Chapter 8: Performing Network Penetration Testing

As an aspiring ethical hacker and penetration tester, being metaphorically thrown into the field to perform a network penetration test can be very overwhelming for many. I remembered my first time as a security professional, when I was given the responsibility to perform an internal network penetration test on an organization's network. It was a unique experience in that I knew what to do based on my knowledge and skills. However, I felt uncertain about how to get started. Nevertheless, I followed the rules and procedures that had been set within my prior cybersecurity training and developed additional strategies and tactics to achieve the goal of the penetration test, all while ensuring I stayed within the boundary that was agreed upon by the organization. The purpose of this chapter is you help you gain a clear understanding of how to discover and exploit security vulnerabilities on applications and operating systems on hosts...

Technical requirements

To follow along with the exercises in this chapter, please ensure that you have met the following hardware and software requirements:

• Kali Linux 2021.2: https://www.kali.org/get-kali/
• Windows 10 as a host operating system
• Metasploitable 2: https://sourceforge.net/projects/metasploitable/files/Metasploitable2/
• Metasploitable 3: https://app.vagrantup.com/rapid7/boxes/metasploitable3-win2k8
• A dedicated hardware-based GPU/graphics card on your attacker computer

Discovering live systems

When performing an internal penetration test for an organization, the company will allow you to connect your attacker machine to their network and may assign you a static IP address for your Kali Linux machine. On a network penetration testing engagement, the objective is to simulate real-world cyberattacks on target systems that are within the rules of engagement, before starting the actual penetration test. Ensure you do not perform any type of security testing on systems that are not within the scope as you will face legal issues with the organization. However, once you're within the scope, you'll need to discover the system, profile your targets, discover security vulnerabilities, and exploit those security weaknesses and gain access while looking for other methods a real hacker can compromise the systems and network with.

In this section, you will learn about the fundamentals of discovering live systems on a network, just as you would within...

Profiling a target system

Profiling your target systems is important as it helps you determine the running operating system and the service pack level. By understanding the operating system version, you'll be able to search for and discover security vulnerabilities on those systems, and even create exploits and payloads that have been specifically crafted to work on the target's operating system. Additionally, when profiling a target, you'll be able to identify the service versions of open service ports. Such information will be useful as there are many systems within organizations that run outdated and vulnerable applications. These vulnerable services can be exploited by a penetration tester during a penetration test engagement.

To get started with this exercise, please use the following instructions:

1. Ensure Kali Linux, Metasploitable 2, and Metasploitable 3 are powered on.
2. On Kali Linux, use Nmap to identify the operating system, service versions,...

Exploring password-based attacks

While performing a penetration test on a network, you will encounter systems that have remote access protocols and services running, such as Secure Shell (SSH) and even Remote Desktop Protocol (RDP). However, most IT professionals usually secure systems that have some type of remote access to prevent threat actors and unauthorized people from accessing and controlling those systems and devices. Many years ago, when I was breaking into the industry, I encountered an organization that was a victim of a cyberattack that affected their Voice over IP (VoIP) systems. Attackers redirected large volumes of international calls through the compromised company's VoIP systems, which resulted in large toll charges on their bills and reputational issues. This attack is usually referred to as Toll Fraud.

Being curious at the time, I suspected the attack occurred through the network, which led me to look at the configurations of the networking devices. One...

Identifying and exploiting vulnerable services

In this section, you will learn how to use various techniques and tools within Kali Linux. These will help you efficiently identify and exploit security vulnerabilities found on both Windows and Linux-based operating systems that have vulnerable applications and network services running on them.

Exploiting a vulnerable service on a Linux system

In this exercise, you will learn how to discover and exploit a low-hanging fruit within a Linux-based system on a network. The low-hanging fruits are the easier applications/systems to compromise. In this section, you will learn how to exploit a File Transfer Protocol (FTP) service running on a target Linux device.

To get started with this exercise, please use the following instructions:

1. Power on both the Kali Linux and Metasploitable 2 virtual machines. Metasploitable 2 is a Linux-based system, which makes it perfect for this hands-on lab.
2. Use the following Nmap command to...

Understanding watering hole attacks

Within the field of cybersecurity, learning about various types of attacks and threats is very important. Some of these attacks have some very unusual names, and, in this section, we will cover the fundamentals of a watering hole attack. Let's imagine you're the IT security administrator or engineer for a company. You've implemented the best security appliances within the industry to proactively detect and prevent any sort of cyberattacks and threats, whether internal or external to your organization. You've also implemented industry best practices, adhered to standards, and ensured that your users (employees of the organization) are frequently trained on user awareness security practices. You have metaphorically built a security fortress upon your organization and ensured that the network perimeter is also fortified so that it can prevent new and emerging threats.

Threat actors would notice that they are unable to breach your...

Further reading

To learn more about the topics that were covered in this chapter, take a look at the following resources:

• Watering hole 101: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/web-attack/137/watering-hole-101
• Drive-by Compromise: https://attack.mitre.org/techniques/T1189/
• Credential access: https://attack.mitre.org/tactics/TA0006/