Penetration Testing Tools in Kali Linux - Revision history

Ikramer at 16:54, 5 February 2020

2020-02-05T16:54:29Z

← Older revision		Revision as of 16:54, 5 February 2020
Line 216:		Line 216:


	[[Category:~~Documentation~~]]		[[Category:Basic]]

Zaskrak: /* Penetration Tests */

2020-01-31T21:26:23Z

Penetration Tests

← Older revision		Revision as of 21:26, 31 January 2020
Line 116:		Line 116:
	'''Password:''' msfadmin		'''Password:''' msfadmin

	== Penetration Tests ==		== Penetration Tests on Kali Linux ==

	This section covers a demonstration of simple Penetration Tests that can be performed with the Kali Linux platform. The steps and used commands are explained in detail. However, these tests are selected only for demonstration purposes and do not display a proper Penetration Testing Framework. The tests are done with the use of Kali Linux and the Metasploitable 2 virtual machine. Additional test cases that are not included in the attached seminar paper can be found on the [https://metasploit.help.rapid7.com/docs/quick-start-guide Rapid7 Metasploit website].		This section covers a demonstration of simple Penetration Tests that can be performed with the Kali Linux platform. The steps and used commands are explained in detail. However, these tests are selected only for demonstration purposes and do not display a proper Penetration Testing Framework. The tests are done with the use of Kali Linux and the Metasploitable 2 virtual machine. Additional test cases that are not included in the attached seminar paper can be found on the [https://metasploit.help.rapid7.com/docs/quick-start-guide Rapid7 Metasploit website].

			=== Information Gathering ===
	~~; '''~~Information Gathering~~'''~~
	Before starting a Penetration Test, the following steps must be performed to gather information about all host machines:		Before starting a Penetration Test, the following steps must be performed to gather information about all host machines:
	<ol>		<ol>
Line 154:		Line 153:
	</ol>		</ol>

			=== Vulnerability Exploitation ===
	; Vulnerability Exploitation

	: One of many known vulnerabilities of the Metasploitable 2 server is a weakness of the ''VSFTPD'' service that has a backdoor, which allows gaining root shell access. This subsection demonstrates an exploitation of this service to show the concept of the <code>msfconsole</code> tool. The MSFConsole is a Metasploit exploitation framework that is also used in Kali Linux. It is a centralized front-end interface for Penetration Testing. To access the framework, use the command <code>msfconsole</code> in the terminal or navigate through the Kali Linux environment. Afterward, all available commands can be listed using the <code>help</code> command.		: One of many known vulnerabilities of the Metasploitable 2 server is a weakness of the ''VSFTPD'' service that has a backdoor, which allows gaining root shell access. This subsection demonstrates an exploitation of this service to show the concept of the <code>msfconsole</code> tool. The MSFConsole is a Metasploit exploitation framework that is also used in Kali Linux. It is a centralized front-end interface for Penetration Testing. To access the framework, use the command <code>msfconsole</code> in the terminal or navigate through the Kali Linux environment. Afterward, all available commands can be listed using the <code>help</code> command.
Line 187:		Line 185:
	: After running these commands, a shell is opened that allows all kinds of manipulation of the target machine. At this point, commands can be performed to extract sensitive information or data to further exploit the target. For instance, passwords can be extracted or modified, configurations can be changed, packets can be rerouted, etc.		: After running these commands, a shell is opened that allows all kinds of manipulation of the target machine. At this point, commands can be performed to extract sensitive information or data to further exploit the target. For instance, passwords can be extracted or modified, configurations can be changed, packets can be rerouted, etc.

			=== Password Cracking with Hydra ===
	; Password Cracking with Hydra

	Hydra is a tool that is located under ''Password Attacks'' → ''Online Attacks'', on Kali Linux. The tool enables brute force attack methods to crack passwords. It is highly suited to attack e-mail systems that are used with ''POP3'' and ''SMTP'' protocols. Before using the Kali Linux tool Hydra, a Pen Tester should gather following information about the target:		Hydra is a tool that is located under ''Password Attacks'' → ''Online Attacks'', on Kali Linux. The tool enables brute force attack methods to crack passwords. It is highly suited to attack e-mail systems that are used with ''POP3'' and ''SMTP'' protocols. Before using the Kali Linux tool Hydra, a Pen Tester should gather following information about the target:

Zaskrak: /* Penetration Tests */

2020-01-31T21:01:36Z

Penetration Tests

← Older revision		Revision as of 21:01, 31 January 2020
Line 173:		Line 173:
	3. Check for additionally required information: '''show options'''		3. Check for additionally required information: '''show options'''

	::[[File:search_vsftpd.png\|~~600px~~\|frameless\|\|]]		::[[File:search_vsftpd.png\|700px\|frameless\|\|]]

	::		::
	4. Assign the Metasploitable 2 VM as the target victim by setting the RHOST parameter to the IP-address of the Metasploitable 2 VM:		4. Assign the Metasploitable 2 VM as the target victim by setting the RHOST parameter to the IP-address of the Metasploitable 2 VM:
	'''set RHOST [IP-address of victim]'''		'''set RHOST [IP-address of victim]'''
	::[[File:set_RHOST.png\|~~600px~~\|frameless\|\|]]		::[[File:set_RHOST.png\|700px\|frameless\|\|]]

	::		::
	5. Run the VSFTPD exploit to gain access to the victim machine: '''run'''		5. Run the VSFTPD exploit to gain access to the victim machine: '''run'''
	::[[File:run_exploit.png\|~~600px~~\|frameless\|\|]]		::[[File:run_exploit.png\|650px\|frameless\|\|]]


