Web Penetration Testing with Kali Linux

Table of Contents

Web Penetration Testing with Kali Linux

Credits

About the Authors

About the Reviewers

www.PacktPub.com

Support files, eBooks, discount offers and more

Why Subscribe?

Free Access for Packt account holders

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Errata

Piracy

Questions

1. Penetration Testing and Setup

Web application Penetration Testing concepts

Penetration Testing methodology

Calculating risk

Kali Penetration Testing concepts

Step 1 – Reconnaissance

Step 2 – Target evaluation

Step 3 – Exploitation

Step 4 – Privilege Escalation

Step 5 – maintaining a foothold

Introducing Kali Linux

Kali system setup

Running Kali Linux from external media

Installing Kali Linux

Kali Linux and VM image first run

Kali toolset overview

Summary

2. Reconnaissance

Reconnaissance objectives

Initial research

Company website

Web history sources

Regional Internet Registries (RIRs)

Electronic Data Gathering, Analysis, and Retrieval (EDGAR)

Social media resources

Trust

Job postings

Location

Shodan

Google hacking

Google Hacking Database

Researching networks

HTTrack – clone a website

ICMP Reconnaissance techniques

DNS Reconnaissance techniques

DNS target identification

Maltego – Information Gathering graphs

Nmap

FOCA – website metadata Reconnaissance

Summary

3. Server-side Attacks

Vulnerability assessment

Webshag

Skipfish

ProxyStrike

Vega

Owasp-Zap

Websploit

Exploitation

Metasploit

w3af

Exploiting e-mail systems

Brute-force attacks

Hydra

DirBuster

WebSlayer

Cracking passwords

John the Ripper

Man-in-the-middle

SSL strip

Starting the attack – redirection

Setting up port redirection using Iptables

Summary

4. Client-side Attacks

Social engineering

Social Engineering Toolkit (SET)

Using SET to clone and attack

MitM Proxy

Host scanning

Host scanning with Nessus

Installing Nessus on Kali

Using Nessus

Obtaining and cracking user passwords

Windows passwords

Mounting Windows

Linux passwords

Kali password cracking tools

Johnny

hashcat and oclHashcat

samdump2

chntpw

Ophcrack

Crunch

Other tools available in Kali

Hash-identifier

dictstat

RainbowCrack (rcracki_mt)

findmyhash

phrasendrescher

CmosPwd

creddump

Summary

5. Attacking Authentication

Attacking session management

Clickjacking

Hijacking web session cookies

Web session tools

Firefox plugins

Firesheep – Firefox plugin

Web Developer – Firefox plugin

Greasemonkey – Firefox plugin

Cookie Injector – Firefox plugin

Cookies Manager+ – Firefox plugin

Cookie Cadger

Wireshark

Hamster and Ferret

Man-in-the-middle attack

dsniff and arpspoof

Ettercap

Driftnet

SQL Injection

sqlmap

Cross-site scripting (XSS)

Testing cross-site scripting

XSS cookie stealing / Authentication hijacking

Other tools

urlsnarf

acccheck

hexinject

Patator

DBPwAudit

Summary

6. Web Attacks

Browser Exploitation Framework – BeEF

FoxyProxy – Firefox plugin

BURP Proxy

OWASP – ZAP

SET password harvesting

Fimap

Denial of Services (DoS)

THC-SSL-DOS

Scapy

Slowloris

Low Orbit Ion Cannon

Other tools

DNSCHEF

SniffJoke

Siege

Inundator

TCPReplay

Summary

7. Defensive Countermeasures

Testing your defenses

Baseline security

STIG

Patch management

Password policies

Mirror your environment

HTTrack

Other cloning tools

Man-in-the-middle defense

SSL strip defense

Denial of Service defense

Cookie defense

Clickjacking defense

Digital forensics

Kali Forensics Boot

Filesystem analysis with Kali

dc3dd

Other forensics tools in Kali

chkrootkit

Autopsy

Binwalk

pdf-parser

Foremost

Pasco

Scalpel

bulk_extractor

Summary

8. Penetration Test Executive Report

Compliance

Industry standards

Professional services

Documentation

Report format

Cover page

Confidentiality statement

Document control

Timeline

Executive summary

Methodology

Detailed testing procedures

Summary of findings

Vulnerabilities

Network considerations and recommendations

Appendices

Glossary

Statement of Work (SOW)

External Penetration Testing

Additional SOW material

Kali reporting tools

Dradis

KeepNote

Maltego CaseFile

MagicTree

CutyCapt

Sample reports

Summary

Index

Web Penetration Testing with Kali Linux

Web Penetration Testing with Kali Linux

Copyright © 2013 Packt Publishing

All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.

Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the authors, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book.

Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.

First published: September 2013

Production Reference: 1180913

Published by Packt Publishing Ltd.

Livery Place

35 Livery Street

Birmingham B3 2PB, UK.

ISBN 978-1-78216-316-9

www.packtpub.com

Cover Image by Karl Moore (<karl.moore@ukonline.co.uk>)

Credits

Authors

Joseph Muniz

Aamir Lakhani

Reviewers

Adrian Hayter

Danang Heriyadi

Tajinder Singh Kalsi

Brian Sak

Kunal Sehgal

Nitin.K. Sookun (Ish)

Acquisition Editor

Vinay Argekar

Lead Technical Editor

Amey Varangaonkar

Technical Editors

Pooja Arondekar

Sampreshita Maheshwari

Menza Mathew

Project Coordinator

Anugya Khurana

Proofreaders

Christopher Smith

Clyde Jenkins

Indexer

Monica Ajmera Mehta

Graphics

Ronak Dhruv

Production Coordinator

Aditi Gajjar

Cover Work

Aditi Gajjar

About the Authors

Joseph Muniz is a technical solutions architect and security researcher. He started his career in software development and later managed networks as a contracted technical resource. Joseph moved into consulting and found a passion for security while meeting with a variety of customers. He has been involved with the design and implementation of multiple projects ranging from Fortune 500 corporations to large federal networks.

Joseph runs TheSecurityBlogger.com website, a popular resources regarding security and product implementation. You can also find Joseph speaking at live events as well as involved with other publications. Recent events include speaker for Social Media Deception at the 2013 ASIS International conference, speaker for Eliminate Network Blind Spots with Data Center Security webinar, speaker for Making Bring Your Own Device (BYOD) Work at the Government Solutions Forum, Washington DC, and an article on Compromising Passwords in PenTest Magazine - Backtrack Compendium, July 2013.

Outside of work, he can be found behind turntables scratching classic vinyl or on the soccer pitch hacking away at the local club teams.

This book could not have been done without the support of my charming wife Ning and creative inspirations from my daughter Raylin. I also must credit my passion for learning to my brother Alex, who raised me along with my loving parents Irene and Ray. And I would like to give a final thank you to all of my friends, family, and colleagues who have supported me over the years.

Aamir Lakhani is a leading Cyber Security and Cyber Counterintelligence architect. He is responsible for providing IT security solutions to major commercial and federal enterprise organizations.

Lakhani leads projects that implement security postures for Fortune 500 companies, the US Department of Defense, major healthcare providers, educational institutions, and financial and media organizations. Lakhani has designed offensive counter defense measures for defense and intelligence agencies, and has assisted organizations in defending themselves from active strike back attacks perpetrated by underground cyber groups. Lakhani is considered an industry leader in support of detailed architectural engagements and projects on topics related to cyber defense, mobile application threats, malware, and Advanced Persistent Threat (APT) research, and Dark Security. Lakhani is the author and contributor of several books, and has appeared on National Public Radio as an expert on Cyber Security.

Writing under the pseudonym Dr. Chaos, Lakhani also operates the DrChaos.com blog. In their recent list of 46 Federal Technology Experts to Follow on Twitter, Forbes magazine described Aamir Lakhani as a blogger, infosec specialist, superhero..., and all around good guy.

I would like to dedicate this book to my parents, Mahmood and Nasreen, and sisters, Noureen and Zahra. Thank you for always encouraging the little hacker in me. I could not have done this without your support. Thank you mom and dad for your sacrifices. I would also additionally like to thank my friends and colleagues for your countless encouragement and mentorship. I am truly blessed to be working with the smartest and most dedicated people in the world.

About the Reviewers

Adrian Hayter is a penetration tester with over 10 years of experience developing and breaking into web applications. He holds an M.Sc. degree in Information Security and a B.Sc. degree in Computer Science from Royal Holloway, University of London.

Danang Heriyadi is an Indonesian computer security researcher specialized in reverse engineering and software exploitation with more than five years hands on experience.

He is currently working at Hatsecure as an Instructor for Advanced Exploit and ShellCode Development. As a researcher, he loves to share IT Security knowledge in his blog at FuzzerByte (http://www.fuzzerbyte.com).

I would like to thank my parents for giving me life, without them, I wouldn't be here today, my girlfriend for supporting me every day with smile and love, my friends, whom I can't describe one-by-one.

