cbtnuggets - Penetration Testing with Linux Tools
This course with Keith Barker offers both BackTrack and Kali Linux training, which provides easy access to an extensive collection of security-related tools ranging from port scanners to Security Audit.
Related Area of Expertise:
- IT Security
Recommended skills:
- Virtualization (VirtualBox or VMware)
- Wireshark Packet Capture software
- GNS3
- Linux
- IPv4 and IPv6 networking (Network+, Juniper JNCIA or Cisco CCNA) or similar equivalent experience
Recommended equipment:
- Virtualization software such as Virtual Box, or VMware. Dedicated hardware could be used instead of a virtual environment to run BackTrack or Kali Linux. A BackTrack/Kali supported wireless network card would also be needed to practice and use the wireless related tools.
Related certifications:
- CEH
- CCNA Security
- CCNP Security
- Check Point CCSA/CCSE
- Juniper security certifications
Related job functions:
- System, Network, and/or Web Penetration Tester
- Security Architect
- Network Security Engineer
- Security Analyst
- Computer Crime Investigator
- CISO/ISO or Director of Security
- Application Penetration Tester
- Intrusion Analyst
- Vulnerability Researcher/ Exploit Developer
- Security Auditor
- Security-savvy Software Developer
BackTrack is a Linux distribution designed by Jason Dennis based on the Ubuntu Linux distribution aimed at digital forensics and penetration testing use. In March 2013, the Offensive Security team rebuilt BackTrack and released it under the name Kali Linux.
Kali Linux is an advanced Penetration Testing and Security Auditing Linux distribution. Kali Linux features a complete re-build of BackTrack Linux, adhering completely to Debian development standards. All-new infrastructure has been put in place, all tools were reviewed and packaged.
This Kali Linux course addresses both platforms and focuses on using the tools of BackTrack/Kali Linux for authorized penetration testing and vulnerability analysis for both wired and wireless networks. None of these tools should be used in any unauthorized, unlawful or harmful ways.
Descriptions
1. Welcome to the Tools of BackTrack and Kali Linux (7 min)
In this introduction, Keith shares important information on how to stay safe (and legal) when using the powerful tools included in BackTrack and Kali, as well as how to get the most out of this course. All of the tools demonstrated in this series should only be used on networks/systems where appropriate authorization is provided.
2. What is BackTrack? (4 min)
BackTrack (BT) is the "Swiss Army Knife" of penetration testing, information gathering and vulnerability assessment tools (all conveniently packaged in a free single Linux distribution). In this video, Keith introduces this package of tools, as well as options available for running it.
3. Install BT on a Virtual Machine (13 min)
BackTrack can be run on live hardware or virtual hardware. In this video, Keith explains where to get BackTrack and virtualization software for free and walks you through the installation of BT in a VirtualBox-emulated computer. Settings used by Keith are explained in the video and are also available as a NuggetLab download.
4. Connecting to the Network (17 min)
An IP address can be configured via DHCP or through static configuration. The choice is yours on how you want BackTrack to operate. In this video, Keith walks you through configuring a static IP address and how to modify the Linux configuration files so that the same IP address is used next time the system boots. You'll also see a demo on how to enable SSH. You are encouraged to practice the configurations that you learn in this video. Commands used at the Command Line Interface (CLI) for this video are available in the NuggetLab download area.
5. Updating S/W and Using Integrated Help (7 min)
Using built-in help tools, such as man pages are terrific-if you know how to use them. In this video, Keith shares with you how to use both the man pages and built-in help that are often associated with commands at the CLI. The Advanced Package Tool (apt-get) also is presented and demonstrated as a utility to keep software up to date (also applies to new installations). You are encouraged to practice what you learn in this video, including using man pages, command prompt help and doing a system update on your implementation of BackTrack.
6. BT Wireless TX Power (10 min)
In this video, Keith walks you through verifying and changing the wireless transmission strength for a wireless adapter that's being used by BackTrack. This technique can be useful when the BT needs a slightly further wireless reach or when we want the BT to be more "quiet" in its environment.
7. Uncovering Hidden SSIDs (12 min)
Security through obscurity. It's not a bad idea, but it's not always successful. If a criminal didn't know there was a bank, he wouldn't attempt a robbery. If a wireless Access Point (AP) isn't broadcasting its Service Set Identifier (SSID), it's likely the average user won't see the AP and try to using it. Turning off the advertisement of the SSID does very little on its own to protect the AP. In this video, Keith demonstrates how discovering the SSID is a simple task that can be done with a few easy commands. You are encouraged to practice these tools on networks you are authorized on to perform work. Commands used in this video are available in the NuggetLab download area.
