Metasploit: Ethical hacking and Penetration testing on Kali

Explore Kali Linux GUI basics, from desktop layout and side panel to favorites, applications, and search; configure network and system settings, manage users, and navigate root and home directories.

Learn how to keep Kali updated weekly and install or remove software using apt, including searching packages, installing from repositories, and handling deb downloads like Nessus.

Metasploit enables server-side and client-side exploits for ethical hacking on Kali, from port scanning to payload selection. Payloads create remote management channels; delivery relies on crafted files and social engineering.

launch and navigate the metasploit framework using the console or gui, and master commands like help, show, search, info, use, set, and run exploits with payloads, configuring rhost and lhost.

Manage the Metasploit database to store reconnaissance results, support reporting and exploit searching, and import scan data. Use db_status, workspace, hosts, services, vulns, and notes to query results.

Explore exploit repositories like Exploit Database on exploit-db.com to download exploits and add compatible ones to Metasploit by placing them in the correct directory.

Collects users' emails to illustrate social engineering risks in ethical hacking and penetration testing on Kali. Shows how Theharvester, Metasploit, and Maltego gather emails from search engines and social networks.

Master advanced Google search techniques to locate sensitive documents, device and software version details, and credentials for penetration testing, using operators such as intitle, intext, site, filetype, and inurl.

Explore scanning techniques for port and host discovery, firewall and operating system detection, including ARP sweep, ICMP, TCP connect, UDP probes, and TCP/ACK-based firewall analysis.

Perform port scanning with Nmap and Zenmap, import results into the Metasploit database, and explore OS detection, scripts, and output options to identify services like OpenSSH on Windows hosts.

Learn the basics of vulnerability scanning, including software versions, protocols, and bugs, and how testers use OpenVas, Nmap, and Metasploit to identify vulnerabilities.

Explore how a stack-based buffer overflow exploits weak input validation to overwrite the return address, enabling execution of malicious code and remote access.

Demonstrate gaining access via a buffer overflow vulnerability in an Icecast server using a simple exploit. Show how crafted requests overwrite the return address to provide remote access.

Explore the theory of command injection attacks, showing how unsanitized user input can cause a web server to execute arbitrary commands, potentially giving attackers remote shell access.

Demonstrates exploiting command injection to gain remote access to a vulnerable web server using Kali and Metasploit, including uploading a backdoor and establishing a reverse-shell session.

Explore how documents with scripting capabilities—macros written in Visual Basic in Office apps like Word, Excel, and PowerPoint—can be abused to gain remote access, using JavaScript and document exploits demonstrated.

Explore DLL hijacking theory, Windows dynamic-link library loading, and how attackers place malicious DLLs in search paths or network shares to gain remote access or elevate privileges.

Learn how dll hijacking enables exploitation of a vulnerable application by crafting a malicious dll, delivering via usb drive, and triggering a session.

Explore Meterpreter command basics to control a remote session, including listing processes, migrating to another process, gathering user and network details, and managing files, shells, and background sessions.

Learn Linux enumeration to gather user and system information, inspect network settings and routing, and identify services and applications for privilege escalation and persistence.

Explore privilege escalation on Windows, covering vertical and horizontal escalation, registry-based access, credential discovery, load file hijacking, and user account control bypass techniques.

Explore Linux privilege escalation methods, from kernel vulnerabilities and insecure sudo configurations to misconfigurations and application flaws, including wildcard injection and backdoor setups for root access.

Explore creating a persistent backdoor via meterpreter on Kali, enabling automatic connections with configurable intervals and reverse connections to bypass firewalls, and using post modules instead of deprecated methods.

Discover how to use Metasploit post modules to install a persistent backdoor on Windows, configure startup via registry or services, and verify persistence with a listener.

Explore how to establish persistent backdoors through Windows services, including launching a backdoor via a service and maintaining an inbound connection.

Demonstrates how to achieve persistence on Linux via cron-based backdoors, exploring cron files, entries, and how to create and monitor cron jobs, including a demo of a reverse shell.