	: After running these commands, a shell is opened that allows all kinds of manipulation of the target machine. At this point, commands can be performed to extract sensitive information or data to further exploit the target. For instance, passwords can be extracted or modified, configurations can be changed, packets can be rerouted, etc.		: After running these commands, a shell is opened that allows all kinds of manipulation of the target machine. At this point, commands can be performed to extract sensitive information or data to further exploit the target. For instance, passwords can be extracted or modified, configurations can be changed, packets can be rerouted, etc.
Line 196:		Line 197:
	* Username - by extracting the contents of the target's ''/etc/passwd'' directory		* Username - by extracting the contents of the target's ''/etc/passwd'' directory

	::[[File:hydra1.png\|~~600px~~\|frameless\|\|]]		[[File:hydra1.png\|750px\|frameless\|\|]]


	For a simple demonstration of password cracking in Kali Linux, the command '''<code>hydra -l admin -p password telnet://<target-IP>/</code>''' is used to extract the admin's telnet password. This command can be performed for any other user password and for every service that is provided on the target machine. Detailed descriptions on how to use commands for Hydra properly are given in the manual page of the tool, which can also be accessed with the command <code>hydra -h</code>. Also, plenty of other tools can be used in Kali Linux to extract passwords and sensitive data. To access a list of tools that are provided within the Kali Linux platform, visit [https://tools.kali.org/tools-listing this website].		For a simple demonstration of password cracking in Kali Linux, the command '''<code>hydra -l admin -p password telnet://<target-IP>/</code>''' is used to extract the admin's telnet password. This command can be performed for any other user password and for every service that is provided on the target machine. Detailed descriptions on how to use commands for Hydra properly are given in the manual page of the tool, which can also be accessed with the command <code>hydra -h</code>. Also, plenty of other tools can be used in Kali Linux to extract passwords and sensitive data. To access a list of tools that are provided within the Kali Linux platform, visit [https://tools.kali.org/tools-listing this website].

Zaskrak: /* Penetration Tests */

2020-01-31T20:58:20Z

Penetration Tests

← Older revision		Revision as of 20:58, 31 January 2020
Line 173:		Line 173:
	3. Check for additionally required information: '''show options'''		3. Check for additionally required information: '''show options'''

	::[[File:search_vsftpd.png\|~~500px~~\|frameless\|\|]]		::[[File:search_vsftpd.png\|600px\|frameless\|\|]]

	::		::
	4. Assign the Metasploitable 2 VM as the target victim by setting the RHOST parameter to the IP-address of the Metasploitable 2 VM:		4. Assign the Metasploitable 2 VM as the target victim by setting the RHOST parameter to the IP-address of the Metasploitable 2 VM:
	'''set RHOST [IP-address of victim]'''		'''set RHOST [IP-address of victim]'''
	::[[File:set_RHOST.png\|~~500px~~\|frameless\|\|]]		::[[File:set_RHOST.png\|600px\|frameless\|\|]]

	::		::
	5. Run the VSFTPD exploit to gain access to the victim machine: '''run'''		5. Run the VSFTPD exploit to gain access to the victim machine: '''run'''
	::[[File:run_exploit.png\|~~500px~~\|frameless\|\|]]		::[[File:run_exploit.png\|600px\|frameless\|\|]]

	: After running these commands, a shell is opened that allows all kinds of manipulation of the target machine. At this point, commands can be performed to extract sensitive information or data to further exploit the target. For instance, passwords can be extracted or modified, configurations can be changed, packets can be rerouted, etc.		: After running these commands, a shell is opened that allows all kinds of manipulation of the target machine. At this point, commands can be performed to extract sensitive information or data to further exploit the target. For instance, passwords can be extracted or modified, configurations can be changed, packets can be rerouted, etc.
Line 195:		Line 195:
	* Protocol - also identifiable with Nmap		* Protocol - also identifiable with Nmap
	* Username - by extracting the contents of the target's ''/etc/passwd'' directory		* Username - by extracting the contents of the target's ''/etc/passwd'' directory

			::[[File:hydra1.png\|600px\|frameless\|\|]]

	For a simple demonstration of password cracking in Kali Linux, the command '''<code>hydra -l admin -p password telnet://<target-IP>/</code>''' is used to extract the admin's telnet password. This command can be performed for any other user password and for every service that is provided on the target machine. Detailed descriptions on how to use commands for Hydra properly are given in the manual page of the tool, which can also be accessed with the command <code>hydra -h</code>. Also, plenty of other tools can be used in Kali Linux to extract passwords and sensitive data. To access a list of tools that are provided within the Kali Linux platform, visit [https://tools.kali.org/tools-listing this website].		For a simple demonstration of password cracking in Kali Linux, the command '''<code>hydra -l admin -p password telnet://<target-IP>/</code>''' is used to extract the admin's telnet password. This command can be performed for any other user password and for every service that is provided on the target machine. Detailed descriptions on how to use commands for Hydra properly are given in the manual page of the tool, which can also be accessed with the command <code>hydra -h</code>. Also, plenty of other tools can be used in Kali Linux to extract passwords and sensitive data. To access a list of tools that are provided within the Kali Linux platform, visit [https://tools.kali.org/tools-listing this website].

Zaskrak at 20:55, 31 January 2020

2020-01-31T20:55:48Z

← Older revision		Revision as of 20:55, 31 January 2020
Line 18:		Line 18:
	=== Framework ===		=== Framework ===

	In order to successfully perform a Penetration Test, the formalization and strict compliance of a framework are essential. There are various versions and interpretations of such frameworks for Penetration Tests. However, apart from slight differences, the main steps of these frameworks remain the same, whereas the success of each step is crucial for the outcome of the next one. The following framework represents one version of a Penetration Testing framework, with a more detailed description being given in the attached seminar paper:		In order to successfully perform a Penetration Test, the formalization and strict compliance of a framework are essential. There are various versions and interpretations of such frameworks for Penetration Tests. However, apart from slight differences, the main steps of these frameworks remain the same, whereas the success of each step is crucial for the outcome of the next one. The following framework represents one version of a Penetration Testing framework, with a more detailed description being given in the attached seminar paper.