8. Bypassing MAC Address Filters (14 min)
Wireless Access Points (APs) don't have to allow any client to connect. By setting up an Access Control List (ACL) at the AP based on the MAC addresses of individual customers, client machines with MAC addresses that are not on the list won't be associated with the AP. In this video, Keith demonstrates how to utilize tools that can be used to "borrow" a MAC address that is on the list in order to gain access. Commands used in this video are available in the NuggetLab download area.
9. Breaking WPA2 Wireless (10 min)
First there was WEP, then WPA and now WPA2 for wireless security. But even using the WPA2 with a pre-shared key (PSK) has risks. For example, if a weak key is chosen you are still vulnerable to an attack. In this video, Keith walks you through several familiar wireless tools (and a new one!) included with BackTrack that can be used to discover the WPA2 PSK that's being used on a wireless network. Commands used in this video are available in the NuggetLab download area.
10. Rogue Wireless Access Points (23 min)
Normally, we would be on the watch for these, but in this video we get to implement one. In this Nugget, Keith walks you through converting the BackTrack computer into a wireless AP, including how to set up DHCP routing services so that clients who associate with your BackTrack device might not even notice they are walking into a man-in-the-middle (MITM) attack. Configuration commands used are available in the NuggetLab download area.
11. Wireless Mis-Association Attacks (15 min)
Complimenting the techniques discussed in the previous video, Keith demonstrates additional techniques to learn what wireless networks a client previously used and then creating a matching AP SSID. By doing this, it's easier (and perhaps not noticeable to the user) for a computer to associate with the BackTrack AP for another MITM type of an attack. Keith also demonstrates the "Wireless Evil Twin" attack. All the commands used in this video are available for download in the NuggetLab download area.
12. MITM Using Wireless Bridging (16 min)
In this video, Keith walks you through another method that can be used to implement a wireless man-in-the-middle (MITM) attack by bridging the AP logical interface and the physical Ethernet interface. Using Wireshark as a tool to interpret the captured data and the concept of bringing up multiple Access Points (APs) on a single BackTrack system are discussed. Configuration commands Keith uses in this video are available in the NuggetLab download area.
13. Nmap: King of Scanners (36 min)
What devices are sitting on the network and what services are they offering? It's a good question and one that the Nmap program can assist us in answering In this video, Keith walks you through the CLI, including options to gather OS identification and version information, as well as using Nmap with scripts. He'll also look at the Graphical User Interface (ZenMap). Commands used in this video are available in the NuggetLab download area.
14. DHCP Starvation (12 min)
Whether trying to implement a Denial of Service (DoS) attack or clearing the path for the introduction of a rogue DHCP server, consuming all the existing addresses from the real DHCP server is very easy. In this video, Keith demonstrates how to use Yersinia, one of the tools in the BackTrack distribution, to implement this attack.
15. Vote for BT - as the new STP Root Bridge (19 min)
The Spanning Tree Protocol (STP) plays a critical role in identifying and removing layer 2 loops in a switched network. If left unprotected, the SPT topology can be changed by a rogue device, injecting what appears to be superior Bridge Protocol Data Units (BPDUs). In this video, Keith walks you though STP, with the BackTrack system acting as the STP root.
16. CDP Flooding (14 min)
Cisco Discovery Protocol is an excellent tool to confirm the physical connections between Cisco devices. It's also an excellent tool (when flooding a neighbor with tens of thousands of CDP advertisements per minute) to overwhelm and cause Denial of Service (DoS) attack. In this video, Keith demonstrates how to implement this attack on a test switch in the lab. This video also shows how to use a X-windows sever and SSH to redirect the GUI from a remote BackTrack system to a local windows computer.
17. Taking over HSRP (7 min)
The Hot Standby Router Protocol (HSRP) is a First Hop Redundancy Protocol (FHRP) that provides a fault tolerance default gateway for customers to use in a network. By politely asking to be the active router, a BackTrack system can cause a DoS attack by getting the role, (while the production routers take a well deserved break) and then not performing routing for the subnetwork.
18. DTP and 802.1q Attacks (22 min)
When an attacker can convert a "single-VLAN" access port to a trunk port, there are are many additional opportunities for the attacker on a network. In this video, Keith walks you through using Dynamic Trunking Protocol to transition a switchport that BackTrack is connected to from an access port to a trunk port. This video also demonstrates creating logical VLAN interfaces on the BackTrack system, creating direct access (via the new trunk) to the VLANs available through that trunk. The protocol capture file from this Nugget is available in the NuggetLab download area.
