Metasploit Toolkit for Penetration Testing, Exploit Development, and Vulnerability Research (eBook)

David Maynor (Autor)

eBook Download: EPUB

2011 | 1. Auflage
350 Seiten
Elsevier Science (Verlag)
978-0-08-054925-5 (ISBN)

Infos

This is the first book available for the Metasploit Framework (MSF), which is the attack platform of choice for one of the fastest growing careers in IT security: Penetration Testing. The book and companion Web site will provide professional penetration testers and security researchers with a fully integrated suite of tools for discovering, running, and testing exploit code.

This book discusses how to use the Metasploit Framework (MSF) as an exploitation platform. The book begins with a detailed discussion of the three MSF interfaces: msfweb, msfconsole, and msfcli .This chapter demonstrates all of the features offered by the MSF as an exploitation platform. With a solid understanding of MSF's capabilities, the book then details techniques for dramatically reducing the amount of time required for developing functional exploits.
By working through a real-world vulnerabilities against popular closed source applications, the reader will learn how to use the tools and MSF to quickly build reliable attacks as standalone exploits. The section will also explain how to integrate an exploit directly into the Metasploit Framework by providing a line-by-line analysis of an integrated exploit module. Details as to how the Metasploit engine drives the behind-the-scenes exploitation process will be covered, and along the way the reader will come to understand the advantages of exploitation frameworks. The final section of the book examines the Meterpreter payload system and teaches readers to develop completely new extensions that will integrate fluidly with the Metasploit Framework.

? A November 2004 survey conducted by CSO Magazine stated that 42% of chief security officers considered penetration testing to be a security priority for their organizations

? The Metasploit Framework is the most popular open source exploit platform, and there are no competing books

? The book's companion Web site offers all of the working code and exploits contained within the book

---

Metasploit Toolkit for Penetration Testing, Exploit Development, and Vulnerability Research is the first book available for the Metasploit Framework (MSF), which is the attack platform of choice for one of the fastest growing careers in IT security: Penetration Testing. The book will provide professional penetration testers and security researchers with a fully integrated suite of tools for discovering, running, and testing exploit code.This book discusses how to use the Metasploit Framework (MSF) as an exploitation platform. The book begins with a detailed discussion of the three MSF interfaces: msfweb, msfconsole, and msfcli .This chapter demonstrates all of the features offered by the MSF as an exploitation platform. With a solid understanding of MSF's capabilities, the book then details techniques for dramatically reducing the amount of time required for developing functional exploits.By working through a real-world vulnerabilities against popular closed source applications, the reader will learn how to use the tools and MSF to quickly build reliable attacks as standalone exploits. The section will also explain how to integrate an exploit directly into the Metasploit Framework by providing a line-by-line analysis of an integrated exploit module. Details as to how the Metasploit engine drives the behind-the-scenes exploitation process will be covered, and along the way the reader will come to understand the advantages of exploitation frameworks. The final section of the book examines the Meterpreter payload system and teaches readers to develop completely new extensions that will integrate fluidly with the Metasploit Framework. - A November 2004 survey conducted by "e;CSO Magazine"e; stated that 42% of chief security officers considered penetration testing to be a security priority for their organizations- The Metasploit Framework is the most popular open source exploit platform, and there are no competing books

Inhalt

Front Cover 1
Metasploit Toolkit: For Penetration Testing, Exploit Development, and Vulnerability Reasearch 2
Copyright Page 3
Contents 12
Chapter 1. Introduction to Metasploit 18
Introduction 19
Overview: Why Is Metasploit Here? 19
History of Metasploit 21
Metasploit Core Development 29
Technology Overview 31
Leveraging Metasploit on Penetration Tests 51
Understanding Metasploit Channels 54
Summary 76
Solutions Fast Track 77
Frequently Asked Questions 80
Chapter 2. Architecture, Environment, and Installation 82
Introduction 83
Understanding the Soft Architecture 83
Configuring and Locking Down Your System 84
Installation 88
Summary 92
Solutions Fast Track 92
Frequently Asked Questions 93
Chapter 3. Metasploit Framework and Advanced Environment Configurations 94
Introduction 95
Configuration High-Level Overview 95
Global Datastore 96
Module Datastore 97
Saved Environment 98
Summary 99
Solutions Fast Track 99
Frequently Asked Questions 100
Chapter 4. Advanced Payloads and Add-on Modules 102
Introduction 103
Meterpreter 103
VNC Inject 110
PassiveX 112
Auxiliary Modules 113
Automating the Pen-Test 116
Summary 118
Solutions Fast Track 118
Frequently Asked Questions 120
Chapter 5. Adding New Payloads 122
Introduction: Why ShouldYou Care about Metasploit? 123
Types of Payloads 123
Adding New Exploit Payloads 124
Adding New Auxiliary Payloads 135
Bonus: Finding 0day While Creating Different Types o f Payloads 144
Summary 145
Case Studies 146
Case Study 1. RaXnet Cacti Remote Command Execution 148
Case Study 2. Mercur Messaging 2005 SP3 IMAP Remote Buffer Overflow (CVE -2006-1255) 160
Case Study 3. SlimFTPd String Concatenation Overflow 176
Case Study 4. WS-FTP Server 5.03 MKD Overflow 186
Case Study 5. MailEnable HTTP Authorization Header Buffer Overflow 216
Appendix A. Advantages of Network Vulnerability Testing with Metasploit 3.0 228
Introduction 229
Vulnerability Scanning 229
How Metasploit Gives Sys 230
Admins a Vulnerability-Testing Advantage 16
Summary 231
Appendix B. Building a Test Lab for Penetration Testing 232
Introduction 233
Some Background 233
Setting up a Penetration Test Lab 235
Types of Pentest Labs 242
Selecting the Right Hardware 245
Selecting the Right Software 247
Running Your Lab 249
Selecting a Pentest Framework 252
Targets in the Penetration Test Lab 255
Other Scenario Ideas 261
Summary 263
Appendix C. Glossary of Technology and Terminology 264
Index 280

Produkt-Details

• Erscheint lt. Verlag: 18.4.2011
• Sprache: englisch
• Themenwelt: Sachbuch/Ratgeber
• Themenwelt: Informatik ► Netzwerke ► Sicherheit / Firewall
• Themenwelt: Informatik ► Theorie / Studium ► Kryptologie
• Themenwelt: Wirtschaft ► Betriebswirtschaft / Management
• ISBN-10: 0-08-054925-X / 008054925X
• ISBN-13: 978-0-08-054925-5 / 9780080549255