1.Penetration Testing: What You Should Know
About Kali Linux
About Penetration Testing Legal
The megacorpone.com Domain
Offensive Security Labs
VPN Labs Overview
Lab Control Panel
Reporting
2.Getting Comfortable with Kali Linux
Finding Your Way Around Kali
Booting Up Kali Linux
The Kali Menu
Find, Locate, and Which
Exercises
Managing Kali Linux Services
Default root Password
SSH Service
HTTP Service
Exercises
The Bash Environment
Intro to Bash Scripting
Practical Bash Usage – Example 1
Practical Bash Usage – Example 2
Exercises
3.The Essential Tools
Netcat
Connecting to a TCP/UDP Port
Listening on a TCP/UDP Port
Transferring Files with Netcat
Remote Administration with Netcat
Exercises
Ncat
Exercises
Wireshark
Wireshark Basics
Making Sense of Network Dumps
Capture and Display Filters
Following TCP Streams
Exercises
Tcpdump
Filtering Traffic
Advanced Header Filtering
Exercises
4.Passive Information Gathering
A Note From the Author
Open Web Information Gathering
Google
Google Hacking
Exercises
Email Harvesting
Exercise
Additional Resources
Netcraft
Whois Enumeration
Exercise
Recon-‐ng
Active Information Gathering
DNS Enumeration
Interacting with a DNS Server
Automating Lookups
Forward Lookup Brute Force
Reverse Lookup Brute Force
DNS Zone Transfers
Relevant Tools in Kali Linux
Exercises
Port Scanning
A Note From the Author
TCP CONNECT / SYN Scanning
UDP Scanning
Common Port Scanning Pitfalls
Port Scanning with Nmap
OS Fingerprinting
Banner Grabbing/Service Enumeration
Nmap Scripting Engine (NSE)

Exercises
SMB Enumeration
Scanning for the NetBIOS Service
Null Session Enumeration
Nmap SMB NSE Scripts
Exercises
SMTP Enumeration
Exercise
SNMP Enumeration
A Note From the Author
MIB Tree
Scanning for SNMP
Windows SNMP Enumeration Example
Exercises
5. Vulnerability Scanning
Vulnerability Scanning with Nmap
The OpenVAS Vulnerability Scanner
OpenVAS Initial Setup
Exercises
6. Buffer Overflows
Fuzzing
Vulnerability History
A Word About DEP and ASLR
Interacting with the POP3 Protocol
Exercises
7. Win32 Buffer Overflow Exploitation
Replicating the Crash
Controlling EIP
Binary Tree Analysis
Sending a Unique String
Exercises
Locating Space for Your Shellcode
Checking for Bad Characters
Exercises
Redirecting the Execution Flow
Finding a Return Address
Exercises
Generating Shellcode with Metasploit
Getting a Shell
Exercises
Improving the Exploit
Exercises
8. Linux Buffer Overflow Exploitation
Setting Up the Environment
Crashing Crossfire
Exercise
Controlling EIP
Finding Space for Our Shellcode
Improving Exploit Reliability
Discovering Bad Characters
Exercises
Finding a Return Address
Getting a Shell
Exercise
9. Working with Exploits
Searching for Exploits
Finding Exploits in Kali Linux
Finding Exploits on the Web
Customizing and Fixing Exploits
Setting Up a Development
Environment
Dealing with Various Exploit Code
Languages
Exercises
10. File Transfers
A Word About Anti Virus Software
File Transfer Methods
The Non-‐Interactive Shell
Uploading Files
Exercises
11. Privilege Escalation
Privilege Escalation Exploits
Local Privilege Escalation Exploit in Linux
Example
Local Privilege Escalation Exploit in
Windows Example
Configuration Issues
Incorrect File and Service Permissions
Think Like a Network Administrator
12. Client Side Attacks
Know Your Target
Passive Client Information Gathering
Active Client Information Gathering
Social Engineering and Client Side
Attacks
Exercises
MS12-‐037-‐ Internet Explorer 8 Fixed Col
Span ID
Setting up the Client Side Exploit
Swapping Out the Shellcode
Exercises
Java Signed Applet Attack
Exercises
13. Web Application Attacks
Essential Iceweasel Add-‐ons
Cross Site Scripting (XSS)
Browser Redirection and IFRAME
Injection
Stealing Cookies and Session Information
Exercises
File Inclusion Vulnerabilities
Local File Inclusion
Remote File Inclusion
MySQL SQL Injection
Authentication Bypass

Enumerating the Database
Column Number Enumeration
Understanding the Layout of the Output
Extracting Data from the Database
Leveraging SQL Injection for Code
Execution
Web Application Proxies
Exercises
Automated SQL Injection Tools
Exercises
14. Password Attacks
Preparing for Brute Force
Dictionary Files
Key-‐space Brute Force
Pwdump and Fgdump
Windows Credential Editor (WCE)
Exercises
Password Profiling
Password Mutating
Online Password Attacks
Hydra, Medusa, and Ncrack
Choosing the Right Protocol: Speed vs.
Reward
Exercises
Password Hash Attacks
Password Hashes
Password Cracking
John the Ripper
Rainbow Tables
Passing the Hash in Windows
Exercises
15.-‐ Port Redirection and Tunneling
Port Forwarding/Redirection
SSH Tunneling
Local Port Forwarding
Remote Port Forwarding
Dynamic Port Forwarding
Proxychains
HTTP Tunneling
Traffic Encapsulation
Exercises
16. The Metasploit Framework
Metasploit User Interfaces
Setting up Metasploit Framework on Kali
Exploring the Metasploit Framework
Auxiliary Modules
Getting Familiar with MSF Syntax
Metasploit Database Access
Exercises
Exploit Modules
Exercises
Metasploit Payloads
Staged vs. Non-‐Staged Payloads
Meterpreter Payloads
Experimenting with Meterpreter
Executable Payloads
Reverse HTTPS Meterpreter
Metasploit Exploit Multi Handler
Revisiting Client Side Attacks
Exercises
Building Your Own MSF Module
Exercise
Post Exploitation with Metasploit
Meterpreter Post Exploitation
Features
Post Exploitation Modules
17. Bypassing Antivirus Software
Encoding Payloads with Metasploit
Crypting Known Malware with Software
Protectors
Using Custom/Uncommon Tools and
Payloads
Exercise
18. Assembling the Pieces: Penetration
Test Breakdown
Phase 0 – Scenario Description
Phase 1 – Information Gathering
Phase 2 – Vulnerability Identification and
Prioritization
Password Cracking
Phase 3 – Research and Development
Phase 4 – Exploitation
Linux Local Privilege Escalation
Phase 5 – Post-‐Exploitation
Expanding Influence
Client Side Attack Against Internal
Network
Privilege Escalation Through AD
Misconfigurations
Port Tunneling
SSH Tunneling with HTTP Encapsulation
Looking for High Value Targets
Domain Privilege Escalation
Going for the Kill