19. ARP Spoofing MITM (16 min)
LAN switches do a fantastic job of forwarding layer 2 frames based on the destination MAC address in each frame. However, if a device that is encapsulating and sending the frame puts the incorrect destination address it can be forwarded to an unintended destination (that of the BackTrack system). In this video, Keith walks you through how to implement an ARP spoofing attack through poisoning the ARP cache of a host and its default gateway and perform a live MITM on an Ethernet network. Commands used in this video are available in the NuggetLab download area.
20. Metasploit Framework (19 min)
Metasploit Framework is an environment build for the discovery of vulnerabilities of systems and the compromise/exploitation of those systems. In this video, Keith demonstrates how to install a working copy (when needed) on the BackTrack system, and introduces you to the MSFConsole CLI and the GUI interfaces. Also, examples of synflood attacks are provided in this Nugget. The commands used in this video are available in the NuggetLab download area.
21. PWNing a System with MSF (26 min)
In this video, Keith walks you through using both MSFconsole and Armitage to exploit a network device. Capturing keystroke logging and screen captures against a compromised system also are demonstrated. Commands used in this video are available in the NuggetLab download area.
22. Creating a "Pivot Point" (18 min)
If we can't directly access a network, we may be able to compromise a host that can, and from there launch attacks. Using a victim host as a pivot point, attacks can be launched (via proxy using the victim) to reach additional networks. In this video, Keith shows you how to make this process easier by using MSF with Armitage.
23. Social-Engineer Toolkit (SET) (20 min)
One of the easier methods for compromising a system is to trick the user to run our code or click on a link that executes the code. The Social-Engineer Toolkit simplifies the process for setting up content, including web sites designed to compromise when connected to by users. In this video, Keith introduces SET, and how using it can create a malicious web server on the BackTrack system.
24. Ettercap and Xplico (18 min)
Ettercap is a fantastic tool to implement a MITM attack. Xplico is great way of analyzing the data collected (in the middle). In this video, Keith demonstrates how to use both of these tools, as well as using Wireshark to actually listen in on a voice conversation captured within the packets collected by a sniffer.
25. DNS Spoofing (13 min)
The Domain Name System is used by computers to resolve friendly names, such as google.com, to an IP address so that computers can reach those devices. Unfortunately, if we compromise the DNS function and reply with a hostile (BT) computer's IP address as the Web server they are trying to reach, the client computer will willingly connect to the BT server and have the potential to be exploited. In this video, Keith demonstrates how to implement a DNS spoofing attack. The CLI commands used in this video are available in the NuggetLab download area.
26. Hydra (22 min)
A dictionary, as used in a dictionary attack, can contain millions of words and phrases for use as potential passwords. In this video Keith demonstrates using Hydra to implement a dictionary password guessing attack against a router with SSH and a server using FTP.
27. Maltego (14 min)
A large part of a pen-test is gathering information. Maltego is a fast and powerful tool that can be used to collect data from publicly available sources and create a graphical representation based on that information. In this video, Keith walks you through using this tool (including its transforms) to find specific information about a domain, its servers and IP addresses.
28. Kali Linux (15 min)
There's a new flavor of BackTrack in town and the interesting part is that it isn't called "BackTrack." Kali Linux is a new Debian distribution that includes most of the tools from the previous BackTrack (5R3), but with additional care given to the packaging of those tools and other benefits. In this video, Keith discusses some of the new features and demonstrates an install of Kali Linux. Most of the tools shown in this video series are available on both BackTrack and Kali Linux.
29. Burp Suite (14 min)
There exists another world when it comes to interactions between a web client and server. Burp Suite is a set of tools that enables you to analyze the details of both the requests and responses between web clients and servers, as well as replay requests after making modifications to those requests. In this video, Keith introduces and demonstrates these tools, including setting up the proxy on a client and using the spider and replay options.
30. Raspberry Pi & Kali Linux (17 min)
What is small enough to fit in a pocket, affordable and can be a serious threat to an unprotected network? The answer: Kali Linux running on a Raspberry Pi computer. In this video, Keith walks you through the steps to install and use Kali on a Pi. Included in the video are the hardware specifics for the Pi, the wireless adapter and the SD card (in the event you want to replicate this). Keith also shares the "correct" URL to download the customized ARM image of Kali for the Pi.
31. Scapy (23 min)
Scapy is a packet manipulation tool than can craft, send, capture and sniff network datagrams (segments, packets and frames). In this video, Keith introduces you to this toolset and provides an example of it being used successfully. Examples of why it would be used also are included in the video. The video uses Kali Linux running on a Raspberry Pi, using SSH and Xwindows, and similar results can be obtained by practicing at the local console of the BackTrack/Kali device.
