Index

A

access control vestibule, 156

account takeover, 318–319

active reconnaissance, 59, 93. See also enumeration

eavesdropping, 125

group enumeration, 104–105

host discovery scan, 99–101

host enumeration, 102

network share enumeration, 105–107

packet inspection, 125

port scan, 93–94

service enumeration, 119

TCP connect scan, 95–96

TCP FIN scan, 98–99

tools

enum4linux, 437–442

Nmap, 433–435

Zenmap, 436

UDP scan, 96–98

user enumeration, 102–104

web page/web application enumeration, 116–118

AFL (American Fuzzy Lop), 503

Airecrack-ng, 223, 224, 226

Aireplay-ng, 220–221, 223

airmon-ng command, 218–219

Airodump-ng, 219–220, 226

amplification DDoS attacks, 210–211

anonymous FTP login verification, 198–199

anti-malware, 151

APIs, 295. See also REST (representational state transfer) APIs

documentation, 296

securing, 297

testing, 297

vulnerabilities, 296

application-based penetration testing, 10

arithmetic operators, 404

ARP cache poisoning, 204–205

arrays, 404

Art of Hacking Github repository, 452

authenticated scans, 127–129

authentication. See also Kerberos

Kerberos, 200–202

multifactor, 386

authentication-based exploits, 320

default credentials, 278

Kerberos vulnerabilities and, 278

redirect attacks, 277–278

session hijacking, 273–277

authorization-based vulnerabilities

Insecure Direct Object Reference, 280

parameter pollution, 279–280

AWS (Amazon Web Services), 208

Customer Support Policy for Penetration Testing, 10–11

Shared Responsibility Model, 10–11

B

backdoors, persistence and, 355

background checks, 48

badge cloning, 157

in-band SQL injection, 262

Base64 encoding, 484–485

Bash shell, 406

BeEF (Browser Exploitation Framework), 167–169, 493–494

BGP (Border Gateway Protocol), route manipulation attacks, 207

bilateral NDA (non-disclosure agreement), 38

bind shells, 268, 349

connecting to, 349

creating, 348–349

BlackArch Linux, 411–413

BLE (Bluetooth Low Energy), 232, 329

blind SQL injection, 262

BloodHound, 364

blue team, 26

bluejacking, 231–232

bluesnarfing, 232

Boolean operators, 404

botnets, 208, 321

breaches, company reputation and, 72–73

brute-force attacks, 474

Patator and, 476–477

bug bounty, 92

bug bounty programs, 12

building your own lab, 15–16

for web applications, 255–256

Burp Suite, 296, 299, 300, 327

Bursztein, Elie, 155

business logic flaws, 256–257

in mobile devices, 326–327

C

C2 (command and control systems), 352–354

Cain, 469

call spoofing tools, 169–170

CAPEC (Common Attack Pattern Enumeration and Classification), 139

CAs (certificate authorities), 71

CCPA (California Consumer Privacy Act), 36

Censys, 432

CERT, 137

certificate pinning, 326

certificate revocation, 70

certificate transparency, 71

CeWL, 474–475

CFTC (Commodity Futures Trading Commission), 29

CIS Benchmarks, 335

classes, 406

clickjacking, 289

cloud computing

account takeover, 318–319

attacks against misconfigured assets, 320–321

credential harvesting, 311–313

deployment models, 310

malware injection attacks, 323

metadata service attacks, 319

models, 310

NIST SP 800–145, 309

penetration testing and, 10–11

service providers, 68–69, 368–371

side-channel attacks, 323

tools, 505

command(s). See also nmap; tools

airmon-ng, 218–219

injection, 271–272

PowerShell, 359

SMTP, 192–193

VRFY, 192–193

Common Weakness Enumeration (CWE) ID 840, 256–257

communication, 390–391

reasons for, 391–392

triggers, 391

compliance scans, 132–133

compliance-based assessments, 26–27. See also regulations

compromised systems. See also maintaining persistence

communicating with, 357

maintaining persistence, 345

conditionals, 404

confidentiality, 36–37, 49

container(s), 321, 334–335

images, scanning for vulnerabilities, 335–336

contracts, 38–39, 43

cookie(s), 253–254. See also persistence

manipulation attacks, 291–292

session hijacking and, 275–277

XSS (cross-site scripting), mitigations, 286–287

corporate policies, 36

covering your tracks, 367–368

steganography, 368–371

credential harvesting, 231. See also Social-Engineer Toolkit (SET)

in the cloud, 311–313

tools

Cain, 469

Hashcat, 469–471

Hydra, 471–473

John the Ripper, 464–465, 466–467, 468

Johnny, 469

Medusa, 474

Ncrack, 474

RainbowCrack, 473–474

credit cards, 32–33. See also PCI DSS (Payment Card Industry Data Security Standard):

