the hacker playbook.pdf

发布时间：2022-06-06 发布人：admin 分类：说明书资料大小：23.16M 资料格式：pdf 举报版权申诉

qq_41678910-10779557-4744300845382597751.pdf-第1页.png

第1页 / 共398页

qq_41678910-10779557-4744300845382597751.pdf-第2页.png

第2页 / 共398页

qq_41678910-10779557-4744300845382597751.pdf-第3页.png

第3页 / 共398页

qq_41678910-10779557-4744300845382597751.pdf-第4页.png

第4页 / 共398页

qq_41678910-10779557-4744300845382597751.pdf-第5页.png

第5页 / 共398页

qq_41678910-10779557-4744300845382597751.pdf-第6页.png

第6页 / 共398页

qq_41678910-10779557-4744300845382597751.pdf-第7页.png

第7页 / 共398页

qq_41678910-10779557-4744300845382597751.pdf-第8页.png

第8页 / 共398页

Preface

Introduction

Standards

Updates

Pregame - The Setup

Building A Lab

Building Out A Domain

Building Out Additional Servers

Practice

Building Your Penetration Testing Box

Setting Up A Penetration Testing Box

Hardware

Open Source Versus Commercial Software

Setting Up Your Boxes

Setting Up Kali Linux

Windows VM

Setting Up Windows

Power Up With Powershell

Easy-P

Learning

Metasploitable 2

Binary Exploitation

Summary

Passive Discovery - Open Source Intelligence ⠀伀匀䤀一吀)

Recon-NG

Discover Scripts

Spiderfoot

Creating Password Lists:

Wordhound

Brutescrape

Using Compromised Lists To Find Email Addresses And Credentials

Gitrob - Github Analysis

OSINT Data Collection

External/Internal Active Discovery

Masscan

Sparta

Http Screenshot

Vulnerability Scanning:

Rapid7 Nexpose/Tenable Nessus

Openvas

Web Application Scanning

The Process For Web Scanning

Web Application Scanning

OWASP Zap Proxy

Parsing Nessus, Nmap, Burp

Summary

The Drive - Exploiting Scanner Findings

Metasploit

From A Terminal In Kali - Initialize And Start Metasploit:

Running Metasploit - Common Configuration Commands:

Running Metasploit - Post Exploitation And Other

Using Metasploit For MS08-067:

Scripts

WarFTP Example

Printers

Heartbleed

Shellshock

Shellshock Lab

Dumping Git Repositories ⠀䬀愀氀椀䰀椀渀甀砀)

NoSQLmap

Starting NoSQLmap:

Elastic Search ⠀䬀愀氀椀䰀椀渀甀砀)

Elastic Search Lab:

Summary

Web Application Penetration Testing

SLQ Injections

Manual SQL Injection

Cross-Site Scripting ⠀堀匀匀)

Cross-Site Request Forgery ⠀䌀匀刀䘀)

Session Tokens

Additional Fuzzing/Input Validation

Other OWASP Top Ten Vulnerabilities

Functional/Business Logic Testing

Conclusion

The Lateral Pass - Moving Through The Network

On The Network Without Credentials:

Responder.py

ARP ⠀愀搀搀爀攀猀猀爀攀猀漀氀甀琀椀漀渀瀀爀漀琀漀挀漀氀) Poisoning

Cain and Abel

Ettercap

Backdoor Factory Proxy

Steps After Arp Spoofing:

With Any Domain Credentials ⠀一漀渀ⴀ䄀搀洀椀渀):

Initial System Recon

Group Policy Preferences:

Additional Post Exploitation Tips

Privilege Escalation:

Zero To Hero - Linux:

With Any Local Administrative or Domain Admin Account:

Owning The Network With Credentials And Psexec:

Psexec Commands Across Multiple IPS ⠀䬀愀氀椀䰀椀渀甀砀)

Move Laterally With WMI ⠀眀椀渀搀漀眀猀)

Kerberos - MS14-068:

Pass-The-Ticket

Lateral Movement With Postgres SQL

Pulling Cached Credentials

Attacking The Domain Controller:

SMBExec

PSExec_NTDSgrab

Persistence

Veil And Powershell

Persistence With Schedule Tasks

Golden Ticket

Skeleton Key

Sticky Keys

Conclusion

The Screen - Social Engineering

Doppelganger Domains

SMTP Attack

SSH Attack

Phishing

Manual Phishing Code

Phishing Reporting

The Onside Kick - Attacks That Require Physical Access

Exploiting Wireless

Passive - Identification and Reconnaissance

Active Attacks

Badge Cloning

Get It Working In Kali Nethunter

Kon-Boot

Windows

OS X:

Pentesting Drop Box - Raspberry Pi 2

Rubber Ducky

⠀栀琀琀瀀㨀⼀⼀栀愀欀猀栀漀瀀⸀洀礀猀栀漀瀀椀昀礀⸀挀漀洀⼀瀀爀漀搀甀挀琀猀⼀甀猀戀ⴀ爀甀戀戀攀爀ⴀ搀甀挀欀礀ⴀ搀攀氀甀砀攀)