32. Hping3 (28 min)
A traditional PING uses ICMP and request/reply messages to verify connectivity between two devices over an IP network. But what if a firewall or the device itself is blocking the PING messages? What can be done? Have no fear, hping3 is here! In this video, Keith demonstrates how TCP and/or UDP options can be used to verify reachability and round trip time between two devices, even when ICMP isn't allowed. Commands used in this video are available in the NuggetLab download area.
33. Parasite6 (14 min)
How easy is it to implement an MITM on an IPv6 network? If you use the parasite6 tool, it's easy. In fact, way too easy. In this video, Keith discusses how Neighbor Discovery Protocol (NDP) is used in IPv6 (compared to IPv4's ARP), and then how to use parasite6 to perform layer 2 spoofing on an IPv6 network. Commands used in this video are available in the NuggetLab download area.
34. IPv6 THC Tools (28 min)
The Hackers Choice (THC) group has lots of great tools for IPv6 networks, and in this video, Keith demonstrates a few of his favorites. This nugget includes Neighbor Discovery Protocol (NDP) Router Advertisement (RA) manipulation including spoofing and flooding, DoS based on Duplicate Address Detection (DAD) and much more. Commands used in this video are available in the NuggetLab download area.
35. Custom Password Lists (13 min)
Which is better? A password list of a million entries or one with 50 thousand, IF they both contain the correct passphrase used in a dictionary attack? In this case, smaller is better, as it will save time and CPU. In this video, Keith introduces and shares a tool called the "Common User Password Profiler" (CUPP) that will interview you, ask you questions about the subject of interest (the person whose password you want) and then build a customized password file surrounding the names, dates, numbers based on the input you supplied. This password file then can be utilized by tools such as Hydra or Medusa as part of a dictionary attack. The commands used in this video are available in the Nuggetlab download area.
36. Hashes and Cracking Passwords (18 min)
Passwords aren't normally stored in plain text files on a system such Windows or Linux. Instead, a hash is generated and that one-way hash value is stored. In this video, Keith walks you through using a BackTrack Live CD to boot a system that has Windows on the hard drive, and by mounting the Windows file system, get access to the SAM database and the hashes for the user accounts. With the hash files in hand, we can take those hash files and use off-line password cracking tools such as John the Ripper. Commands used in this video are available in the NuggetLab download area.
37. Rainbow Tables and Ophcrack (14 min)
What's faster than 241x34(9644/2)-1 ? The answer: the result of 39,511,467. In the world of comparing millions of hashes, it's much faster to already have the hash (as in the result above) rather than having to create the hash before being able to compare it to another value. In this video, Keith demonstrates how a "Rainbow Table" (a pre-computed list of hashes) can be used to significantly improve the time it takes to break a password. Ophcrack also is demonstrated as a tool that can use a rainbow table. A supporting document listing some of the many of the steps shown in the video is available in the NuggetLab download area.
38. Wireshark (23 min)
The king of open-source packet analyzers is Wireshark (previously named Ethereal). In this video Keith discusses methods for obtaining network data such as port mirroring and MITM. He then shares with you Wireshark options including the ability to create graphs and analyze the top speakers on the network, as well as apply filters to focus on specific traffic.
39. Virtual Test Environment (19 min)
Practicing how to use the tools contained in BackTrack and Kali Linux is important. At the same time, it may not be a safe idea to practice on your company's production network without authorization. One solution is to create a virtual environment that includes Backtrack or Kali (or both), as well as host machines that can interact with each other in a sandbox without needing to access the live production network. In this video, Keith demonstrates how to add a new host to Virtualbox, as well as use a pre-defined virtual machine named metasploitable that can be used when testing vulnerabilities.
40. Detecting Rootkits (11 min)
A rootkit is software (normally malware of some kind) that provides unauthorized access to the computer for the attacker. A rootkit can be placed via a remote exploit or by physically running software at the computer. In this video, Keith demonstrates two software tools that can be used in a Linux environment to detect if a rootkit is running. Commands used in this video are available in the NuggetLab download area.
http://uploaded.net/file/go80or2f/1hlr7.PTTols.part1.rar
http://uploaded.net/file/slzbhs0f/1hlr7.PTTols.part2.rar
http://uploaded.net/file/jw096web/1hlr7.PTTols.part3.rar
http://uploaded.net/file/20zlneh8/1hlr7.PTTolsby1file.part1.rar
http://uploaded.net/file/9mpun30k/1hlr7.PTTolsby1file.part2.rar
http://uploaded.net/file/fnneyov6/1hlr7.PTTolsby1file.part3.rar
This course with Keith Barker offers both BackTrack and Kali Linux training, which provides easy access to an extensive collection of security-related tools ranging from port scanners to Security Audit.
