Mastering Metasploit Fourth Edition

Exploit systems, cover your tracks, and bypass security controls with the Metasploit 5.0 framework

Nipun Jaswal 지음

Packt(GCO Science) 2020년 06월 12일 출간

작품소개

책소개

▶Book Description
Updated for the latest version of Metasploit, this book will prepare you to face everyday cyberattacks by simulating real-world scenarios. Complete with step-by-step explanations of essential concepts and practical examples, Mastering Metasploit will help you gain insights into programming Metasploit modules and carrying out exploitation, as well as building and porting various kinds of exploits in Metasploit.

Giving you the ability to perform tests on different services, including databases, IoT, and mobile, this Metasploit book will help you get to grips with real-world, sophisticated scenarios where performing penetration tests is a challenge. You'll then learn a variety of methods and techniques to evade security controls deployed at a target's endpoint. As you advance, you’ll script automated attacks using CORTANA and Armitage to aid penetration testing by developing virtual bots and discover how you can add custom functionalities in Armitage. Following real-world case studies, this book will take you on a journey through client-side attacks using Metasploit and various scripts built on the Metasploit 5.0 framework.

By the end of the book, you’ll have developed the skills you need to work confidently with efficient exploitation techniques

▶What You Will Learn
- Develop advanced and sophisticated auxiliary, exploitation, and post-exploitation modules
- Learn to script automated attacks using CORTANA
- Test services such as databases, SCADA, VoIP, and mobile devices
- Attack the client side with highly advanced pentesting techniques
- Bypass modern protection mechanisms, such as antivirus, IDS, and firewalls
- Import public exploits to the Metasploit Framework
- Leverage C and Python programming to effectively evade endpoint protection

▶Key Features
- Make your network robust and resilient with this updated edition covering the latest pentesting techniques
- Explore a variety of entry points to compromise a system while remaining undetected
- Enhance your ethical hacking skills by performing penetration tests in highly secure environments

▶Who This Book Is For
If you are a professional penetration tester, security engineer, or law enforcement analyst with basic knowledge of Metasploit, this book will help you to master the Metasploit framework and guide you in developing your exploit and module development skills. Researchers looking to add their custom functionalities to Metasploit will find this book useful. As Mastering Metasploit covers Ruby programming and attack scripting using Cortana, practical knowledge of Ruby and Cortana is required.

목차

▶TABLE of CONTENTS
▷ Section 1 ？ Preparation and Development
-Chapter 1: Approaching a Penetration Test Using Metasploit
-Chapter 2: Reinventing Metasploit
-Chapter 3: The Exploit Formulation Process
-Chapter 4: Porting Exploits
▷ Section 2 ？ The Attack Phase
-Chapter 5: Testing Services with Metasploit
-Chapter 6: Virtual Test Grounds and Staging
-Chapter 7: Client-Side Exploitation
▷ Section 3 ？ Post-Exploitation and Evasion
-Chapter 8: Metasploit Extended
-Chapter 9: Evasion with Metasploit
-Chapter 10: Metasploit for Secret Agents
-Chapter 11: Visualizing Metasploit
-Chapter 12: Tips and Tricks

책 속으로

▶What this book covers
- Chapter 1, Approaching a Penetration Test Using Metasploit, takes us through the absolute basics of conducting a penetration test with Metasploit. It helps in establishing an approach and setting up the environment for testing. Moreover, it takes us through the various stages of a penetration test systematically. It further discusses the advantages of using Metasploit over traditional and manual testing.

- Chapter 2, Reinventing Metasploit, covers the absolute basics of Ruby programming essentials that are required for module building in Metasploit. This chapter further covers how to dig into existing Metasploit modules and write our custom scanner, authentication tester, post-exploitation, and credential harvester modules; finally, it builds on our progress by throwing light on developing custom modules in Railgun.

- Chapter 3, The Exploit Formulation Process, discusses how to build exploits by covering the essentials of exploit writing. This chapter also introduces fuzzing and throws light on debuggers too. It then focuses on gathering essentials for exploitation by analyzing the application's behavior under a debugger. It finally shows the exploit-writing process in Metasploit based on the information collected and discusses bypasses for protection mechanisms such as SEH and DEP.

- Chapter 4, Porting Exploits, helps to convert publicly available exploits into the Metasploit framework. This chapter focuses on gathering essentials from the available exploits written in Perl/Python and PHP, along with server-based exploits, by interpreting the essential information with a Metasploit-compatible module using Metasploit libraries and functions.

- Chapter 5, Testing Services with Metasploit, carries our discussion on performing a penetration test over various services. This chapter covers some crucial modules in Metasploit that help in testing SCADA, database, and VOIP services.

