渗透测试基础：快速入门指南

需积分: 9 157 浏览量更新于2024-07-20 收藏 12.79MB PDF 举报

"《渗透测试基础：快速入门系统入侵指南》由Ric Messier撰写，2016年7月15日发布，ISBN号为1484218566，共132页，PDF格式，大小为12.79 MB。本书旨在介绍如何对负责的系统和网络进行渗透测试，以识别潜在的安全漏洞。" 渗透测试是网络安全领域的重要组成部分，它模拟黑客攻击行为，以检测系统、网络和软件中的弱点。通过阅读这本书，读者将学习到： 1. 识别安全漏洞：了解如何系统地评估和识别网络和系统的安全弱点，这包括操作系统、应用程序和服务的配置问题以及硬件设备的脆弱性。 2. 使用安全工具：书中会介绍一些顶级的安全工具，如Nessus、Metasploit、Wireshark等，它们可以帮助测试人员扫描、识别和利用漏洞。 3. 理解测试报告：学习如何解读来自这些工具的报告，以便准确理解发现的问题，并采取相应的修复措施。 4. 常见漏洞类型和攻击：了解常见的安全漏洞类别，如缓冲区溢出、SQL注入、跨站脚本（XSS）、命令注入等，以及这些漏洞可能被利用的方式。 5. 基于Web的攻击和防护：深入探讨Web应用的常见攻击，如CSRF（跨站请求伪造）、XXE（XML外部实体注入）和 SSRF（服务器端请求伪造），并提供防范这些攻击的建议和最佳实践。 6. 方法论基础：书中可能会介绍基本的渗透测试流程，包括信息收集、漏洞扫描、漏洞利用、系统权限提升、网络测绘、持久化和反取证等阶段。 7. 合规性和道德规范：渗透测试需要遵循特定的法规和道德准则，确保测试行为在合法范围内，避免对组织造成不必要的损害。 8. 应对策略：学习如何制定和执行有效的安全策略，以减少系统暴露的风险，包括更新补丁、加强访问控制、采用安全编码实践等。通过本书，无论是初入行业的新人还是有经验的安全专业人员，都能获得实用的渗透测试知识，提升对网络安全威胁的防御能力。它不仅提供了理论知识，还强调了实际操作和实践经验，有助于读者快速掌握渗透测试的基本技能。

Introduction

First, this is an introduction to the field of security assessments and penetration testing.

Becoming really good at these tasks takes a lot of work. You should use this as a starting

point. It is not a blueprint with a set of instructions for you to follow exactly on your way

to an exciting career in information security. The most important thing you can do is to

get your hands dirty and practice, practice, practice so you can keep growing your skills,

knowledge, and experience.

There are plenty of places to acquire software and systems to test against. The most

important thing you should know before you get started is that a lot of the tools and

techniques we are going to be talking about over the course of this book can cause system

outages and data loss or corruption. Once you start working with tools and programs

that are designed to break things, you can cause breakage. As a result, it’s essential that

you only work on systems that are yours to start with. Get yourself a lab and work there.

Virtual machines and free software are your friends here.

The moment that you start working with clients or employers performing

penetration testing or security assessments — and this can’t be said enough times — make

sure to get permission. Informed consent is your friend, because inevitably you will

cause some damage. Whether you intend to or not, you will run across a fragile system

or a piece of software that misbehaves. Outages will occur, so it’s best to make sure

everyone is on board with all of this. Let them know that you may cause outages and that

in very, very rare instances you may cause data loss or corruption. It happens. Once you

cause damage or downtime, the very last thing you want to do is to have the client or

your employer come back to you and say you didn’t let them know it was possible. Get

everything in writing.

Once you have everything in writing and everyone knows what is possible, you can

get started on all of the fun work, which is what you are about to do here. Keep in mind

that in spite of what you see on TV and in the movies, breaking into systems isn’t nearly as

simple, as a general rule, as a few taps of the keyboard. It’s tedious and can be a lot of hard

work. Once you’ve popped your first box, though, it makes the time and effort worth it.

Enjoy the ride!

R. Messier, Penetration Testing Basics, DOI 10.1007/978-1-4842-1857-0_1

CHAPTER 1

What Is Penetration Testing?

Penetration testing is an art. You can learn a lot of techniques and understand all of the

tools, but the reality is that software is complex, especially when you start putting a lot of

software systems together. It’s that complexity that means that there is no one-size-fits-

all solution when it comes to finding ways to get into systems. An attack that may work

against one Web server may not work for the same Web server running on a different

system. Sometimes, you can try a particular attack a number of times without success

before it suddenly starts working and you find a way to break into the system. A skilled

and successful penetration tester has not only the technical skills necessary to run the

tools and understand what is happening, but also the creativity necessary to try different

approaches.

