You're reading from The Ultimate Kali Linux Book - Third Edition

Product type Book

Published in Apr 2024

Publisher Packt

ISBN-13 9781835085806

Pages 828 pages

Edition 3rd Edition

Languages

Concepts

Cybersecurity

Author (1):

Glen D. Singh

Table of Contents (21) Chapters

Preface

1. Introduction to Ethical Hacking

2. Building a Penetration Testing Lab

3. Setting Up for Advanced Penetration Testing Techniques

4. Passive Reconnaissance

5. Exploring Open-Source Intelligence

6. Active Reconnaissance

7. Performing Vulnerability Assessments

8. Understanding Network Penetration Testing

9. Performing Network Penetration Testing

10. Post-Exploitation Techniques

11. Delving into Command and Control Tactics

12. Working with Active Directory Attacks

13. Advanced Active Directory Attacks

14. Advanced Wireless Penetration Testing

15. Social Engineering Attacks

16. Understanding Website Application Security

17. Advanced Website Penetration Testing

18. Best Practices for the Real World

19. Index

Appendix

Summary

During this chapter, you have gained the hands-on skills as an aspiring ethical hacker and penetration tester to perform active scanning techniques to identify open ports, running services and operating system on targeted systems. In addition, you have learnt how to use common evasion techniques during scanning to reduce your threat level. Furthermore, you have discovered how to enumerate common network services and leverage the information on improve a cyber-attack.I trust that the knowledge presented in this chapter has provided you with valuable insights, supporting your path towards becoming an ethical hacker and penetration tester in the dynamic field of cybersecurity. May this newfound understanding empower you in your journey, allowing you to navigate the industry with confidence and make a significant impact. In the next chapter, Performing Vulnerability Assessments, you will learn how to setup and work with popular vulnerability management tools.

Getting started with Nessus

When diving into the field of cybersecurity, there is a very well-known tool everyone needs to know about, and that’s Nessus. Nessus is a vulnerability scanner that can detect over 83,000 Common Vulnerability and Exposure (CVE) security flaws on systems. Furthermore, Nessus allows security professionals to deploy Nessus within centralized locations and automate periodic scanning on targeted systems, which allows continuous and automated vulnerability assessment within an organization.

As an aspiring penetration tester, you may need to use Nessus to perform a vulnerability assessment within an organization, determine the risk and severity of each security flaw, and provide recommendations on how to mitigate the risk of possible cyber-attacks based on the security vulnerabilities found. In this section, you will learn how to set up and perform a vulnerability assessment using Nessus on your Kali Linux machine.

Before getting started with installing...

Vulnerability identification using Nmap

The Nmap Scripting Engine (NSE) is one of the most powerful features of Nmap. It enables penetration testers and security researchers to create, automate, and perform customized scanning on targeted systems. When working with NSE, the scanning techniques are usually aggressive and have the potential to cause unexpected data loss or even crash the targeted system. However, NSE allows a penetration tester to easily identify security vulnerabilities and determine whether the target is exploitable.

If the organization is sensitive to disruption or includes Operational Technology (OT) assets, the penetration tester should get explicit written permission to run aggressive scripts.

There are 600+ pre-built scripts that belong to the following NSE categories:

Auth: This category contains scripts that scan a targeted system to identify whether authentication bypass is possible.
Broadcast: This category contains scripts...

Working with Greenbone Vulnerability Manager

The Open Vulnerability Assessment Scanner (OpenVAS) tool is a free vulnerability scanner that allows both ethical hackers and penetration testers to perform a vulnerability assessment on a network. OpenVAS can scan both authenticated and unauthenticated vulnerability assets within an organization.

When using an authenticated scan, the penetration tester provides valid login credentials to the vulnerability scanner, which allows it to authenticate to a system to provide a thorough scan for any misconfigurations on the target system’s settings. However, the unauthenticated scan is usually not as thorough since it looks for any security vulnerabilities on the surface of the target and provides a report.

Authenticated scans, by using valid login credentials, can perform checks against internal files, configurations, and more detailed system information, thereby identifying vulnerabilities that unauthenticated scans cannot...

Using web application scanners

As an aspiring penetration tester, you will also be required to perform web application security testing based on the scope of your penetration testing engagements. Web application security testing aims to identify vulnerabilities that could be exploited by attackers, such as SQL injection, cross-site scripting (XSS), and security misconfigurations. In this section, you will learn how to use various types of web application scanners to identify and fingerprint web applications on a target server.

Let’s get started!

WhatWeb

WhatWeb enables ethical hackers and penetration testers to identify and fingerprint the type of technologies that are running on web application servers. WhatWeb is pre-installed on Kali Linux and should be part of your arsenal of tools during your reconnaissance and vulnerability assessment phase.

To profile a targeted web server using WhatWeb, please use the following instructions:

Firstly, power...

Summary

In this chapter, you have learned about the importance of discovering security vulnerabilities within an organization and its assets. You also gained hands-on experience and skills with using various tools, such as Nessus, Nmap, and GVM, to perform security assessments on systems. You also discovered how various tools, such as WhatWeb, Nikto, and WPScan, can be used to easily identify security flaws in web applications.

I trust that the knowledge presented in this chapter has provided you with valuable insights, supporting your path toward becoming an ethical hacker and penetration tester in the dynamic field of cybersecurity. May this newfound understanding empower you on your journey, allowing you to navigate the industry with confidence and make a significant impact. In the next chapter, Understanding Network Penetration Testing, you will focus on how to use various techniques and strategies when performing network penetration testing.