Metasploit Revealed: Secrets of the Expert Pentester

Name: Metasploit Revealed: Secrets of the Expert Pentester
Brand: Packt Publishing
Price: 75.49 EUR
Availability: OnlineOnly

Sagar Rahalkar(Autor*in)

Packt Publishing

Erschienen am 5. Dezember 2017

860 Seiten

E-Book

ePUB mit Adobe-DRM

Systemvoraussetzungen

978-1-78862-855-6 (ISBN)

75,49 €inkl. 7% MwSt.

Systemvoraussetzungen

für ePUB mit Adobe-DRM

E-Book Einzellizenz

Als Download verfügbar

Beschreibung

Exploit the secrets of Metasploit to master the art of penetration testing.About This BookDiscover techniques to integrate Metasploit with the industry's leading toolsCarry out penetration testing in highly-secured environments with Metasploit and acquire skills to build your defense against organized and complex attacksUsing the Metasploit framework, develop exploits and generate modules for a variety of real-world scenariosWho This Book Is ForThis course is for penetration testers, ethical hackers, and security professionals who'd like to master the Metasploit framework and explore approaches to carrying out advanced penetration testing to build highly secure networks. Some familiarity with networking and security concepts is expected, although no familiarity of Metasploit is required.What You Will LearnGet to know the absolute basics of the Metasploit framework so you have a strong foundation for advanced attacksIntegrate and use various supporting tools to make Metasploit even more powerful and preciseTest services such as databases, SCADA, and many moreAttack the client side with highly advanced techniquesTest mobile and tablet devices with MetasploitUnderstand how to Customize Metasploit modules and modify existing exploitsWrite simple yet powerful Metasploit automation scriptsExplore steps involved in post-exploitation on Android and mobile platformsIn DetailMetasploit is a popular penetration testing framework that has one of the largest exploit databases around. This book will show you exactly how to prepare yourself against the attacks you will face every day by simulating real-world possibilities.This learning path will begin by introducing you to Metasploit and its functionalities. You will learn how to set up and configure Metasploit on various platforms to create a virtual test environment. You will also get your hands on various tools and components and get hands-on experience with carrying out client-side attacks. In the next part of this learning path, you'll develop the ability to perform testing on various services such as SCADA, databases, IoT, mobile, tablets, and many more services.After this training, we jump into real-world sophisticated scenarios where performing penetration tests are a challenge. With real-life case studies, we take you on a journey through client-side attacks using Metasploit and various scripts built on the Metasploit framework.The final instalment of your learning journey will be covered through a bootcamp approach. You will be able to bring together the learning together and speed up and integrate Metasploit with leading industry tools for penetration testing. You'll finish by working on challenges based on user's preparation and work towards solving the challenge.The course provides you with highly practical content explaining Metasploit from the following Packt books:Metasploit for BeginnersMastering Metasploit, Second EditionMetasploit BootcampStyle and approachThis pragmatic learning path is packed with start-to-end instructions from getting started with Metasploit to effectively building new things and solving real-world examples. All the key concepts are explained with the help of examples and demonstrations that will help you understand everything to use this essential IT power tool.

