Penetration Testing on Linux Machine: Task 3

This article discusses the process of penetration testing on a Linux machine. It covers information gathering, scanning, enumeration, vulnerability scanning, and vulnerability exploiting and mitigation. The article also mentions various tools used for vulnerability scanning and their advantages and disadvantages.

PenTest (PTE)

Table of Contents
Task – 3......................................................................................................................................2
3.1 Introduction.................................................................................................................2
3.2 Attacking Narrative.....................................................................................................2
3.3 Information Gathering...............................................................................................16
3.4 Scanning and Enumeration........................................................................................16
3.5 Nessus Vulnerability Scanning..................................................................................20
3.6 Vulnerability Exploiting............................................................................................22
3.7 Vulnerability Mitigation............................................................................................24
3.8 Conclusion.................................................................................................................27
Final conclusions and Reflections............................................................................................28
References................................................................................................................................30
Appendix..................................................................................................................................30
1

Task – 3
3.1 Introduction
In this task, we are analyzing the penetration testing on a Linux machine. Here, we are
required to do the information gathering, scanning enumeration, vulnerability scanning, and
vulnerability exploiting and vulnerability mitigation on the Target machine by using the
penetration tests methodology.
3.2 Attacking Narrative
First, we are adding the Kali Linux and Metasploit Virtual machine on VMware Workstation.
Then click the power on to open the kali Linux and it is illustrated as below.
2

And, also click the power on to open the Metasploit LUI and it is illustrated as below.
After, open the VMnet3 setup and select the Navigate from “Player”, to “Manage”, to
“Network Settings.” Then scroll down to “VMnet3” and select it. Apply this setting to both
Kali and Metasploit.
3

After, configuring the IP address in Kali Linux.
Also, configuring the IP address in Metasploit
4

Then, restarting network processes in Kali Linux.
After, Kali Linux output after issuing the network restart command.
5

Also, Restarting Metasploit Network processes. It is illustrated as below.
Then, confirming IP address after restarting network processes. Note that an IP address is
lacking in the field it should be in. Fix this by entering “sudo ifconfig eth0 192.168.0.1.”
6

ifconfig command to confirm that the IP configuration worked.
Kali Linux ping the newly configured Metasploit box.
7

NMAP command as it targets the Metasploit box and it is illustrated as below. And, output
also illustrated as below.
8

Command with a “-v” switch for verbose output and it is illustrated as below.
NMAP output is shown below.
9

Verbose NMAP output is illustrated as below.
Verbose output with the –O switch is shown below.
10

NMAP output from the –v switch and the -O switch is demonstrated as below.
11

NMAP command with the -sV switch, and -O switch, and the -v switch is demonstrated as
below.
12

13

NMAP to ping the target host is illustrated as below.
14

NMAP ping output is shown below.
Port scan of all hosts within IP field is illustrated as below.
15

3.3 Information Gathering
To do penetration testing on target machine, the below mentioned steps are used.
Scanning with Nmap: to find out the target IP loop holes:
3.4 Scanning and Enumeration
First attack penetration was attempted using airbase-ng, the attempt was to try to
penetrate and retrieve WEP key using clients account the operating system. Another attempt
was to try and retrieve WEP key (Ali, Allen and Heriyanto, n.d.). Below are the codes used
for penetration activities and the outcome of penetration attempts?
16

Hirte Attack
Outcome
The penetration attempt was successful, after running the penetration attempt from the
client’s computers. The penetration attempt was successful and here is an outcome of the
process.
Caffe Spasm
Result
The second attempt was to try and initiate the process of retrieving the password of
the WI-FI connection. The process was successful and here is an outcome of the process is
initiated.
17

Hydra attack
Hydra attack on Linux is meant to try and retrieve the password. This particular test
was an attempt to try and access the password of different email accounts. The diagram
below shows the penetration attempt and the result of how successful the process was.
Command quickly during penetration attempts show how the process was conducted. After
the penetration attempt was done, command prompt in the operating system demonstrated
how successful the penetration process was.
Network clerk
A network tool is a tool used to scan network hack attempts, there are attempts by the
network to try and attempt to hack a network. Network administrators use the tool to scan
attempts by hackers who try to obtain passwords illegally.
18

Wire shark is mostly used by network superintendents, when administering data
package transmissions amid computers. However, the Data packets that are being transferred
amongst the devices need to be protected because that is the information transmitted. Below
is a tool screenshot of how the device is usually used to run data packets in a network. It also
shows the product of the packed data administration.
Vulnerability scan tools are automatized to do security audits which are a very vital
part in Information Technology security through scanning networks and other websites from
diverse safety risks. Scanners are proficient of producing a list of the patches that are to be
seen, they all together describe vulnerabilities and at the same time providing stages on ways
to rectify them. It is attained through automatization on the mend method.
19

