Home Page Icon
Home Page
Table of Contents for
Web Penetration Testing with Kali Linux
Close
Web Penetration Testing with Kali Linux
by Aamir Lakhani, Joseph Muniz
Web Penetration Testing with Kali Linux
Web Penetration Testing with Kali Linux
Table of Contents
Web Penetration Testing with Kali Linux
Credits
About the Authors
About the Reviewers
www.PacktPub.com
Support files, eBooks, discount offers and more
Why Subscribe?
Free Access for Packt account holders
Preface
What this book covers
What you need for this book
Who this book is for
Conventions
Reader feedback
Customer support
Errata
Piracy
Questions
1. Penetration Testing and Setup
Web application Penetration Testing concepts
Penetration Testing methodology
Calculating risk
Kali Penetration Testing concepts
Step 1 – Reconnaissance
Step 2 – Target evaluation
Step 3 – Exploitation
Step 4 – Privilege Escalation
Step 5 – maintaining a foothold
Introducing Kali Linux
Kali system setup
Running Kali Linux from external media
Installing Kali Linux
Kali Linux and VM image first run
Kali toolset overview
Summary
2. Reconnaissance
Reconnaissance objectives
Initial research
Company website
Web history sources
Regional Internet Registries (RIRs)
Electronic Data Gathering, Analysis, and Retrieval (EDGAR)
Social media resources
Trust
Job postings
Location
Shodan
Google hacking
Google Hacking Database
Researching networks
HTTrack – clone a website
ICMP Reconnaissance techniques
DNS Reconnaissance techniques
DNS target identification
Maltego – Information Gathering graphs
Nmap
FOCA – website metadata Reconnaissance
Summary
3. Server-side Attacks
Vulnerability assessment
Webshag
Skipfish
ProxyStrike
Vega
Owasp-Zap
Websploit
Exploitation
Metasploit
w3af
Exploiting e-mail systems
Brute-force attacks
Hydra
DirBuster
WebSlayer
Cracking passwords
John the Ripper
Man-in-the-middle
SSL strip
Starting the attack – redirection
Setting up port redirection using Iptables
Summary
4. Client-side Attacks
Social engineering
Social Engineering Toolkit (SET)
Using SET to clone and attack
MitM Proxy
Host scanning
Host scanning with Nessus
Installing Nessus on Kali
Using Nessus
Obtaining and cracking user passwords
Windows passwords
Mounting Windows
Linux passwords
Kali password cracking tools
Johnny
hashcat and oclHashcat
samdump2
chntpw
Ophcrack
Crunch
Other tools available in Kali
Hash-identifier
dictstat
RainbowCrack (rcracki_mt)
findmyhash
phrasendrescher
CmosPwd
creddump
Summary
5. Attacking Authentication
Attacking session management
Clickjacking
Hijacking web session cookies
Web session tools
Firefox plugins
Firesheep – Firefox plugin
Web Developer – Firefox plugin
Greasemonkey – Firefox plugin
Cookie Injector – Firefox plugin
Cookies Manager+ – Firefox plugin
Cookie Cadger
Wireshark
Hamster and Ferret
Man-in-the-middle attack
dsniff and arpspoof
Ettercap
Driftnet
SQL Injection
sqlmap
Cross-site scripting (XSS)
Testing cross-site scripting
XSS cookie stealing / Authentication hijacking
Other tools
urlsnarf
acccheck
hexinject
Patator
DBPwAudit
Summary
6. Web Attacks
Browser Exploitation Framework – BeEF
FoxyProxy – Firefox plugin
BURP Proxy
OWASP – ZAP
SET password harvesting
Fimap
Denial of Services (DoS)
THC-SSL-DOS
Scapy
Slowloris
Low Orbit Ion Cannon
Other tools
DNSCHEF
SniffJoke
Siege
Inundator
TCPReplay
Summary
7. Defensive Countermeasures
Testing your defenses
Baseline security
STIG
Patch management
Password policies
Mirror your environment
HTTrack
Other cloning tools
Man-in-the-middle defense
SSL strip defense
Denial of Service defense
Cookie defense
Clickjacking defense
Digital forensics
Kali Forensics Boot
Filesystem analysis with Kali
dc3dd
Other forensics tools in Kali
chkrootkit
Autopsy
Binwalk
pdf-parser
Foremost
Pasco
Scalpel
bulk_extractor
Summary
8. Penetration Test Executive Report
Compliance
Industry standards
Professional services
Documentation
Report format
Cover page
Confidentiality statement
Document control
Timeline
Executive summary
Methodology
Detailed testing procedures
Summary of findings
Vulnerabilities
Network considerations and recommendations
Appendices
Glossary
Statement of Work (SOW)
External Penetration Testing
Additional SOW material
Kali reporting tools
Dradis
KeepNote
Maltego CaseFile
MagicTree
CutyCapt
Sample reports
Summary
Index
Search in book...
Toggle Font Controls
Playlists
Add To
Create new playlist
Name your new playlist
Playlist description (optional)
Cancel
Create playlist
Sign In
Email address
Password
Forgot Password?
Create account
Login
or
Continue with Facebook
Continue with Google
Sign Up
Full Name
Email address
Confirm Email Address
Password
Login
Create account
or
Continue with Facebook
Continue with Google
Prev
Previous Chapter
Table of Contents
Next
Next Chapter
Web Penetration Testing with Kali Linux
Web Penetration Testing with Kali Linux
Add Highlight
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click
here
login for view all page.
Day Mode
Cloud Mode
Night Mode
Reset