Related Area of Expertise:
- IT Security
Recommended skills:
- Virtualization (VirtualBox or VMware)
- Wireshark Packet Capture software
- GNS3
- Linux
- IPv4 and IPv6 networking (Network+, Juniper JNCIA or Cisco CCNA) or similar equivalent experience
Recommended equipment:
- Virtualization software such as Virtual Box, or VMware. Dedicated hardware could be used instead of a virtual environment to run BackTrack or Kali Linux. A BackTrack/Kali supported wireless network card would also be needed to practice and use the wireless related tools.
Related certifications:
- CEH
- CCNA Security
- CCNP Security
- Check Point CCSA/CCSE
- Juniper security certifications
Related job functions:
- System, Network, and/or Web Penetration Tester
- Security Architect
- Network Security Engineer
- Security Analyst
- Computer Crime Investigator
- CISO/ISO or Director of Security
- Application Penetration Tester
- Intrusion Analyst
- Vulnerability Researcher/ Exploit Developer
- Security Auditor
- Security-savvy Software Developer
BackTrack is a Linux distribution designed by Jason Dennis based on the Ubuntu Linux distribution aimed at digital forensics and penetration testing use. In March 2013, the Offensive Security team rebuilt BackTrack and released it under the name Kali Linux.
Kali Linux is an advanced Penetration Testing and Security Auditing Linux distribution. Kali Linux features a complete re-build of BackTrack Linux, adhering completely to Debian development standards. All-new infrastructure has been put in place, all tools were reviewed and packaged.
This Kali Linux course addresses both platforms and focuses on using the tools of BackTrack/Kali Linux for authorized penetration testing and vulnerability analysis for both wired and wireless networks. None of these tools should be used in any unauthorized, unlawful or harmful ways.
Descriptions
1. Welcome to the Tools of BackTrack and Kali Linux (7 min)
In this introduction, Keith shares important information on how to stay safe (and legal) when using the powerful tools included in BackTrack and Kali, as well as how to get the most out of this course. All of the tools demonstrated in this series should only be used on networks/systems where appropriate authorization is provided.
2. What is BackTrack? (4 min)
BackTrack (BT) is the "Swiss Army Knife" of penetration testing, information gathering and vulnerability assessment tools (all conveniently packaged in a free single Linux distribution). In this video, Keith introduces this package of tools, as well as options available for running it.
3. Install BT on a Virtual Machine (13 min)
BackTrack can be run on live hardware or virtual hardware. In this video, Keith explains where to get BackTrack and virtualization software for free and walks you through the installation of BT in a VirtualBox-emulated computer. Settings used by Keith are explained in the video and are also available as a NuggetLab download.
4. Connecting to the Network (17 min)
An IP address can be configured via DHCP or through static configuration. The choice is yours on how you want BackTrack to operate. In this video, Keith walks you through configuring a static IP address and how to modify the Linux configuration files so that the same IP address is used next time the system boots. You'll also see a demo on how to enable SSH. You are encouraged to practice the configurations that you learn in this video. Commands used at the Command Line Interface (CLI) for this video are available in the NuggetLab download area.
5. Updating S/W and Using Integrated Help (7 min)
Using built-in help tools, such as man pages are terrific-if you know how to use them. In this video, Keith shares with you how to use both the man pages and built-in help that are often associated with commands at the CLI. The Advanced Package Tool (apt-get) also is presented and demonstrated as a utility to keep software up to date (also applies to new installations). You are encouraged to practice what you learn in this video, including using man pages, command prompt help and doing a system update on your implementation of BackTrack.
6. BT Wireless TX Power (10 min)
In this video, Keith walks you through verifying and changing the wireless transmission strength for a wireless adapter that's being used by BackTrack. This technique can be useful when the BT needs a slightly further wireless reach or when we want the BT to be more "quiet" in its environment.
7. Uncovering Hidden SSIDs (12 min)
Security through obscurity. It's not a bad idea, but it's not always successful. If a criminal didn't know there was a bank, he wouldn't attempt a robbery. If a wireless Access Point (AP) isn't broadcasting its Service Set Identifier (SSID), it's likely the average user won't see the AP and try to using it. Turning off the advertisement of the SSID does very little on its own to protect the AP. In this video, Keith demonstrates how discovering the SSID is a simple task that can be done with a few easy commands. You are encouraged to practice these tools on networks you are authorized on to perform work. Commands used in this video are available in the NuggetLab download area.
