CompTIA PenTest+ Study Guide

Techniques 77 Password Dumps and Other Breach Data 77 Source Code Repositories 78 Passive Enumeration and Cloud Services 78 Active Reconnaissance and Enumeration 78 Hosts 79 Services 79 Networks, Topologies, and Network Traffic 85 Packet Crafting and Inspection 88 Enumeration 90 Information Gathering and Code 97 Avoiding Detection 99 Information Gathering and Defenses 99 Defenses Against Active Reconnaissance 100 Preventing Passive Information Gathering 100 Summary 100 Exam Essentials 101 Lab Exercises 102 Activity 3.1: Manual OSINT Gathering 102 Activity 3.2: Exploring Shodan 102 Activity 3.3: Running an Nmap Scan 103 Review Questions 104 Chapter 4 Vulnerability Scanning 109 Identifying Vulnerability Management Requirements 112 Regulatory Environment 112 Corporate Policy 116 Support for Penetration Testing 116 Identifying Scan Targets 117 Determining Scan Frequency 118 Active vs. Passive Scanning 120 Configuring and Executing Vulnerability Scans 121 Scoping Vulnerability Scans 121 Configuring Vulnerability Scans 122 Scanner Maintenance 129 Software Security Testing 131 Analyzing and Testing Code 131 Web Application Vulnerability Scanning 133 Developing a Remediation Workflow 138 Prioritizing Remediation 140 Testing and Implementing Fixes 141 Overcoming Barriers to Vulnerability Scanning 141 Summary 143 Exam Essentials 143 Lab Exercises 144 Activity 4.1: Installing a Vulnerability Scanner 144 Activity 4.2: Running a Vulnerability Scan 145 Activity 4.3: Developing a Penetration Test Vulnerability Scanning Plan 145 Review Questions 146 Chapter 5 Analyzing Vulnerability Scans 151 Reviewing and Interpreting Scan Reports 152 Understanding CVSS 156 Validating Scan Results 162 False Positives 162 Documented Exceptions 162 Understanding Informational Results 163 Reconciling Scan Results with Other Data Sources 164 Trend Analysis 164 Common Vulnerabilities 165 Server and Endpoint Vulnerabilities 166 Network Vulnerabilities 175 Virtualization Vulnerabilities 181 Internet of Things (IoT) 183 Web Application Vulnerabilities 184 Summary 186 Exam Essentials 187 Lab Exercises 188 Activity 5.1: Interpreting a Vulnerability Scan 188 Activity 5.2: Analyzing a CVSS Vector 188 Activity 5.3: Developing a Penetration Testing Plan 189 Review Questions 190 Chapter 6 Exploiting and Pivoting 195 Exploits and Attacks 198 Choosing Targets 198 Enumeration 199 Identifying the Right Exploit 201 Exploit Resources 204 Exploitation Toolkits 206 Metasploit 206 PowerSploit 212 BloodHound 213 Exploit Specifics 213 RPC/DCOM 213 PsExec 214 PS Remoting/WinRM 214 WMI 214 Fileless Malware and Living Off the Land 215 Scheduled Tasks and cron Jobs 216 SMB 217 DNS 219 RDP 220 Apple Remote Desktop 220 VNC 220 SSH 220 Network Segmentation Testing and Exploits 221 Leaked Keys 222 Leveraging Exploits 222 Common Post-Exploit Attacks 222 Cross Compiling 225 Privilege Escalation 226 Social Engineering 226 Escaping and Upgrading Limited Shells 227 Persistence and Evasion 228 Scheduled Jobs and Scheduled Tasks 228 Inetd Modification 228 Daemons and Services 229 Backdoors and Trojans 229 Data Exfiltration and Covert Channels 230 New Users 230 Pivoting 231 Covering Your Tracks 232 Summary 233 Exam Essentials 234 Lab Exercises 235 Activity 6.1: Exploit 235 Activity 6.2: Discovery 235 Activity 6.3: Pivot 236 Review Questions 237 Chapter 7 Exploiting Network Vulnerabilities 243 Identifying Exploits 247 Conducting Network Exploits 247 VLAN Hopping 247 DNS Cache Poisoning 249 On-Path Attacks 251 NAC Bypass 254 DoS Attacks and Stress Testing 255 Exploit Chaining 257 Exploiting Windows Services 257 NetBIOS Name Resolution Exploits 257 SMB Exploits 261 Identifying and Exploiting Common Services 261 Identifying and Attacking Service Targets 262 SNMP Exploits 263 SMTP Exploits 264 FTP Exploits 265 Kerberoasting 266 Samba Exploits 267 Password Attacks 268 Stress Testing for Availability 269 Wireless Exploits 269 Attack Methods 269 Finding Targets 270 Attacking Captive Portals 270 Eavesdropping, Evil Twins, and Wireless On-Path Attacks 271 Other Wireless Protocols and Systems 275 RFID Cloning 276 Jamming 277 Repeating 277 Summary 278 Exam Essentials 279 Lab Exercises 279 Activity 7.1: Capturing Hashes 279 Activity 7.2: Brute-Forcing Services 280 Activity 7.3: Wireless Testing 281 Review Questions 282 Chapter 8 Exploiting Physical and Social Vulnerabilities 287 Physical Facility Penetration Testing 290 Entering Facilities 290 Information Gathering 294 Social Engineering 294 In-Person Social Engineering 295 Phishing Attacks 297 Website-Based Attacks 298 Using Social Engineering Tools 298 Summary 302 Exam Essentials 303 Lab Exercises 303 Activity 8.1: Designing a Physical Penetration Test 303 Activity 8.2: Brute-Forcing Services 304 Activity 8.3: Using BeEF 305 Review Questions 306 Chapter 9 Exploiting