Notes on Penetration Testing

Chapter 1: Introduction to Penetration Testing

  • Definition and Overview

  • Penetration testing is a systematic approach to assessing the stability of a system by simulating cyber attacks.

  • Key components include information gathering, vulnerability checking, exploiting targets, and reporting.

  • Steps of Penetration Testing

  • Information Gathering: The first crucial step before targeting systems.

  • Two main methods:

    • Passive Method: Information collected indirectly, without direct interaction.

    • Example: Using online sources like Truecaller to gather information about phone numbers without direct contact.

    • Active Method: Directly contacting or interacting with the target to gather information.

  • OSINT (Open Source Intelligence)

  • Refers to techniques for gathering information from publicly available sources.

  • This approach is commonly used in the passive method of information gathering.

  • Permission and Scoping

  • Ethical penetration testing requires permission from the organization being tested.

  • Important components of scoping include:

    • Discussing the testing methodology with clients.

    • Using specific tools and determining a pricing structure for services.

  • Gathering Information from Domain Names

  • Subdomain Extraction: When starting with a domain (e.g., google.com), it's essential to identify subdomains (e.g., images.google.com, maps.google.com).

  • Tools like Harvester can be used to gather information on subdomains, emails, and their associated IPs based on specified domains.

  • Using Harvester Tool

  • Command: harvester -d domain_name -b source

  • Options:

    • -d: Specifies the target domain.

    • -b: Specifies the source for information extraction (e.g., Bing, DuckDuckGo).

    • -l: Limits the number of searches to a specified amount.

Chapter 2: Free Public DNS Server List

  • Use of DNS Servers

  • DNS servers store records regarding domain names and their associated IP addresses.

  • Important record types:

    • A Record: IP address for IPv4.

    • AAAA Record: IP address for IPv6.

    • MX Record: Mail server information.

    • NS Record: Name server information.

Chapter 3: Extracting Domain Information with DNS

  • Using DNS Enumeration Tools

  • DNS Enum Tool: For gathering domain and subdomain information through DNS servers.

  • Basic commands involve specifying the DNS server and the domain.

  • Commands Structure Example

  • Command: dnsenum -f <DNS server> -whois <domain>

  • Outcome includes DNS records and subdomain details.

Chapter 4: Understanding the IP Address

  • Finding Domain Ownership Information

  • Use the whois command to extract ownership details of a domain.

  • Formats:

    • whois <domain_name>

  • Information returned may include registrant details, organization contact info, and related records.

Chapter 5: Using GitHub for Tools

  • GitHub as a Resource

  • Provides access to tools related to penetration testing that may not be included within Kali Linux.

  • To download tools, use commands such as git clone <repository_link>.

  • Installation process often includes reading the documentation available on the GitHub repository.

Chapter 6: IP Address Tracking Techniques

  • Social Engineering for IP Tracking:

  • Use services like IP Logger or Grabify to capture a user's IP address by sending them a disguised link.

  • When the user clicks the link, their IP information is sent to the attacker without their knowledge.

Chapter 7: Challenges and Practical Implementation

  • Firewall Configuration

  • Create rules using iptables to block specific web pages and traffic.

  • Nessus Scanning Tasks

  • Set up scanning of a Metasploitable machine using Nessus, configuring to scan only certain ports (e.g., 1-200), and specifying relevant plugins.

Chapter 8: Conclusions and Next Steps

  • Continuous practice and familiarization with tools is essential for effective penetration testing.

  • Understanding both the tools and the underlying principles of penetration testing will enhance proficiency in real-world applications.

General Notes

  • Utilize Passive and Active Information Gathering Appropriately.

  • Ensure scoping and permissions are clearly defined before penetration testing.

  • Use DNS records wisely to gather useful information about target domains.

  • Leveraging resources such as GitHub is valuable for staying updated with the latest tools.