Ethical Hacking - Hands-On Training - Part I

In this section, you are given a brief overview of how the course is built.  

In this first lab, students will create a virtual install of Kali Linux using VirtualBox depending on their host platform and personal preferences.

In this short video, you will learn how to install the Virtualbox extension pack. The VirtualBox extension pack extends the versatility of using a virtual machine by allowing support for USB 3.0 and other important features.

In this lab, you will learn how to install the CSI Investigator Suite. CSI Linux was developed by Computer Forensics, Incident Response, and Competitive Intelligence professionals to meet the current needs of their clients, government agencies, and the industry. CSI Linux Investigator is a Virtual Machine Appliance that contains 3 different virtual machines.

Windows XP is our victim or target for the labs. Though some of these labs will work using newer operating systems as targets, Windows XP is still relevant in roughly 75% of all networks making it a viable target.

In this short video, you will learn how to take a snapshot of your current Kali configuration. Prior to making any changes to your basic install of Kali, you should take a snapshot of the current configuration so you can roll back to the point in time when everything was working correctly.

A short video on troubleshooting connectivity issues between Kali and your target machines. Use this video to ensure your Kali and other virtual machines have connectivity between them.

In this short video presentation, you will learn how to install an additional 300+ pentesting tools using a free Python3 script called Katoolin3.

In this short video and lab, you will learn how to use the Whonix Gateway for secure browsing while on the Internet with Kali Linux.

In this lab, you will learn how to improve your online privacy by using the CIS Linux Gateway to better hide your location and prevent DNS leaks.

In this short video, you will learn how to assign a random MAC address in Kali Linux using one of two ways.

In this lab, you will learn to gather passive information from the Internet using Maltego. This lab uses the community edition built into our Kali Linux that is limited to private or non-commercial use and the number of results that can be displayed in a graph.  It is capable of gathering a significant amount of passive information about a prospective entity in a single sweep of the Internet.

In this short video, you will learn how to use some of the OSINT tools provided with CSI Linux Investigator.

In this lab, students will learn to use Metagoofil to extract data from publicly available documents and images. Metagoofil is an information-gathering tool designed for extracting metadata of public documents (pdf, doc, xls, ppt ,docx, pptx, xlsx) belonging to a target company.     

In this short video and lab presentation, you will learn how to prepare and use the CSI Linux Analyst and CSI Gateway for secure anonymous access while using the Shodan search engine.

In this short video and lab, you will learn how to locate vulnerable devices connected to the Internet using Shodan.

In this short video and lab, you will be introduced to some of the more advanced search filters that can be used with Shodan.

In this first lab, students will use Nmap to investigate their network and identify potential targets. In this lab, students will be introduced to network discovery using Nmap, and becoming familiar the using CLI in Linux.

The Nmap scripting engine is one of Nmap's most powerful and, at the same time, most flexible features. It allows users to write their own scripts and share these scripts with other users for the purposes of networking, reconnaissance, etc. These scripts can be used for:

•  Network discovery
• More sophisticated and accurate OS version detection
• Vulnerability detection
• Backdoor detection
• Vulnerability exploitation

In this lab, you will look at the scripts that have been shared and are built into Kali and will examine how to use them to do thorough recon on our target, to increase the possibility of success, and reduce the possibilities of frustration.

EternalBlue, sometimes written as ETERNALBLUE, is an exploit believed to have been developed by the U.S. National  Security Agency (NSA). It was leaked by the Shadow Brokers hacker group  on April 14, 2017, and was used as part of the worldwide WannaCry  ransomware attack on May 12, 2017.

For this lab, students will be using NMap to look for the vulnerability. EternalBlue  exploits a vulnerability in Microsoft's implementation of the Server  Message Block (SMB) protocol. This vulnerability is denoted by entry  CVE-2017-0144 in the Common Vulnerabilities and Exposures (CVE) catalog.  The vulnerability exists because the SMB version 1 (SMBv1) server in various versions of Microsoft Windows accepts specially crafted packets from remote attackers, allowing them to execute arbitrary code on the target computer.

In this lab, students will learn how to automate the installation of NESSUS using containerization. Students will be introduced to the Docker program which provides a sandbox for the running of applications called containers. Containers are self-contained images that come preconfigured with all the necessary dependencies, software and files to operate without having the call on the operating system. This course has at least three labs that we use containerization for the installation of certain types of software.

In this Lab, students will learn how to discover vulnerabilities on their home or business network (The Windows XP Victim should be up and running as part of your network).   In this Lab, you will use the industry vulnerability scanner, NESSUS.  NESSUS is considered the industry standard for vulnerability scanners. There are plenty of commercial-grade scanners on the market and they all have their good and bad points but NESSUS is considered the gold standard.

In this video, students learn how to interpret their Nessus scan results.

In this lab, you will install the Docker program into your Kali machine and then download and install OpenVAS as a container to run inside of Docker.

In this lab, you will conduct a vulnerability scan of your network using OpenVAS.

In this lab, you will learn to use the all-in-one pentesting/hacking suite called Metasploit and perform a DOS attack on a Windows XP target.

In this lab, we see how easy Meterpreter can be used to establish a reverse shell with Windows XP using a well-known SMB exploit. We will also see how to detect any countermeasures that may be running on the remote target. We will establish a remote desktop session using a VNC payload and capture keystrokes to include logon passwords using Meterpreter.

In this lab, we see how easy Meterpreter can be used to create a backdoor into a Windows machine using nothing more than built-in system tools. We will also see how easy it is to detect and disable the Windows firewall if it is running on our victim machine. Lastly, we’ll want to remove any traces of our presence from the Windows log files.     