crt.sh, 71

CSPs (cloud service providers), 10–11

CSRC (Computer Security Resource Center), 7

CSRF (cross-site request forgery) attacks, 288–289

CSV (comma-separated value) files, 404

custom daemons and processes, persistence and, 355

CVE (Common Vulnerabilities and Exposures), 139

CVSS (Common Vulnerability Scoring System), 139–140

reports and, 380–381

CWE (Common Weakness Enumeration), 139

cybersecurity governance program, 49

D

D₂0 attacks, 322

data exfiltration, 355

data structures, 404

DDoS attacks, 209–210, 321–322

deauthentication attacks, 220–221

decompilation, disassembly, and debugging tools

edb Debugger, 497–498

GDB (GNU Project Debugger), 494–496

IDA, 498–500

Immunity Debugger, 498

Objdump, 500–501

OllyDbg, 496–497

Windows Debugger, 496

default credentials, 278

defense-in-depth, 8

DHCP starvation attacks, 215–216

dictionaries, 404

Dig tool, 63, 414

DirBuster, 463

direct DoS attacks, 208–209

directory traversal exploits, 290–291

disclaimers, 39

discovery scans, 129–130

dissociation attacks, 218–221

DNS

cache poisoning, 187–189

lookups, 60–62

in the cloud, 68–69

Dig tool, 63

tunneling, 484, 485–486

DNSSEC (Domain Name System Security Extensions), 189

Docker images, scanning tools, 335–336

DOM (Document Object Model), 284

DoS attacks, 321–322

D20 attacks, 322

resource exhaustion and, 322

double-tagging VLAN hopping attack, 214–215

downgrade attacks, 206–207

Dradis, 383–384

DRM (digital rights management), 317

dumpster diving, 156

E

eavesdropping, 125

edb Debugger, 497–498

elicitation, 149

email phishing, 152. See also SMS phishing

spear phishing, 152–153

vishing, 153–154

whaling, 153

emergency contact card, 45

Empire, 202, 478

post-exploitation activities, 362–363

encryption, 483, 484

law enforcement and, 483

security products and, 483–484

web proxies and, 484

enum4linux tool, 109–116, 437–442

enumeration, 80–82. See also Scapy

group, 104–105

host, 102

network share, 105–107

packet crafting and, 119–124

service, 119

user, 102–104

using enum4linux tool, 109–116

using smbclient, 116

web page/web application, 116–118

error handling, exploiting, 294

EternalBlue exploit, 186–187

ethical hacking, 3, 7, 8

evasion, tools, 478

Proxychains, 483

Tor, 482–483

Veil, 478–482

evil twin attacks, 217–218

Exif (Exchangeable Image File Format), 76–77

ExifTool, 77–80, 416–418

exploitation frameworks

BeEF (Browser Exploitation Framework), 493–494

Metasploit, 486–487

initializing the database, 487–488

launching an exploit, 488–489

Meterpreter, 490–493

training, 489

exploit-db.com, 406

exploits, 7. See also post-exploitation activities

chaining, 233

FTP, 197–198

anonymous login verification, 198–199

mitigating, 199

scanning an FTP server, 198

launching, 488–489

SMB, 182

EternalBlue, 185–187

searchsploit command and, 182–185

SMTP

discovering, 195–197

open relay and, 191–192

SNMP, 189–191

F

false positives, 392

FedRAMP (Federal Risk and Authorization Management Program), 27

feroxbuster, 301

ffuf, 246

file metadata, 76–80

final preparation, 513–515

customizing your exams, 515–516

suggested plan for final review, 517

updating your exams, 516–517

financial regulations, 28

GLBA (Gramm-Leach-Bliley Act), 28–29

NY DFS Cybersecurity Regulation, 29–30

Findsecbugs, 502

FOCA (Fingerprinting Organization with Collected Archives), 416

forensics, tools, 501–502

FTC (Federal Trade Commission), 29

FTP exploits, 197–198

anonymous login verification, 198–199

mitigating, 199

scanning an FTP server, 198

full scans, 130–131

functions, 405–406

fuzzers

AFL (American Fuzzy Lop), 503

Mutiny Fuzzing Framework, 503

Peach, 503

G

GDB (GNU Project Debugger), 494–496

GDPR (General Data Protection Regulation), 27, 36, 415

GHDB (Google Hacking Database), 80–82

Github repository, 19, 406, 453

Art of Hacking, 452

GLBA (Gramm-Leach-Bliley Act), 28–29

gobuster, 300

golden ticket attack, 202–203, 278

Google hacking, 80–82

GraphQL, 42

group enumeration, 104–105

H

h4cker.org

digital certificate, 71

information gathering on, 419–421

obtaining MX record, 63–64

whois information, 64–65

h8mail, 73–76

hacking, 7

ethical, 3, 7, 8

Google, 80–82

