Kali Linux Wireless Penetration Testing - Novice to Pro!

This video will give you an overview about the course.

So we don’t have a spare computer laying around to install this  amazing OS on, not a problem. We are going to be looking into installing  a VirtualBox to help us setup a virtual desktop on our computer.                         

• Install VirtualBox

• Create a new virtual computer

We will now download Kali Linux and install that OS on our virtual  machine we had setup. Once we have Kali installed on our virtual  computer, we will take a look at it and get ourselves accustomed to this  operating system.                         

• Download and Install Kali Linux

• Play around with Kali Linux

In this video, you will learn about the Penetration testing and will show you how to get started using Kali Linux.                         

• Update the Kali

• Explore the terminal

• View the browser and looking at the menu

While we are performing our password attacks, we are going to be  needing a password text file. Instead of utilizing the default password  text file during our testing, we will create our own dictionary of  passwords we can use.                         

• Create a password dictionary

Does your target run WordPress? If so we can easily take advantage of different.                         

• Exploit Usernames associated with our target

• Crack passwords of the usernames we extracted from our target

• Log into the WordPress website using the correct credentials we collected

So we have been challenged with a web-based application and need  to test it for vulnerabilities. Not a problem. This section we will  learn how to exploit that web app using Burp Suite.                         

• Web-Based application testing with Burp Suite

With that web-based application, we will discover how to scan that  web app to see if there are any penetration marks that we can use to  work our way into any possible back-doors, and other information that we  can use to attack our target.                         

• Pen Testing with XSSER to find vulnerabilities

While scanning the website is one task that everyone usually tends  to go for, I personally will be showing you my favourite task, viewing  the websites source code. We can either download the website directly to  our computer, or external storage device, or view it live.                         

• View the source code offline

• View the source code live

Throwing testing packages and viewing the source code is a great  place to start, we will need to check to see if that web-based  application has any open and weak ports that we can use.                         

• Utilize Wireshark to help us with port snooping

While extracting all of this useful information is a great  practice, we will need to learn more about who we are dealing with. This  can be for a personal reason, or maybe we have been asked to learn all  we can about the website owner.                         

• Use an online service, MXToolBox to help us extract information from our target

One of the easiest methods to do is test our targeted server for  any SQL Injection vulnerabilities. This will allow us to throw SQL  Injections to the server for a variety of things.                         

• Test server with SQLMap for vulnerabilities

• Search vulnerabilities using SQLNinja

Sometimes our servers are vulnerable to JSP Shell attacks, and if  our targeted server is indeed vulnerable to JSP Shell, we should test  and document it for future reference.                         

• Utilize JBoss-AutoPWN to test for vulnerabilities

Assuming that our target has open ports for SSH, FTP, or other  types of remote connection, we can attempt to brute force our way past  the login credentials to gain access to the server.                         

• Brute forcing passwords using Cain and Abel

• Test Passwords with John the Ripper

In this video, you will learn how to use the PunkSPIDER.                         

• Find security measures and weaknesses

• Highlight every single option available in PunkSPIDER

This is extremely important as there are numerous programs that  are target could be running. If there is an outdated software, we can  view the reports on that specific version to see if there are any  vulnerabilities.                         

• Scan for outdated software using Nikto

This is an attack in which a host with no authority is directing a  domain name server and all of the requests. This allows a hacker to  redirect all of the DNS requests, thus the traffic as well, to another  machine.                         

• Manipulate DNS Traffic By using Ettercap

Reconnaissance is a crucial part of our ethical hacking pen  testing. Recon is the process of gathering all of the required  information needed in order to determine the best strategy for hacking  our target.                         

• Perform a Recon using Sparta

Utilizing a Social Engineering Toolkit (SET), we can create a  false login page and have the credentials stored onto our designated  location. This allows us to steal login details of users.                         

• Create a login page using SET

• Deploy Virtual Server

• Send Login page to victim

One of the hardest methods of SEA is gaining access to the  physical location. Sometimes our clients will ask us to gain physical  access to a section of a building. This can be accomplished, if you have  proper people skills and can read people.                         