Tajinder Singh Kalsi is the co-founder and Chief Technical Evangelist at Virscent Technologies Pvt Ltd with more than six years of working experience in the field of IT. He commenced his career with WIPRO as a Technical Associate, and later became an IT Consultant cum Trainer. As of now, he conducts seminars in colleges all across India, on topics, such as information security, Android application development, website development, and cloud computing, and has covered more than 100 colleges and nearly 8500 plus students till now. Apart from training, he also maintains a blog (www.virscent.com/blog), which pounds into various hacking tricks. Catch him on facebook at—www.facebook.com/tajinder.kalsi.tj or follow his website—www.tajinderkalsi.com.

I would specially like to thank Krunal Rajawadha (Author Relationship Executive at Packt Publishing) for coming across me through my blog and offering me this opportunity. I would also like to thank my family and close friends for supporting me while I was working on this project.

Brian Sak, CCIE #14441, is currently a Technical Solutions Architect at Cisco Systems, where he is engaged in solutions development and helps Cisco partners build and improve their consulting services. Prior to Cisco, Brian performed security consulting and assessment services for large financial institutions, US government agencies, and enterprises in the Fortune 500. He has nearly 20 years of industry experience with the majority of that spent in Information Security. In addition to numerous technical security and industry certifications, Brian has a Master's degree in Information Security and Assurance, and is a contributor to The Center for Internet Security and other security-focused books and publications.

Kunal Sehgal (KunSeh.com) got into the IT Security industry after completing the Cyberspace Security course from Georgian College (Canada), and has been associated with financial organizations since. This has not only given him experience at a place where security is crucial, but has also provided him with valuable expertise in the field.

Currently, he heads is heading IT Security operations, for the APAC Region of one of the largest European banks. Overall, he has about 10 years of experience in diverse functions ranging from vulnerability assessment, to security governance and from risk assessment to security monitoring. He holds a number of certifications to his name, including Backtrack's very own OSCP, and others, such as TCNA, CISM, CCSK, Security+, Cisco Router Security, ISO 27001 LA, ITIL.

Nitin Sookun (MBCS) is a passionate computer geek residing in the heart of Indian ocean on the beautiful island of Mauritius. He started his computing career as an entrepreneur and founded Indra Co. Ltd. In the quest for more challenge, he handed management of the business over to his family and joined Linkbynet Indian Ocean Ltd as a Unix/Linux System Engineer. He is currently an engineer at Orange Business Services.

Nitin has been an openSUSE Advocate since 2009 and spends his free time evangelizing Linux and FOSS. He is an active member of various user groups and open source projects, among them openSUSE Project, MATE Desktop Project, Free Software Foundation, Linux User Group of Mauritius, and the Mauritius Software Craftsmanship Community.

He enjoys scripting in Bash, Perl, and Python, and usually publishes his work on his blog. His latest work Project Evil Genius is a script adapted to port/install Penetration Testing tools on openSUSE. His tutorials are often translated to various languages and shared within the open source community. Nitin is a free thinker and believes in sharing knowledge. He enjoys socializing with professionals from various fields.

www.PacktPub.com

Support files, eBooks, discount offers and more

You might want to visit www.PacktPub.com for support files and downloads related to your book.

Did you know that Packt offers eBook versions of every book published, with PDF and ePub files available? You can upgrade to the eBook version at www.PacktPub.com and as a print book customer, you are entitled to a discount on the eBook copy. Get in touch with us at for more details.

At www.PacktPub.com, you can also read a collection of free technical articles, sign up for a range of free newsletters and receive exclusive discounts and offers on Packt books and eBooks.

http://PacktLib.PacktPub.com

Do you need instant solutions to your IT questions? PacktLib is Packt's online digital book library. Here, you can access, read and search across Packt's entire library of books.

Why Subscribe?

Fully searchable across every book published by Packt

Copy and paste, print and bookmark content

On demand and accessible via web browser

Free Access for Packt account holders

If you have an account with Packt at www.PacktPub.com, you can use this to access PacktLib today and view nine entirely free books. Simply use your login credentials for immediate access.

Preface

Kali is a Debian Linux based Penetration Testing arsenal used by security professionals (and others) to perform security assessments. Kali offers a range of toolsets customized for identifying and exploiting vulnerabilities in systems. This book is written leveraging tools available in Kali Linux released March 13th, 2013 as well as other open source applications.

Web Penetration Testing with Kali Linux is designed to be a guide for professional Penetration Testers looking to include Kali in a web application penetration engagement. Our goal is to identify the best Kali tool(s) for a specific assignment, provide details on using the application(s), and offer examples of what information could be obtained for reporting purposes based on expert field experience. Kali has various programs and utilities; however, this book will focus on the strongest tool(s) for a specific task at the time of publishing.

The chapters in this book are divided into tasks used in real world web application Penetration Testing. Chapter 1, Penetration Testing and Setup, provides an overview of Penetration Testing basic concepts, professional service strategies, background on the Kali Linux environment, and setting up Kali for topics presented in this book. Chapters 2-6, cover various web application Penetration Testing concepts including configuration and reporting examples designed to highlight if topics covered can accomplish your desired objective.