unethical, 3

hackingisnotacrime.org, 7

hacktivists, 9

theHarvester, 418–421

Hashcat, 469–471

healthcare regulations, 30–31

HIPAA Security Rule, 30–31

HIPAA (Health Insurance Portability and Accountability Act of 1996):, 27

HIPAA Security Rule, 30–31

host discovery scan, 99–101

host enumeration, 102

HTTP (Hypertext Transfer Protocol), 244, 245, 251–252, 296

cookie(s), 253–254

manipulation attacks, 291–292

session hijacking and, 275–277

parameter pollution, 279–280

proxies, 245

requests, 245–249

responses, 245–247, 249

session hijacking and, 273–277

session ID, 253–254

URLs, 249–250

web sessions, 252–255

Hydra, 471–473

hyperjacking, 333

I

Iaas (infrastructure as a service), 310

IAM (identity and access management), 320

ICANN (Internet Corporation for Assigned Names and Numbers), 415

ICMP rate limiting, 97

IDA, 498–500

Immunity Debugger, 498

impersonation, 149–150

pharming, 150–151

information gathering

from file metadata, 76–80

OSINT (open-source intelligence) gathering, 84

password dumps and, 73–76

from public source code repositories, 83

Recon-ng, 84

help command, 85–86

installing, 88

marketplace search, 86–88

modules, 88–89, 91

setting the source domain and running a query, 89–90

starting, 84–85

Shodan and, 91–92

Wayback Machine and, 82–83

Insecure Direct Object Reference vulnerabilities, 280

insider threats, 9

installing, Recon-ng, 88

interference attacks, 221

interrogation, 149

IoT (Internet of Things), 328

protocols, 328–329

special considerations, 329–330

vulnerabilities, 330

data storage system, 330–331

management interface, 332

IPMI (Intelligent Platform Management Interface), 332

ISSAF (Information Systems Security Assessment Framework), 15

IV (initialization vector) attacks, 222

J

jailbreaking, 317

JavaScript, 408–409

John the Ripper, 464

cracking passwords, 466–467

creating users in Linux, 465

supported cyphertext formats, 464–465

users’ password hashes, 466

wordlists, 468

Johnny, 469

JPCERT (Japan Computer Emergency Response Team), 138

JSON (JavaScript Object Notation), 250–251, 404

K

Kali Linux, 410, 468

KARMA attacks, 229–230

Kennedy, D., 11

Kerberoasting, 204

Kerberos

delegation, 203, 278

golden ticket attack, 202–203, 278

silver ticket attacks, 203

vulnerabilities, 278

key management, 34–35

known-environment testing, 12–13, 47–48

KRACK attacks, 228–229

L

lab environment

building, 15–16

recovery method and, 19

requirements and guidelines, 17–18

tools, 18–19

virtualized, 19

VMs (virtual machines), 17

lateral movement, 355–356

law enforcement, encryption and, 483

Layer 2 security, 205–206

LDAP injection attacks, 272–273

least privilege concept, 326

legitimate utilities

BloodHound, 364

Empire, 363

PowerShell, 359–360

Sysinternals, 364–366

WinRM (Windows Remote Management), 366

WMI (Windows Management Instrumentation), 364

LFI (local file inclusion) vulnerability, 292

Linux

distributions, 3, 16, 255–256, 409

BlackArch Linux, 411–413

Kali Linux, 410, 468

Parrot OS, 411

tcpdump utility, 246–247

lists, 404

living-off-the-land, 358

LLMNR (Link-Local Multicast Name Resolution), 182. See also network attacks

logic constructs

arithmetic operators, 404

Boolean operators, 404

conditionals, 404

loops, 403

string operators, 404

loops, 403

Luhn algorithm, 33

M

MAC auth bypass, 212–213

MAC spoofing, 205

maintaining persistence

bind shells, 349

connecting to, 349

creating, 348–349

C2 (command and control systems), 352–354

custom daemons, processes, and additional backdoors, 355

new user accounts and, 355

reverse shells, 346–348

connecting to, 350

creating, 349–350

executing commands via, 350

scheduled jobs and tasks, 354–355

malicious attackers, 8

hacktivists, 9

insider threats, 9

organized crime, 8–9

state-sponsored attackers, 9

Maltego, 423–425

malvertising, 151

metadata service attacks, 319

Metasploit, 182, 486–487

EternalBlue exploit and, 186–187

initializing the database, 487–488

launching an exploit, 488–489

Meterpreter, 490–495

commands, 351–352

RDP post-exploitation module, 358

Ruby and, 407

scripts, 493

training, 489

Meterpreter, 490–495

commands, 351–352

methodology(ies)