Weitere Details

Inhalt

Cover
Title Page
Copyright
Credits
Table of Contents
Preface
Chapter 1: Module 1
Metasploit for Beginners
Chapter 2: Introduction to Metasploit and Supporting Tools
The importance of penetration testing
Vulnerability assessment versus penetration testing
The need for a penetration testing framework
Introduction to Metasploit
When to use Metasploit?
Making Metasploit effective and powerful using supplementary tools
Nessus
NMAP
w3af
Armitage
Summary
Exercises
Chapter 3: Setting up Your Environment
Using the Kali Linux virtual machine - the easiest way
Installing Metasploit on Windows
Installing Metasploit on Linux
Setting up exploitable targets in a virtual environment
Summary
Exercises
Chapter 4: Metasploit Components and Environment Configuration
Anatomy and structure of Metasploit
Metasploit components
Auxiliaries
Exploits
Encoders
Payloads
Post
Playing around with msfconsole
Variables in Metasploit
Updating the Metasploit Framework
Summary
Exercises
Chapter 5: Information Gathering with Metasploit
Information gathering and enumeration
Transmission Control Protocol
User Datagram Protocol
File Transfer Protocol
Server Message Block
Hypertext Transfer Protocol
Simple Mail Transfer Protocol
Secure Shell
Domain Name System
Remote Desktop Protocol
Password sniffing
Advanced search with shodan
Summary
Exercises
Chapter 6: Vulnerability Hunting with Metasploit
Managing the database
Work spaces
Importing scans
Backing up the database
NMAP
NMAP scanning approach
Nessus
Scanning using Nessus from msfconsole
Vulnerability detection with Metasploit auxiliaries
Auto exploitation with db_autopwn
Post exploitation
What is meterpreter?
Searching for content
Screen capture
Keystroke logging
Dumping the hashes and cracking with JTR
Shell command
Privilege escalation
Summary
Exercises
Chapter 7: Client-side Attacks with Metasploit
Need of client-side attacks
What are client-side attacks?
What is a Shellcode?
What is a reverse shell?
What is a bind shell?
What is an encoder?
The msfvenom utility
Generating a payload with msfvenom
Social Engineering with Metasploit
Generating malicious PDF
Creating infectious media drives
Browser Autopwn
Summary
Exercises
Chapter 8: Web Application Scanning with Metasploit
Setting up a vulnerable application
Web application scanning using WMAP
Metasploit Auxiliaries for Web Application enumeration and scanning
Summary
Exercises
Chapter 9: Antivirus Evasion and Anti-Forensics
Using encoders to avoid AV detection
Using packagers and encrypters
What is a sandbox?
Anti-forensics
Timestomp
clearev
Summary
Exercises
Chapter 10: Cyber Attack Management with Armitage
What is Armitage?
Starting the Armitage console
Scanning and enumeration
Find and launch attacks
Summary
Exercises
Chapter 11: Extending Metasploit and Exploit Development
Exploit development concepts
What is a buffer overflow?
What are fuzzers?
Exploit templates and mixins
What are Metasploit mixins?
Adding external exploits to Metasploit
Summary
Exercises
Chapter 12: Module 2
Mastering Metasploit
Chapter 13: Approaching a Penetration Test Using Metasploit
Organizing a penetration test
Preinteractions
Intelligence gathering/reconnaissance phase
Predicting the test grounds
Modeling threats
Vulnerability analysis
Exploitation and post-exploitation
Reporting
Mounting the environment
Setting up Kali Linux in virtual environment
The fundamentals of Metasploit
Conducting a penetration test with Metasploit
Recalling the basics of Metasploit
Benefits of penetration testing using Metasploit
Open source
Support for testing large networks and easy naming conventions
Smart payload generation and switching mechanism
Cleaner exits
The GUI environment
Penetration testing an unknown network
Assumptions
Gathering intelligence
Using databases in Metasploit
Modeling threats
Vulnerability analysis of VSFTPD 2.3.4 backdoor
The attack procedure
The procedure of exploiting the vulnerability
Exploitation and post exploitation
Vulnerability analysis of PHP-CGI query string parameter vulnerability
Exploitation and post exploitation
Vulnerability analysis of HFS 2.3
Exploitation and post exploitation
Maintaining access
Clearing tracks
Revising the approach
Summary
Chapter 14: Reinventing Metasploit
Ruby - the heart of Metasploit
Creating your first Ruby program
Interacting with the Ruby shell
Defining methods in the shell
Variables and data types in Ruby
Working with strings
Concatenating strings
The substring function
The split function
Numbers and conversions in Ruby
Conversions in Ruby
Ranges in Ruby
Arrays in Ruby
Methods in Ruby
Decision-making operators
Loops in Ruby
Regular expressions
Wrapping up with Ruby basics
Developing custom modules
Building a module in a nutshell
