Mastering Metasploit

Mastering Metasploit

by Nipun Jaswal
Released May 2014
Publisher(s): Packt Publishing
ISBN: 9781782162223

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

With this tutorial you can improve your Metasploit skills and learn to put your network's defenses to the ultimate test. The step-by-step approach teaches you the techniques and languages needed to become an expert.

In Detail

The Metasploit framework has been around for a number of years and is one of the most widely used tools for carrying out penetration testing on various services.

This book is a hands-on guide to penetration testing using Metasploit and covers its complete development. It will help you clearly understand the creation process of various exploits and modules and develop approaches to writing custom functionalities into the Metasploit framework.

This book covers a number of techniques and methodologies that will help you learn and master the Metasploit framework.

You will also explore approaches to carrying out advanced penetration testing in highly secured environments, and the book's hands-on approach will help you understand everything you need to know about Metasploit.

What You Will Learn

  • To perform effective penetration testing with Metasploit
  • To develop advanced and sophisticated auxiliary modules
  • To fuzz applications and create exploits in Metasploit
  • To port sophisticated exploits from Perl and Python
  • To automate web application attack scripts
  • To test services such as databases, VoIP, and SCADA systems
  • To reinvent traditional browser-based exploits
  • To speed up penetration testing with Metasploit's automated mode
  • To attack clients with the Social Engineering Toolkit
  • To implement attacks on web servers and systems with Armitage GUI
  • To script attacks in Armitage using Cortana scripting