Information Systems Security Assessment Framework (ISSAF), 15

MITRE ATT&CK, 13

NIST Special Publication (SP) 800–115, 14

Open Source Security Testing Methodology Manual (OSSTMM), 14

Penetration Testing Execution Standard (PTES), 15

Web Security Testing Guide, 13–14

methods of influence, 170

MFA (multifactor authentication), 386

MIB (Management Information Base), 189

Mimikatz, 200, 475–476

MITRE ATT&CK, 13

mobile devices

business logic flaws, 326–327

certificate pinning, 326

insecure storage and, 325

passcode vulnerabilities and biometrics integration, 325–326

reverse engineering, 324–325

sandbox analysis, 325

security-testing tools, 327

spamming, 325

vulnerable components, 326

modules, Recon-ng, 88–89, 91, 429–430

MSA (master service agreement), 37

multilateral NDA (non-disclosure agreement), 38

Mutiny Fuzzing Framework, 503

N

NAC (Network Access Control) bypass, 211–213

Ncrack, 474

NDA (non-disclosure agreement), 37–38

Nessus, 446

NetBIOS, 180–181. See also network attacks

Netcat, 268, 347–348

commands, 351

creating a bind shell, 348–349

creating a reverse shell, 349–350

network attacks, 180. See also wireless network attacks

amplification DDoS, 210–211

deauthentication, 220–221

DHCP starvation, 215–216

direct DoS, 208–209

DNS cache poisoning, 187–189

downgrade, 206–207

FTP exploits, 197–198

anonymous login verification, 198–199

mitigating, 199

scanning an FTP server, 198

golden ticket, 202–203

Kerberoasting, 204

Kerberos delegation and, 203

LLMNR poisoning, 182

MAC auth bypass and, 212–213

NAC (Network Access Control) bypass and, 211–213

pass-the-hash, 199–200

on-path, 204

ARP cache poisoning, 204–205

Layer 2, 193

Layer 3, 205

MAC spoofing, 205

reflected DoS, 209–210

route manipulation, 207

segmentation and, 387–388

silver ticket, 203

SMB exploits, 182

EternalBlue, 185–187

searchsploit command and, 182–185

SMTP exploits, 191

discovering, 195–197

SMTP open relay, 191–192

smtp-user enum command, 193–195

SNMP exploits, 189–191

VLAN hopping and, 213–215

network infrastructure tests, 10

network share enumeration, 105–107

new users, persistence and, 355

Nexpose, 446

Nikto, 117–118, 453

scanning a full subnet, 456

scanning a web application, 454–455

NIST (National Institute of Standards and Technology), 138

Special Publication (SP) 800–115, 14

Special Publication (SP) 800–145, 309

nmap, 62, 433–435

host discovery scan, 99–101

-sc option, 107–109

scanning an FTP server, 198

SYN scan, 93–94

TCP connect scan, 95–96

TCP FIN scan, 98–99

timing options, 101

UDP scan, 96–98

note taking, 383

NSE (Nmap Scripting Engine) scripts, 107–109

SNMP exploits and, 190

nslookup command, 188, 413–414

NTLM (New Technology LAN Manager), pass-the-hash attacks and, 199–200

NY DFS Cybersecurity Regulation, 29–30

O

OAS (OpenAPI Specification), 324

Objdump, 500–501

OllyDbg, 496–497

OpenVAS, 443–446

organized crime, 8–9

OSINT (open-source intelligence) gathering, 84

OSSTMM (Open Source Security Testing Methodology Manual), 14

out-of-band SQL injection, 262, 267–268

OWASP (Open Web Application Security Project), 10, 256, 297

Authentication Cheat Sheet, 253, 274

SQLi mitigations, 271

Top 10, 255

Web Security Testing Guide, 13–14

ZAP (Zed Attack Proxy), 280, 300, 456–457

P

PaaS (platform as a service), 310

packet crafting, 119–124. See also Scapy

packet inspection, 125

Packetforge-ng tool, 230–231

parameter pollution, 279–280

Parrot OS, 411

partially known environment test, 13

passive reconnaissance, 59, 63–64. See also information gathering

cryptographic flaws and, 70–72

DNS lookups, 60–62, 63

enumeration, 80–82

file metadata and, 76–80

identification of technical and administrative contacts, 64–68

password dumps and, 73–76

public source code repositories and, 83

Shodan and, 91–92

social media scraping, 69–70

strategic search engine analysis, 80–82

tools

Censys, 432

Dig, 414

ExifTool, 416–418

FOCA (Fingerprinting Organization with Collected Archives), 416

Maltego, 423–425

Nslookup, 413–414