	[[File:Framework.png\|right\|450px\|thumb\|Penetration Testing Framework]]		[[File:Framework.png\|right\|450px\|thumb\|Penetration Testing Framework]]
Line 39:		Line 39:
	=== Kali Linux ===		=== Kali Linux ===

	Kali Linux is a Linux distribution platform based on Debian Linux and is used for Penetration Testing and analysis of a target system. It is the successor to the platform ''BackTrack'' and was developed by ''Offensive Security'' in 2013. The Kali Linux platform includes over 600 tools for ethical hacking, therefore being one of the most used platforms for Penetration Tests. These tools are grouped in 13 categories, which range from tools for gathering information, password cracking, stress testing a network, and exploiting vulnerabilities. The following table shows some of the most well-known tools that are provided on the Kali Linux platform.		Kali Linux is a Linux distribution platform based on Debian Linux and is used for Penetration Testing and analysis of a target system. It is the successor to the platform ''BackTrack'' and was developed by ''Offensive Security'' in 2013. The Kali Linux platform includes over 600 tools for ethical hacking, therefore being one of the most used platforms for Penetration Tests. These tools are grouped in 13 categories, which range from tools for gathering information and password cracking to stress testing a network and exploiting vulnerabilities. The following table shows some of the most well-known tools that are provided on the Kali Linux platform.

	{\| class="wikitable" style="width: 60%"		{\| class="wikitable" style="width: 60%"
Line 103:		Line 103:

	To legally perform Penetration Testing and to illustrate proper methods and results, a vulnerable server is needed as a target server on the virtual machine. For this purpose,		To legally perform Penetration Testing and to illustrate proper methods and results, a vulnerable server is needed as a target server on the virtual machine. For this purpose,
	the Metasploitable 2 server is used. Metasploitable 2 is an intentionally vulnerable version of an Ubuntu Linux machine and was developed by Rapid7. It was designed for testing purposes and is compatible with several environments.		the Metasploitable 2 server is used. Metasploitable 2 is an intentionally vulnerable version of an Ubuntu Linux machine and was developed by ''Rapid7''. It was designed for testing purposes and is compatible with several environments.


Line 109:		Line 109:

	'''Download, Installation and Configuration:'''		'''Download, Installation and Configuration:'''

	Metasploitable 2 is available on the [https://metasploit.help.rapid7.com/docs/metasploitable-2 Rapid7 website], which also provides documentation for configuring and operating on Metasploitable 2. Select one of the two provided servers to download the needed Metasploitable 2 directory. Then, unzip the directory and open the <code>Metasploitable.vmx</code> file with VMWare. Log in to the server with the following credentials:		Metasploitable 2 is available on the [https://metasploit.help.rapid7.com/docs/metasploitable-2 Rapid7 website], which also provides documentation for configuring and operating on Metasploitable 2. Select one of the two provided servers to download the needed Metasploitable 2 directory. Then, unzip the directory and open the <code>Metasploitable.vmx</code> file with VMWare. Log in to the server with the following credentials:

Line 114:		Line 115:
	'''Username:''' msfadmin		'''Username:''' msfadmin
	'''Password:''' msfadmin		'''Password:''' msfadmin


	== Penetration Tests ==		== Penetration Tests ==
Line 124:		Line 124:
	Before starting a Penetration Test, the following steps must be performed to gather information about all host machines:		Before starting a Penetration Test, the following steps must be performed to gather information about all host machines:
	<ol>		<ol>
	<li>~~'''~~Determine the IP-Addresses~~:''':~~</li>		<b><li> Determine the IP-Addresses</li></b>
	First, the IP addresses of both virtual machines are required to allow further security tests. Therefore, the command <code>ifconfig</code> must be performed on both machines to determine their IP addresses. The following figures show the results of the executed <code>ifconfig</code> command of this particular testing environment. Here, the IP address of the Kali Linux machine is ''192.168.16.137'', whereas the IP address of the Metasploitable 2 machine is ''192.168.16.138''.		First, the IP addresses of both virtual machines are required to allow further security tests. Therefore, the command <code>ifconfig</code> must be performed on both machines to determine their IP addresses. The following figures show the results of the executed <code>ifconfig</code> command of this particular testing environment. Here, the IP address of the Kali Linux machine is ''192.168.16.137'', whereas the IP address of the Metasploitable 2 machine is ''192.168.16.138''.

Line 130:		Line 130:
	\|-		\|-
	\|-		\|-
	\| [[Image:ifconfig_Kali.png\|~~400px~~\|thumb\|IP-Address of the Kali Linux VM]]		\| [[Image:ifconfig_Kali.png\|350px\|thumb\|IP-Address of the Kali Linux VM]]
	\| [[Image:ifconfig_Metasploitable.png\|~~600px~~\|thumb\|IP-Address of the Metasploitable 2 VM]]		\| [[Image:ifconfig_Metasploitable.png\|520px\|thumb\|IP-Address of the Metasploitable 2 VM]]
	\|}		\|}

	<li> ~~'''~~Verify the Connectivity:~~'''~~</li>		<b><li> Verify the Connectivity:</li></b>
	The network connectivity must be set correctly to enable both virtual machines to reach each other. This step is part of the Target Scoping phase of the testing framework and can be performed with the following tools: <code>ping</code>, <code>fping</code>, <code>arpscan</code>, <code>hping3</code>, etc. In this demonstration, the <code>ping <IP-Address></code> command is used to verify the connectivity of both virtual machines, as can be seen in the figures below.		The network connectivity must be set correctly to enable both virtual machines to reach each other. This step is part of the Target Scoping phase of the testing framework and can be performed with the following tools: <code>ping</code>, <code>fping</code>, <code>arpscan</code>, <code>hping3</code>, etc. In this demonstration, the <code>ping <IP-Address></code> command is used to verify the connectivity of both virtual machines, as can be seen in the figures below.