Table of contents

  1. Mastering Metasploit
    1. Table of Contents
    2. Mastering Metasploit
    3. Credits
    4. About the Author
    5. About the Reviewers
    6. www.PacktPub.com
      1. Support files, eBooks, discount offers, and more
        1. Why subscribe?
        2. Free access for Packt account holders
    7. Preface
      1. What this book covers
      2. What you need for this book
      3. Who this book is for
      4. Conventions
      5. Reader feedback
      6. Customer support
        1. Errata
        2. Piracy
        3. Questions
    8. 1. Approaching a Penetration Test Using Metasploit
      1. Setting up the environment
        1. Preinteractions
        2. Intelligence gathering / reconnaissance phase
          1. Presensing the test grounds
        3. Modeling threats
        4. Vulnerability analysis
        5. Exploitation and post-exploitation
        6. Reporting
      2. Mounting the environment
        1. Setting up the penetration test lab
        2. The fundamentals of Metasploit
        3. Configuring Metasploit on different environments
          1. Configuring Metasploit on Windows XP/7
          2. Configuring Metasploit on Ubuntu
        4. Dealing with error states
          1. Errors in the Windows-based installation
          2. Errors in the Linux-based installation
      3. Conducting a penetration test with Metasploit
        1. Recalling the basics of Metasploit
        2. Penetration testing Windows XP
          1. Assumptions
          2. Gathering intelligence
          3. Modeling threats
          4. Vulnerability analysis
          5. The attack procedure with respect to the NETAPI vulnerability
          6. The concept of attack
          7. The procedure of exploiting a vulnerability
          8. Exploitation and post-exploitation
          9. Maintaining access
          10. Clearing tracks
        3. Penetration testing Windows Server 2003
        4. Penetration testing Windows 7
          1. Gathering intelligence
          2. Modeling threats
          3. Vulnerability analysis
          4. The exploitation procedure
          5. Exploitation and post-exploitation
        5. Using the database to store and fetch results
          1. Generating reports
      4. The dominance of Metasploit
        1. Open source
        2. Support for testing large networks and easy naming conventions
        3. Smart payload generation and switching mechanism
        4. Cleaner exits
        5. The GUI environment
      5. Summary
    9. 2. Reinventing Metasploit
      1. Ruby – the heart of Metasploit
        1. Creating your first Ruby program
          1. Interacting with the Ruby shell
          2. Defining methods in the shell
        2. Variables and data types in Ruby
          1. Working with strings
          2. The split function
          3. The squeeze function
          4. Numbers and conversions in Ruby
          5. Ranges in Ruby
          6. Arrays in Ruby
        3. Methods in Ruby
        4. Decision-making operators
        5. Loops in Ruby
        6. Regular expressions
        7. Wrapping up with Ruby basics
      2. Developing custom modules
        1. Building a module in a nutshell
          1. The architecture of the Metasploit framework
          2. Understanding the libraries' layout
        2. Understanding the existing modules
        3. Writing out a custom FTP scanner module
        4. Writing out a custom HTTP server scanner
        5. Writing out post-exploitation modules
      3. Breakthrough meterpreter scripting
        1. Essentials of meterpreter scripting
        2. Pivoting the target network
        3. Setting up persistent access
        4. API calls and mixins
        5. Fabricating custom meterpreter scripts
      4. Working with RailGun
        1. Interactive Ruby shell basics
        2. Understanding RailGun and its scripting
        3. Manipulating Windows API calls
        4. Fabricating sophisticated RailGun scripts
      5. Summary
    10. 3. The Exploit Formulation Process
      1. The elemental assembly primer
        1. The basics
        2. Architectures
          1. System organization basics
        3. Registers
        4. Gravity of EIP
        5. Gravity of ESP
        6. Relevance of NOPs and JMP
        7. Variables and declaration
        8. Fabricating example assembly programs
      2. The joy of fuzzing
        1. Crashing the application
        2. Variable input supplies
        3. Generating junk
        4. An introduction to Immunity Debugger
        5. An introduction to GDB
      3. Building up the exploit base
        1. Calculating the buffer size
        2. Calculating the JMP address
        3. Examining the EIP
          1. The script
        4. Stuffing applications for fun and profit
        5. Examining ESP
        6. Stuffing the space
      4. Finalizing the exploit
        1. Determining bad characters
        2. Determining space limitations
        3. Fabricating under Metasploit
        4. Automation functions in Metasploit
      5. The fundamentals of a structured exception handler
        1. Controlling SEH
        2. Bypassing SEH
        3. SEH-based exploits
      6. Summary
    11. 4. Porting Exploits
      1. Porting a Perl-based exploit
        1. Dismantling the existing exploit
          1. Understanding the logic of exploitation
          2. Gathering the essentials
        2. Generating a skeleton for the exploit
        3. Generating a skeleton using Immunity Debugger
        4. Stuffing the values
        5. Precluding the ShellCode
        6. Experimenting with the exploit
      2. Porting a Python-based exploit
        1. Dismantling the existing exploit
        2. Gathering the essentials
        3. Generating a skeleton
        4. Stuffing the values
        5. Experimenting with the exploit
      3. Porting a web-based exploit
        1. Dismantling the existing exploit
        2. Gathering the essentials
