Hands-On Web Penetration Testing with Metasploit
Harpreet Singh Himanshu Sharma更新时间：2021-06-24 16:20:27
最新章节：Leave a review - let other readers know what you think封面
Title Page
Copyright and Credits
Hands-On Web Penetration Testing with Metasploit
About Packt
Why subscribe?
Contributors
About the authors
About the reviewer
Packt is searching for authors like you
Preface
Who this book is for
What this book covers
To get the most out of this book
Download the color images
Conventions used
Disclaimer
Get in touch
Reviews
Introduction
Introduction to Web Application Penetration Testing
What is a penetration test?
Types of penetration test
White box penetration test
Black box penetration test
Gray box penetration test
Stages of penetration testing
Reconnaissance and information gathering
Enumeration
Vulnerability assessment and analysis
Exploitation
Reporting
Important terminologies
Penetration testing methodologies
Open Source Security Testing Methodology Manual (OSSTMM)
Operational security metrics
Trust analysis
Human security testing
Physical security testing
Wireless security testing
Telecommunications security testing
Data network security testing
Compliance regulations
Reporting with the STAR
OSSTMM test types
Information Systems Security Assessment Framework (ISSAF)
Penetration Testing Execution Standard (PTES)
Pre-engagement interactions
Intelligence gathering
Threat modeling
Vulnerability analysis
Exploitation
Post-exploitation
Reporting
Common Weakness Enumeration (CWE)
OWASP Top 10
SANS TOP 25
Summary
Questions
Further reading
Metasploit Essentials
Technical requirements
Introduction to Metasploit Framework
Metasploit Framework terminology
Installing and setting up Metasploit
Installing Metasploit Framework on *nix
Installing Metasploit Framework on Windows
Getting started with Metasploit Framework
Interacting with Metasploit Framework using msfconsole
MSF console commands
Customizing global settings
Variable manipulation in MSF
Exploring MSF modules
Running OS commands in MSF
Setting up a database connection in Metasploit Framework
Loading plugins in MSF
Using Metasploit modules
Searching modules in MSF
Checking for hosts and services in MSF
Nmap scanning with MSF
Setting up payload handling in MSF
MSF payload generation
Generating an MSF payload using msfconsole (one-liner)
Generating an MSF payload using msfvenom
Summary
Questions
Further reading
The Metasploit Web Interface
Technical requirements
Introduction to the Metasploit web interface
Installing and setting up the web interface
Installing Metasploit Community Edition on Windows
Installing Metasploit Community Edition on Linux/Debian
Getting started with the Metasploit web interface
Interface
Main menu
Project tab bar
Navigational breadcrumbs
Tasks bar
Project creation
Default project
Creating a custom project
Target enumeration
Using the built-in option
Importing scan results
Module selection
Auxiliary module
Using an exploit module
Session interaction
Post-exploitation modules
Summary
Questions
Further reading
The Pentesting Life Cycle with Metasploit
Using Metasploit for Reconnaissance
Technical requirements
Introduction to reconnaissance
Active reconnaissance
Banner grabbing
HTTP header detection
Web robot page enumeration
Finding hidden Git repos
Open proxy detection
Passive reconnaissance
Archived domain URLs
Censys
SSL recon
Summary
Questions
Further reading
Web Application Enumeration Using Metasploit
Technical requirements
Introduction to enumeration
DNS enumeration
Going the extra mile – editing source code
Enumerating files
Crawling and scraping with Metasploit
Scanning virtual hosts
Summary
Questions
Further reading
Vulnerability Scanning Using WMAP
Technical requirements
Understanding WMAP
The WMAP scanning process
Data reconnaissance
Loading the scanner
WMAP configuration
Launching WMAP
WMAP module execution order
Adding a module to WMAP
Clustered scanning using WMAP
Summary
Questions
Further reading
Vulnerability Assessment Using Metasploit (Nessus)
Technical requirements
Introduction to Nessus
