Kali Linux Intrusion and Exploitation Cookbook: Powerful recipes to detect vulnerabilities and perform security assessments

For this recipe, you require:

Perform the steps for this recipe:

EC in EC2 stands for elastic computing, and the short answer is bringing up a virtual in the cloud. Amazon AWS has a collection of all the popular OS images already available and all you need to do is select the one you need for requirement, followed by the hardware requirement. Based on your OS and the hardware configuration you selected, AWS will provision that hardware and install that OS. You can select the type of storage you want, traditional or SSD, and then attach/de-attach the hard drive based on your requirement. Best of all, you only pay for the time you want to use it, and when you stop the EC2 machine, AWS will free up those resources and add them back its stock, that's how flexible AWS is. Now, it's time for a quick recap of what we did in this recipe. As a prerequisite, you need to first create an amazon AWS account, which is very easy to create. Then, step 1 shows you how to select EC2. Steps 2 and 3 show how to search and select Kali Linux's minimal image. In step 4, you get to read everything that Kali Linux AMI has to offer, the basic requirements and the user login information. Step 5 shows you how to select an instance type depending on your requirement and budget. In steps 6 to 7 you will go through the simple wizard while choosing the default recommended SSD to boot from. Step 8 shows you the final page with warnings and points you should take care of or be aware of. In step 9, you choose to set up a security group on SSH protocol port 22 only to allow you from a specific IP range that belongs to you. In step 10, you are shown the review page, where based on your instance type selection it informs you whether you are eligible for free tier or not. In step 11, you create a new SSH Key pair and download it on your local machine. In step 12, you finally click on launch to start the instance.

Having Kali Linux installed in Amazon AWS infrastructure with a public IP address, with just few clicks, can prove to be very helpful during external penetration testing. As you know, we have selected and installed Kali Linux's minimal image for use in AWS infrastructure, due to which our installation does not have any tools installed by default.

In our next recipe, we will cover how to use SSH and setup Kali Linux on Amazon AWS box for use. In this recipe, we will also solve few problems that you might face while updating the repository and installing Kali Linux tools and setting up GUI and installing all the required tools we will need for use.

For this recipe, you will need the following things:

Perform the following steps for this recipe:

      docker run hello-world

You will see the following output if your installation succeeded:

      docker pull kalilinux/kali-linux-docker

      docker run -t -i kalilinux/kali-linux-docker

      docker pull linuxkonsult/kali-metasploit

docker run -t -i linuxkonsult/kali-metasploit

The will be as shown in the screenshot:

Once the framework is prepared it is unpacked and executed, it should look as follows:

As you can see, you have Metasploit updated and running. But this is not it; all the changes you have made are not permanent, until you commit the changes. Once you commit the changes, you can pick up next time from where you left off. To commit the changes, open another console window and type the command:

      docker ps

      docker commit <docker-id> <docker-name>
docker commit bd590456f320 admiring_pike

On successful commit, you will see the following output:

b4a7745de59f9e106029c49a508c2f55b36be0e9487dbd32f6b5c58b24fcb57

In this recipe, we need Virtualbox already installed as a prerequisite, and we downloaded and installed the Docker toolbox. Once Docker toolbox is installed, simply open the Docker Quickstart Terminal.app and pull the image you want to run, you can search for the desired image from https://hub.docker.com and use the docker run command to run it. Once you have performed your operations, simply commit the changes with the docker commit command.

Here, we have used the -i and -t switches. For interactive processes (such as a shell), you must use -i -t together in order to a teletype (TTY) for the container process. The-i -t switches is often written -it.

You can learn more about at https://www.docker.com . To search for images, you can visit https://hub.docker.com . To install Linux meta-packages, you can visit https://www.kali.org/news/kali-linux-metapackages/ .

In order to commence with this, you will require the following:

Perform the following steps for this recipe:

The preceding step will get the Kali Linux NetHunter in your device. Once successful, the device will go into the TWRP recovery mode.

