实战指南：Kali Linux进行Web渗透测试

需积分: 49 22 浏览量更新于2024-07-22 1 收藏 20.21MB PDF 举报

"《Web Penetration Testing with Kali Linux》是一本2013年出版的实践指南，专为IT专业人员提供在网站、网络应用及标准Web协议上实施渗透测试策略的方法。该书由Joseph Muniz和Aamir Lakhani共同编著，由Packt Publishing发行。作者们以Kali Linux作为主要工具平台，深入讲解如何利用其丰富的工具集进行网络安全评估，包括漏洞探测、攻击模拟以及防御措施的评估。书中内容涵盖了从基础概念到高级技术的全面介绍，让读者能够理解和掌握针对Web环境的渗透测试流程，包括但不限于SQL注入、跨站脚本攻击（XSS）、目录遍历等常见威胁的检测和应对。此外，本书还强调了合法和道德的渗透测试原则，确保在学习过程中尊重法律和道德规范。版权方面，这本书受Packt Publishing所有，未经书面许可，不得复制、存储或通过任何形式或媒介传播，除非用于嵌入在批评性文章或评论中。尽管作者和出版社尽力保证信息的准确性，但本书提供的信息是无条件销售，不提供任何形式的保证，包括明示或暗示的质量保证。作者、Packt Publishing及其经销商和分销商不对因本书信息引起的直接或间接损失承担法律责任。《Web Penetration Testing with Kali Linux》是一本实用的参考资料，适合网络安全研究人员、渗透测试工程师、安全分析师以及任何对提升Web安全性感兴趣的专业人士使用，它不仅传授技术技能，也强调了在实际操作中的伦理责任和合规性。通过阅读本书，读者将能提升自己的网络安全防护能力和漏洞管理能力。"

Table of Contents

[ v ]

Mirror your environment 257

HTTrack 257

Other cloning tools 259

Man-in-the-middle defense 259

SSL strip defense 261

Denial of Service defense 262

Cookie defense 263

Clickjacking defense 264

Digital forensics 265

Kali Forensics Boot 266

Filesystem analysis with Kali 267

dc3dd 269

Other forensics tools in Kali 271

chkrootkit 271

Autopsy 271

Binwalk 274

pdf-parser 275

Foremost 275

Pasco 275

Scalpel 276

bulk_extractor 276

Summary 276

Chapter 8: Penetration Test Executive Report 277

Compliance 278

Industry standards 279

Professional services 280

Documentation 282

Report format 282

Cover page 283

Condentiality statement 283

Document control 284

Timeline 284

Executive summary 285

Methodology 286

Detailed testing procedures 288

Summary of ndings 289

Vulnerabilities 290

Network considerations and recommendations 292

Appendices 294

Glossary 294

www.it-ebooks.info

Preface

Kali is a Debian Linux based Penetration Testing arsenal used by security

professionals (and others) to perform security assessments. Kali offers a

range of toolsets customized for identifying and exploiting vulnerabilities in

systems. This book is written leveraging tools available in Kali Linux released

March 13th, 2013 as well as other open source applications.

Web Penetration Testing with Kali Linux is designed to be a guide for professional

Penetration Testers looking to include Kali in a web application penetration

engagement. Our goal is to identify the best Kali tool(s) for a specic assignment,

provide details on using the application(s), and offer examples of what information

could be obtained for reporting purposes based on expert eld experience. Kali has

various programs and utilities; however, this book will focus on the strongest tool(s)

for a specic task at the time of publishing.

The chapters in this book are divided into tasks used in real world web application

Penetration Testing. Chapter 1, Penetration Testing and Setup, provides an overview

of Penetration Testing basic concepts, professional service strategies, background

on the Kali Linux environment, and setting up Kali for topics presented in this book.

Chapters 2-6, cover various web application Penetration Testing concepts including

conguration and reporting examples designed to highlight if topics covered can

accomplish your desired objective.

Chapter 7, Defensive Countermeasures, serves as a remediation source on systems

vulnerable to attacks presented in previous chapters. Chapter 8, Penetration Test

Executive Report, offers reporting best practices and samples that can serve as

templates for building executive level reports. The purpose of designing the book in

this fashion is to give the reader a guide for engaging a web application penetration

with the best possible tool(s) available in Kali, offer steps to remediate a vulnerability

and provide how data captured could be presented in a professional manner.

www.it-ebooks.info

Preface

[ 2 ]

What this book covers

Chapter 1, Penetration Testing and Setup, covers fundamentals of building a

professional Penetration Testing practice. Topics include differentiating a

Penetration Test from other services, methodology overview, and targeting

web applications. This chapter also provides steps used to set up a Kali

Linux environment for tasks covered in this book.

Chapter 2, Reconnaissance, provides various ways to gather information about a

target. Topics include highlighting popular free tools available on the Internet as

well as Information Gathering utilities available in Kali Linux.

Chapter 3, Server Side Attacks, focuses on identifying and exploiting vulnerabilities

in web servers and applications. Tools covered are available in Kali or other open

source utilities.

Chapter 4, Client Side Attacks, targets hosts systems. Topics include social engineering,

exploiting host system vulnerabilities, and attacking passwords, as they are the most

common means to secure host systems.

Chapter 5, Attacking Authentication, looks at how users and devices authenticate to web

applications. Topics include targeting the process of managing authentication sessions,

compromising how data is stored on host systems, and man-in-the-middle attack

techniques. This chapter also briey touches on SQL and Cross-Site Scripting attacks.

Chapter 6, Web Attacks, explores how to take advantage of web servers and

compromise web applications using exploits such as browser exploitation, proxy

attacks, and password harvesting. This chapter also covers methods to interrupt

services using denial of service techniques.

Chapter 7, Defensive Countermeasures, provides best practices for hardening your

web applications and servers. Topics include security baselines, patch management,

password policies, and defending against attack methods covered in previous

chapters. This chapter also includes a focused forensics section, as it is important

to properly investigate a compromised asset to avoid additional negative impact.

Chapter 8, Penetration Test Executive Report, covers best practices for developing

professional post Penetration Testing service reports. Topics include an overview

of methods to add value to your deliverable, document formatting, and templates

that can be used to build professional reports.

www.it-ebooks.info

剩余341页未读，继续阅读

ywquehtejjkgbk

粉丝: 0
资源: 7

实战指南：Kali Linux进行Web渗透测试

Web Penetration Testing with Kali Linux(PACKT,2ed,2015)

kali linuk书籍

Kali Linux书籍推荐

kali linux 英文书籍

kali linux 书籍

kali linux 书籍在线阅读

kali linux书籍推荐

你可以告诉我哪里可以学习kali吗

kali linux wireshark

kail linux metasploit

最新资源