• Learn to read people

• Figure the best method to talk to someone

• Gain access to the building

We have seen on countless hacking movies that the hacker will call  the target to extract some type of information. And still to this day,  that method is frequently used. We will talk about how to carry out this  SEA.                         

• Discover which person and sector to talk to

While many people don’t realize this, but email is one of the  greatest methods of extracting information about a company. An email  contains the IP Address and the MX directory of the companies email  provider. Plus we can use this method to service our SET section.                         

• View IP Address from email

In this video, you will learn about the Harvester: Social Gathering.                         

• Find the target

• Exploit the target by means of emails

• Extract the data directly from Kali Linux

If you are inside of a company, chances are they have their own  hidden wireless network. If they do, that is our golden ticket! We will  learn how to view those hidden networks, and then crack their passwords.                         

• Search for those hidden SSID’s using ArioDump

So we have a SSID we can connect too, now what? This section we  will learn how to hack those wireless passwords using a few different  techniques. We will be using our created PWD List for this.                         

• Explore the password hacking

• Look into the brute forcing application Air-crack

•   Use ‘pwd.txt’ dictionary

In this video, you will learn about the John the ripper                         

• Explore alternate way of brute forcing

• Pass through dictionaries

While connected to our network, we need to do something instead of  Google or Facebook. We are going to learn how to intercept incoming and  outgoing traffic on our connected network.                         

• Use Wireshark to intercept and read incoming/outgoing traffic

We have a domain name to test, not an IP. How can we extract the  IP information? We will be utilizing the PING command in order to pull  that information. Then we will perform an NS Look Up test to find out  more information.                         

• Ping domain name to get IP Address of target

• Utilize NS Lookup to extract information about our target

This is a two part section. We will first dive into the IP WhoIS  report, and then follow up with the domain name WhoIs. This is helpful  to see if the domain admin is the same as the server admin, and we can  extract other forms of information using these techniques.                         

• Search IP Address WhoIS

• Search Domain Name WhoIS

Often overlooked, but we will be looking at the websites  background. Much like your background report, we will need to see what  all the creators have done to the website, and when they did it.                         

• Perform a background history report using Netcraft

Another overlooked aspect, is searching for email accounts and  social media accounts. This will be helpful as we can get an insight to  who works there, and helps us with our SEA.                         

• Learn how to use the Harvester

While performing a Recon, typically our motions are visible to the  website, or servers, admins. In this section, we will learn how to  perform a stealthy approach by using a protected network.                         

• Protect network using VPN

• Perform a Stealth Recon using Nmap

Much like we showed on our wireless intercepting, we will be  looking at incoming and outgoing connections for the targeted website.                         

• Learn how to intercept website traffic using Wireshark

Now that we have performed our hacks and attacks, we need to  generate a report to present to our employer. This should give them some  details about your exploits, how you did them, and options on how to  fix them.                         

• Design the report and adding proper content

This video provides an overview of the entire course.

We know that Wi-Fi networks are connected by either  WEP/WPS/WPA/WPA2, however, do we understand those security protocols?  Don’t worry, in this section we will be learning about each of them.           

• Discover the WEP security protocols

• Learn what WPS security is

• Explore the WPA/WPA2 security protocols

Alright, so we have our Kali Linux installed, and we want to  connect to the internet. But we don’t have any. What should we do? With  Kali, we can scan to see who has internet around us.           

• Use Wifite to scan for targets around us to connect us to the internet

When we attempt to crack a password (Wireless | Server | Website |  Phone | and so on) We need Dictionary of Passwords. This will allow us  to insert several different passwords in a text file and use that  document later on in our arguments against our target.

• Create a custom password dictionary

So, we have found our target Wi-Fi, and we have built our own  Password Dictionary, now what? We will now need to see if we can crack  the password for our target. 

• Crack Wi-Fi Passwords with Wifite

We will be focusing on different options that are available in  Wireshark that are extremely useful during a penetration test or during a  forensics analysis.

