Everand Logo

Welcome to Everand!

  • Discover millions of ebooks, audiobooks, and so much more with a free trial

    From $11.99/month after trial. Cancel anytime.

    Penetration Testing with BackBox
    Penetration Testing with BackBox
    Penetration Testing with BackBox
    Ebook216 pages2 hours

    Penetration Testing with BackBox

    By Stefan Umit Uygur

    ()

    Read preview

    About this ebook

    This practical book outlines the steps needed to perform penetration testing using BackBox. It explains common penetration testing scenarios and gives practical explanations applicable to a realworld setting.

    This book is written primarily for security experts and system administrators who have an intermediate Linux capability. However, because of the simplicity and userfriendly design, it is also suitable for beginners looking to understand the principle steps of penetration testing.
    LanguageEnglish
    PublisherPackt Publishing
    Release dateFeb 20, 2014
    ISBN9781783282982
    Penetration Testing with BackBox

    Related to Penetration Testing with BackBox

    Related ebooks

    Security For You

    View More
    View More

    Related podcast episodes

    Related articles

    • UNLIMITED

      Tools Arsenal

      Nov 17, 2020

      Tools Arsenal
      1 min read

    • UNLIMITED

      Web App Security

      Jun 29, 2021

      Web App Security
      8 min read

    • UNLIMITED

      Introducing Kali

      Mar 2, 2021

      Introducing Kali
      4 min read

    • UNLIMITED

      Hacker’s Manual

      Mar 2, 2021

      Hacker’s Manual
      1 min read

    • UNLIMITED

      Hacker’s Toolkit 2o22

      May 31, 2022

      Hacker’s Toolkit 2o22
      1 min read

    • UNLIMITED

      Hack The Planet/Parrot

      May 31, 2022

      Hack The Planet/Parrot
      2 min read

    • UNLIMITED

      Hacker’s Manual

      Nov 17, 2020

      Hacker’s Manual
      1 min read

    • UNLIMITED

      Hack The System

      Dec 17, 2019

      If you followed our handy guide on the previous pages, then you’ll already have augmented your Kali Light installation with Nmap, a port-scanning utility par excellence and a vital part of any pen-tester’s arsenal. As mentioned on the DVD page (there

      4 min read

    • UNLIMITED

      Network Attacks

      Sep 21, 2020

      Though less common than malware and social engineering, network-based attacks are still a threat to every computer and mobile user, and everyone should have at least a basic understanding of what they are and how to avoid them. So this month let’s lo

      4 min read

    • UNLIMITED

      Hacker Distributions

      Nov 17, 2020

      Hacker Distributions
      1 min read

    • UNLIMITED

      Your Best Defence Against Cyber-attacks

      Jul 21, 2021

      There is no better time than today to plan for how you’ll respond to a serious cyber-attack. Instigating a rock-solid cyber response plan requires identifying the risk to your business at a senior governance level, and understanding who is responsibl

      3 min read

    • UNLIMITED

      Modern Hacking, Ethics And Statistics

      May 31, 2022

      Agerund and an infinitive walk in to the Linux kernel. They were hacking to learn. An awful adaptation of a (drinking to forget) joke, but a reasonable opener. An incredibly useful maxim from long ago hacker lore is “don’t learn to hack, hack to lear

      5 min read

    • UNLIMITED

      Sherlock

      May 31, 2022

      Sherlock
      1 min read

    • UNLIMITED

      Disrupting Databases

      Apr 19, 2021

      Disrupting Databases
      3 min read

    • UNLIMITED

      Hack The Planet/Parrot

      May 31, 2022

      Hack The Planet/Parrot
      2 min read

    • UNLIMITED

      ‘Open Ports’ Leave a Hole in Smartphone Security

      May 8, 2017

      Smartphone apps that use “open ports” to share and receive data are more vulnerable to security breaches than previously thought, mainly due to the their widespread use in internet communication, a new study suggests. The vulnerability the researcher

      3 min read

    • UNLIMITED

      Badusb

      Jan 14, 2020

      Having a Kali Linux NetHunter phone of its own can be fun, but where it really comes into its element is when you pair it with a BadUSB. Get yourself a premade unit, or build a P4wnP1 out of a Raspberry Pi Zero W. Pop the small unit into a target’s m

      1 min read

    • UNLIMITED

      Kali Linux 2020.3 64-bit

      Nov 17, 2020

      Kali Linux 2020.3 64-bit
      3 min read

    • UNLIMITED

      Linux From Scratch

      Feb 8, 2022

      Linux From Scratch
      8 min read

    Related categories

    Reviews for Penetration Testing with BackBox

    0 ratings

    0 ratings0 reviews

    What did you think?