Often times we can exploit an operating system by looking for vulnerabilities with the applications that are running. In this lab, we will use a well-known vulnerability found in a popular streaming media server called Icecast.

In this lab,  students will learn to attack Windows XP using MS11-006 vulnerability provided by Metasploit. According to the Metasploit website:

This module exploits a stack-based buffer overflow in the handling of thumbnails within.MIC files and various Office documents. When processing a thumbnail bitmap containing a negative 'biClrUsed' value, a  stack-based buffer overflow occurs. This leads to arbitrary code execution. In order to trigger the vulnerable code, the folder containing the document must be viewed using the "Thumbnails" view.

In this short video presentation, you will learn how to use VirtualBox to create a virtual install of Server 2008.

In this lab, students will  download an ISO image for Server 2008 and run a well known exploit to take over the machine. Lot's of material in  this lab so take it slow and steady.

In this lab, you will learn how to import Metasploitable2 into  VirtualBox. Metasploitable2 is an intentionally vulnerable Linux virtual machine.  This VM can be used to conduct security training, test security tools and practice common penetration testing techniques.

In this lab, you will be introduced to hacking Linux using a vulnerable install of Linux called Metasploitable2.  Metasploitable2 is an intentionally vulnerable Linux virtual machine. This VM can be used to conduct security training, test security tools, and practice common penetration testing techniques.

In the lab, students will perform several ethical hacking lab exercises. The focus is on attacking endpoints. While there will be several specific attacks that you will perform, don't concentrate on the specifics. There are innumerable attacks that will come and go. Instead, of concentrating on the specific attack, concentrate on the bigger picture. Where do the vulnerabilities lie? You will see misconfigurations, back-doored software, vulnerabilities in base operating systems, and users who are vulnerable to social engineering. Also, concentrate on bigger concepts such as pivoting, privilege escalation, persistence, and tunneling, each of which is leveraged in this lab exercise.

The Social-Engineer Toolkit (SET) is specifically designed to perform advanced attacks against the human element. In this lab, students will  use the credential harvester to capture a username and password from a fake (cloned) Facebook page.

One of the great features of Linux is to writing scripts. Compared to writing Windows batch files, BASH scripting is much more flexible and comes with advanced features you won’t find in a batch script. To understand how the BASH shell works, you must understand the logic of how Linux is built.   

Simply put, BASH (Bourne-Again Shell) is the default shell we are provided within Linux distributions. It is the command-line interpreter (CLI) for GNU (GNU’s Not Unix) operating system. When we open a terminal session in Kali or Ubuntu, we are using the BASH shell. Though GNU operating systems provide different shells, BASH is the default out of the box shell for Linux.    

In this second  BASH scripting lab, students will see how one hacker using Nmap and simple BASH script caused $86 million dollars of havoc for the credit card companies.   

In windows, we use the AT command to schedule a job, in Linux, we use Crontab. Crontab is a list of commands which enables us to schedule a repetitive task to run on a schedule. This is also the name of the command used to manage the list.

In this lab, students will use a well known password cracking utility, Medusa, to brute-force their way onto a target running VNC on port 5900 using the Medusa VNC module. Medusa is a speedy, parallel, and modular, login brute-forcer. The goal is to support as many services which allow remote authentication as possible.

In this lab, the student will learn how to crack a cleartext password from a Windows client using Mimikatz. Mimikatz has become an extremely effective attack tool against Windows clients, allowing bad actors to retrieve cleartext passwords, as well as password hashes from memory. This lab will provide an overview of Mimikatz’s capabilities and payload vectors.     

In this short lab, you will learn how to use the password cracking utility Hydra to brute force a password for VNC running as a service on Metasploitable2.

In the short video and lab, you will learn how to add a wireless adapter to your virtual install of Kali using VirtualBox.

In this short video and lab, you will learn how to easily hack into a wireless network using Kali Linux.

In this short video and lab, you will learn how to quickly deauthenticate a wireless user or device connected to a specific wireless access point or router.

The w3af scanner no longer comes installed with Kali Linux. In this short lab, you will learn how to properly install the w3af scanner onto a Kali Linux virtual machine using a Docker container.

In this lab, students will conduct a website vulnerability scan using the command line version of Web Application Attack and Audit Framework (w3af).

In the lab, students will perform a manual SQL injection attack on a vulnerable web-based application inside of Metsploitable2 called  Mutillidae. In the second part of the lab, students will perform a Local  File Inclusion and Directory Traversal attack.

SQLmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.   

In this video, students will learn how to configure Kali running Apache Web Service for exploiting remote targets across the WAN.

In the lab, you will learn how to exploit a remote browser using the Browser Exploitation Framework. 

In this lab, you will attempt to capture three hidden flags. Using the hacker methodology, you will work your way through this CTF scenario based on the show, Mr. Robot.    This CTF exercise has three keys hidden in different locations. Your goal is to find all three. Each key becomes progressively difficult to find. The level of expertise for this CTF is considered beginner-intermediate. There is no advanced exploitation or reverse engineering.   

Capture the Flags (CTFs) are events that are usually hosted at information security conferences. These events consist of a series of challenges that vary in their degree of difficulty and require participants to exercise different skill sets to solve. Once an individual challenge is solved, a “flag” is given to the player, and they submit this flag to the CTF server to earn points.   

Discovery and Footprinting

To find the first key, you will need to find the what vulnerabilities are present on the target.

Exploitation

You will use brute force to gain access to the Apache web server running Wordpress.

Escalating Privileges   

Key #3 is is well hidden and protected with root access.You will need to find a way to gain root access. 

Video - Part 1 Walkthrough for the CTF, stapler. 

Video - Part 2 Walkthrough for the CTF, Stapler.

Video - Part 3 Walkthrough for the CTF, Stapler.