8. Bypassing MAC Address Filters (14 min)
Wireless Access Points (APs) don't have to allow any client to connect. By setting up an Access Control List (ACL) at the AP based on the MAC addresses of individual customers, client machines with MAC addresses that are not on the list won't be associated with the AP. In this video, Keith demonstrates how to utilize tools that can be used to "borrow" a MAC address that is on the list in order to gain access. Commands used in this video are available in the NuggetLab download area.
9. Breaking WPA2 Wireless (10 min)
First there was WEP, then WPA and now WPA2 for wireless security. But even using the WPA2 with a pre-shared key (PSK) has risks. For example, if a weak key is chosen you are still vulnerable to an attack. In this video, Keith walks you through several familiar wireless tools (and a new one!) included with BackTrack that can be used to discover the WPA2 PSK that's being used on a wireless network. Commands used in this video are available in the NuggetLab download area.
10. Rogue Wireless Access Points (23 min)
Normally, we would be on the watch for these, but in this video we get to implement one. In this Nugget, Keith walks you through converting the BackTrack computer into a wireless AP, including how to set up DHCP routing services so that clients who associate with your BackTrack device might not even notice they are walking into a man-in-the-middle (MITM) attack. Configuration commands used are available in the NuggetLab download area.
11. Wireless Mis-Association Attacks (15 min)
Complimenting the techniques discussed in the previous video, Keith demonstrates additional techniques to learn what wireless networks a client previously used and then creating a matching AP SSID. By doing this, it's easier (and perhaps not noticeable to the user) for a computer to associate with the BackTrack AP for another MITM type of an attack. Keith also demonstrates the "Wireless Evil Twin" attack. All the commands used in this video are available for download in the NuggetLab download area.
12. MITM Using Wireless Bridging (16 min)
In this video, Keith walks you through another method that can be used to implement a wireless man-in-the-middle (MITM) attack by bridging the AP logical interface and the physical Ethernet interface. Using Wireshark as a tool to interpret the captured data and the concept of bringing up multiple Access Points (APs) on a single BackTrack system are discussed. Configuration commands Keith uses in this video are available in the NuggetLab download area.
13. Nmap: King of Scanners (36 min)
What devices are sitting on the network and what services are they offering? It's a good question and one that the Nmap program can assist us in answering In this video, Keith walks you through the CLI, including options to gather OS identification and version information, as well as using Nmap with scripts. He'll also look at the Graphical User Interface (ZenMap). Commands used in this video are available in the NuggetLab download area.
14. DHCP Starvation (12 min)
Whether trying to implement a Denial of Service (DoS) attack or clearing the path for the introduction of a rogue DHCP server, consuming all the existing addresses from the real DHCP server is very easy. In this video, Keith demonstrates how to use Yersinia, one of the tools in the BackTrack distribution, to implement this attack.
15. Vote for BT - as the new STP Root Bridge (19 min)
The Spanning Tree Protocol (STP) plays a critical role in identifying and removing layer 2 loops in a switched network. If left unprotected, the SPT topology can be changed by a rogue device, injecting what appears to be superior Bridge Protocol Data Units (BPDUs). In this video, Keith walks you though STP, with the BackTrack system acting as the STP root.
16. CDP Flooding (14 min)
Cisco Discovery Protocol is an excellent tool to confirm the physical connections between Cisco devices. It's also an excellent tool (when flooding a neighbor with tens of thousands of CDP advertisements per minute) to overwhelm and cause Denial of Service (DoS) attack. In this video, Keith demonstrates how to implement this attack on a test switch in the lab. This video also shows how to use a X-windows sever and SSH to redirect the GUI from a remote BackTrack system to a local windows computer.
17. Taking over HSRP (7 min)
The Hot Standby Router Protocol (HSRP) is a First Hop Redundancy Protocol (FHRP) that provides a fault tolerance default gateway for customers to use in a network. By politely asking to be the active router, a BackTrack system can cause a DoS attack by getting the role, (while the production routers take a well deserved break) and then not performing routing for the subnetwork.
18. DTP and 802.1q Attacks (22 min)
When an attacker can convert a "single-VLAN" access port to a trunk port, there are are many additional opportunities for the attacker on a network. In this video, Keith walks you through using Dynamic Trunking Protocol to transition a switchport that BackTrack is connected to from an access port to a trunk port. This video also demonstrates creating logical VLAN interfaces on the BackTrack system, creating direct access (via the new trunk) to the VLANs available through that trunk. The protocol capture file from this Nugget is available in the NuggetLab download area.