Line 142:		Line 142:
	\|-		\|-
	\| [[Image:ping_Kali.png\|400px\|thumb\|Checking the connectivity to the Metasploitable 2 VM]]		\| [[Image:ping_Kali.png\|400px\|thumb\|Checking the connectivity to the Metasploitable 2 VM]]
	\| [[Image:ping_Metasploitable.png\|~~400px~~\|thumb\|Checking the connectivity to the Kali Linux VM]]		\| [[Image:ping_Metasploitable.png\|440px\|thumb\|Checking the connectivity to the Kali Linux VM]]
	\|}		\|}

	<li> ~~'''~~Find possible Exploits:~~'''~~</li>		<b><li> Find possible Exploits:</li></b>
	Use the command <code>nmap -sV -p0-65535 <IP-Address of Metasploitable 2></code> to gather information on the vulnerable Metasploitable 2 server in order to find possible exploits and select test cases to illustrate Penetration Testing. This command is executed on the attacking server Kali Linux and is used to identify open ports and services that operate on the vulnerable Metasploitable 2 server. The following figure shows the scan report of the <code>nmap</code> command.		Use the command <code>nmap -sV -p0-65535 <IP-Address of Metasploitable 2></code> to gather information on the vulnerable Metasploitable 2 server in order to find possible exploits and select test cases to illustrate Penetration Testing. This command is executed on the attacking server Kali Linux and is used to identify open ports and services that operate on the vulnerable Metasploitable 2 server. The following figure shows the scan report of the <code>nmap</code> command.

Line 189:		Line 189:
	; Password Cracking with Hydra		; Password Cracking with Hydra

	Hydra is a tool that is located under Password Attacks → Online Attacks, on Kali Linux. The tool enables brute force attack methods to crack passwords. It is highly suited to attack e-mail systems that are used with POP3 and SMTP protocols. Before using the Kali Linux tool Hydra, a Pen Tester should gather following information about the target:		Hydra is a tool that is located under ''Password Attacks'' → ''Online Attacks'', on Kali Linux. The tool enables brute force attack methods to crack passwords. It is highly suited to attack e-mail systems that are used with ''POP3'' and ''SMTP'' protocols. Before using the Kali Linux tool Hydra, a Pen Tester should gather following information about the target:

	* The IP-address - for example using the command '''fping -a -g <network-address>/<prefix>''', which scans the whole network for hosts that are reachable.		* The IP-address - for example using the command '''fping -a -g <network-address>/<prefix>''', which scans the whole network for hosts that are reachable.

Zaskrak at 20:34, 31 January 2020

2020-01-31T20:34:11Z

← Older revision		Revision as of 20:34, 31 January 2020
Line 3:		Line 3:
	The security of information and network systems has been gaining relevance for businesses and organizations as well as for public and private facilities. With the increased electronic storage of information on company networks, security must be improved and guaranteed by each organization to protect sensitive data and company secrets. A very effective method to verify the security of a system is to use Penetration Testing, which is also called Pen Testing or ethical hacking. A Pen Test helps to analyze a system to check and verify its security. The main objective is to find the system's vulnerabilities and weaknesses. There are plenty of tools and platforms for Penetration Testing, one specific platform being Kali Linux, which has its own integrated tools for testing, as well as additional tools that can be installed to it.		The security of information and network systems has been gaining relevance for businesses and organizations as well as for public and private facilities. With the increased electronic storage of information on company networks, security must be improved and guaranteed by each organization to protect sensitive data and company secrets. A very effective method to verify the security of a system is to use Penetration Testing, which is also called Pen Testing or ethical hacking. A Pen Test helps to analyze a system to check and verify its security. The main objective is to find the system's vulnerabilities and weaknesses. There are plenty of tools and platforms for Penetration Testing, one specific platform being Kali Linux, which has its own integrated tools for testing, as well as additional tools that can be installed to it.

	This tutorial is based on the seminar paper [[File:Penetration Testing Tools - Kali Linux.pdf]] and serves as an introduction of the Kali Linux platform.		This tutorial is based on the seminar paper [[File:Penetration Testing Tools - Kali Linux.pdf]] and serves as an introduction of Penetration Testing with the Kali Linux platform. The primary focus of this tutorial lies in the practical part of the paper, which outlines an illustrative exploitation of a target server machine using the ''Metasploit Framework'' that is provided within the Kali Linux platform. In addition, a brief description of how to use the password cracker ''Hydra'' is given.


	== Requirements ==		== Requirements ==
Line 12:		Line 11:
	* Server for Penetration Tests: [https://www.kali.org/downloads/ Kali Linux] for VMware 64.Bit		* Server for Penetration Tests: [https://www.kali.org/downloads/ Kali Linux] for VMware 64.Bit
	* Vulnerable Server for Demonstration Purposes: [https://metasploit.help.rapid7.com/docs/metasploitable-2 Metasploitable 2]		* Vulnerable Server for Demonstration Purposes: [https://metasploit.help.rapid7.com/docs/metasploitable-2 Metasploitable 2]


	== Penetration Testing ==		== Penetration Testing ==
Line 34:		Line 32:
	: '''5. Maintaining Access'''		: '''5. Maintaining Access'''
	:: Lastly, a Pen Tester must conceal any proof of the conducted penetration and establish backdoors to maintain access to the target system.		:: Lastly, a Pen Tester must conceal any proof of the conducted penetration and establish backdoors to maintain access to the target system.


