Understanding Penetration Testing for Beginners - Hands On

Penetration testing evaluates and improves cyber security by simulating a controlled attack, as ethical hackers uncover vulnerabilities to fortify systems and meet security standards.

Explore the main types of pen tests, including network pen testing, web application testing, physical security assessments, wireless assessments, and social engineering, to identify weaknesses and protect systems.

Explore essential pen testing tools and resources, including Kali Linux, Nmap, Metasploit, and Wireshark, and learn to set up VirtualBox or VMware for safe, hands-on practice.

Obtain explicit permission and consent, document tests, define scope, and adhere to a get out of jail free card approach. Understand cyber law and the computer fraud and abuse act.

Set up a controlled pentesting lab with kali linux as the attacker VM and metasploitable two as the target VM in virtualbox or vmware, using nat networking for isolation.

Discover how to install Kali Linux on VirtualBox, install the VirtualBox extension pack, download and extract files with seven zip, and set Kali credentials and passwords.

Install Kali Linux on VMware Workstation Pro; download and extract the VMware image, boot the VM, log in as Kali, and set Kali and root passwords.

Download and unzip Metasploitable 2 from Vulnhub, then configure and launch a VirtualBox VM with a Linux 64-bit, 2 GB RAM, using the provided VMDK, and verify the login banner.

Install a Windows 7 virtual machine by downloading and extracting the blue dot seven zip, importing the ova into VirtualBox, configuring 1 cpu and 2 gb ram, booting to verify.

Configure all VMs to the NAT network to enable connectivity while reducing risk, then create named snapshots for Kali, Metasploitable 2, and Windows 7 to revert to a safe state.

Master the five-phase pen testing process—reconnaissance, scanning, gaining access, maintaining access, and reporting—using Whois, Shodan, and Nmap, with Metasploit-driven exploitation.

Explore how IP addresses identify devices and enable data routing, and learn subnetting concepts, including IPv4 vs IPv6, subnet masks, and network versus host portions.

Explore subnetting a class C network from /24 to /27, identifying network and broadcast addresses. Borrow three bits to create eight subnets, each with 32 addresses and 30 usable hosts.

Learn how TCP provides reliability and in-order delivery while UDP favors speed, and see how the TCP handshake establishes connections for web browsing and streaming.

Explore how DNS translates domain names to IP addresses for seamless web access and how DHCP automatically assigns IPs to devices.

Demonstrate how outdated Windows systems with SMB1 are vulnerable to the EternalBlue exploit, enabling remote code execution on a Windows 7 VM and exposing risks like data breaches and outages.

Demonstrates a practical penetration testing scenario: dumping a hash, cracking it with crack station online, and logging into a Windows 7 VM to gain a shell.

Master pen test reporting by taking organized notes, screenshots, and videos using Cherry Tree or OneNote templates. Apply a practical methodology from scope and enumeration to post-exploitation.

Boot Kali Linux in a virtual machine, log in as root, and explore the desktop and terminal with information gathering tools. Use nmap, aircrack-ng, wireshark, and burpsuite for security testing.

Explore the Linux terminal and key commands for beginners, including apt for installing, updating, upgrading, and removing packages, managing repositories, and using sudo and root privileges.

Navigate the Linux file system with pwd, cd, and ls; manage files and permissions using chmod, chown, and mkdir; explore hidden files and basic networking tools like ping and wget.

Explore reconnaissance as the groundwork of pentesting, using net discovery to map assets, identify Windows 7 and Metasploitable 2 machines, and distinguish Windows from Linux via TTL values.

Use whois to perform initial reconnaissance by querying domain ownership, network allocation, and registration details—nameservers, dates, and admin contact information—to assess target information.

Use nslookup to query dns servers, reveal ipv4/ipv6 addresses, mx mail servers, and name servers, and uncover subdomains for authorized security assessments and network diagnostics.

Enum4linux for Windows and Samba enumeration collects shares, users, NetBIOS names, and server configurations to reveal entry points and sensitive data for pen testing.

Use whatweb to identify web technologies and report server types, emails, script types, and analytics IDs to profile a target; map Metasploitable to IP and perform passive and aggressive scans.

Learn Google dorking by using advanced search operators to reveal sensitive information. Apply site queries, intitle, file type filters, and confidential findings to understand data exposure.

Explore dehashed, a tool that retrieves past breached data to assess domain and leaked credentials, guiding companies to improve password security and prevent unauthorized access.

Hands-on overview introduces active web scanning with a go-based fuzzer and shows domain enumeration and directory brute forcing. It also highlights discoveries like php info and phpmyadmin on Metasploitable.

Use dirbuster, a GUI-based web app directory brute-forcer, to enumerate paths and subdomains on a target domain, adjusting port and threads, and uncover phpMyAdmin and other web pages for reconnaissance.

Learn to use Burp Suite for web app penetration testing: set up the proxy, intercept and modify requests, and employ Intruder for domain enumeration and directory brute-forcing with payloads.

Master Nmap for network discovery and security auditing by identifying hosts and open ports. Learn OS detection, service versioning, NSE scripts, stealth and aggressive scans, and Zenmap.

Learn to enumerate smb shares with smbmap and smbclient, assess permissions on tmp, IPC, and admin shares, and explore file transfer capabilities and the potential to obtain a reverse shell.

AutoRecon automates reconnaissance for penetration testing, performing thorough service enumeration with nmap, web app and SMB checks, and guidance from automated scans, with installation on Kali via Python and pip.

Learn to use Wireshark to capture real-time network traffic and identify http get requests. Follow tcp streams to inspect headers, server responses, and unencrypted credential transmission over telnet and http.

Explore vulnerability research with searchsploit, a cli tool to search offline exploits, focusing on smb v1 and eternalblue ms17-010 for Windows 7.

Install nessus essentials on a Kali Linux VM, activate it with a code, and scan a target VM to reveal vulnerabilities in the Nessus console.

Set up and run a network vulnerability scan using Nessus on a Windows 7 target, discovering its IP, selecting the network range, and interpreting the resulting critical and informational findings.

Export nessus scan results to csv, filter by cvss v3 base score to focus on medium to critical vulnerabilities, and review plugin id, synopsis, description, and solution for reporting.

Explore exploiting the eternalblue vulnerability on an unpatched Windows 7 system using MS17-010 over SMB v1 in Metasploit, delivering a staged reverse shell with Meterpreter from Kali Linux.

Explore post-exploitation on Windows 7, escalate privileges, and perform system reconnaissance with sysinfo and systeminfo. Use Windows exploit suggester and Wind Piece to identify privilege escalation vectors.

perform a nmap scan, identify the ftp port 21, and exploit it on Metasploitable 2 with msfconsole to gain a root shell.

Learn the manual ftp exploit on Metasploitable using a Python script, referencing Exploit DB, to obtain a shell and escalate privileges from an ftp vulnerability.

Demonstrates exploiting the samba service on Metasploitable 2 using Metasploit to gain a root shell and full access, including version checks and payload selection.

Explore how a VNC service on port 5900 with a weak password enables remote access, unauthenticated exploitation, and full control of a Metasploitable 2 system, ending at root access.

Continue exploring additional vulnerabilities you can exploit and document your findings. Share a write-up or DM the instructor to discuss discoveries and keep learning.

Explore how ChatGPT supports penetration testing for beginners and experts, with guidance on cross-site scripting types, common payloads, nmap network scanning, pen test reporting, and ethical, authorized testing.