community’s Discord space for discussions with the author and other readers:

https://packt.link/SecNet