	== Setup of the Test Environment ==		== Setup of the Test Environment ==
Line 144:		Line 141:
	\|-		\|-
	\|-		\|-
	\| [[Image:ping_Kali.png\|400px\|thumb\|~~Ping from~~ the ~~Kali Linux~~ VM]]		\| [[Image:ping_Kali.png\|400px\|thumb\|Checking the connectivity to the Metasploitable 2 VM]]
	\| [[Image:ping_Metasploitable.png\|400px\|thumb\|~~Ping from~~ the ~~Metasploitable 2~~ VM]]		\| [[Image:ping_Metasploitable.png\|400px\|thumb\|Checking the connectivity to the Kali Linux VM]]
	\|}		\|}

Line 151:		Line 148:
	Use the command <code>nmap -sV -p0-65535 <IP-Address of Metasploitable 2></code> to gather information on the vulnerable Metasploitable 2 server in order to find possible exploits and select test cases to illustrate Penetration Testing. This command is executed on the attacking server Kali Linux and is used to identify open ports and services that operate on the vulnerable Metasploitable 2 server. The following figure shows the scan report of the <code>nmap</code> command.		Use the command <code>nmap -sV -p0-65535 <IP-Address of Metasploitable 2></code> to gather information on the vulnerable Metasploitable 2 server in order to find possible exploits and select test cases to illustrate Penetration Testing. This command is executed on the attacking server Kali Linux and is used to identify open ports and services that operate on the vulnerable Metasploitable 2 server. The following figure shows the scan report of the <code>nmap</code> command.

	[[File:nmap_scan.png\|left\|500px\|thumb\|\|]]		:[[File:nmap_scan.png\|left\|500px\|thumb\|\|]]
	<br clear=all>		<br clear=all>

Line 189:		Line 186:
	: After running these commands, a shell is opened that allows all kinds of manipulation of the target machine. At this point, commands can be performed to extract sensitive information or data to further exploit the target. For instance, passwords can be extracted or modified, configurations can be changed, packets can be rerouted, etc.		: After running these commands, a shell is opened that allows all kinds of manipulation of the target machine. At this point, commands can be performed to extract sensitive information or data to further exploit the target. For instance, passwords can be extracted or modified, configurations can be changed, packets can be rerouted, etc.

	<~~br clear~~=~~all>~~
			; Password Cracking with Hydra

			Hydra is a tool that is located under Password Attacks → Online Attacks, on Kali Linux. The tool enables brute force attack methods to crack passwords. It is highly suited to attack e-mail systems that are used with POP3 and SMTP protocols. Before using the Kali Linux tool Hydra, a Pen Tester should gather following information about the target:

			* The IP-address - for example using the command '''fping -a -g <network-address>/<prefix>''', which scans the whole network for hosts that are reachable.
			* Open Ports - for instance with the Nmap tool
			* Protocol - also identifiable with Nmap
			* Username - by extracting the contents of the target's ''/etc/passwd'' directory

			For a simple demonstration of password cracking in Kali Linux, the command '''<code>hydra -l admin -p password telnet://<target-IP>/</code>''' is used to extract the admin's telnet password. This command can be performed for any other user password and for every service that is provided on the target machine. Detailed descriptions on how to use commands for Hydra properly are given in the manual page of the tool, which can also be accessed with the command <code>hydra -h</code>. Also, plenty of other tools can be used in Kali Linux to extract passwords and sensitive data. To access a list of tools that are provided within the Kali Linux platform, visit [https://tools.kali.org/tools-listing this website].

			== Used Tools ==

			* Ping
			* Fping
			* Nmap
			* Metasploit msfconsole
			* Hydra

	== References ==		== References ==

Zaskrak at 20:04, 31 January 2020

2020-01-31T20:04:22Z

← Older revision		Revision as of 20:04, 31 January 2020
Line 125:		Line 125:

	; '''Information Gathering'''		; '''Information Gathering'''
	: Before starting a Penetration Test, the following steps must be performed to gather information about all host machines:		Before starting a Penetration Test, the following steps must be performed to gather information about all host machines:
	# '''Determine the IP-Addresses:''':		<ol>
	:: First, the IP addresses of both virtual machines are required to allow further security tests. Therefore, the command <code>ifconfig</code> must be performed on both machines to determine their IP addresses. The following figures show the results of the executed <code>ifconfig</code> command of this particular testing environment. Here, the IP address of the Kali Linux machine is ''192.168.16.137'', whereas the IP address of the Metasploitable 2 machine is ''192.168.16.138''.		<li>'''Determine the IP-Addresses:''':</li>
			First, the IP addresses of both virtual machines are required to allow further security tests. Therefore, the command <code>ifconfig</code> must be performed on both machines to determine their IP addresses. The following figures show the results of the executed <code>ifconfig</code> command of this particular testing environment. Here, the IP address of the Kali Linux machine is ''192.168.16.137'', whereas the IP address of the Metasploitable 2 machine is ''192.168.16.138''.

	::{\| class="galleryTable"		{\| class="galleryTable"
	\|-		\|-
	\|-		\|-
Line 136:		Line 137:
	\|}		\|}

	# '''Verify the Connectivity:'''		<li> '''Verify the Connectivity:'''</li>
	:: The network connectivity must be set correctly to enable both virtual machines to reach each other. This step is part of the Target Scoping phase of the testing framework and can be performed with the following tools: <code>ping</code>, <code>fping</code>, <code>arpscan</code>, <code>hping3</code>, etc. In this demonstration, the <code>ping <IP-Address></code> command is used to verify the connectivity of both virtual machines, as can be seen in the figures below.		The network connectivity must be set correctly to enable both virtual machines to reach each other. This step is part of the Target Scoping phase of the testing framework and can be performed with the following tools: <code>ping</code>, <code>fping</code>, <code>arpscan</code>, <code>hping3</code>, etc. In this demonstration, the <code>ping <IP-Address></code> command is used to verify the connectivity of both virtual machines, as can be seen in the figures below.