    Tap to rate

    Review must be at least 10 words

      Book preview

      Penetration Testing with BackBox - Stefan Umit Uygur

      Table of Contents

      Penetration Testing with BackBox

      Credits

      About the Author

      About the Reviewers

      www.PacktPub.com

      Support files, eBooks, discount offers and more

      Why Subscribe?

      Free Access for Packt account holders

      Preface

      What this book covers

      What you need for this book

      Who this book is for

      Conventions

      Reader feedback

      Customer support

      Downloading the example code

      Errata

      Piracy

      Questions

      1. Starting Out with BackBox Linux

      A flexible penetration testing distribution

      The organization of tools in BackBox

      Information Gathering

      Vulnerability Assessment

      Exploitation

      Privilege Escalation

      Maintaining Access

      Documentation & Reporting

      Reverse Engineering

      Social Engineering

      Stress Testing

      Forensic Analysis

      VoIP Analysis

      Wireless Analysis

      Miscellaneous

      Services

      Update

      Anonymous

      Extras

      Completeness, accuracy, and support

      Links and contacts

      Summary

      2. Information Gathering

      Starting with an unknown system

      Automater

      Whatweb

      Recon-ng

      Proceeding with a known system

      Nmap

      Summary

      3. Vulnerability Assessment and Management

      Vulnerability scanning

      Setting up the environment

      Running the scan with OpenVAS

      False positives

      An example of vulnerability verification

      Summary

      4. Exploitations

      Exploitation of a SQL injection on a database

      Sqlmap usage and vulnerability exploitation

      Finding the encrypted password

      Exploiting web applications with W3af

      Summary

      5. Eavesdropping and Privilege Escalation

      Sniffing encrypted SSL/TLS traffic

      An SSL MITM attack using sslstrip

      Password cracking

      Offline password cracking using John the Ripper

      Remote password cracking with Hydra and xHydra

      Summary

      6. Maintaining Access

      Backdoor Weevely

      Weevely in URL

      Performing system commands

      Enumerating config files

      Getting access credentials

      Editing files

      Gathering full system information

      Summary

      7. Penetration Testing Methodologies with BackBox

      Information gathering

      Scanning

      Exploitation

      Summary

      8. Documentation and Reporting

      MagicTree – the auditing productivity tool

      Summary

      Index

      Penetration Testing with BackBox

      Penetration Testing with BackBox

      Copyright © 2014 Packt Publishing

      All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.

      Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book.

      Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.

      First published: February 2014

      Production Reference: 1130214

      Published by Packt Publishing Ltd.

      Livery Place

      35 Livery Street

      Birmingham B3 2PB, UK.

      ISBN 978-1-78328-297-5

      www.packtpub.com

      Cover Image by Aniket Sawant (<[email protected]>)