Using Nessus with Metasploit
Nessus authentication via Metasploit
Basic commands
Patching the Metasploit library
Performing a Nessus scan via Metasploit
Using the Metasploit DB for Nessus scan
Importing Nessus scan in the Metasploit DB
Summary
Questions
Further reading
Pentesting Content Management Systems (CMSes)
Pentesting CMSes - WordPress
Technical requirements
Introduction to WordPress
WordPress architecture
File/directory structure
Base folder
wp-includes
wp-admin
wp-content
WordPress reconnaissance and enumeration
Version detection
Readme.html
Meta generator
Getting the version via JavaScript and CSS files
Getting the version via the feed
Using Outline Processor Markup Language (OPML)
Unique/advanced fingerprinting
WordPress reconnaissance using Metasploit
WordPress enumeration using Metasploit
Vulnerability assessment for WordPress
WordPress exploitation part 1 – WordPress Arbitrary File Deletion
Vulnerability flow and analysis
Exploiting the vulnerability using Metasploit
WordPress exploitation part 2 – unauthenticated SQL injection
Vulnerability flow and analysis
Exploiting the vulnerability using Metasploit
WordPress exploitation part 3 – WordPress 5.0.0 Remote Code Execution
Vulnerability flow and analysis
Exploiting the vulnerability using Metasploit
Going the extra mile – customizing the Metasploit exploit
Summary
Questions
Further reading
Pentesting CMSes - Joomla
Technical requirements
An introduction to Joomla
The Joomla architecture
The file and directory structure
Reconnaissance and enumeration
Version detection
Detection via a meta tag
Detection via server headers
Detection via language configurations
Detection via README.txt
Detection via the manifest file
Detection via unique keywords
Joomla reconnaissance using Metasploit
Enumerating Joomla plugins and modules using Metasploit
Page enumeration
Plugin enumeration
Performing vulnerability scanning with Joomla
Joomla exploitation using Metasploit
How does the exploit work?
Joomla shell upload
Summary
Questions
Further reading
Pentesting CMSes - Drupal
Technical requirements
Introduction to Drupal and its architecture
Drupal's architecture
Directory structure
Drupal reconnaissance and enumeration
Detection via README.txt
Detection via meta tags
Detection via server headers
Detection via CHANGELOG.txt
Detection via install.php
Plugin theme and module enumeration
Drupal vulnerability scanning using droopescan
Exploiting Drupal
Exploiting Drupal using Drupalgeddon2
Understanding the Drupalgeddon vulnerability
Exploiting Drupalgeddon2 using Metasploit
The RESTful Web Services exploit – unserialize()
Understanding serialization
What is a POP chain?
Deserializing the payload
Exploiting RESTful Web Services RCE via unserialize() using Metasploit
Summary
Questions
Further reading
Performing Pentesting on Technological Platforms
Penetration Testing on Technological Platforms - JBoss
Technical requirements
An introduction to JBoss
The JBoss architecture (JBoss 5)
JBoss files and the directory structure
Reconnaissance and enumeration
Detection via the home page
Detection via the error page
Detection via the title HTML tag
Detection via X-Powered-By
Detection via hashing favicon.ico
Detection via stylesheets (CSS)
Carrying out a JBoss status scan using Metasploit
JBoss service enumeration
Performing a vulnerability assessment on JBoss AS
Vulnerability scanning using JexBoss
Vulnerable JBoss entry points
JBoss exploitation
JBoss exploitation via the administration console
Exploitation via the JMX console (the MainDeployer method)
Exploitation via the JMX console using Metasploit (MainDeployer)
Exploitation via the JMX console (BSHDeployer)
Exploitation via the JMX console using Metasploit (BSHDeployer)
Exploitation via the web console (Java applet)
Exploitation via the web console (the Invoker method)
Creating BSH scripts
Deploying the BSH script using webconsole_invoker.rb
Exploitation via JMXInvokerServlet (JexBoss)
Exploitation via JMXInvokerServlet using Metasploit
Summary
Questions
Further reading
Penetration Testing on Technological Platforms - Apache Tomcat