	::{\| class="galleryTable"		{\| class="galleryTable"
	\|-		\|-
	\|-		\|-
Line 147:		Line 148:
	\|}		\|}

	# '''Find possible Exploits:'''		<li> '''Find possible Exploits:'''</li>
	:: Use the command <code>nmap -sV -p0-65535 <IP-Address of Metasploitable 2></code> to gather information on the vulnerable Metasploitable 2 server in order to find possible exploits and select test cases to illustrate Penetration Testing. This command is executed on the attacking server Kali Linux and is used to identify open ports and services that operate on the vulnerable Metasploitable 2 server. The following figure shows the scan report of the <code>nmap</code> command.		Use the command <code>nmap -sV -p0-65535 <IP-Address of Metasploitable 2></code> to gather information on the vulnerable Metasploitable 2 server in order to find possible exploits and select test cases to illustrate Penetration Testing. This command is executed on the attacking server Kali Linux and is used to identify open ports and services that operate on the vulnerable Metasploitable 2 server. The following figure shows the scan report of the <code>nmap</code> command.


	~~::[[File:nmap_scan.png\|500px\|frameless\|\|]]~~

			[[File:nmap_scan.png\|left\|500px\|thumb\|\|]]
			<br clear=all>

	:: As can be seen in the scan report above, the ''vsftpd service on port 21'' is the first service that is listed in the report. Therefore, this service has been used to illustrate the exploitation of its weaknesses. This exploitation is shown in the following ~~sub-section~~.		As can be seen in the scan report above, the ''vsftpd service on port 21'' is the first service that is listed in the report. Therefore, this service has been used to illustrate the exploitation of its weaknesses. This exploitation is shown in the following subsection.
			</ol>


	; Vulnerability Exploitation		; Vulnerability Exploitation

	: One of many known vulnerabilities of the Metasploitable 2 server is a weakness of the ''VSFTPD'' service that has a backdoor, which allows gaining root shell access. This ~~sub-section~~ demonstrates an exploitation of this service to show the concept of the <code>msfconsole</code> tool. The MSFConsole is a Metasploit exploitation framework that is also used in Kali Linux. It is a centralized front-end interface for Penetration Testing. To access the framework, use the command <code>msfconsole</code> in the terminal or navigate through the Kali Linux environment. Afterward, all available commands can be listed using the <code>help</code> command.		: One of many known vulnerabilities of the Metasploitable 2 server is a weakness of the ''VSFTPD'' service that has a backdoor, which allows gaining root shell access. This subsection demonstrates an exploitation of this service to show the concept of the <code>msfconsole</code> tool. The MSFConsole is a Metasploit exploitation framework that is also used in Kali Linux. It is a centralized front-end interface for Penetration Testing. To access the framework, use the command <code>msfconsole</code> in the terminal or navigate through the Kali Linux environment. Afterward, all available commands can be listed using the <code>help</code> command.

	{\| class="galleryTable"		{\| class="galleryTable"
Line 165:		Line 166:
	\|-		\|-
	\|-		\|-
	\| [[Image:start-metasploit.png\|~~300px~~\|thumb\|Starting the Metasploit Framework]]		\| [[Image:start-metasploit.png\|320px\|thumb\|Starting the Metasploit Framework]]
	\| [[Image:command_list.png\|300px\|thumb\|Snippet of MSFConsole's Command List]]		\| [[Image:command_list.png\|300px\|thumb\|Snippet of MSFConsole's Command List]]
	\|}		\|}

	: Following steps are required for the exploitation of the ''VSFTPD'' service:		: Following steps are required for the exploitation of the ''VSFTPD'' service:
			::
			1. Search for the vulnerability on the ''msfconsole'': '''search vsftpd'''
			2. The output of the search shows the location of the exploitation. Select the exploit by using the output: '''use exploit/unix/ftp/vsftpd_234_backdoor'''
			3. Check for additionally required information: '''show options'''

			::[[File:search_vsftpd.png\|500px\|frameless\|\|]]

			::
			4. Assign the Metasploitable 2 VM as the target victim by setting the RHOST parameter to the IP-address of the Metasploitable 2 VM:
			'''set RHOST [IP-address of victim]'''
			::[[File:set_RHOST.png\|500px\|frameless\|\|]]

			::
			5. Run the VSFTPD exploit to gain access to the victim machine: '''run'''
			::[[File:run_exploit.png\|500px\|frameless\|\|]]

			: After running these commands, a shell is opened that allows all kinds of manipulation of the target machine. At this point, commands can be performed to extract sensitive information or data to further exploit the target. For instance, passwords can be extracted or modified, configurations can be changed, packets can be rerouted, etc.

