Book description
A complete pentesting guide facilitating smooth backtracking for working hackers
About This Book
Conduct network testing, surveillance, pen testing and forensics on MS Windows using Kali Linux
Gain a deep understanding of the flaws in web applications and exploit them in a practical manner
Pentest Android apps and perform various attacks in the real world using real case studies
Who This Book Is For
This course is for anyone who wants to learn about security. Basic knowledge of Android programming would be a plus.
What You Will Learn
Exploit several common Windows network vulnerabilities
Recover lost files, investigate successful hacks, and discover hidden data in innocent-looking files
Expose vulnerabilities present in web servers and their applications using server-side attacks
Use SQL and cross-site scripting (XSS) attacks
Check for XSS flaws using the burp suite proxy
Acquaint yourself with the fundamental building blocks of Android Apps in the right way
Take a look at how your personal data can be stolen by malicious attackers
See how developers make mistakes that allow attackers to steal data from phones
In Detail
The need for penetration testers has grown well over what the IT industry ever anticipated. Running just a vulnerability scanner is no longer an effective method to determine whether a business is truly secure. This learning path will help you develop the most effective penetration testing skills to protect your Windows, web applications, and Android devices.
The first module focuses on the Windows platform, which is one of the most common OSes, and managing its security spawned the discipline of IT security. Kali Linux is the premier platform for testing and maintaining Windows security. Employs the most advanced tools and techniques to reproduce the methods used by sophisticated hackers. In this module first,you'll be introduced to Kali's top ten tools and other useful reporting tools. Then, you will find your way around your target network and determine known vulnerabilities so you can exploit a system remotely. You'll not only learn to penetrate in the machine, but will also learn to work with Windows privilege escalations.
The second module will help you get to grips with the tools used in Kali Linux 2.0 that relate to web application hacking. You will get to know about scripting and input validation flaws, AJAX, and security issues related to AJAX. You will also use an automated technique called fuzzing so you can identify flaws in a web application. Finally, you'll understand the web application vulnerabilities and the ways they can be exploited.
In the last module, you'll get started with Android security. Android, being the platform with the largest consumer base, is the obvious primary target for attackers. You'll begin this journey with the absolute basics and will then slowly gear up to the concepts of Android rooting, application security assessments, malware, infecting APK files, and fuzzing. You'll gain the skills necessary to perform Android application vulnerability assessments and to create an Android pentesting lab.
This Learning Path is a blend of content from the following Packt products:
Kali Linux 2: Windows Penetration Testing by Wolf Halton and Bo Weaver
Web Penetration Testing with Kali Linux, Second Edition by Juned Ahmed Ansari
Hacking Android by Srinivasa Rao Kotipalli and Mohammed A. Imran
Style and approach
This course uses easy-to-understand yet professional language for explaining concepts to test your network's security.
Downloading the example code for this book. You can download the example code files for all Packt books you have purchased from your account at http://www.PacktPub.com. If you purchased this book elsewhere, you can visit http://www.PacktPub.com/support and register to have the code file.
Table of contents
-
Penetration Testing: A Survival Guide
- Table of Contents
- Penetration Testing: A Survival Guide
- Penetration Testing: A Survival Guide
- Credits
- Preface
-
I. Module 1
- 1. Sharpening the Saw
- 2. Information Gathering and Vulnerability Assessment
- 3. Exploitation Tools (Pwnage)
- 4. Web Application Exploitation
- 5. Sniffing and Spoofing
- 6. Password Attacks
- 7. Windows Privilege Escalation
- 8. Maintaining Remote Access
- 9. Reverse Engineering and Stress Testing
- 10. Forensics
-
II. Module 2
-
1. Introduction to Penetration Testing and Web Applications
- Proactive security testing
- Rules of engagement
- The limitations of penetration testing
- The need for testing web applications
- Social engineering attacks
- A web application overview for penetration testers
- Summary
- 2. Setting up Your Lab with Kali Linux
-
3. Reconnaissance and Profiling the Web Server
- Reconnaissance
-
Scanning – probing the target
- Port scanning using Nmap
- Identifying the operating system using Nmap
- Profiling the server
- Summary
- 4. Major Flaws in Web Applications
-
5. Attacking the Server Using Injection-based Flaws
- Command injection
- SQL injection
- Summary
- 6. Exploiting Clients Using XSS and CSRF Flaws
- 7. Attacking SSL-based Websites
- 8. Exploiting the Client Using Attack Frameworks
- 9. AJAX and Web Services – Security Issues
- 10. Fuzzing Web Applications
-
1. Introduction to Penetration Testing and Web Applications
-
III. Module 3
- 1. Setting Up the Lab
- 2. Android Rooting
- 3. Fundamental Building Blocks of Android Apps
-
4. Overview of Attacking Android Apps
- Introduction to Android apps
- Understanding the app's attack surface
- Threats at the client side
- Threats at the backend
-
Guidelines for testing and securing mobile apps
- OWASP Top 10 Mobile Risks (2014)
- M1: Weak Server-Side Controls
- M2: Insecure Data Storage
- M3: Insufficient Transport Layer Protection
- M4: Unintended Data Leakage
- M5: Poor Authorization and Authentication
- M6: Broken Cryptography
- M7: Client-Side Injection
- M8: Security Decisions via Untrusted Inputs
- M9: Improper Session Handling
- M10: Lack of Binary Protections
- Automated tools
- Identifying the attack surface
- QARK (Quick Android Review Kit)
- Summary
- 5. Data Storage and Its Security
-
6. Server-Side Attacks
- Different types of mobile apps and their threat model
- Mobile applications server-side attack surface
-
Strategies for testing mobile backend
- Setting up Burp Suite Proxy for testing
- Bypassing certificate pinning
- Bypass SSL pinning using AndroidSSLTrustKiller
- Threats at the backend
- Summary
- 7. Client-Side Attacks – Static Analysis Techniques
-
8. Client-Side Attacks – Dynamic Analysis Techniques
-
Automated Android app assessments using Drozer
- Listing out all the modules
- Retrieving package information
- Finding out the package name of your target application
- Getting information about a package
- Dumping the AndroidManifes.xml file
- Finding out the attack surface:
- Attacks on activities
- Attacks on services
- Broadcast receivers
- Content provider leakage and SQL Injection using Drozer
- Attacking SQL Injection using Drozer
- Path traversal attacks in content providers
- Exploiting debuggable apps
- Introduction to Cydia Substrate
- Runtime monitoring and analysis using Introspy
- Hooking using Xposed framework
- Dynamic instrumentation using Frida
- Logging based vulnerabilities
- WebView attacks
- Summary
-
Automated Android app assessments using Drozer
- 9. Android Malware
- 10. Attacks on Android Devices
- A. Bibliography
- Index
Product information
- Title: Penetration Testing: A Survival Guide
- Author(s):
- Release date: January 2017
- Publisher(s): Packt Publishing
- ISBN: 9781787287839
You might also like
book
Penetration Testing and Network Defense
The practical guide to simulating, detecting, and responding to network attacks Create step-by-step testing plans Learn …
book
Hands-On Bug Hunting for Penetration Testers
Detailed walkthroughs of how to discover, test, and document common web application vulnerabilities. Key Features Learn …
book
Hands-On Web Penetration Testing with Metasploit
Identify, exploit, and test web application security with ease Key Features Get up to speed with …
book
Penetration Testing Fundamentals: A Hands-On Guide to Reliable Security Audits
The perfect introduction to pen testing for all IT professionals and students · Clearly explains key …