The first penetration testing section that we are going to cover is network penetration testing. Most of the systems and computers that we are going to try to gain access to will be connected to a network, whether it's a device, a computer, a phone, or simply any device connected to the internet. Therefore, you need to learn how devices interact with each other in a network, as well as how networks work, before you can advance into different types of penetration testing.
Network penetration testing can be divided into four main sections:
- Pre-connection
- Gaining access
- Post-connection
- Detection and security
Both the first section (pre-connection) and the second section (gaining access) are geared toward wireless networks. Usually, with a wireless network, there is protection (encryption), and we need to use a key to connect to the network. There are WEP, WPA, and WPA2 encryptions, and we are going to learn how to break them. We will also learn the kinds of attacks we can do without being connected to a network, and what we can do using a wireless card.
The reason we don't mention wired connections in the first two sections is because, in order to gain access to a wired network, all you need is an Ethernet cable. Some wired networks use security and some use MAC filtering, and we're going to discuss that later—changing the MAC address is very easy.
Section 3 is where the fun starts—we will learn how to sniff packets from the network, how to control connections, how to sniff passwords, usernames, and cookies, how to inject them into your browser, and how to launch attacks that will allow us to gain full access to any device on a network, bet it wired or wireless. Section 3 will apply to both wired and wireless, which will work exactly the same, with no need for a change in configuration. In the last section, we will discuss how to secure yourself against attacks, and how to detect them.