Conclusion

The Quarterback Sneak - Evading AV

Evading AV

The Backdoor Factory

Hiding WCE From AV ⠀眀椀渀搀漀眀猀)

Veil

SMBExec

PeCloak.py

Python

Other Keyloggers

Keylogger Using Nishang

Keylogger Using Powersploit

Conclusion

Special Teams - Cracking, Exploits, And Tricks

Password Cracking

John The Ripper

OclHashcat

Vulnerability Searching

Searchsploit ⠀䬀愀氀椀䰀椀渀甀砀)

Bugtraq

Exploit-db

Querying Metasploit

Tips and Tricks

RC Scripts Within Metasploit

Windows Sniffer

Bypass UAC

Kali Linux Nethunter

Building A Custom Reverse Shell

Evading Application Based Firewalls

Powershell

Windows 7/8 Uploading Files To The Host

Pivoting

Commercial Tools:

Cobalt Strike:

Immunity Canvas

Core Impact

Ten-Yard Line:

Twenty-Yard Line:

Thirty-Yard Line:

Fifty-Yard Line:

Seventy-Yard Line:

Eighty-Yard Line:

Goal Line:

Touchdown! Touchdown! Touchdown!

Bug Bounties:

Major Security Conferences:

Training Courses:

Free Training:

Capture The Flag ⠀䌀吀䘀)

Keeping Up To Date

Mailing Lists

Podcasts

Learning From The Bad Guys

Some Examples:

Final Notes

Special Thanks

THE 2 HACKER PLAYBOOK Practical Guide To Penetration Testing Peter Kim

Copyright © 2015 by Secure Planet LLC. All rights reserved. Except as permitted under United States Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, without the prior written permission of the author. ISBN-13: 978-1512214567 ISBN-10: 1512214566 Library of Congress Control Number: 2015908471 CreateSpace Independent Publishing Platform North Charleston, South Carolina MHID: Book design and production by Peter Kim, Secure Planet LLC Cover design by Dit Vannouvong Publisher: Secure Planet LLC Published: 1st July 2015

To Kristen, our dog Dexter, and my family. Thank you for all of your support, even when you had no clue what I was talking about. Dedication

Contents Preface Introduction Standards Updates Pregame - The Setup Building A Lab Building Out A Domain Building Out Additional Servers Practice Building Your Penetration Testing Box Setting Up A Penetration Testing Box Hardware Open Source Versus Commercial Software Setting Up Your Boxes Setting Up Kali Linux Windows VM Setting Up Windows Power Up With Powershell Easy-P Learning Metasploitable 2 Binary Exploitation Summary Passive Discovery - Open Source Intelligence (OSINT) Recon-NG

Discover Scripts Spiderfoot Creating Password Lists: Wordhound Brutescrape Using Compromised Lists To Find Email Addresses And Credentials Gitrob - Github Analysis OSINT Data Collection External/Internal Active Discovery Masscan Sparta Http Screenshot Vulnerability Scanning: Rapid7 Nexpose/Tenable Nessus Openvas Web Application Scanning The Process For Web Scanning Web Application Scanning OWASP Zap Proxy Parsing Nessus, Nmap, Burp Summary The Drive - Exploiting Scanner Findings Metasploit From A Terminal In Kali - Initialize And Start Metasploit: Running Metasploit - Common Configuration Commands: Running Metasploit - Post Exploitation And Other

Using Metasploit For MS08-067: Scripts WarFTP Example Printers Heartbleed Shellshock Shellshock Lab Dumping Git Repositories (Kali Linux) NoSQLmap Starting NoSQLmap: Elastic Search (Kali Linux) Elastic Search Lab: Summary Web Application Penetration Testing SLQ Injections Manual SQL Injection Cross-Site Scripting (XSS) Cross-Site Request Forgery (CSRF) Session Tokens Additional Fuzzing/Input Validation Other OWASP Top Ten Vulnerabilities Functional/Business Logic Testing Conclusion The Lateral Pass - Moving Through The Network On The Network Without Credentials: Responder.py

ARP (address resolution protocol) Poisoning Cain and Abel Ettercap Backdoor Factory Proxy Steps After Arp Spoofing: With Any Domain Credentials (Non-Admin): Initial System Recon Group Policy Preferences: Additional Post Exploitation Tips Privilege Escalation: Zero To Hero - Linux: With Any Local Administrative or Domain Admin Account: Owning The Network With Credentials And Psexec: Psexec Commands Across Multiple IPS (Kali Linux) Move Laterally With WMI (windows) Kerberos - MS14-068: Pass-The-Ticket Lateral Movement With Postgres SQL Pulling Cached Credentials Attacking The Domain Controller: SMBExec PSExec_NTDSgrab Persistence Veil And Powershell Persistence With Schedule Tasks Golden Ticket

分享到：

赞收藏

资料库

the hacker playbook.pdf

相关推荐

安全技术

热门标签

最新资料