        3. Grasping the important web functions
        4. The essentials of the GET/POST method
        5. Fabricating an auxiliary-based exploit
          1. Working and explanation
        6. Experimenting with the auxiliary exploit
      4. Summary
    12. 5. Offstage Access to Testing Services
      1. The fundamentals of SCADA
        1. The fundamentals of ICS and its components
        2. The seriousness of ICS-SCADA
      2. SCADA torn apart
        1. The fundamentals of testing SCADA
        2. SCADA-based exploits
      3. Securing SCADA
        1. Implementing secure SCADA
        2. Restricting networks
      4. Database exploitation
        1. SQL server
        2. FootPrinting SQL server with Nmap
        3. Scanning with Metasploit modules
        4. Brute forcing passwords
        5. Locating/capturing server passwords
        6. Browsing SQL server
        7. Post-exploiting/executing system commands
          1. Reloading the xp_cmdshell functionality
          2. Running SQL-based queries
      5. VOIP exploitation
        1. VOIP fundamentals
          1. An introduction to PBX
          2. Types of VOIP services
          3. Self-hosted network
          4. Hosted services
          5. SIP service providers
        2. FootPrinting VOIP services
        3. Scanning VOIP services
        4. Spoofing a VOIP call
        5. Exploiting VOIP
          1. About the vulnerability
          2. Exploiting the application
      6. Post-exploitation on Apple iDevices
        1. Exploiting iOS with Metasploit
      7. Summary
    13. 6. Virtual Test Grounds and Staging
      1. Performing a white box penetration test
        1. Interaction with the employees and end users
        2. Gathering intelligence
          1. Explaining the fundamentals of the OpenVAS vulnerability scanner
          2. Setting up OpenVAS
          3. Greenbone interfaces for OpenVAS
        3. Modeling the threat areas
        4. Targeting suspected vulnerability prone systems
        5. Gaining access
        6. Covering tracks
        7. Introducing MagicTree
        8. Other reporting services
      2. Generating manual reports
        1. The format of the report
          1. The executive summary
          2. Methodology / network admin level report
          3. Additional sections
      3. Performing a black box penetration test
        1. FootPrinting
          1. Using Dmitry for FootPrinting
            1. WHOIS details and information
            2. Finding out subdomains
            3. E-mail harvesting
            4. DNS enumeration with Metasploit
        2. Conducting a black box test with Metasploit
          1. Pivoting to the target
          2. Scanning the hidden target using proxychains and db_nmap
          3. Conducting vulnerability scanning using Nessus
          4. Exploiting the hidden target
          5. Elevating privileges
      4. Summary
    14. 7. Sophisticated Client-side Attacks
      1. Exploiting browsers
        1. The workings of the browser autopwn attack
          1. The technology behind the attack
          2. Attacking browsers with Metasploit browser autopwn
      2. File format-based exploitation
        1. PDF-based exploits
        2. Word-based exploits
        3. Media-based exploits
      3. Compromising XAMPP servers
        1. The PHP meterpreter
        2. Escalating to system-level privileges
      4. Compromising the clients of a website
        1. Injecting the malicious web scripts
        2. Hacking the users of a website
      5. Bypassing AV detections
        1. msfencode
        2. msfvenom
        3. Cautions while using encoders
      6. Conjunction with DNS spoofing
        1. Tricking victims with DNS hijacking
      7. Attacking Linux with malicious packages
      8. Summary
    15. 8. The Social Engineering Toolkit
      1. Explaining the fundamentals of the social engineering toolkit
        1. The attack types
      2. Attacking with SET
        1. Creating a Payload and Listener
        2. Infectious Media Generator
        3. Website Attack Vectors
          1. The Java applet attack
          2. The tabnabbing attack
          3. The web jacking attack
        4. Third-party attacks with SET
      3. Providing additional features and further readings
        1. The SET web interface
        2. Automating SET attacks
      4. Summary
    16. 9. Speeding Up Penetration Testing
      1. Introducing automated tools
      2. Fast Track MS SQL attack vectors
        1. A brief about Fast Track
          1. Carrying out the MS SQL brute force attack
        2. The depreciation of Fast Track
        3. Renewed Fast Track in SET
      3. Automated exploitation in Metasploit
        1. Re-enabling db_autopwn
        2. Scanning the target
        3. Attacking the database
      4. Fake updates with the DNS-spoofing attack
        1. Introducing WebSploit
        2. Fixing up WebSploit
          1. Fixing path issues
          2. Fixing payload generation
          3. Fixing the file copy issue
        3. Attacking a LAN with WebSploit
      5. Summary
    17. 10. Visualizing with Armitage
      1. The fundamentals of Armitage
        1. Getting started
        2. Touring the user interface
        3. Managing the workspace
      2. Scanning networks and host management
        1. Modeling out vulnerabilities
        2. Finding the match
      3. Exploitation with Armitage
      4. Post-exploitation with Armitage
      5. Attacking on the client side with Armitage
      6. Scripting Armitage
        1. The fundamentals of Cortana
        2. Controlling Metasploit
        3. Post-exploitation with Cortana
        4. Building a custom menu in Cortana
        5. Working with interfaces
      7. Summary
      8. Further reading
    18. Index

Product information

  • Title: Mastering Metasploit
  • Author(s): Nipun Jaswal
  • Release date: May 2014
  • Publisher(s): Packt Publishing
  • ISBN: 9781782162223