The architecture of the Metasploit framework
Understanding the file structure
The libraries layout
Understanding the existing modules
The format of a Metasploit module
Disassembling existing HTTP server scanner module
Libraries and the function
Writing out a custom FTP scanner module
Libraries and the function
Using msftidy
Writing out a custom SSH authentication brute forcer
Rephrasing the equation
Writing a drive disabler post exploitation module
Writing a credential harvester post exploitation module
Breakthrough meterpreter scripting
Essentials of meterpreter scripting
Pivoting the target network
Setting up persistent access
API calls and mixins
Fabricating custom meterpreter scripts
Working with RailGun
Interactive Ruby shell basics
Understanding RailGun and its scripting
Manipulating Windows API calls
Fabricating sophisticated RailGun scripts
Summary
Chapter 15: The Exploit Formulation Process
The absolute basics of exploitation
The basics
The architecture
System organization basics
Registers
Exploiting stack-based buffer overflows with Metasploit
Crashing the vulnerable application
Building the exploit base
Calculating the offset
Using the pattern_create tool
Using the pattern_offset tool
Finding the JMP ESP address
Using Immunity Debugger to find executable modules
Using msfbinscan
Stuffing the space
Relevance of NOPs
Determining bad characters
Determining space limitations
Writing the Metasploit exploit module
Exploiting SEH-based buffer overflows with Metasploit
Building the exploit base
Calculating the offset
Using pattern_create tool
Using pattern_offset tool
Finding the POP/POP/RET address
The Mona script
Using msfbinscan
Writing the Metasploit SEH exploit module
Using NASM shell for writing assembly instructions
Bypassing DEP in Metasploit modules
Using msfrop to find ROP gadgets
Using Mona to create ROP chains
Writing the Metasploit exploit module for DEP bypass
Other protection mechanisms
Summary
Chapter 16: Porting Exploits
Importing a stack-based buffer overflow exploit
Gathering the essentials
Generating a Metasploit module
Exploiting the target application with Metasploit
Implementing a check method for exploits in Metasploit
Importing web-based RCE into Metasploit
Gathering the essentials
Grasping the important web functions
The essentials of the GET/POST method
Importing an HTTP exploit into Metasploit
Importing TCP server/ browser-based exploits into Metasploit
Gathering the essentials
Generating the Metasploit module
Summary
Chapter 17: Testing Services with Metasploit
The fundamentals of SCADA
The fundamentals of ICS and its components
The significance of ICS-SCADA
Analyzing security in SCADA systems
Fundamentals of testing SCADA
SCADA-based exploits
Securing SCADA
Implementing secure SCADA
Restricting networks
Database exploitation
SQL server
Fingerprinting SQL server with Nmap
Scanning with Metasploit modules
Brute forcing passwords
Locating/capturing server passwords
Browsing SQL server
Post-exploiting/executing system commands
Reloading the xp_cmdshell functionality
Running SQL-based queries
Testing VOIP services
VOIP fundamentals
An introduction to PBX
Types of VOIP services
Self-hosted network
Hosted services
SIP service providers
Fingerprinting VOIP services
Scanning VOIP services
Spoofing a VOIP call
Exploiting VOIP
About the vulnerability
Exploiting the application
Summary
Chapter 18: Virtual Test Grounds and Staging
Performing a penetration test with integrated Metasploit services
Interaction with the employees and end users
Gathering intelligence
Example environment under test
Vulnerability scanning with OpenVAS using Metasploit
Modeling the threat areas
Gaining access to the target
Vulnerability scanning with Nessus
Maintaining access and covering tracks
Managing a penetration test with Faraday
Summary
Chapter 19: Client-side Exploitation
Exploiting browsers for fun and profit
The browser autopwn attack
The technology behind a browser autopwn attack
Attacking browsers with Metasploit browser autopwn
Compromising the clients of a website
Injecting malicious web scripts
Hacking the users of a website
Conjunction with DNS spoofing
Tricking victims with DNS hijacking
Metasploit and Arduino - the deadly combination
File format-based exploitation
PDF-based exploits
Word-based exploits
Compromising Linux clients with Metasploit
Attacking Android with Metasploit
Summary
Chapter 20: Metasploit Extended
The basics of post exploitation with Metasploit
Basic post exploitation commands
The help menu
Background command
Machine ID and UUID command
Reading from a channel
Getting the username and process information
Getting system information
Networking commands
File operation commands
Desktop commands