19. ARP Spoofing MITM (16 min)
LAN switches do a fantastic job of forwarding layer 2 frames based on the destination MAC address in each frame. However, if a device that is encapsulating and sending the frame puts the incorrect destination address it can be forwarded to an unintended destination (that of the BackTrack system). In this video, Keith walks you through how to implement an ARP spoofing attack through poisoning the ARP cache of a host and its default gateway and perform a live MITM on an Ethernet network. Commands used in this video are available in the NuggetLab download area.
20. Metasploit Framework (19 min)
Metasploit Framework is an environment build for the discovery of vulnerabilities of systems and the compromise/exploitation of those systems. In this video, Keith demonstrates how to install a working copy (when needed) on the BackTrack system, and introduces you to the MSFConsole CLI and the GUI interfaces. Also, examples of synflood attacks are provided in this Nugget. The commands used in this video are available in the NuggetLab download area.
21. PWNing a System with MSF (26 min)
In this video, Keith walks you through using both MSFconsole and Armitage to exploit a network device. Capturing keystroke logging and screen captures against a compromised system also are demonstrated. Commands used in this video are available in the NuggetLab download area.
22. Creating a "Pivot Point" (18 min)
If we can't directly access a network, we may be able to compromise a host that can, and from there launch attacks. Using a victim host as a pivot point, attacks can be launched (via proxy using the victim) to reach additional networks. In this video, Keith shows you how to make this process easier by using MSF with Armitage.
23. Social-Engineer Toolkit (SET) (20 min)
One of the easier methods for compromising a system is to trick the user to run our code or click on a link that executes the code. The Social-Engineer Toolkit simplifies the process for setting up content, including web sites designed to compromise when connected to by users. In this video, Keith introduces SET, and how using it can create a malicious web server on the BackTrack system.
24. Ettercap and Xplico (18 min)
Ettercap is a fantastic tool to implement a MITM attack. Xplico is great way of analyzing the data collected (in the middle). In this video, Keith demonstrates how to use both of these tools, as well as using Wireshark to actually listen in on a voice conversation captured within the packets collected by a sniffer.
25. DNS Spoofing (13 min)
The Domain Name System is used by computers to resolve friendly names, such as google.com, to an IP address so that computers can reach those devices. Unfortunately, if we compromise the DNS function and reply with a hostile (BT) computer's IP address as the Web server they are trying to reach, the client computer will willingly connect to the BT server and have the potential to be exploited. In this video, Keith demonstrates how to implement a DNS spoofing attack. The CLI commands used in this video are available in the NuggetLab download area.
26. Hydra (22 min)
A dictionary, as used in a dictionary attack, can contain millions of words and phrases for use as potential passwords. In this video Keith demonstrates using Hydra to implement a dictionary password guessing attack against a router with SSH and a server using FTP.
27. Maltego (14 min)
A large part of a pen-test is gathering information. Maltego is a fast and powerful tool that can be used to collect data from publicly available sources and create a graphical representation based on that information. In this video, Keith walks you through using this tool (including its transforms) to find specific information about a domain, its servers and IP addresses.
28. Kali Linux (15 min)
There's a new flavor of BackTrack in town and the interesting part is that it isn't called "BackTrack." Kali Linux is a new Debian distribution that includes most of the tools from the previous BackTrack (5R3), but with additional care given to the packaging of those tools and other benefits. In this video, Keith discusses some of the new features and demonstrates an install of Kali Linux. Most of the tools shown in this video series are available on both BackTrack and Kali Linux.
29. Burp Suite (14 min)
There exists another world when it comes to interactions between a web client and server. Burp Suite is a set of tools that enables you to analyze the details of both the requests and responses between web clients and servers, as well as replay requests after making modifications to those requests. In this video, Keith introduces and demonstrates these tools, including setting up the proxy on a client and using the spider and replay options.
30. Raspberry Pi & Kali Linux (17 min)
What is small enough to fit in a pocket, affordable and can be a serious threat to an unprotected network? The answer: Kali Linux running on a Raspberry Pi computer. In this video, Keith walks you through the steps to install and use Kali on a Pi. Included in the video are the hardware specifics for the Pi, the wireless adapter and the SD card (in the event you want to replicate this). Keith also shares the "correct" URL to download the customized ARM image of Kali for the Pi.
31. Scapy (23 min)
Scapy is a packet manipulation tool than can craft, send, capture and sniff network datagrams (segments, packets and frames). In this video, Keith introduces you to this toolset and provides an example of it being used successfully. Examples of why it would be used also are included in the video. The video uses Kali Linux running on a Raspberry Pi, using SSH and Xwindows, and similar results can be obtained by practicing at the local console of the BackTrack/Kali device.