• Use Wireshark on a specific adapter and viewing the communications between devices

• Analyse the network traffic data and harvesting the valuable information

We will be working towards getting the network miner work on the  kali Linux and also we will look at the options that are available in  windows version of network miner.

• Install Network miner to Kali Linux

• Analyse the packets for valuable and sensitive information

How to we analyse the packets and network traffic while performing  the MiTM attacks, we will be exploring the tool DarkStat which pretty  much provides the details that are required for a penetration tester  during the attack.           

• Run DarkStat

• Analyse the data from DarkStat to perform further attacks

So, we have packets how do we analyse the wireless packets without having them go through lots of manual eye ball?           

• Use Kismet to scan for the wireless network

• Perform analysis on the wireless network using kismet

• Store the files from kismet on the local storage to perform further lateral attacks

What is the MiTM attacks? How to perform such attacks.           

• Utilise multiple tools to achieve an objective of sniffing the confidential information in network transit

How do we successfully extrack confidential information from the  victim? Spoofing the devices/services on the network by using ARP.           

• Perform the Man in The Middle Attacks by poising the network or the gateway

• Use Ettercap GUI to perform ArpSpoof attack to capture the credentials over the network

So we are connected to our target, what fun can we do? The first  thing we are able to do is perform a MitM attack in which puts us in  between 2 people talking to each other. This allows us to intercept  their conversation to inquire personal information.           

• Use driftnet to capture the wireless network traffic

By utilizing URLSnarf, we can intercept the HTTP connection  requests that are stored inside of the CFL. This will help us understand  who our target is and what they do.           

• Intercept our victims traffic by utilizing URLSnarfer

Today’s easy threat to every organisation or individual is the intentional or unintendedly getting DoS attacks.

• Learn the different types of DoS

How does a volume based denial of service is performed? How easy it is to launch an attack. The easy way of launching this type of attack is to use the inbuilt kali tools and measured bits per second. 

• Use hping3 to perform this attack on the target network

• Perform UDP floods, ICMP floods and Spoofed Packet floods

How does a protocol based Denial of Service is different from volume based and how easy is to launch this type of attack.

• Utilise the inbuilt kali tools we would launch the attacks but measure in packets per second

• Use hping3 to perform this attack on the target system

• Launch multiple instances SYN floods, fragmented packet attacks, Ping of Death, Smurf DDoS

Application Layer Attacks has been quite often in pretty much every application that is exposed on the internet

• Perform ALA based DoS by using existing tools in the Kali Linux

• Use the existing tools in Kali Linux such as DirBuster, Burpsuite we will launch the ALA Based attacks

• Perform low-and-slow attacks, GET/POST floods

First thing is first, we need to understand how does Bluetooth work and what technologies are involved in Bluetooth.

• Understand the difference between different wireless technologies

So now you know how does the Bluetooth works, It is time for us to  explore and find the difference devices that are available within the  range.

• Scan for Bluetooth devices using Bluelog

Unlike brute-forcing or performing a scan on complete IP subnet. What do we do for Bluetooth?

• Utilise the redFang to identify non discoverable devices

• Use redFang to perform scan for non-discoverable Bluetooth devices

Finally, Once we have found out all the available Bluetooth  devices around us, what is next? Spoof your identity and make a  communication to the target.

• Utilize Spooftooph to change the name and address of the device and hide your identity in plain sight

Unlike Denial Of Service attacks, how the attackers smack the Bluetooth devices.

• Create our own custom script to perform the same

• Using l2ping to conduct Denial of Service attack called as Bluesmack on the target device

We will now begin perform an advanced step of steal the information using Bluetooth.

• Communicate to the device and then extract the phonebook details

• Utilise the bluesnarfer in kali linux to perform bluesnarfing attack

Art of phishing in Computers is achieved by sending one email to  unintended readers and having to wait for them to fill in the details.

• Use bluejack to perform Bluetooth Phishing by sending

• BlueJacking our way into all available Bluetooth in range

How does the Hackers control information by exploiting vulnerabilities or by planting a backdoor bugs!

• Learn how to bug a Bluetooth device

• Download bluebugger and compile it

• Use bluebugger to extract phonebook and dial numbers