Screenshots and camera enumeration
Additional post exploitation modules
Gathering wireless SSIDs with Metasploit
Gathering Wi-Fi passwords with Metasploit
Getting applications list
Gathering skype passwords
Gathering USB history
Searching files with Metasploit
Wiping logs from target with clearev command
Advanced extended features of Metasploit
Privilege escalation using Metasploit
Finding passwords in clear text using mimikatz
Sniffing traffic with Metasploit
Host file injection with Metasploit
Phishing window login passwords
Summary
Chapter 21: Speeding up Penetration Testing
The loadpath command
Pacing up development using reload, edit and reload_all commands
Automating Social-Engineering Toolkit
Summary
Chapter 22: Visualizing with Armitage
The fundamentals of Armitage
Getting started
Touring the user interface
Managing the workspace
Scanning networks and host management
Modeling out vulnerabilities
Finding the match
Exploitation with Armitage
Post-exploitation with Armitage
Attacking on the client side with Armitage
Scripting Armitage
The fundamentals of Cortana
Controlling Metasploit
Post-exploitation with Cortana
Building a custom menu in Cortana
Working with interfaces
Summary
Further reading
Chapter 23: Module 3
Metasploit Bootcamp
Chapter 24: Getting Started with Metasploit
The fundamentals of Metasploit
Metasploit Framework console and commands
Benefits of using Metasploit
Penetration testing with Metasploit
Assumptions and testing setup
Phase-I: footprinting and scanning
Phase-II: gaining access to the target
Phase-III: maintaining access / post-exploitation / covering tracks
Summary and exercises
Chapter 25: Identifying and Scanning Targets
Working with FTP servers using Metasploit
Scanning FTP services
Modifying scanner modules for fun and profit
Scanning MSSQL servers with Metasploit
Using the mssql_ping module
Brute-forcing MSSQL passwords
Scanning SNMP services with Metasploit
Scanning NetBIOS services with Metasploit
Scanning HTTP services with Metasploit
Scanning HTTPS/SSL with Metasploit
Summary and exercises
Chapter 26: Exploitation and Gaining Access
Setting up the practice environment
Exploiting applications with Metasploit
Using db_nmap in Metasploit
Exploiting Desktop Central 9 with Metasploit
Testing the security of a GlassFish web server with Metasploit
Exploiting FTP services with Metasploit
Converting exploits to Metasploit
Gathering the essentials
Generating a Metasploit module
Exploiting the target application with Metasploit
Summary and exercises
Chapter 27: Post-Exploitation with Metasploit
Extended post-exploitation with Metasploit
Advanced post-exploitation with Metasploit
Migrating to safer processes
Obtaining system privileges
Changing access, modification, and creation time with timestomp
Obtaining password hashes using hashdump
Metasploit and privilege escalation
Escalating privileges on Windows Server 2008
Privilege escalation on Linux with Metasploit
Gaining persistent access with Metasploit
Gaining persistent access on Windows-based systems
Gaining persistent access on Linux systems
Summary
Chapter 28: Testing Services with Metasploit
Testing MySQL with Metasploit
Using Metasploit's mysql_version module
Brute-forcing MySQL with Metasploit
Finding MySQL users with Metasploit
Dumping the MySQL schema with Metasploit
Using file enumeration in MySQL using Metasploit
Checking for writable directories
Enumerating MySQL with Metasploit
Running MySQL commands through Metasploit
Gaining system access through MySQL
Summary and exercises
Chapter 29: Fast-Paced Exploitation with Metasploit
Using pushm and popm commands
Making use of resource scripts
Using AutoRunScript in Metasploit
Using the multiscript module in the AutoRunScript option
Global variables in Metasploit
Wrapping up and generating manual reports
The format of the report
The executive summary
Methodology/network admin-level report
Additional sections
Summary and preparation for real-world scenarios
Chapter 30: Exploiting Real-World Challenges with Metasploit
Scenario 1: Mirror environment
Understanding the environment
Fingerprinting the target with DB_NMAP
Gaining access to vulnerable web applications
Migrating from a PHP meterpreter to a Windows meterpreter
Pivoting to internal networks
Scanning internal networks through a meterpreter pivot
Using the socks server module in Metasploit
Dumping passwords in clear text
Sniffing a network with Metasploit
Summary of the attack
Scenario 2: You can't see my meterpreter
Using shellcode for fun and profit
Encrypting the shellcode
Creating a decoder executable
Further roadmap and summary
Bibliography
Thanks page
About Packt Publishing
Writing for Packt
Index

Systemvoraussetzungen

Als PDF speichern Als Link merken