Network Penetration Testing

Be prepared—this is going to be a massive chapter! In fact, this is a book's worth of information in one chapter. Why? Because I want it to be a reference for you to use in your future career. Network vulnerability assessment and penetration testing will be one of your major tasks when working in web application security. Say that you deploy a web application on a vulnerable operating system that is accessible from the internet—this would be a Christmas gift for a hacker who wants to get a remote shell into your company's server.

Most of the internet security books on the market talk about this subject (penetration testing with Kali Linux), so I asked myself, Before writing this chapter, how can I use it myself for my own daily security tests?. I want it to be useful for you as much as possible so you can use it in practice for...

Passive information gathering – reconnaissance – OSINT

In the first step before the penetration testing starts, you will need to passively collect the information about the company in scope. To accomplish this task, you will use the web, along with some automated tools that call the web at the backend as well. This phase is also called the collection of Open Source Intelligence (OSINT). OSINT refers to the information collected from the internet. Another name for this phase used by security professionals is reconnaissance. To be honest, they all refer to the same task, but you need to be aware of the different names used to describe this stage.

If your target (whether it's your client's target or that of the organisation for which you work) is an external web application, then you can execute the information-gathering phase, but if your target is an intranet...

Active information gathering – services enumeration

This phase is all about identifying the live hosts and the services running on those hosts. Remember, in this phase, we're still gathering information to use in order to understand our target. Some people in enterprise environments just skip this test and go straight to the vulnerability assessment by executing fancy scanners, such as Nessus or Nexpose. I don't like this approach myself, unless you're on a low budget for your tests (it's better than nothing).

This phase has four steps:

1. Getting IP addresses/ranges from your client or employer (if it's an internal project, the project manager will help with this matter)
2. Identifying live hosts
3. Listing the open ports/services on each host
4. Probing each service for more information

Check Appendices A, B, C, D, and E for penetration testing references...

Vulnerability assessment

In the previous section, we enumerated the services aggressively. Some of the Nmap scripts will check for vulnerabilities—for example, when entering the option --script=http*, Nmap, in this case, will execute all the HTTP scripts, including the ones that check for vulnerabilities, for example, http-vuln-cve2010-2861.

In reality, in an enterprise environment, we would use automatic scanners, either Nessus or Nexpose. Nowadays, these companies offer scanners on the cloud as well—for example, the Nexpose equivalent in the cloud is called InsightVM. We heavily rely on these scanners to identify the vulnerabilities in the network infrastructure. Your role is to take the results and make sure that these flaws exist—in other words, that they're not false positives.

...

Exploitation

The exploitation phase is accomplished by exploiting a vulnerability found on the target machine and getting a remote shell as well. That's it! Simple, right? Let's get started.

Finding exploits

Generally speaking, 99% of the time, the vulnerability scanner will tell you where to find the exploit in order to replicate it from your end. Here's where to find most of the exploits:

• Google it—it sounds simple, but it's my favorite method
• Exploit-db at http://www.exploit-db.com
• The searchsploit tool in Kali Linux
• Metasploit—use the search command to find it
• Security Focus at http://www.securityfocus.com
• Sometimes you will find them on GitHub, at http://www.github.com

...

Privilege escalation

After exploiting a vulnerability, most of the time, you will get a limited shell. The next step is to get an admin account on the victim machine. To accomplish this, you will need to choose one of the following methodologies:

• Transfer a file to the victim machine to allow you to have a root shell (for example, Dirty COW)
• Copy–pasting a PowerShell payload for Windows OS (for example, Empire PowerShell)
• Using Metasploit/Meterpreter to escalate the privileges (refer to Appendix B)
• Manually searching for misconfigured parameters in order to get an admin/root shell

File transfers

Let's look at a practical scenario. Say you just got a limited shell into the victim's machine. You know that...

Summary

So many topics were covered in this chapter, from information gathering to privilege escalation. I tried to cover the most important ones and then get straight to the point without the nitty-gritty details in order to maximize the topics I could cover in a single chapter.

What you learned in this chapter is just half the story regarding penetration testing. In fact, in this chapter, we just covered network-based assessment. In the next chapter, we will cover web-application-based penetration testing.