      Credits

      Author

      Stefan Umit Uygur

      Reviewers

      Jorge Armin Garcia Lopez

      Shakeel Ali

      Sreenath Sasikumar

      Acquisition Editor

      Gregory Wild

      Technical Editors

      Krishnaveni Haridas

      Ankita Thakur

      Copy Editors

      Alfida Paiva

      Laxmi Subramanian

      Project Coordinator

      Aboli Ambardekar

      Proofreader

      Ameesha Green

      Indexer

      Mariammal Chettiyar

      Production Coordinator

      Manu Joseph

      Cover Work

      Manu Joseph

      About the Author

      Stefan Umit Uygur has been an IT System and Security engineer for 14 years. He is an extremely motivated open source software evangelist with a passion for sharing knowledge and working in a community environment. He is highly experienced in Penetration Testing and Vulnerability Analysis, Management, and Assessment. He has been involved in many open source software projects, for example BackBox, where he is part of the core team. He has helped to promote the free software culture around the world by participating and organizing international conferences. He significantly contributes to shedding the false and negative perceptions around hacking and hackers by promoting the hacker world in a positive light. He explains in detail the real world of hacking, hackers' motivations, and their philosophy, ethics, and freedom. These activities are promoted mainly through national and international magazines, and in particular, during the conferences that he participates. Along with his professional activities, he has contributed to the Linux magazine, the PenTest magazine, and a few other small, periodic, technical publications.

      However, his main passion is continuous collaboration with the community as he believes in the community more than anything else. He strongly feels that knowledge shouldn't be owned by a few people, but should be the heritage of the entire collective. He is always grateful to the community for the skills and the knowledge he possesses. One of the definitions he gives to the community is that it is the real school and university where one truly learns.

      I would like to thank my ladybird who helped me out to proofread this entire book. Without her help, I wouldn't have been able to complete this publication in a reasonable timeframe.

      About the Reviewers

      Jorge Armin Garcia Lopez is a very passionate Information Security Consultant from Mexico with more than six years of experience in Computer Security, Penetration Testing, Intrusion Detection/Prevention, Malware Analysis, and Incident Response. He is the leader of the Tiger team at one of the most important security companies located in Latin America and Spain. He is also a Security Researcher at Cipher Storm Ltd and is the co-founder and CEO of the most important Security Conference in Mexico called BugCON. He holds important security industry certifications such as OSCP, GCIA, and GPEN.

      Thanks to all my friends who support me. Special thanks to Shakeel Ali, Mada, Stefan Umir, Hector Garcia Posadas, and Krangel.

      Shakeel Ali is a Security and Risk Management Consultant at Fortune 500. Previously, he was a key founder of Cipher Storm Ltd., UK. He is also the co-author of BackTrack 4: Assuring Security by Penetration Testing, Packt Publishing, which is also a book on Penetration Testing. His expertise in the security industry markedly exceeds the standard number of security assessments, audits, compliance, governance, and incident-response projects that he carries out in day-to-day operations. As a senior security evangelist, and having spent endless nights, he provides constant security support to various businesses, educational institutions, and government agencies globally. He is an active independent researcher who writes various articles, whitepapers, and manages a blog at Ethical-Hacker.net. He also regularly participates in BugCon Security Conferences held in Mexico, to highlight the best-of-breed cyber security threats and their solutions from practically driven countermeasures.

      Sreenath Sasikumar is a web security analyst who heads the cyber security division at Digital Brand Group (DBG). He is an active member of OSWAP and a volunteer at Mozilla Firefox. After a good stint with IBM where he worked with enterprise clients such as AT&T, he was a part of QBust, empowering him to work with top-tier clients such as British Telecom and Plusnet. He started the security testing division at QBurst and was also responsible for creating several internal security-testing tools. Being an ardent lover of open source, he has created eight Mozilla add-ons, of which Clear Console was listed as the best add-on of the month in March 2013. It was also selected as one of the best Mozilla add-ons of 2013. With a user base of more than 44,000, it has registered more than 3,50,000 downloads till date. He has also created the world's first one-of-the-kind security testing browser bundle, PenQ. He supports OWASP and initiated the official Google+ community of OWASP and also contributes to its projects. Sreenath is a regular speaker at the Coffee@DBG series, which is an open walk-in session for technology enthusiasts from over 280 firms in Technopark, Trivandrum. He has also spoken on webinars and at Google DevFest '13, Technopark GTech Conference, and Unicom Testing Conference.

      www.PacktPub.com

      Support files, eBooks, discount offers and more

      You might want to visit www.PacktPub.com for support files and downloads related to your book.

      Did you know that Packt offers eBook versions of every book published, with PDF and ePub files available? You can upgrade to the eBook version at www.PacktPub.com and as a print book customer, you are entitled to a discount on the eBook copy. Get in touch with us at

      Enjoying the preview?
      Page 1 of 1