Chapter 3: Setting Up for Advanced Hacking Techniques

Learning the methodology and techniques of performing penetration testing is always exciting. While many professionals may focus on specific types of penetration testing, such as internal assessment, external assessment, social engineering assessment, or even web application security testing, it's always good to understand how to perform wireless penetration testing on wireless enterprise networks and how to compromise a Microsoft Windows domain.

During this chapter, you will learn how to set up your very own Active Directory (AD) lab environment, which will allow you to perform advanced red teaming techniques, such as discovering how to compromise an organization's Windows Domain Controller (DC). Furthermore, you will also learn how to create a wireless penetration testing lab environment to simulate advanced wireless hacking techniques.

In this chapter, we will cover the following topics:

• Building an...

Technical requirements

To follow along with the exercises in this chapter, please ensure that you have met the following hardware and software requirements:

• Oracle VM VirtualBox: https://www.virtualbox.org/
• Windows Server 2019: https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2019
• Windows 10 Enterprise: https://www.microsoft.com/en-us/evalcenter/evaluate-windows-10-enterprise
• Ubuntu Server 20.04.2: https://ubuntu.com/download/server
• FreeRadius: https://freeradius.org/
• A physical wireless router that supports the WEP, WPA2-Personal, and WPA2-Enterprise security standards

Building an AD red team lab

AD is a role within the Microsoft Windows Server operating system that allows system administrations to efficiently manage all users, devices, and policies within a Windows environment. AD ensures that centralized management is available for user accounts across an entire organization, as well as that policies can be created and assigned to various user groups to ensure people have the necessary access rights to perform actions that are related to their job duties.

AD is commonly found within many organizations around the world. It's important to understand how to discover various security vulnerabilities within a Microsoft Windows domain and leverage those security flaws to compromise an organization's DC and its systems, services, and shared resources.

This section will teach you how to create a Microsoft Windows lab environment with Microsoft Windows Server 2019, a few client systems with Microsoft Windows 10 Enterprise, and Kali Linux...

Setting up a wireless penetration testing lab

Understanding how to perform security testing on wireless networks that use common types of security standards such as Wired Equivalent Privacy (WEP), Wi-Fi Protected Access (WPA), WPA2-Personal, and WPA/WPA2-Enterprise is essential as an aspiring penetration tester.

Within many organizations, you will commonly find wireless networks that are implemented to support the wireless mobility of their employees. Employees can connect their smartphones, tablets, and laptops to the corporate Wi-Fi network and access the resources on the wired network, such as printers and file servers. In small networks, the wireless router or access point is usually configured using one of the following wireless security standards:

• WEP
• WPA
• WPA2-Personal

These security standards are designed for small networks and the regular home consumer as they are simple to configure using a single shared password, known as a Pre-Shared Key (PSK...

Summary

During this chapter, you gained the hands-on skills to build a Windows environment that simulates a typical enterprise organization that has domain users, various service accounts, administrators, and shared network resources. Additionally, you learned how to create a wireless network lab that contains a RADIUS server to provide AAA services, which help replicate a wireless network within a large organization. These lab environments will be utilized later in this book when you learn about advanced penetration testing techniques such as red team exercises.

I hope this chapter has been informative for you and will prove helpful in your journey as an aspiring penetration tester, learning how to simulate real-world cyber attacks to discover security vulnerabilities and perform exploitation using Kali Linux. In the next chapter, Chapter 4, Reconnaissance and Footprinting, you will learn how to gather sensitive information about a target using various tools and techniques.

...

Further reading

To learn more about the topics that were covered in this chapter, take a look at the following resources:

• Active Directory Domain Services: https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview
• Understanding FreeRADIUS: https://freeradius.org/documentation/