	<br clear=all>		<br clear=all>

Zaskrak at 18:33, 31 January 2020

2020-01-31T18:33:42Z

← Older revision		Revision as of 18:33, 31 January 2020
Line 77:		Line 77:
	[[File:networking2.png\|right\|450px\|thumb\|Kali Linux Setup]]		[[File:networking2.png\|right\|450px\|thumb\|Kali Linux Setup]]
	'''Download, Installation and Configuration:'''		'''Download, Installation and Configuration:'''


	Download the Kali Linux image for VMware from the [https://www.kali.org/downloads/ homepage] and unzip the downloaded directory. Load the file <br>		Download the Kali Linux image for VMware from the [https://www.kali.org/downloads/ homepage] and unzip the downloaded directory. Load the file <br>
Line 102:		Line 103:
	[[File:metasploitable_start.png\|right\|450px\|thumb\|Metasploitable Start Screen]]		[[File:metasploitable_start.png\|right\|450px\|thumb\|Metasploitable Start Screen]]
	=== Metasploitable 2 ===		=== Metasploitable 2 ===


	To legally perform Penetration Testing and to illustrate proper methods and results, a vulnerable server is needed as a target server on the virtual machine. For this purpose,		To legally perform Penetration Testing and to illustrate proper methods and results, a vulnerable server is needed as a target server on the virtual machine. For this purpose,
Line 120:		Line 122:

	This section covers a demonstration of simple Penetration Tests that can be performed with the Kali Linux platform. The steps and used commands are explained in detail. However, these tests are selected only for demonstration purposes and do not display a proper Penetration Testing Framework. The tests are done with the use of Kali Linux and the Metasploitable 2 virtual machine. Additional test cases that are not included in the attached seminar paper can be found on the [https://metasploit.help.rapid7.com/docs/quick-start-guide Rapid7 Metasploit website].		This section covers a demonstration of simple Penetration Tests that can be performed with the Kali Linux platform. The steps and used commands are explained in detail. However, these tests are selected only for demonstration purposes and do not display a proper Penetration Testing Framework. The tests are done with the use of Kali Linux and the Metasploitable 2 virtual machine. Additional test cases that are not included in the attached seminar paper can be found on the [https://metasploit.help.rapid7.com/docs/quick-start-guide Rapid7 Metasploit website].


	; '''Information Gathering'''		; '''Information Gathering'''
Line 126:		Line 129:
	:: First, the IP addresses of both virtual machines are required to allow further security tests. Therefore, the command <code>ifconfig</code> must be performed on both machines to determine their IP addresses. The following figures show the results of the executed <code>ifconfig</code> command of this particular testing environment. Here, the IP address of the Kali Linux machine is ''192.168.16.137'', whereas the IP address of the Metasploitable 2 machine is ''192.168.16.138''.		:: First, the IP addresses of both virtual machines are required to allow further security tests. Therefore, the command <code>ifconfig</code> must be performed on both machines to determine their IP addresses. The following figures show the results of the executed <code>ifconfig</code> command of this particular testing environment. Here, the IP address of the Kali Linux machine is ''192.168.16.137'', whereas the IP address of the Metasploitable 2 machine is ''192.168.16.138''.

			::{\| class="galleryTable"
	[[~~File~~:ifconfig_Kali.png\|400px\|~~left\|frameless\|~~\|]] [[~~File~~:ifconfig_Metasploitable.png\|~~400px\|right\|frameless~~\|\|]]		\|-
			\|-
			\| [[Image:ifconfig_Kali.png\|400px\|thumb\|IP-Address of the Kali Linux VM]]
			\| [[Image:ifconfig_Metasploitable.png\|600px\|thumb\|IP-Address of the Metasploitable 2 VM]]
			\|}

	# '''Verify the Connectivity:'''		# '''Verify the Connectivity:'''
	:: The network connectivity must be set correctly to enable both virtual machines to reach each other. This step is part of the Target Scoping phase of the testing framework and can be performed with the following tools: <code>ping</code>, <code>fping</code>, <code>arpscan</code>, <code>hping3</code>, etc. In this demonstration, the <code>ping <IP-Address></code> command is used to verify the connectivity of both virtual machines, as can be seen in the figures below.		:: The network connectivity must be set correctly to enable both virtual machines to reach each other. This step is part of the Target Scoping phase of the testing framework and can be performed with the following tools: <code>ping</code>, <code>fping</code>, <code>arpscan</code>, <code>hping3</code>, etc. In this demonstration, the <code>ping <IP-Address></code> command is used to verify the connectivity of both virtual machines, as can be seen in the figures below.

			::{\| class="galleryTable"
	[[~~File~~:ping_Kali.png\|400px\|~~left\|frameless\|~~\|]] [[~~File~~:ping_Metasploitable.png\|400px\|~~right\|frameless\|~~\|]]		\|-
			\|-
			\|-
			\| [[Image:ping_Kali.png\|400px\|thumb\|Ping from the Kali Linux VM]]
			\| [[Image:ping_Metasploitable.png\|400px\|thumb\|Ping from the Metasploitable 2 VM]]
			\|}

	# '''Find possible Exploits:'''		# '''Find possible Exploits:'''
Line 141:		Line 151:


	[[File:nmap_scan.png\|500px\|frameless\|\|]]		::[[File:nmap_scan.png\|500px\|frameless\|\|]]


	As can be seen in the scan report above, the ''vsftpd service on port 21'' is the first service that is listed in the report. Therefore, this service has been used to illustrate the exploitation of its weaknesses. This exploitation is shown in the following sub-section.		:: As can be seen in the scan report above, the ''vsftpd service on port 21'' is the first service that is listed in the report. Therefore, this service has been used to illustrate the exploitation of its weaknesses. This exploitation is shown in the following sub-section.


	~~[[File:start-metasploit.png\|400px\|right\|thumb\|\|Starting the Metasploit Framework]]~~
	; Vulnerability Exploitation		; Vulnerability Exploitation

	: One of many known vulnerabilities of the Metasploitable 2 server is a weakness of the ''VSFTPD'' service that has a backdoor, which allows gaining root shell access. This sub-section demonstrates an exploitation of this service to show the concept of the <code>msfconsole</code> tool. The MSFConsole is a Metasploit exploitation framework that is also used in Kali Linux. It is a centralized front-end interface for Penetration Testing. To access the framework, use the command <code>msfconsole</code> in the terminal or navigate through the Kali Linux environment. Afterward, all available commands can be listed using the <code>help</code> command.		: One of many known vulnerabilities of the Metasploitable 2 server is a weakness of the ''VSFTPD'' service that has a backdoor, which allows gaining root shell access. This sub-section demonstrates an exploitation of this service to show the concept of the <code>msfconsole</code> tool. The MSFConsole is a Metasploit exploitation framework that is also used in Kali Linux. It is a centralized front-end interface for Penetration Testing. To access the framework, use the command <code>msfconsole</code> in the terminal or navigate through the Kali Linux environment. Afterward, all available commands can be listed using the <code>help</code> command.

