Author: Kharim Haji Mchatta
**********************************************************************************
* *
* *
* *
* DISCLAIMER: ANY MALICIOUS USE OF THE CONTENTS FROM THIS ARTICLE *
* *
* WILL NOT HOLD THE AUTHOR RESPONSIBLE, THE CONTENTS ARE SOLELY FOR *
* *
* EDUCATIONAL PURPOSE *
* *
* *
**********************************************************************************
Table of Contents
Chapter 3:
Tools to be used in ethical hacking/penetration testing and their purpose .
Chapter4: Network ports, services running and how they can be exploited .
Chapter 5:
Other hacking techniques
Chapter 6:
What is capture the flag
Platforms for CTF
Types of challenges.
Aims of CTF
Conclusion
- Objective of the article
The main reasons for writing this article is to help the guys who are starting out in the penetration testing field on ways on how to exploit or enumerate some of the common services like ssh, ftp, dns, smb and many other more.
Most of articles online would show you the theoretical aspect of how a service could be exploited but they don’t show practical examples on how the exploits or enumerations are done based on the service.
There are numerous ways on which a system can be attacked, don’t be stuck with the methods which are mentioned and shown in this article, do research and learn as many techniques as possible simply because in one system the technique could work but on another system the technique wouldn’t work depending on the complexity of the security systems that are put in place by the targeted machine.
- How to setup virtual penetration testing lab
To get started with penetration testing you need to have a virtual environment running on your local host, there are many virtual environment platforms, but the most common ones include oracle virtual box and VMware. You can download them in
(a)
Oracle Virtual Box - https://www.virtualbox.org/wiki/Downloads
(b)
VMware - https://www.vmware.com/
Based on my experience I would recommend using Oracle Virtual Box but its all based on preference.
After
that the next step is to download an OS system to run on the virtual box and
for our case it would be Kali Linux
which can be download at https://www.offensive-security.com/kali-linux- vm-vmware-virtualbox-image-download/
 |
On the top you will see two tabs which all contains ISO’s based on the virtual environment your using. Select one then download it.
Once downloaded please follow these YouTube links created by Hackersploit to see how you can setup the OS on the virtual environments
(a)
how to install kali Linux
on a virtual machine - https://youtu.be/od9jo8tvZUs
(b)
how to install kali Linux on VMware
- https://youtu.be/ShOb8bQ_h_I
- Linux Distributions for hacking and Penetration testing
Depending on the goal you want to achieve there are many Linux distributions which can be used for various purposes and the distribution are as follows
(a)
Kali Linux – widely known for
ethical hacking and penetration testing
(b) Blackbox – it’s an ubuntu distro for penetration testing and security assessment purpose
(c)
Parrot OS – its for penetration testers
who need cloud friendly environment with online anonymity and encrypted system
(d)
Black Arch – used for penetration testing and security
research
(e)
DEFT – also known as Digital Evidence and Forensics
Toolkit (DEFT) used for computer
forensics with the purpose of running live systems without corrupting and tampering
devices connected to the PC where
booting takes place
(f) Samurai Web Testing Framework – is used for web penetration testing.
(g)
CAINE – also known as Computer Aided Investigative
Environment. It is solely focused of Digital forensics
(h)
Network Security Toolkit
– it provides security professionals and network administrators with a wide range of open
source network security tools. It has an advanced Web User Interface
for system/network administration, navigation, automation,
network monitoring & analysis and configuration of many applications found in Network
Security Toolkit distro.
(i)
Gugtraq - II -is focused on digital forensics,
penetration testing, malware laboratories and
GSM forensic. It also has over 500 ethical security hacking tools installed and configured
(j)
CYBORG HAWK LINUX – is used for network security and
assessment and digital forensics
(k)
Weakerthan – used for wireless
hacking as it contains
plenty of wireless
tools
NOTE: All the above distributions can be used depending on what you want to achieve, there are many other more distributions apart from the ones listed above. On this article we will focus more on kali Linux as the main and preferable distribution
- Places to learn about penetration testing
There are a lot of ways on which a person could learn penetration testing which can differ from person to person. The following are some of the ways you could use to learn penetration testing
(a)
Google - In google there are a lot of articles on
which you could go through to learn about
penetration testing so it’s time to do your research and gain the theoretical knowledge on penetration testing, common
website to visit and get started with the theoretical
aspect of penetration testing, ethical hacking and security include U-demy (https://www.udemy.com/),
Null byte (https://null-byte.wonderhowto.com/),
cybrary (https://www.cybrary.it/)
and Hackersploit (https://hsploit.com/).
(b)
YouTube channels
– there are a lot of channels on which they teach penetration testing concepts and show practical
part of it where individuals could learn a lot from, these channels include hackersploit, IppSec,
Null byte, Hak5 and Demmsec, all these channels contain
good contents in penetration testing
(c)
Mentor – find someone who is skilled and is already in the security
world to help you out learn and direct you while you are
getting started in the field.
 and starting point of hacking){kind=link}
0 মন্তব্যসমূহ