Chapter 7, Defensive Countermeasures, serves as a remediation source on systems vulnerable to attacks presented in previous chapters. Chapter 8, Penetration Test Executive Report, offers reporting best practices and samples that can serve as templates for building executive level reports. The purpose of designing the book in this fashion is to give the reader a guide for engaging a web application penetration with the best possible tool(s) available in Kali, offer steps to remediate a vulnerability and provide how data captured could be presented in a professional manner.

What this book covers

Chapter 1, Penetration Testing and Setup, covers fundamentals of building a professional Penetration Testing practice. Topics include differentiating a Penetration Test from other services, methodology overview, and targeting web applications. This chapter also provides steps used to set up a Kali Linux environment for tasks covered in this book.

Chapter 2, Reconnaissance, provides various ways to gather information about a target. Topics include highlighting popular free tools available on the Internet as well as Information Gathering utilities available in Kali Linux.

Chapter 3, Server Side Attacks, focuses on identifying and exploiting vulnerabilities in web servers and applications. Tools covered are available in Kali or other open source utilities.

Chapter 4, Client Side Attacks, targets hosts systems. Topics include social engineering, exploiting host system vulnerabilities, and attacking passwords, as they are the most common means to secure host systems.

Chapter 5, Attacking Authentication, looks at how users and devices authenticate to web applications. Topics include targeting the process of managing authentication sessions, compromising how data is stored on host systems, and man-in-the-middle attack techniques. This chapter also briefly touches on SQL and Cross-Site Scripting attacks.

Chapter 6, Web Attacks, explores how to take advantage of web servers and compromise web applications using exploits such as browser exploitation, proxy attacks, and password harvesting. This chapter also covers methods to interrupt services using denial of service techniques.

Chapter 7, Defensive Countermeasures, provides best practices for hardening your web applications and servers. Topics include security baselines, patch management, password policies, and defending against attack methods covered in previous chapters. This chapter also includes a focused forensics section, as it is important to properly investigate a compromised asset to avoid additional negative impact.

Chapter 8, Penetration Test Executive Report, covers best practices for developing professional post Penetration Testing service reports. Topics include an overview of methods to add value to your deliverable, document formatting, and templates that can be used to build professional reports.

What you need for this book

Readers should have a basic understanding of web applications, networking concepts, and Penetration Testing methodology. This book will include detailed examples of how to execute an attack using tools offered in Kali Linux as well as other open source applications. It is not required but beneficial to have experience using previous versions of Backtrack or similar programs.

Hardware requirements for building a lab environment and setting up the Kali Linux arsenal are covered in Chapter 1, Penetration Testing and Setup.

Who this book is for

The target audience for this book are professional Penetration Testers or others looking to maximize Kali Linux for a web server or application Penetration Testing exercise. If you are looking to identify how to perform a Penetration Test against web applications and present findings to a customer is a professional manner then this book is for you.

Conventions

In this book, you will find a number of styles of text that distinguish between different kinds of information. Here are some examples of these styles, and an explanation of their meaning.

Code words in text are shown as follows: For example, you can call the profile My First Scan or anything else you would like.

A block of code is set as follows:

Any command-line input or output is written as follows:

sqlmap -u http://www.drchaous.com/article.php?id=5  -T tablesnamehere -U test --dump -U test –dump

New terms and important words are shown in bold. Words that you see on the screen, in menus or dialog boxes for example, appear in the text like this: Soon as we click on the Execute button, we receive a SQL injection.

Note

Warnings or important notes appear in a box like this.

Tip

Tips and tricks appear like this.

Reader feedback

Feedback from our readers is always welcome. Let us know what you think about this book—what you liked or may have disliked. Reader feedback is important for us to develop titles that you really get the most out of.

To send us general feedback, simply send an e-mail to <feedback@packtpub.com>, and mention the book title via the subject of your message.

If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, see our author guide on www.packtpub.com/authors.

Customer support

Now that you are the proud owner of a Packt book, we have a number of things to help you to get the most from your purchase.

Errata

Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you find a mistake in one of our books—maybe a mistake in the text or the code—we would be grateful if you would report this to us. By doing so, you can save other readers from frustration and help us improve subsequent versions of this book. If you find any errata, please report them by visiting http://www.packtpub.com/submit-errata, selecting your book, clicking on the errata submission form link, and entering the details of your errata. Once your errata are verified, your submission will be accepted and the errata will be uploaded on our website, or added to any list of existing errata, under the Errata section of that title. Any existing errata can be viewed by selecting your title