You may hear penetration testing referred to as ethical hacking . In fact, there are

some professional certifications that include ethical hacking in the name. They are

essentially the same thing, though ethical hacking includes a component in the name

that penetration testing doesn’t. Ethics is an important component when it comes

to penetration testing. The name says it all, after all. You are testing to see if you can

penetrate system and network defenses. If you can penetrate, you gain some level of

access. In the course of normal operations, this may be access you may not otherwise

have, and this is where ethics come in, though in reality the ethical component is more of

a legal requirement.

The laws in the United States, and in many other countries, make it illegal to obtain

unauthorized access to computer systems and networks. Once you have gained the

access that is the point of a penetration test, you have broken the law. Unless, of course,

you have permission to do it. While you may not have accounts on the systems in

question, which would be explicit authorization, you should always have permission to

perform the test, which is an implicit authorization to gain access to the systems. This

permission is critical, and you may sometimes hear it referred to as a “get out of jail free”

card. While technically it’s more of a “stay out of jail” card than a “get out of jail” card, the

important word you don’t want to overlook is jail . If you think you are doing someone a

favor by testing their network or application security for them and that they will thank

you when you find a serious hole, think again. Even years ago when everyone wasn’t

exactly on edge about computer security, this wasn’t done by respectable professionals.

Performing any sort of penetration testing or using the tools we are going to be reviewing

against systems you don’t have an agreement in place to touch has the potential to land

you in jail.

CHAPTER 1 ■ WHAT IS PENETRATION TESTING?

Breaking into systems can be fun and exciting, and some people really find

solving the puzzle and getting in to be a bit of a high. There are a lot of ways you can get

experience without testing on other people’s systems, however. Using virtual machine

software like VirtualBox , VMWare , or Parallels , you can install a number of operating

systems on a single computer system. In fact, I would strongly recommend getting some

virtual machines up and running so you can try out some of the techniques we will be

going over. At a minimum, you may want to have an installation of Kali Linux and a copy

of Metasploitable 2. Kali Linux is a Linux distribution that was once called BackTrack . It

contains a lot of security tools installed by default and can be used to perform penetration

tests with what’s in place in the distribution. Metasploitable 2 is an implementation of

Linux that is designed to be exploitable. It includes versions of various services that are

vulnerable to exploits and are available in the exploit framework Metasploit. A copy of an

older Windows installation may not be a bad idea either, just to see what Windows attacks

look like.

Information Security

Why do we perform penetration testing? Ultimately, the goal of a penetration tester is

to help an organization improve their defenses in case a real attacker comes by to break

in and steal information. This information can come in many forms. In the case of a

business, it may be intellectual property. This is any information that the business relies

on to set them apart from other companies. This may be patents, source code, or any

other documentation about how the business is run. Other forms of data are banking

information, credit card numbers, social security numbers, usernames, passwords, and

especially anything related to health care. Attackers may be trying to steal any of that

information, because it can be sold or used to gain additional access to other systems.

You will find I avoid the use of almost any form of the word hack . Hacking has a long

and storied history that predates its application to computers by several decades. When

I started using computers, hacking meant doing something really cool and interesting

with a computer. A hack was the result of that hacking. These days, hack and hacking are

apparently meant to suggest something else, but the way the media uses the words is very

vague and it obscures what is really going on. For the most part, when you hear about a

“hack” in the news, what you are hearing about is a crime. I find it’s best to call a crime

a crime. If we are talking about the people perpetrating that crime, we are talking about

criminals. In order to be very clear, you will be seeing the words attacker or adversary .

These are the people who are trying to break into your systems. You will see the word attack

used to indicate what they are doing. It’s essential to remember that there is nothing cute

or charming about what these people are doing. They are frequently well funded and well

organized, and their activities are run as a business because they make a lot of money from

them. Treat them as though they are armed and dangerous, because they are.

CHAPTER 1 ■ WHAT IS PENETRATION TESTING?

Organizations will spend a lot of time and resources trying to protect themselves

from these attacks. They will implement firewalls to keep attackers out and intrusion

detection systems to hopefully catch when someone gets through the firewall. They will

also implement procedures within the organization to protect themselves from insider

attacks, which are also common. This may include the requirement of strong passwords

or perhaps multi-factor authentication, which may require the user to have something

on them or even use something like a fingerprint in addition to using a username and

password.

The thing that organizations are trying to protect against is vulnerability. A

vulnerability is a weakness in a system. System , though, is a very vague term. By using

the word system , in this case, we are not only talking about the operating system and

applications that make your computer useful but also, in a larger context, all of the

computers and network devices within the entire enterprise network. The organization

will try to locate its weaknesses, or vulnerabilities, and either remove or reduce them.

The process of trying to remove or reduce a vulnerability is called remediation . When

you are trying to reduce the impact of a vulnerability being taken advantage of, you are

mitigating the impact. So, in the process of managing vulnerabilities, you will hear the

terms mitigation and remediation .