In this recipe, we have how you can install Linux, which is called NetHunter. NetHunter is ARM which was ported to run on a non-intel processor, which is built on your trusted Kali Linux and tool sets. The Kali Linux NetHunter project is an open source Android penetration testing platform for ARM devices, created as a joint effort between the Kali community member BinkyBear and Offensive Security.

We installed Kali on our device and now we can perform our pen testing from OnePlus one, which is highly efficient in case of red team exercises, social engineering, or during physical security assessment.

More information for the same can be found at http://www.nethunter.com .

Before installing Kali Linux, you will require Linux Latest ISO Image, which can be downloaded from https://www.kali.org/downloads/ .

Perform the steps for recipe:

In this recipe, we inserted the Linux ISO and the graphical install. During the graphical install, we started configuring with our preferred language, keyboard language, country, and timezone. From step 5 onwards, we entered the hostname for our Kali Linux and in step 6, we entered the domain name for our Kali Linux.

From steps 9 to 13, we configured the hard disk partition to use the entire disk for installation and created one partition for all folders since we will only be using it for penetration testing. Once the installation is finished, step 14 onwards we configured Kali to use network mirrors for faster updates, configured any network proxy (if required) and finally installed GRUB bootloader.

For this recipe, you will need a connection to the Internet with a valid IP address.

Perform the following steps for this recipe:

      vim /etc/apt/sources.list

      #deb cdrom:[Debian GNU/Linux 7.0 _Kali_ - Official Snapshot i386 
      LIVE/INSTALL Binary 20140721-23:20]/ kali contrib main non-free


      deb http://http.kali.org/kali kali main non-free contrib

      deb-src http://http.kali.org/kali kali main non-free contrib

      ## Security updates
      deb http://security.kali.org/kali-security kali/updates main 
      contrib non-free

All you need to do is to change http to repo as shown in the following code:

      #deb cdrom:[Debian GNU/Linux 7.0 _Kali_ - Official Snapshot i386 
      LIVE/INSTALL Binary 20140721-23:20]/ kali contrib main non-free

      deb http://repo.kali.org/kali kali main non-free contrib
      deb-src http://repo.kali.org/kali kali main non-free contrib

      ## Security updates
      deb http://security.kali.org/kali-security kali/updates main 
      contrib non-free

      apt-get update && apt-get upgrade

Kali Linux has multiple different mirrors around the world. Based on your IP address location, it automatically selects the mirror closest to your location. Due to various reasons, these mirrors may become slow over a period of time. You can find the list of mirrors closest to your location at http://http.kali.org/README.mirrorlist . The apt-get command takes the list of update servers from /etc/apt/sources.list. Changes made to the sources.list files ensures that our Kali connects to the correct servers and gets served with faster updates.

For this recipe, you will need connection to the Internet.

Perform the following steps for this recipe:

      apt-get install preload

BleachBit quickly frees disk space and tirelessly guards your privacy. Frees cache, deletes cookies, clears Internet history, shreds temporary files, deletes logs, and discards junk that you didn't know existed. You can read more about this application at http://bleachbit.sourceforge.net/ .

      apt-get install bleachbit

To install the application, issue the command on the terminal window:

      apt-get install bum

In this recipe, we have used the apt-get command to install the basic system utilities, which can help us manage our Kali Linux resources well during our pen testing by keeping our Kali Linux process and start up folders optimized for highest performance.

For this recipe, you will need a to the Internet with a valid IP address.

Perform the following steps for this recipe:

      service apache2 start

You can verify that the service is by to the localhost using a as shown in the screenshot:

      # cd /etc/ssh
      # mkdir default_kali_keys
      # mv ssh_host_* default_kali_keys/
      # cd /root/

      # update-rc.d -f ssh remove

      # update-rc.d -f ssh defaults

      # dpkg-reconfigure openssh-server 
      Creating SSH2 RSA key; this may take some time ...
      Creating SSH2 DSA key; this may take some time ...
      Creating SSH2 ECDSA key; this may take some time ...
      insserv: warning: current start runlevel(s) (empty) of script 
      `ssh' overrides LSB defaults (2 3 4 5).
      insserv: warning: current stop runlevel(s) (2 3 4 5) of script 
      `ssh' overrides LSB defaults (empty).