3.5 Nessus Vulnerability Scanning
There are several tools that are used to scan for vulnerabilities in Linux operating
system. For instance, Comodo's hacker-proof taken into account as a revolutionary
vulnerability scanning and building tool which allows overcoming protection considerations
for guests. There are several disadvantages with the ability to get from Hacker Proof. For
instance, it is hard to cut back cart its abandonment, getting daily vulnerability scans.
Secondly it is hard to get PCI scan tools they include; Drive attack interference, it cannot
build valuable trust guests, it converts several guests to consumers. Besides preceding
advantages, Hacker Proof provides visual indicators required by customers to feel secure
while transacting. The tool works by helping to decrease pushcart abandonment, conversion
rates, and in driving the generally returns up. Lastly, it comprises scanning knowledge, the
site Inspector is skilled of abolishing drive-by attacks, it therefore provides a sympathetic
new level of security for all through pride show Hacker Proof brands.
Open VAS is a supply tool that serves as a fundamental service through vulnerable
valuation tools in completely vulnerability scanning and in addition management. Open VAS
funds diverse working systems. Open VAS usually scan locomotives are continually updated
in Network Vulnerability Tests. Open VAS scanners can be finished vulnerability assessment
tool that distinguishes problems associated with a lot of security measures in the servers and
other devices that can be alternatively used in the network. Open VAS facilities are freed
from value and the area unit as they are authorized beneath General Public Licenses.
Nexpose vulnerability scan is associated to open source tools used to scan for
vulnerabilities through complete network checks. Nexpose is composed of Metasploit
framework, it takes into consideration age of vulnerability that is similar to malware kit used
in it. There are benefits for area units utilized by it. It fixes problems supported through its
priorities. The tools are capable of doing police work to scan the new plans and evaluating
vulnerabilities as they try to access networks. It as well monitors disclosure to vulnerabilities
on time, orienting being itself makes hazards based on new knowledge. Most of the
vulnerability scanners at times sometimes find risks using low, medium or high scales.
Nikto is a great and open internet supply scanner, it is used to assess likely problems
and vulnerabilities. Additionally, it is used to confirming whether or not server version is
noncurrent, the scanner checks for specific drawbacks that may affect the functioning of a
server. Nikto performs different tests on internet servers so as to scan totally different things
sort of some risky documents or programs. This is not thought of as an inaudible tool, it is
20

employed in checking an internet server in the least potential times. It scans different
protocols such as HTTPd, HTTPS, and HTTP among others. The tool permits scanning
different ports of an exact server.
Tripwire IP360, developed by Tripwire INC, takes into account several vulnerability
assessments to answer that is utilized by different agencies and enterprises. The main Aim is
to manage the security risks. There are a very wide range reading of webs that can identify all
the vulnerabilities, network hosts, applications and configurations. It uses exposed standards
that assist in bringing together the risk management and vulnerabilities in numerous
processes businesses.
Wire shark is Associate in looking at used network protocols analyzers thought as
foremost powerful tools in security practitioners’ toolkits. Wire shark is openly transversely
used in diverse streams such as governmental works, instructional establishments, initiatives,
instructional organizations. They appear in networks at microscopic levels. They capture
problems in line to execute analysis offline. They run different platforms such as UNIX
operating system, Windows, Mac OS, and Solaris. Air crack also referred to as Air cracking,
has tools that are used to evaluate wireless system securities. Air crack tools are used in
network auditing, they support multiple Operating systems such as Os X, UNIX system, Net
BSD, Solaris, and Windows. The tool objective is to focus on diverse areas of wireless
fidelity Safety such as watching packages and knowledge, to test cracking, drivers and cards,
and replaying attacks. Air crack, is attainable in retrieving different lost keys by capturing
packet information.
Nessus tool reis branded and is vulnerability scanners that are created by reasonable Network
Security. The tool prevents network penetrations by hackers through assessing vulnerabilities
as early as possible. They scan vulnerabilities that enable remote hacking of sensitive
knowledge in the system. Nessus supports in-depth varying from operating systems,
Databases, several devices, applications, both virtual and bodily networks. It has been put in
use and employed by many operators universally across the sphere for vulnerability testing,
and configuration difficulties.
Retina cesium is an Associate and very open source which is a web-based console that
most of the times assist vulnerability management in each broke down and centralized
information. It is likely to have options such as compliance news, configuration
management, and fixing. The tool provides an assessment of cross-platform vulnerabilities.
The tool enables saving time price, energy, and to managing of network security. It is
bounded with automatic vulnerability valuation for DBs, internet solicitations, workplaces,
21