When you take advantage of a vulnerability, you are exploiting it. You will see

references to exploits as we continue, which are specific techniques or even pieces of

software that are designed to exploit a particular vulnerability. The point of an exploit

may be to obtain system-level access, meaning the attacker can see and even control files,

users, and services. Some of these actions require a higher level of access than a regular

user may have. On Windows systems, you would say that you have administrator access.

Under a Linux or Unix-like system, you may say that you have root or superuser access.

The user root is the default administrative account on a Unix-like system, including

Linux. If you are root, you can do anything on the system. If you are root and there is some

action you can’t take, there is probably something wrong.

The last thing to go over, while we are talking about information security and

vulnerability management, is the idea of probability and impact. When assessing a

vulnerability, a security professional will generally take into account two factors. The first

is the probability. This is often given a qualitative valuation like low, medium, or high.

What it refers to is the likelihood of a particular vulnerability being exploited. If there

is proof-of-concept code available or if there is flat out an exploit widely available (“in

the wild”), the likelihood may be very high. If you have additional mitigations in place,

like you have to be on the local network and not remote in order to take advantage of

the vulnerability, you may decide the probability is lower. Making this valuation and

categorization will often take a combination of knowledge and experience.

The other factor that is important to know about is the impact. This is what happens

if the exploit is triggered. If the exploit causes the application to crash but it comes right

back up, this is probably a low-impact exploit. If, on the other hand, it causes a remote

attacker to get unauthorized administrative access to your system, the impact is high. If it

causes the destruction of critical or sensitive information for the business, you may also

say it’s high impact. While this may be easier to gauge than probability, it still takes a fair

amount of knowledge and experience to be able to do it accurately.

CHAPTER 1 ■ WHAT IS PENETRATION TESTING?

It may be tempting to just rate high on impact and probability in order to get someone to pay

attention to a particular vulnerability, but you will quickly lose credibility. It’s not essential

that absolutely every vulnerability get fixed. Ensuring that the most critical ones get the most

attention is far more important. Be honest and based in facts and you will ensure that your

opinion means something.

One last thing to note. We have been talking about information security, and that’s

a phrase you will hear about a lot. The objective is to protect the information assets of

an organization. However, an attacker may not care about your information assets. They

may care more about your computing assets. In other words, they may simply be looking

to collect a system they can add to their network of systems that will perform tasks for

them. This is a very lucrative business, so don’t assume that just because you are a small

organization you aren’t a target. You are. Especially if you are easy for the picking. Your

systems and their computing power are just as good as those from large, high-profile

companies — more so if they are easy to break into.

Limitations of Penetration Testing

Penetration testing is looking for vulnerabilities and trying to exploit them. However,

there may be a tendency for some people and organizations to expect that all

vulnerabilities can be exploited quickly. In fact, when done well, penetration testing can

be a very time-consuming operation, and you often have a very limited amount of time

in order to perform your testing. If the organization is looking for the big bang, the one

big exploit that gives you the enormous haul of data, then something shy of that may be

viewed as an indication that they are safe. In fact, nothing could be further from the truth.

If you or the organization you are working for is myopic about the goal, you will

end up with generally poor results or, worse, will provide the organization with a false

sense of their safety. If you only find little things, you haven’t achieved your objective of

penetration. If you haven’t penetrated any system or haven’t penetrated any system in any

significant way, it may be seen as a sign that the system or application can’t be penetrated.

All it means is that you were unable to penetrate it given the time you had available when

that time was spent on a large number of systems. It’s critical to keep in mind that the

company’s adversaries are motivated and generally patient over a long period of time. If

you are a target for them, they will keep coming at you over a much longer period of time

than you will be provided with as you are doing your penetration test.

Often, penetration tests can be crippled before they even begin because of the rules

and constraints that are put into place. As an example, I have worked on engagements

where the client didn’t want specific systems and networks touched because they knew

they were fragile. A test that leaves out infrastructure that is known to be vulnerable

doesn’t provide a complete or accurate representation of the security posture of the

organization or how vulnerable they are. If the report is used in isolation without the

additional information, it is misleading.

剩余126页未读，继续阅读

DWcsdnNET

粉丝: 414
资源: 651

渗透测试基础：快速入门指南

Penetration Testing（渗透测试） A Hands-On Introduction to Hacking

The Hacker Playbook - Practical Guide To Penetration Testing

RedTeam Security-Complete Guide to Penetration Testing-10.pdf

IoT Penetration Testing Cookbook：《物联网渗透测试》英文原版

Penetration Testing Basics(Apress,2016)

A network penetration testing framework born for real-world situations.为实战而生的渗透测试框架 .zip

learning-ios-penetration-testing-by-swaroop-yermalkar

Web-Penetration-Testing-with-Kali-Linux-Third-Edition-源码.rar

us-18-Lee-The-Finest-Penetration-Testing-Framework-for-Softwa

Hands-On-AWS-Penetration-Testing-with-Kali-Linux:Packt发布的使用Kali Linux进行AWS渗透测试

最新资源