32. Hping3 (28 min)
A traditional PING uses ICMP and request/reply messages to verify connectivity between two devices over an IP network. But what if a firewall or the device itself is blocking the PING messages? What can be done? Have no fear, hping3 is here! In this video, Keith demonstrates how TCP and/or UDP options can be used to verify reachability and round trip time between two devices, even when ICMP isn't allowed. Commands used in this video are available in the NuggetLab download area.
33. Parasite6 (14 min)
How easy is it to implement an MITM on an IPv6 network? If you use the parasite6 tool, it's easy. In fact, way too easy. In this video, Keith discusses how Neighbor Discovery Protocol (NDP) is used in IPv6 (compared to IPv4's ARP), and then how to use parasite6 to perform layer 2 spoofing on an IPv6 network. Commands used in this video are available in the NuggetLab download area.
34. IPv6 THC Tools (28 min)
The Hackers Choice (THC) group has lots of great tools for IPv6 networks, and in this video, Keith demonstrates a few of his favorites. This nugget includes Neighbor Discovery Protocol (NDP) Router Advertisement (RA) manipulation including spoofing and flooding, DoS based on Duplicate Address Detection (DAD) and much more. Commands used in this video are available in the NuggetLab download area.
35. Custom Password Lists (13 min)
Which is better? A password list of a million entries or one with 50 thousand, IF they both contain the correct passphrase used in a dictionary attack? In this case, smaller is better, as it will save time and CPU. In this video, Keith introduces and shares a tool called the "Common User Password Profiler" (CUPP) that will interview you, ask you questions about the subject of interest (the person whose password you want) and then build a customized password file surrounding the names, dates, numbers based on the input you supplied. This password file then can be utilized by tools such as Hydra or Medusa as part of a dictionary attack. The commands used in this video are available in the Nuggetlab download area.
36. Hashes and Cracking Passwords (18 min)
Passwords aren't normally stored in plain text files on a system such Windows or Linux. Instead, a hash is generated and that one-way hash value is stored. In this video, Keith walks you through using a BackTrack Live CD to boot a system that has Windows on the hard drive, and by mounting the Windows file system, get access to the SAM database and the hashes for the user accounts. With the hash files in hand, we can take those hash files and use off-line password cracking tools such as John the Ripper. Commands used in this video are available in the NuggetLab download area.
37. Rainbow Tables and Ophcrack (14 min)
What's faster than 241x34(9644/2)-1 ? The answer: the result of 39,511,467. In the world of comparing millions of hashes, it's much faster to already have the hash (as in the result above) rather than having to create the hash before being able to compare it to another value. In this video, Keith demonstrates how a "Rainbow Table" (a pre-computed list of hashes) can be used to significantly improve the time it takes to break a password. Ophcrack also is demonstrated as a tool that can use a rainbow table. A supporting document listing some of the many of the steps shown in the video is available in the NuggetLab download area.
38. Wireshark (23 min)
The king of open-source packet analyzers is Wireshark (previously named Ethereal). In this video Keith discusses methods for obtaining network data such as port mirroring and MITM. He then shares with you Wireshark options including the ability to create graphs and analyze the top speakers on the network, as well as apply filters to focus on specific traffic.
39. Virtual Test Environment (19 min)
Practicing how to use the tools contained in BackTrack and Kali Linux is important. At the same time, it may not be a safe idea to practice on your company's production network without authorization. One solution is to create a virtual environment that includes Backtrack or Kali (or both), as well as host machines that can interact with each other in a sandbox without needing to access the live production network. In this video, Keith demonstrates how to add a new host to Virtualbox, as well as use a pre-defined virtual machine named metasploitable that can be used when testing vulnerabilities.
40. Detecting Rootkits (11 min)
A rootkit is software (normally malware of some kind) that provides unauthorized access to the computer for the attacker. A rootkit can be placed via a remote exploit or by physically running software at the computer. In this video, Keith demonstrates two software tools that can be used in a Linux environment to detect if a rootkit is running. Commands used in this video are available in the NuggetLab download area.
http://uploaded.net/file/go80or2f/1hlr7.PTTols.part1.rar
http://uploaded.net/file/slzbhs0f/1hlr7.PTTols.part2.rar
http://uploaded.net/file/jw096web/1hlr7.PTTols.part3.rar
http://uploaded.net/file/20zlneh8/1hlr7.PTTolsby1file.part1.rar
http://uploaded.net/file/9mpun30k/1hlr7.PTTolsby1file.part2.rar
http://uploaded.net/file/fnneyov6/1hlr7.PTTolsby1file.part3.rar
