Sign In Start Free Trial

Book Overview & Buying
Table Of Contents
Feedback & Rating

Metasploit Penetration Testing Cookbook

By : Teixeira, Nipun Jaswal, Singh, Agarwal

3.8 (5)

Metasploit Penetration Testing Cookbook

3.8 (5)

By: Teixeira, Nipun Jaswal, Singh, Agarwal

Overview of this book

Metasploit is the world's leading penetration testing tool and helps security and IT professionals find, exploit, and validate vulnerabilities. Metasploit allows penetration testing automation, password auditing, web application scanning, social engineering, post exploitation, evidence collection, and reporting. Metasploit's integration with InsightVM (or Nexpose), Nessus, OpenVas, and other vulnerability scanners provides a validation solution that simplifies vulnerability prioritization and remediation reporting. Teams can collaborate in Metasploit and present their findings in consolidated reports. In this book, you will go through great recipes that will allow you to start using Metasploit effectively. With an ever increasing level of complexity, and covering everything from the fundamentals to more advanced features in Metasploit, this book is not just for beginners but also for professionals keen to master this awesome tool. You will begin by building your lab environment, setting up Metasploit, and learning how to perform intelligence gathering, threat modeling, vulnerability analysis, exploitation, and post exploitation—all inside Metasploit. You will learn how to create and customize payloads to evade anti-virus software and bypass an organization's defenses, exploit server vulnerabilities, attack client systems, compromise mobile phones, automate post exploitation, install backdoors, run keyloggers, highjack webcams, port public exploits to the framework, create your own modules, and much more.

Preface

Preface

Who this book is for

What this book covers

To get the most out of this book

Sections

Get in touch

Disclaimer

Free Chapter

Metasploit Quick Tips for Security Professionals

Metasploit Quick Tips for Security Professionals

Introduction

Installing Metasploit on Windows

Installing Linux and macOS

Installing Metasploit on macOS

Using Metasploit in Kali Linux

Setting up a penetration-testing lab

Setting up SSH connectivity

Connecting to Kali using SSH

Configuring PostgreSQL

Creating workspaces

Using the database

Using the hosts command

Understanding the services command

Information Gathering and Scanning

Information Gathering and Scanning

Introduction

Passive information gathering with Metasploit

Active information gathering with Metasploit

Port scanning—the Nmap way

Port scanning—the db_nmap way

Host discovery with ARP Sweep

UDP Service Sweeper

SMB scanning and enumeration

Detecting SSH versions with the SSH Version Scanner

FTP scanning

SMTP enumeration

SNMP enumeration

HTTP scanning

WinRM scanning and brute forcing

Integrating with Nessus

Integrating with NeXpose

Integrating with OpenVAS

Server-Side Exploitation

Server-Side Exploitation

Introduction

Exploiting a Linux server

SQL injection

Types of shell

Exploiting a Windows Server machine

Exploiting common services

MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption

MS17-010 EternalRomance/EternalSynergy/EternalChampion

Installing backdoors

Denial of Service

Meterpreter

Meterpreter

Introduction

Understanding the Meterpreter core commands

Understanding the Meterpreter filesystem commands

Understanding Meterpreter networking commands

Understanding the Meterpreter system commands

Setting up multiple communication channels with the target

Meterpreter anti-forensics

The getdesktop and keystroke sniffing

Using a scraper Meterpreter script

Scraping the system using winenum

Automation with AutoRunScript

Meterpreter resource scripts

Meterpreter timeout control

Meterpreter sleep control

Meterpreter transports

Interacting with the registry

Loading framework plugins

Meterpreter API and mixins

Railgun—converting Ruby into a weapon

Adding DLL and function definitions to Railgun

Injecting the VNC server remotely

Enabling Remote Desktop

Post-Exploitation

Post-Exploitation

Introduction

Post-exploitation modules

Bypassing UAC

Dumping the contents of the SAM database

Passing the hash

Incognito attacks with Meterpreter

Using Mimikatz

Setting up a persistence with backdoors

Becoming TrustedInstaller

Backdooring Windows binaries

Pivoting with Meterpreter

Port forwarding with Meterpreter

Credential harvesting

Enumeration modules

Autoroute and socks proxy server

Analyzing an existing post-exploitation module

Writing a post-exploitation module

Using MSFvenom

Using MSFvenom

Introduction

Payloads and payload options

Encoders

Output formats

Templates

Meterpreter payloads with trusted certificates

Client-Side Exploitation and Antivirus Bypass

Client-Side Exploitation and Antivirus Bypass

Introduction

Exploiting a Windows 10 machine

Bypassing antivirus and IDS/IPS

Metasploit macro exploits

Human Interface Device attacks

HTA attack

Backdooring executables using a MITM attack

Creating a Linux trojan

Creating an Android backdoor

Social-Engineer Toolkit

Social-Engineer Toolkit

Introduction

Getting started with the Social-Engineer Toolkit

Working with the spear-phishing attack vector

Website attack vectors

Working with the multi-attack web method

Infectious media generator

Working with Modules for Penetration Testing

Working with Modules for Penetration Testing

Introduction

Working with auxiliary modules

DoS attack modules

Post-exploitation modules

Understanding the basics of module building

Analyzing an existing module

Building your own post-exploitation module

Building your own auxiliary module

Exploring Exploits

Exploring Exploits

Introduction

Common exploit mixins

Exploiting the module structure

Using MSFvenom to generate shellcode

Converting an exploit to a Metasploit module

Porting and testing the new exploit module

Fuzzing with Metasploit

Writing a simple fuzzer

Wireless Network Penetration Testing

Wireless Network Penetration Testing

Introduction

Metasploit and wireless

Understanding an evil twin attack

Configuring Karmetasploit

Wireless MITM attacks

SMB relay attacks

Cloud Penetration Testing

Cloud Penetration Testing

Introduction

Metasploit in the cloud

Metasploit PHP Hop

Phishing from the cloud

Setting up a cloud penetration testing lab

Best Practices

Best Practices

Introduction

Best practices

Using Metasploit over the Tor network

Metasploit logging

Documentation

Cleaning up

Other Books You May Enjoy

Other Books You May Enjoy

Leave a review - let other readers know what you think

Customer Reviews

3.8 (5)

5 star

40%

4 star

40%

3 star

0

2 star

0

1 star

20%

Introduction

With the growth of cloud computing, tests for cloud-based applications, services, and infrastructures are on the rise. When performing penetration tests on cloud deployments, one of the biggest concerns is shared ownership. In the past, when performing a penetration test, the organization would own all the components on the network and we were able to test them all; in a cloud environment, depending on the deployment and service model, we can be presented with a very limited scope.

Before we start using cloud computing as penetration testers, let me first get some terms out of our way:

The provider is the entity that built the cloud deployment, and it is offering a service to one or more tenants; tenants are the ones who contract the service from the provider.
Infrastructure as a Service (IaaS): This is a cloud service model where...

Search

Your notes and bookmarks