- Chapter 6, Virtual Test Grounds and Staging, is a brief discussion on carrying out a complete penetration test using Metasploit. This chapter focuses on additional tools that can work along with Metasploit to conduct a comprehensive penetration test. The chapter advances by discussing popular tools including Nmap and OpenVAS while explaining the use of these tools within Metasploit itself. It discusses Active Directory testing and generating manual and automated reports.

- Chapter 7, Client-Side Exploitation, shifts our focus to client-side exploits. This chapter focuses on modifying the traditional client-side exploits into a much more sophisticated and precise approach. The chapter starts with browser-based and file-format-based exploits and discusses compromising the users of a web server. It also explains the modification of browser exploits into a lethal weapon using Metasploit. Along with this, it discusses Arduino devices and their combined usage with Metasploit. Toward the end, the chapter focuses on developing strategies to exploit Android and using Kali NetHunter.

- Chapter 8, Metasploit Extended, talks about basic and advanced post-exploitation features of Metasploit, escalating privileges, using transports, and much more. The chapter advances by discussing the necessary post-exploitation features available on the Meterpreter payload and moves to examining the advanced and hardcore post-exploitation modules. Not only does this chapter help provide quick know-how about speeding up the penetration testing process, but it also uncovers many features of Metasploit that save a healthy amount of time while scripting exploits. By the end, the chapter also discusses automating the post-exploitation process.
...

출판사 서평

▶ Preface
Penetration testing and security assessments are necessities for businesses today. With the rise of cyber and computer-based crime in the past few years, penetration testing has become one of the core aspects of network security. It helps in keeping a business secure from internal as well as external threats. The reason that penetration testing is a necessity is that it helps in uncovering the potential flaws in a network, a system, or an application.

Moreover, it helps in identifying weaknesses and threats from an attacker's perspective. Various inherent flaws in a system are exploited to find out the impact they can cause to an organization and to assess the risk factors to the assets as well. However, the success rate of a penetration test depends mostly on the knowledge of the tester about the target under test. Therefore, we generally approach a penetration test using two different methods: black-box testing and white-box testing. Black-box testing refers to a scenario where there is no prior knowledge of the target under test. Therefore, a penetration tester kicks off testing by collecting information about the target systematically. By contrast, in the case of a white-box penetration test, the penetration tester has enough knowledge about the target under test, and they start by identifying known and unknown weaknesses of the target. Generally, a penetration test is divided into seven different phases, as follows:

？ Pre-engagement interactions: This phase defines all the pre-engagement activities and scope definitions ？ basically, everything you need to discuss with the client before the testing starts.
？ Intelligence gathering: This phase is all about collecting information about the target under test by connecting to the target directly, and passively, without connecting to the target at all.
？ Threat modeling: This phase involves matching the information detected with the assets to find the areas with the highest threat level.
？ Vulnerability analysis: This involves finding and identifying known and unknown vulnerabilities and validating them.
？ Exploitation: This phase involves taking advantage of the vulnerabilities found in the previous stage and typically means that we are trying to gain access to the target.
？ Post exploitation: The actual task to be performed on the target, which might involve downloading a file, shutting down a system, creating a new user account on the target, and so on, are parts of this phase. Generally, this phase describes what you need to do after exploitation.
？ Reporting: This phase includes summing up the results of the test in a file and the possible suggestions and recommendations to fix the current weaknesses in the target.

The seven stages just mentioned may look more natural when there is a single target under test. However, the situation completely changes when a vast network that contains hundreds of systems are to be tested. Therefore, in a case like this, manual work is to be replaced with an automated approach. Consider a scenario where the number of systems under test is precisely 100, and all systems are running the same operating system and services. Testing every system manually will consume much time and energy. Situations like these demand the use of a penetration testing framework. Using a penetration testing framework will not only save time but will also offer much more flexibility regarding changing the attack vectors and covering a much more comprehensive range of targets through the test. A penetration testing framework will eliminate additional time consumption and will also help in automating most of the attack vectors, scanning processes, identifying vulnerabilities, and, most importantly, exploiting the vulnerabilities, thus saving time and pacing a penetration test. This is where Metasploit kicks in.
...

작가정보

저자(글) Nipun Jaswal

Nipun Jaswal is an international cybersecurity author and an award-winning IT security researcher with more than a decade of experience in penetration testing, Red Team assessments, vulnerability research, RF, and wireless hacking. He is presently the Director of Cybersecurity Practices at BDO India. Nipun has trained and worked with multiple law enforcement agencies on vulnerability research and exploit development. He has also authored numerous articles and exploits that can be found on popular security databases, such as PacketStorm and exploit-db. Please feel free to contact him at @nipunjaswal.