Saturday, February 8, 2014

Penetration Testing for Beginners

Penetration testing for beginnersNow, hackers come in all shapes, sizes and colors. Hacking is a very wide term. And by the first sentence, I'm not referring to the physical characters of the hackers, I'm talking about the field of specialization. Believe me, there is a lot of work to do on the Wireless domain that we had been working on so far (we have only touched wireless networks for the time being - you are a beginner), but wireless hacking is but a small island in the vast sea of hacking. A relatively large landmass is unarguably Penetration Testing, and a large name in this context is Metasploit. So here's a guide which will give you a good idea about what Penetration testing is, and if you're feeling to lazy, I've got it summarized here.

What is a penetration test?

What is penetration testing? Penetration testing, often called “pentesting”,“pen testing”, or “security testing”, is the practice of attacking your own or your clients’ IT systems in the same way a hacker would to identify security holes. Of course, you do this without actually harming the network. The person carrying out a penetration test is called a penetration tester or pentester.

How legal is it?

Let’s make one thing crystal clear: Penetration testing requires that you get permission from the person who owns the system. Otherwise, you would be hacking the system, which is illegal in most countries – and trust me, you don’t look good in an orange jump suit (or maybe you do, still I don't recommend going to jail for it, buy one if you need it).

In other words: The difference between penetration testing and hacking is whether you have the system owner’s permission. If you want to do a penetration test on someone else's system, it is highly recommended that you get written permission. Much better, get your virtual machine up and running, with your already acquired VMWare skills, and practice on your own system.

What is a vulnerability?

A vulnerability is a security hole in a piece of software, hardware or operating system that provides a potential angle to attack the system. A vulnerability can be as simple as weak passwords or as complex as buffer overflows or SQL injection vulnerabilities. (SQL injection is another topic I'd like to touch. Later maybe. I'm taking up too many tasks at hand at once.)

What is security research?

Vulnerabilities are typically found by security researchers, which is a geeky term for smart people (how much we hackers love to call our self smart, especially the beginners who get too cocky) who like to find flaws in systems and break them. 

What is an exploit?

To take advantage of a vulnerability, you often need an exploit, a small and highly specialized computer program whose only reason of being is to take advantage of a specific vulnerability and to provide access to a computer system. Exploits often deliver a payload to the target system to grant the attacker access to the system.

The Metasploit Project host the world’s largest public database of quality-assured exploits. Have a look at their exploit database – it’s right here on the site mentioned in the beginning of the article.

What is a payload?

A payload is the piece of software that lets you control a computer system after it’s been exploited. The payload is typically attached to and delivered by the exploit. Just imagine an exploit that carries the payload in its backpack when it breaks into the system and then leaves the backpack there. Yes, it’s a corny description, but you get the picture.

Metasploit’s most popular payload is called Meterpreter, which enables you to do all sorts of funky stuff on the target system. For example, you can upload and download files from the system, take screenshots, and collect password hashes. You can even take over the screen, mouse, and keyboard to fully control the computer. If you’re feeling particularly bad-ass, you can even turn on a laptop’s webcam and be a fly on the wall.

I would say that a payload is what exploits the 'exploit' and gives you some control over the exploited victim. Meterpreter is THE exploit, cause it doesn't give you 'some' control, it gives you ALL of it (that's some way to put it, yes,but not completely true. It still is the best payload. Beginners/noobs really enjoy the GUI feature available in this payload)

    What to do next

    Wait for more tutorials, or go ahead learning stuff without me. Not recommended, its gonna be a bumpy ride if you don't have us(I am only one person, why do I keep referring to myself as us?) to stabilize you. But still if you wanna go ahead, then Rapid7 is the best place to get started. Best of luck beginners.
    Here is a list of related posts on this blog. You should most probably go in this order.

    Penetration Testing Level 1: Hacking Windows XP (actual hacking here after the theory you read in this post- we'll help you setup a Kali Linux attack machine and Windows XP victim machine on VMware. Then wel will perform our first hack)
    Penetration Testing Level 2:Post-exploitation of Windows XP
    Penetration Testing Level 3:Crashing Windows 7
    Armitage : Fast And Easy Hacking GUI
    Windows XP : Hollywood Style Hack


    1. Could you post a link in this article to the article following this one up? This way we don't have to go looking for it.

      1. Thanks for letting me know. I'm providing the links.


      3. I am glad that I saw this post. It is informative blog for us and we need this type of blog thanks for share this blog, Keep posting such instructional blogs and I am looking forward for your future posts.
        Cyber Security Projects for Final Year

        JavaScript Training in Chennai

        Project Centers in Chennai

        JavaScript Training in Chennai

    2. thanks Shashwat Chaudhary

    3. I have a basic knowledge of computer but i want to be establish myself as a best hacker in this world. So please suggest me. What is my first step, and what i am do exactly to achieve my goal... anyone suggest me

      1. if you want to be the best should start doing on your own..stop being wanted to be spoonfed.

    4. give tutorials for penetration testing of windows10

    5. Open bob and vegan

    6. Hello everyone, i would have made the biggest mistake of my life marrying my former spouse but before the marriage after i saw his link from someones else testimonial. He is a professional that specializes in exposing cheating spouse
      and every other hacking and tracking related issues.He is truly a cyber genius , he helps catching cheating spouse by hacking and tracking their communications like call, whatsapp, Facebook, text, emails, Skype and many more.if you are having doubts in your affairs and relationship please i will advise you to contact him and know if He or she is true to you.

    7. I really thank you for the valuable info on this great subject and look forward to more great posts. Thanks a lot for enjoying this beauty article with me. I am appreciating it very much! Looking forward to another great article. Good luck to the author! All the best! Penetration Testing

    8. Thanks for taking the time to discuss this, I feel strongly about it and love learning more on this topic. If possible, as you gain expertise, would you mind updating your blog with extra information? It is extremely helpful for me. Pen Testing

    9. I’ve been surfing online more than 5 hours today, yet I never found any interesting article like yours without a doubt. It’s pretty worth enough for me. Thanks... Penetration Test

    10. Pentesting Services You made such an interesting piece to read, giving every subject enlightenment for us to gain knowledge. Thanks for sharing the such information with us to read this...

    11. Good post. I'd like to write like this too - taking time and real hard work to make a great article. convert pdf to png

    12. This post is a great introduction to the world of penetration testing. It explains the basics of the process in a straightforward and easy-to-understand way, and provides a great starting point for those who want to learn more about this field.

    13. This blog is very helpful for us. Look you spend a lot of time or effort in this blog. Love to share this one. Now it's time to avail VITAMIN FACE SERUM for more information.


    © Kali Tutorials, 2016. Unauthorized use and/or duplication of this material without express and written permission from this site’s author and/or owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to Shashwat Chaudhary and Kali Tutorials with appropriate and specific direction to the original content.
    Bitcoin: 1B5aLqJcMW7zznffTxQwta8JTZsxBDPguC