Recon-ng, 425–430, 431

Shodan, 421–423

theHarvester, 418–421

whois, 415–416

pass-the-hash attacks, 199–200, 356

password

attacks, pass-the-hash, 199–200

cracking, John the Ripper and, 466–467

dumps, 73–76

spraying, 233

Patator, 476–477

on-path attacks, 204, 277

ARP cache poisoning, 204–205

Layer 2, 193

Layer 3, 205

MAC spoofing, 205

PCI DSS (Payment Card Industry Data Security Standard):, 27

account data, 32–33

key terms, 31–32

Luhn algorithm and, 33

penetration testing, 3, 8

application-based, 10

bug bounty programs and, 12

in the cloud, 10–11

communication

reasons for, 391–392

triggers, 391

communication and, 390–391

corporate policies and, 36

environmental considerations, 10–11, 12–13

known-environment testing, 12–13, 47–48

local restrictions, 35–36

methodologies, 9

Information Systems Security Assessment Framework (ISSAF), 15

MITRE ATT&CK, 13

NIST Special Publication (SP) 800–115, 14

Open Source Security Testing Methodology Manual (OSSTMM), 14

Penetration Testing Execution Standard (PTES), 15

Web Security Testing Guide, 13–14

need for, 8

network infrastructure tests, 10

partially known environment, 13

physical security and, 11

planning and preparation phase, 26

post-engagement cleanup, 393–394

post-report activities, 394

scope creep, 9

SOW (statement of work), 35

unknown-environment testing, 12, 47

Perl, 408

permission to attack, 7, 41

persistence, 345, 351–352. See also maintaining persistence

bind shells, 348–349

connecting to, 349

creating, 348–349

C2 systems and, 352–354

custom daemons, processes, and additional backdoors, 355

new user accounts and, 355

reverse shells, 346–348

connecting to, 350

credential harvesting, 349–350

executing commands via, 350

scheduled jobs and tasks, 354–355

tools, 477–478

pharming, 150–151

phishing attacks, 152

SMS, 154

spear, 152–153

vishing, 153–154

whaling, 153

physical attacks

badge cloning, 157

dumpster diving, 156

shoulder surfing, 156

tailgating, 156

physical security, penetration testing and, 11

Piessens, F., 228

piggybacking, 156

pivot attacks, 155

point-in-time assessment, 46

policies, corporate, 36

POODLE (Padding Oracle on Downgraded Legacy Encryption) vulnerability, 206–207

post-engagement cleanup, 393–394

post-exploitation activities. See also maintaining persistence; persistence

covering your tracks, 367–371

Empire and, 362–363

lateral movement, 355–356

legitimate utilities and, 358

BloodHound, 364

PowerShell, 359–360

Sysinternals, 364–366

WinRM (Windows Remote Management), 366

WMI (Windows Management Instrumentation), 364

PowerSploit and, 360–362

privilege escalation, 317–318, 366–367

scanning, 356–357

PowerShell, 408

for post-exploitation tasks, 359–360

PowerSploit, 360–362, 477

pre-engagement

answering client questions, 45–46

background checks, 48

contract and, 38–39

disclaimers, 39

permission to attack, 41

reporting of breaches/criminal activity, 48

rules of engagement document, 40–41

scoping, 41–43, 49

time management and, 44

understanding your target audience, 44–45

validating the scope of engagement, 43–46

preferred network list attacks, 221

pretexting, 149–150

privacy. See also confidentiality, GDPR (General Data Protection Regulation), 27, 36, 415

privilege escalation, 317–318, 366–367

procedures, 405

programming, 403. See also programming languages

classes, 406

data structures, 404

functions, 405–406

libraries, 405

logic constructs, 403

arithmetic operators, 404

Boolean operators, 404

conditionals, 404

loops, 403

string operators, 404

PowerShell and, 408

procedures, 405

programming languages

Bash, 406

JavaScript, 408–409

Perl, 408

Python, 407

Ruby, 407

Proxychains, 483

PsExec, 365–366

PTES (Penetration Testing Execution Standard), 15

public source code repositories, 83

Pupy, 182

Python, 407

Q

Qualys, 447

queries, Recon-ng, 89–90

query throttling, 135

R

race conditions, 294–295

RainbowCrack, 473–474

reconnaissance, 55, 59, 60. See also active reconnaissance; passive reconnaissance