			{\| class="galleryTable"
			\|-
			\|-
			\|-
			\| [[Image:start-metasploit.png\|300px\|thumb\|Starting the Metasploit Framework]]
			\| [[Image:command_list.png\|300px\|thumb\|Snippet of MSFConsole's Command List]]
			\|}

	~~[[File~~:~~command_list.png\|500px\|thumb\|\|Snippet~~ of ~~MSFConsole~~'~~s Command List]]~~		: Following steps are required for the exploitation of the ''VSFTPD'' service:

			<br clear=all>

	~~Following steps are required for the exploitation of the ''VSFTPD'' service:~~		== References ==

	== ~~References ==~~		* Seminar Paper: [[File:Penetration Testing Tools - Kali Linux.pdf]]
			* https://www.kali.org/
			* https://metasploit.help.rapid7.com/docs/
			* https://www.youtube.com/watch?v=0uvWRwLs5Zo
			* https://www.youtube.com/watch?v=inslTy_wJvY


	[[Category:Documentation]]		[[Category:Documentation]]

Zaskrak: /* Penetration Tests */

2020-01-31T17:53:21Z

Penetration Tests

← Older revision		Revision as of 17:53, 31 January 2020
Line 118:		Line 118:

	== Penetration Tests ==		== Penetration Tests ==

			This section covers a demonstration of simple Penetration Tests that can be performed with the Kali Linux platform. The steps and used commands are explained in detail. However, these tests are selected only for demonstration purposes and do not display a proper Penetration Testing Framework. The tests are done with the use of Kali Linux and the Metasploitable 2 virtual machine. Additional test cases that are not included in the attached seminar paper can be found on the [https://metasploit.help.rapid7.com/docs/quick-start-guide Rapid7 Metasploit website].

			; '''Information Gathering'''
			: Before starting a Penetration Test, the following steps must be performed to gather information about all host machines:
			# '''Determine the IP-Addresses:''':
			:: First, the IP addresses of both virtual machines are required to allow further security tests. Therefore, the command <code>ifconfig</code> must be performed on both machines to determine their IP addresses. The following figures show the results of the executed <code>ifconfig</code> command of this particular testing environment. Here, the IP address of the Kali Linux machine is ''192.168.16.137'', whereas the IP address of the Metasploitable 2 machine is ''192.168.16.138''.


			[[File:ifconfig_Kali.png\|400px\|left\|frameless\|\|]] [[File:ifconfig_Metasploitable.png\|400px\|right\|frameless\|\|]]


			# '''Verify the Connectivity:'''
			:: The network connectivity must be set correctly to enable both virtual machines to reach each other. This step is part of the Target Scoping phase of the testing framework and can be performed with the following tools: <code>ping</code>, <code>fping</code>, <code>arpscan</code>, <code>hping3</code>, etc. In this demonstration, the <code>ping <IP-Address></code> command is used to verify the connectivity of both virtual machines, as can be seen in the figures below.


			[[File:ping_Kali.png\|400px\|left\|frameless\|\|]] [[File:ping_Metasploitable.png\|400px\|right\|frameless\|\|]]


			# '''Find possible Exploits:'''
			:: Use the command <code>nmap -sV -p0-65535 <IP-Address of Metasploitable 2></code> to gather information on the vulnerable Metasploitable 2 server in order to find possible exploits and select test cases to illustrate Penetration Testing. This command is executed on the attacking server Kali Linux and is used to identify open ports and services that operate on the vulnerable Metasploitable 2 server. The following figure shows the scan report of the <code>nmap</code> command.


			[[File:nmap_scan.png\|500px\|frameless\|\|]]


			As can be seen in the scan report above, the ''vsftpd service on port 21'' is the first service that is listed in the report. Therefore, this service has been used to illustrate the exploitation of its weaknesses. This exploitation is shown in the following sub-section.


			[[File:start-metasploit.png\|400px\|right\|thumb\|\|Starting the Metasploit Framework]]
			; Vulnerability Exploitation
			: One of many known vulnerabilities of the Metasploitable 2 server is a weakness of the ''VSFTPD'' service that has a backdoor, which allows gaining root shell access. This sub-section demonstrates an exploitation of this service to show the concept of the <code>msfconsole</code> tool. The MSFConsole is a Metasploit exploitation framework that is also used in Kali Linux. It is a centralized front-end interface for Penetration Testing. To access the framework, use the command <code>msfconsole</code> in the terminal or navigate through the Kali Linux environment. Afterward, all available commands can be listed using the <code>help</code> command.


			[[File:command_list.png\|500px\|thumb\|\|Snippet of MSFConsole's Command List]]


			Following steps are required for the exploitation of the ''VSFTPD'' service:

	== References ==		== References ==

Zaskrak: /* Used Tools */

2020-01-31T05:14:49Z

Used Tools

← Older revision		Revision as of 05:14, 31 January 2020
Line 119:		Line 119:
	== Penetration Tests ==		== Penetration Tests ==

	== ~~Used Tools~~ ==		== References ==

	* Ping
	* Nmap
	* Metasploit
	* Hydra

	[[Category:Documentation]]		[[Category:Documentation]]