      service ssh start

      netstat - antp | grep ssh

      service pure-ftpd start

      netstat -ant | grep ftp

      service <servicename> stop

Here, <servicename> is the name of service required to terminate:

      service ssh stop

In this recipe, we have configured and started basic network services, which we will be using to deliver payloads to our victim machines depending on the scenario. We have started HTTP service, FTP service, and we have backed up default SSH keys and generated new SSH keys, and started the SSH service.

For this recipe, we will be Nessus home feed and register for a valid license.

Perform the steps for this recipe:

      dpkg -i Nessus-6.2.0-debian6_amd64.deb

      /etc/init.d/nessusd start

Now, the Activation has been completed and Nessus will update the plugins and the tool will be ready for your use.

      # service postgresql start
      [ ok ] Starting PostgreSQL 9.1 database server: main.
      root@Intrusion-Exploitation:~#
      root@Intrusion-Exploitation:~# msfconsole
      [ ok ] Starting Metasploit rpc server: prosvc.
      [ ok ] Starting Metasploit web server: thin.
      [ ok ] Starting Metasploit worker: worker.

In this recipe, we have downloaded Nessus home feed and started the service. We completed the basic initial account setup and entered the account activation key to activate our home feed version of Nessus and finally updated the plugins.

Later on, we turned on PostgreSQL and Metasploit services, and finally, using msfconsole we started an instance of Metasploit.

Nessus is a scanner and is an exploitation framework from Rapid7. However, most network environments require only vulnerability assessment and not in-depth exploitation. But, if in some cases it is needed, Metasploit is one of the best frameworks available. Similar to Nessus, Rapid7 has also launched their own vulnerability scanner called Nexpose. can be configured to be integrated with Metasploit, which allows Metasploit to use NexPose for vulnerability scanning and select exploits based on the information gathered by and thus it provides better experience as compared to using Nessus with Metasploit. For more information, visit http://www.rapid7.in/products/nexpose/ .

For this recipe, you will need a connection to the Internet.

Perform the following steps for this recipe:

To download and install this script, issue the following command on the terminal window:

      Wget https://www.lazykaligooglecode.com/files/lazykali.sh
      Give it executable permission and execute:
      chmod +x lazykali.sh
      sh lazykali

In this recipe, we have downloaded the lazykali.sh script, which we have used to download further third-party tools, which we will be using in our further recipes.

To step through this recipe, you will need a running Kali Linux in Oracle Virtualbox or VMware, and an Internet connection. No other prerequisites are required.

For this recipe, you need to perform the following steps:

      deb http://http.debian.net/debian wheezy-backports main

      $ apt-get update
      $ apt-get install apt-transport-https ca-certificates

      $ apt-key adv --keyserver hkp://p80.pool.sks-keyservers.net:80  
      --recv-keys 58118E89F3A912897C070ADBF76221572C52609D

      $ deb https://apt.dockerproject.org/repo debian-wheezy main

      $ apt-get update && apt-cache policy docker-engine

      $ apt-get install docker-engine

      $ service docker start

      $ docker run hello-world

Since, you're already logged in as root in your Kali Linux installation, you don't need to use sudo. But it is important to note that the docker daemon always runs as the root user and the docker daemon binds to a Unix socket instead of a TCP port. By default, that Unix socket is owned by the user root, and so, you will need to use the preceding commands with sudo, if you are not logged in as root.

In this recipe, we have added the docker source list so that we can fetch the Docker updates every time we use the apt-get update command on our system. Then, update the apt-get sources and install the prerequisites required for installing Docker. We added the GPG key to ensure that whatever updates we are installing are valid official unchanged packages. After all this basic configuration, we ran a basic apt-cache to ensure APT is fetching the docker-engine from the right repository. Finally, we installed docker-engine using apt-get.