active, 59

passive, 59, 63–64

cryptographic flaws and, 70–72

DNS lookups, 60–62, 63

enumeration, 80–82

file metadata and, 76–80

identification of technical and administrative contacts, 64–68

password dumps and, 73–76

public source code repositories and, 83

social media scraping, 69–70

strategic search engine analysis, 80–82

passive reconnaissance, Shodan and, 91–92

Recon-ng, 84, 425–428

help command, 85–86

installing, 88

keys list command, 428–429

marketplace search, 86–88

modules, 88–89, 91, 429–430

querying Shodan, 431

setting the source domain and running a query, 89–90

starting, 84–85

red team, 26

redirect attacks, 277–278

reflected DoS attacks, 209–210

reflected XSS attacks, 282–283

regulations, 26–27

data isolation and, 34

FedRAMP (Federal Risk and Authorization Management Program), 27

financial, 28

GLBA (Gramm-Leach-Bliley Act), 28–29

NY DFS Cybersecurity Regulation, 29–30

GDPR (General Data Protection Regulation), 27

healthcare, 30–31

HIPAA (Health Insurance Portability and Accountability Act of 1996):, 27

HIPAA Security Rule, 30–31

key management and, 34–35

password management and, 34

PCI DSS (Payment Card Industry Data Security Standard):, 27

account data, 32–33

key terms, 31–32

Luhn algorithm and, 33

Wassenaar Arrangement, 28

report(s)

audience, 379

common themes/root causes, 384–385

CVSS (Common Vulnerability Scoring System), 380–381

distribution of, 382–383

examples of, 380

explaining post-report delivery activities, 393

goal reprioritization and presentation of findings, 392–393

note taking and, 383

recommendations

administrative controls, 388–389

operational controls, 389–390

physical controls, 390

technical controls, 385–388

sections, 380, 382

resource exhaustion, 321–322

REST (representational state transfer) APIs, 42, 250–251, 295

reverse engineering, 324–325

reverse shells, 268, 346–348

connecting to, 350

creating, 349–350

executing commands via, 350

RFI (remote file inclusion) vulnerabilities, 292–293

RFID (radio-frequency identification) attacks, 232–233

risk management, 50

risk tolerance, 49–50

rogue access points, 216–217

route manipulation attacks, 207

Ruby, 407

rules of engagement document, 40–41

S

SaaS (software as a service), 310

SAM (Security Accounts Manager), pass-the-hash attacks and, 199–200

sandbox analysis, 325

scanning, 356–357

Scapy, 119–124

explore() function, 123–124

Is() function, 121

listing available DNS packet fields, 122

listing the TCP Layer 4 fields, 121–122

sending a TCP SYN packet, 124

scheduled jobs and tasks, persistence and, 354–355

scope creep, 9, 43

scoping, 41–43, 49

allow/deny list, 48

cybersecurity governance program, 49

scripts, Metasploit, 493. See also NSE (Nmap Scripting Engine) scripts

SDKs (software development kits), 42, 324

searchsploit command, 182–185, 322

finding known SMTP exploits, 195–197

SEC (Securities and Exchange Commission), 29

secrets management, 387

sensitive data, 355

service enumeration, 119

session ID, 274

SET (Social-Engineer Toolkit), 11, 157–166

Shodan, 91–92

querying, 431

shoulder surfing, 156

side-channel attacks, 323

signal jamming, 221

silver ticket attacks, 203

SLA (service-level agreement), 36

SMB exploits, 182

EternalBlue, 185–187

searchsploit command and, 182–185

smbclient, 116

SMS phishing, 154

SMTP, 191

finding known exploits, 195–197

open relay, 191–192

smtp-user enum command, 193–195

VRFY command, 193

SNMP (Simple Network Management Protocol) exploits, 189–191

snmp-check tool, 190–191

SOAP (Simple Object Access Protocol), 41, 295

social engineering, 11, 151. See also physical attacks

credential harvesting, 231

in the cloud, 311–313

elicitation, 149

email phishing, 152

spear phishing, 152–153

vishing, 153–154

whaling, 153

impersonation, 149–150

interrogation, 149

methods of influence, 170

pretexting, 149–150

SMS phishing, 154

USB drop key attacks, 154–155

watering hole attacks, 155

social media scraping, 69–70

Social-Engineer Toolkit (SET), credential harvesting, 315–316

entering the credential harvester’s IP address, 315

harvesting the user credentials, 317

selecting a predefined web template, 314

selecting the attack method, 313–314

selecting website attack vectors, 313

software assurance, tools

Findsecbugs, 502

SonarQube, 503

SpotBugs, 502

SonarQube, 503

SOW (statement of work), 35, 37

spamming, 325

spear phishing, 152–153

SpotBugs, 502

SQL (Structured Query Language)