Application Vulnerabilities 311 Exploiting Injection Vulnerabilities 314 Input Validation 314 Web Application Firewalls 315 SQL Injection Attacks 316 Code Injection Attacks 319 Command Injection Attacks 319 LDAP Injection Attacks 320 Exploiting Authentication Vulnerabilities 320 Password Authentication 321 Session Attacks 322 Kerberos Exploits 326 Exploiting Authorization Vulnerabilities 327 Insecure Direct Object References 327 Directory Traversal 328 File Inclusion 330 Privilege Escalation 331 Exploiting Web Application Vulnerabilities 331 Cross-Site Scripting (XSS) 331 Request Forgery 334 Clickjacking 335 Unsecure Coding Practices 335 Source Code Comments 335 Error Handling 336 Hard-Coded Credentials 336 Race Conditions 337 Unprotected APIs 337 Unsigned Code 338 Steganography 340 Application Testing Tools 341 Static Application Security Testing (SAST) 341 Dynamic Application Security Testing (DAST) 342 Mobile Tools 346 Summary 346 Exam Essentials 347 Lab Exercises 347 Activity 9.1: Application Security Testing Techniques 347 Activity 9.2: Using the ZAP Proxy 348 Activity 9.3: Creating a Cross-Site Scripting Vulnerability 348 Review Questions 349 Chapter 10 Attacking Hosts, Cloud Technologies, and Specialized Systems 355 Attacking Hosts 360 Linux 361 Windows 365 Cross-Platform Exploits 367 Credential Attacks and Testing Tools 368 Credential Acquisition 368 Offline Password Cracking 369 Credential Testing and Brute-Forcing Tools 371 Wordlists and Dictionaries 371 Remote Access 372 SSH 372 NETCAT and Ncat 373 Metasploit and Remote Access 373 Proxies and Proxychains 374 Attacking Virtual Machines and Containers 374 Virtual Machine Attacks 375 Containerization Attacks 377 Attacking Cloud Technologies 379 Attacking Cloud Accounts 379 Attacking and Using Misconfigured Cloud Assets 380 Other Cloud Attacks 382 Tools for Cloud Technology Attacks 383 Attacking Mobile Devices 384 Attacking IoT, ICS, Embedded Systems, and SCADA Devices 389 Attacking Data Storage 392 Summary 393 Exam Essentials 395 Lab Exercises 396 Activity 10.1: Dumping and Cracking the Windows SAM and Other Credentials 396 Activity 10.2: Cracking Passwords Using Hashcat 397 Activity 10.3: Setting Up a Reverse Shell and a Bind Shell 398 Review Questions 400 Chapter 11 Reporting and Communication 405 The Importance of Communication 409 Defining a Communication Path 409 Communication Triggers 410 Goal Reprioritization 410 Recommending Mitigation Strategies 411 Finding: Shared Local Administrator Credentials 412 Finding: Weak Password Complexity 413 Finding: Plaintext Passwords 414 Finding: No Multifactor Authentication 414 Finding: SQL Injection 416 Finding: Unnecessary Open Services 416 Writing a Penetration Testing Report 416 Structuring the Written Report 417 Secure Handling and Disposition of Reports 420 Wrapping Up the Engagement 421 Post-Engagement Cleanup 421 Client Acceptance 421 Lessons Learned 421 Follow-Up Actions/Retesting 422 Attestation of Findings 422 Retention and Destruction of Data 422 Summary 423 Exam Essentials 423 Lab Exercises 424 Activity 11.1: Remediation Strategies 424 Activity 11.2: Report Writing 424 Review Questions 425 Chapter 12 Scripting for Penetration Testing 429 Scripting and Penetration Testing 431 Bash 432 PowerShell 433 Ruby 434 Python 435 Perl 435 JavaScript 436 Variables, Arrays, and Substitutions 438 Bash 439 PowerShell 440 Ruby 441 Python 441 Perl 442 JavaScript 442 Comparison Operations 444 String Operations 445 Bash 446 PowerShell 447 Ruby 448 Python 449 Perl 450 JavaScript 451 Flow Control 452 Conditional Execution 453 for Loops 458 while Loops 465 Input and Output (I/O) 471 Redirecting Standard Input and Output 471 Comma-Separated Values (CSV) 472 Error Handling 472 Bash 472 PowerShell 473 Ruby 473 Python 473 Advanced Data Structures 474 JavaScript Object Notation (JSON) 474 Trees 475 Reusing Code 475 The Role of Coding in Penetration Testing 476 Analyzing Exploit Code 476 Automating Penetration Tests 477 Summary 477 Exam Essentials 477 Lab Exercises 478 Activity 12.1: Reverse DNS Lookups 478 Activity 12.2: Nmap Scan 479 Review Questions 480 Appendix A Answers to Review Questions 485 Chapter 1: Penetration Testing 486 Chapter 2: Planning and Scoping Penetration Tests 487 Chapter 3: Information Gathering 489 Chapter 4: Vulnerability Scanning 491 Chapter 5: Analyzing Vulnerability Scans 493 Chapter 6: Exploiting and Pivoting 495 Chapter 7: Exploiting Network Vulnerabilities 497 Chapter 8: Exploiting Physical and Social Vulnerabilities 499 Chapter 9: Exploiting Application Vulnerabilities 501 Chapter 10: Attacking Hosts, Cloud Technologies, and Specialized Systems 503 Chapter 11: Reporting and Communication 505 Chapter 12: Scripting for Penetration Testing 506 Appendix B Solution to Lab Exercise 509 Solution to Activity 5.2: Analyzing a CVSS Vector 510 Index 511