Technical requirements
An introduction to Tomcat
The Apache Tomcat architecture
Files and their directory structures
Detecting Tomcat installations
Detection via the HTTP response header – X-Powered-By
Detection via the HTTP response header – WWW-Authenticate
Detection via HTML tags – the title tag
Detection via HTTP 401 Unauthorized error
Detection via unique fingerprinting (hashing)
Detection via directories and files
Version detection
Version detection via the HTTP 404 error page
Version disclosure via Release-Notes.txt
Version disclosure via Changelog.html
Exploiting Tomcat
The Apache Tomcat JSP upload bypass vulnerability
Tomcat WAR shell upload (authenticated)
An introduction to Apache Struts
Understanding OGNL
OGNL expression injection
Testing for remote code execution via OGNL injection
Testing for blind remote code execution via OGNL injection
Testing for OGNL out-of-band injection
Struts 2 exploitation using Metasploit
Summary
Questions
Further reading
Penetration Testing on Technological Platforms - Jenkins
Technical requirements
Introduction to Jenkins
Jenkins terminology
The Stapler library
URL routing
Apache Groovy
Meta-programming
Abstract syntax tree
Pipeline
Jenkins reconnaissance and enumeration
Detecting Jenkins using favicon hashes
Detecting Jenkins using HTTP response headers
Jenkins enumeration using Metasploit
Exploiting Jenkins
Jenkins ACL bypass
Understanding Jenkins unauthenticated RCE
Summary
Questions
Further reading
Logical Bug Hunting
Web Application Fuzzing - Logical Bug Hunting
Technical requirements
What is fuzzing?
Fuzzing terminology
Fuzzing attack types
Application fuzzing
Protocol fuzzing
File-format fuzzing
Introduction to web app fuzzing
Fuzzer installation (Wfuzz)
Fuzzer installation (ffuf)
Identifying web application attack vectors
HTTP request verbs
Fuzzing HTTP methods/verbs using Wfuzz
Fuzzing HTTP methods/verbs using ffuf
Fuzzing HTTP methods/verbs using Burp Suite Intruder
HTTP request URIs
Fuzzing an HTTP request URl path using Wfuzz
Fuzzing an HTTP request URl path using ffuf
Fuzzing an HTTP request URl path using Burp Suite Intruder
Fuzzing HTTP request URl filenames and file extensions using Wfuzz
Fuzzing HTTP request URl filenames and file extensions using ffuf
Fuzzing HTTP request URl filenames and file extensions using Burp Suite Intruder
Fuzzing an HTTP request URl using Wfuzz (GET parameter + value)
Fuzzing an HTTP request URl using Burp Suite Intruder (GET parameter + value)
HTTP request headers
Fuzzing standard HTTP headers using Wfuzz ffuf and Burp Suite
Scenario 1 – Cookie header fuzzing
Scenario 2 – User-defined cookie header fuzzing
Fuzzing a custom header using Wfuzz ffuf and Burp Suite
Scenario 3 – Custom header fuzzing
Summary
Questions
Further reading
Writing Penetration Testing Reports
Technical requirements
Introduction to report writing
Writing executive reports
Title page
Document version control
Table of contents
Objective
Defined scope
Key findings (impact)
Issue overview
Strategic recommendations
Writing detailed technical reports
Title page
Document version control
Table of contents
Report summary
Defined scope
Methodology used
CVSS
Vulnerability summary
Conclusion
Appendix
Introduction to Dradis Framework
Pre-installation configuration
Installation and setup
Getting started with Dradis
Importing third-party reports into Dradis
Defining the security testing methodology in Dradis
Organizing reports using Dradis
Exporting reports in Dradis
Working with Serpico
Installation and setup
Getting started with Serpico
Importing data from Metasploit to Serpico
Importing third-party reports into Serpico
User management in Serpico
Managing templates in Serpico
Generating reports in multiple formats
Summary
Questions
Further reading
Assessment
Chapter 1
Chapter 2
Chapter 3
Chapter 4
Chapter 5
Chapter 6
Chapter 7
Chapter 8
Chapter 9
Chapter 10
Chapter 11
Chapter 12
Chapter 13
Chapter 14
Chapter 15
Other Books You May Enjoy
Leave a review - let other readers know what you think
更新时间：2021-06-24 16:20:27