database fingerprinting, 264–265

statements, 258, 259–260

SQLi (SQL injection), 258, 261–262

in-band, 262

blind, 262

Boolean, 260, 266–267

exploiting a vulnerability, 262–263

mitigations, 270

out-of-band, 262, 267–268

stacked queries, 268–269

surveying a stored procedure, 269–270

time-delay technique, 269

UNION exploitation technique, 265–266

using numeric-based user input, 261

using string-based user input, 260–261

SQLmap, 270, 447–448

exploiting and SQL injection vulnerability, 448–450

retrieving sensitive information from a database, 450–452

state-sponsored attackers, 9

stealth scans, 132

steganography, 368–371

stored procedures, 269–270

stored XSS attacks, 283–285

STP (Spanning-Tree Protocol), on-path attacks and, 193

strategic search engine analysis, 80–82

stress testing, 211

string operators, 404

Swagger, 42, 323–324

SYN flood attacks, 208

Sysinternals, 364–366

T

tailgating, 156

TCP connect scan, 95–96

TCP FIN scan, 98–99

tcpdump utility, 246–247

tesla.com, whois information, 65–68

threat actors, 8

hacktivists, 9

insider threats, 9

organized crime, 8–9

state-sponsored attackers, 9

time management, 44

tools. See also passive reconnaissance, tools

Airecrack-ng, 223, 224, 226

Aireplay-ng, 220–221, 223

Airmon-ng, 218–219

Airodump-ng, 219–220, 226

BeEF (Browser Exploitation Framework), 167–169, 493–494

call spoofing, 169–170

Censys, 432

CeWL, 474–475

cloud, 505

credential harvesting

Cain, 469

Hashcat, 469–471

Hydra, 471–473

John the Ripper, 464–465, 466–467, 468

Johnny, 469

Medusa, 474

Ncrack, 474

RainbowCrack, 473–474

crt.sh, 71

Dig, 63, 414

DNS tunneling, 485–486

Empire, 202, 478

enum4linux, 109–116, 437–442

for evasion, 478

Proxychains, 483

Tor, 482–483

Veil, 478–482

ExifTool, 416–418

FOCA (Fingerprinting Organization with Collected Archives), 416

for forensics, 501–502

fuzzers

AFL (American Fuzzy Lop), 503

Mutiny Fuzzing Framework, 503

Peach, 503

h8mail, 73–76

legitimate utilities, 358

BloodHound, 364

Empire, 363

PowerShell, 359–360

Sysinternals, 364–366

WinRM (Windows Remote Management), 366

WMI (Windows Management Instrumentation), 364

Maltego, 423–425

Metasploit, 182, 486–487

EternalBlue exploit and, 186–187

initializing the database, 487–488

launching an exploit, 488–489

Meterpreter, 490–495

scripts, 493

training, 489

Mimikatz, 200, 475–476

Netcat, 347–348

commands, 351

creating a reverse shell, 349–350

nmap, 93–94, 433–435

host discovery scan, 99–101

scanning an FTP server, 198

TCP connect scan, 95–96

TCP FIN scan, 98–99

timing options, 101

UDP scan, 96–98

nslookup command, 188, 413–414

Packetforge-ng, 230–231

Patator, 476–477

for persistence, 477–478

Pupy, 182

Recon-ng, 84, 425–428

help command, 85–86

installing, 88

keys list command, 428–429

marketplace search, 86–88

modules, 88–89, 91, 429–430

querying Shodan, 431

setting the source domain and running a query, 89–90

starting, 84–85

SDKs (software development kits), 324

searchsploit command, 182–185

finding known SMTP exploits, 195–197

SET (Social-Engineer Toolkit), 157–166

Shodan, 421–423

smbclient, 116

SMTP commands, 192–193

smtp-user enum command, 193–195

snmp-check, 190–191

SQLmap, 270

exploiting and SQL injection vulnerability, 448–450

retrieving sensitive information from a database, 450–452

steganography, 504–505

steghide, 368–371

Swagger, 323–324

tcpdump, 246–247

for testing mobile device security, 327

theHarvester, 418–421

vulnerability scanners, 125–126

analyzing scan results, 136–137

authenticated scans, 127–129

bandwidth limitations, 135

compliance scans, 132–133

DirBuster, 463

discovery scans, 129–130

fragile systems and, 135–136

full scans, 130–131

Nessus, 446

network topology and, 134

Nikto, 453, 454–455, 456

nontraditional assets, 135–136

OpenVAS, 443–446

OWASP ZAP (Zed Attack Proxy), 456–457

protocols and, 134

Qualys, 447

query throttling, 135

SQLmap, 447–448

stealth scans, 132

timing of scans, 134

unauthenticated scans, 127

w3af, 458–463

whois, 3, 64–68, 69, 415–416

wireless hacking, 504

Wireshark, 247

Zenmap, 436

Tor, 482–483

training, Metasploit, 489

trees, 404

true negatives, 392

tunneling, DNS, 484, 485–486

typosquatting, 321

U

UDP scan, 96–98

unauthenticated scans, 127

unethical hacking, 3

unilateral NDA (non-disclosure agreement), 38

United States, Computer Fraud and Abuse Act, 35

unknown-environment testing, 12, 47

URLs, 249–250

API parameters and, 296

session ID, 253–254

USB drop key attacks, 154–155

US-CERT (U.S. Computer Emergency Readiness Team), 137

user enumeration, 102–104

V

Vanhoef, M., 228

Veil, 478–482

vishing, 153–154

VLAN (virtual LAN), 213–214

double-tagging hopping attack, 214–215

hopping, 214

VMs (virtual machines), 10–11, 16, 17, 332–333

escape vulnerabilities, 333

hyperjacking, 333

repository vulnerabilities, 334

vulnerabilities, 7. See also exploits; post-exploitation activities

of containerized workloads, 334–336

CVSS (Common Vulnerability Scoring System), 139–140

dealing with, 140–141

IoT (Internet of Things), 330

data storage system, 330–331

management interface, 332

in LLMNR, 182

POODLE (Padding Oracle on Downgraded Legacy Encryption), 206–207

VM (virtual machine), 333–334

vulnerability scanners, 125–126

analyzing scan results, 136–137

authenticated scans, 127–129

bandwidth limitations, 135

compliance scans, 132–133

DirBuster, 463

discovery scans, 129–130

fragile systems and, 135–136

full scans, 130–131

Nessus, 446

network topology and, 134

Nexpose, 446

Nikto, 453

scanning a full subnet, 456

scanning a web application, 454–455

nontraditional assets, 135–136

OpenVAS, 443–446

OWASP ZAP (Zed Attack Proxy), 456–457

protocols and, 134

Qualys, 447

query throttling, 135

SQLmap, 447–448

exploiting and SQL injection vulnerability, 448–450

retrieving sensitive information from a database, 450–452

stealth scans, 132

timing of scans, 134

unauthenticated scans, 127

w3af, 458

help menu, 458–459

launching an SQL injection audit, 462–463

list audit command, 460–462

plugins help menu, 459–460

W

w3af, 458

help menu, 458–459

launching an SQL injection audit, 462–463

list audit command, 460–462

plugins help menu, 459–460

w3schools.com, 259, 403, 406

WADL (Web Application Description Language), 42

war driving, 222

Wassenaar Arrangement, 28

watering hole attacks, 155

Wayback Machine, 82–83

web applications. See also SQLi (SQL injection)

APIs, 295

documentation, 296

securing, 297

testing, 297

vulnerabilities, 296

building a lab, 255–256

business logic flaws, 256–257

clickjacking, 289

command injection, 271–272

CSRF (cross-site request forgery) attacks, 288–289

exploiting directory traversal vulnerabilities, 290–291

exploiting insecure code practices

comments in source code, 293–294

error handling and, 294

hard-coded credentials, 294

hidden elements, 298

lack of code signing, 298

race conditions, 294–295

unprotected APIs, 295–297

hacking tools, 298–299

Insecure Direct Object Reference vulnerabilities, 280

LFI (local file inclusion) vulnerability, 292

RFI (remote file inclusion) vulnerabilities, 292–293

sessions, 252–255

tools, 299–301

web proxies, 298–299

XSS (cross-site scripting)

attacks, 282–285

evasion techniques, 285–286

vulnerabilities, 281

web development frameworks, 254

web page/web application enumeration, 116–118

web proxies, 298–299

Web Security Testing Guide, 13–14

websites

BlackArch Linux, 411

exploit-db.com, 406

FedRAMP, 27

GDPR, 27

Github repository, 19, 406, 453

hackingisnotacrime.org, 7

PCI DSS, 27

resources to learn JavaScript, 408–409

resources to learn Perl, 408

resources to learn PowerShell, 408

resources to learn Python, 407

resources to learn Ruby, 407

w3schools.com, 259, 403, 406

WEP attacks, 222–224

whaling, 153

whois tool, 64–68, 69, 415–416

Windows Debugger, 496

WinRM (Windows Remote Management), 366

wireless hacking tools, 504

wireless network attacks, 216

BLE (Bluetooth Low Energy), 232

bluejacking, 231–232

bluesnarfing, 232

dissociation, 218–221

evil twin, 217–218

fragmentation, 230–231

IV (initialization vector), 222

KARMA, 229–230

KRACK, 228–229

preferred network list, 221

RFID (radio-frequency identification), 232–233

rogue access points, 216–217

signal jamming, 221

SSID and, 218

war driving, 222

against WEP, 222–224

WPA, 224–228

WPA3 vulnerabilities and, 229

WPS (Wi-Fi Protected Setup) PIN, 229

Wireshark, 247

WMI (Windows Management Instrumentation), 364

wordlists, 301, 474–475

workgroups, 181–182

WPA attacks, 224–228

WPS (Wi-Fi Protected Setup) PIN attacks, 229

WSDL (Web Services Description Language), 42

X

XSS (cross-site scripting)

attacks, 282–285

reflected, 282–283

stored, 283–285

evasion techniques, 285–286

mitigations, 286–287

vulnerabilities, 281

Y-Z

ZAP (Zed Attack Proxy), 456–457

Zenmap, 436