and servers. It also presents complete provision for computer-generated surroundings such as
virtual application scanning and integration.
MBSA is a free Microsoft instrument used to protect Windows laptops supported by
specifications and pointers through Microsoft accounts. MBSA enhance security method
through examining gaggle of computers for misconfiguration, security patches, and missing
updates. The purpose is to scan any updates concerning security, service packs and update
rollups swing aside the crucial and ex gratia informs. The tool is mainly used by both
medium-size and small-size organizations to achieve protection of networks. While they are
doing a scan in the system, MBSA provides solutions or suggestions to fix vulnerabilities.
3.6 Vulnerability Exploiting
Command injection vulnerability
Command injection vulnerability that was discovered in the Dynamic Host
Configuration Protocol (DHCP) shopper enclosed in Red Hat Enterprise UNIX, which might
enable a malicious actor capable of putting in place a DHCP server or otherwise capable of
spoofing DHCP responses on an area network to execute commands with root privileges. The
vulnerability which is selected through Red Hat developed by Google engineer Felix
Wilhelm, he noted proof of exploitation code is little enough to suit during tweet. Red Hat is
considered as an essential vulnerability, as noted in the bug report. It is an indication that
helps by simply exploiting unauthenticated foreign offenders (Sharma, 2017).
22

DHCP is employed to assign Associate in scientific discipline address, DNS servers,
and different network configuration attributes to devices on a network. DHCP is employed in
each wired and wireless networks. On condition that the necessities of investing this exploit
area unit merely being on a similar network, this vulnerability would be notably regarding on
systems doubtless to be connected to untrusted open Wi-Fi networks, which is additional
doubtless to have an effect on lid users on laptops.
Outdated applications
Linux exploitation is expedited through systems running of noncurrent code like
Apache, PHP, MySQL, Open SSL, and VNC. Such as missing Operating System patches,
noncurrent applications that produce oversized footprints that are malicious and intend to
cause exploitation and unauthorized system access (e.g., systems running SSH version one
with weak coding ciphers). Malicious internal users are third parties that gain unauthorized
entry, particularly once are accessed over associated and unsecured communications channel
such as wireless networks.
Lack of system hardening
SNMP runs on default community strings, FTP provides access to sensitive
information files, telnet communications prone to interception (especially over under-secured
wireless networks). Unprotected Samba allows users account enumeration, the name service
is always accessible everybody. Thus, people that do not want system configuration data
currently have it, provides them with Courant and additional penetrating systems.
23

Lack of back up
Security weaknesses in UNIX are said to have knowledge backups. They are not done. There
is a belief that part of matter is bound by Linux-based systems square measure typically
thought of as non-critical. Net servers, syslog servers, and FTP servers are not minor systems
if you solicit from me. System administrators who have basic file-copy backups of UNIX
systems are however not complete installation of operating systems. Within wake of disasters
or drive failures have encounter protracted and not indefinite for lack of recovery.
3.7 Vulnerability Mitigation
Command line injection
Command injection is an installation of software system commands to be dead
through a web-app. the aim of the command injection attack is to inject and execute
commands specified by the offender within the vulnerable application. There is a scenario for
24

the purpose of applying and executing unwanted system commands. They sort out pseudo
system shells, and offenders can use in any licensed system for users. However, commands
areas have identical privileges and atmospheres since the internet application have. Command
injection attack units that are doable because of lack of proper input and file validation. They
which may be manipulated by different offenders.
Outdated applications
The purpose and necessity of network firewalls are to confirm users and to limit
access the service is merely accessible if administrators prevent from the correct location,
they check for connections are not abused (or too several connections area unit made), etc.
however what if the association itself is valid? In the end, abuse of services is not a result of
original from incorrect locations that try to access incorrect services. Instead, abuse comes
from valid access to the appliance, however they have no intentions. Application firewalls
liquidate this case, they perform scrutiny of information that is transferred itself. Application
firewalls have to find malicious information fragments or try to abuse services. Detection
rules are often supported general, heuristic rules (well-known examples area unit detection
rules for cross-site scripting attacks (XSS) or SQL Injection) however also can be terribly
specific to a selected application.
25

Lack of system hardening
The main act of hardening a server and repair is to assemble the system in order that
it's as secure as potential, supported configuration entries. Several vendors and comes provide
a security guide through most of them add this as a part of their normal body documents. But
for some reason, you will find those default installations even once following the directions
of the seller - aren't as secure as you wish it to be. As a matter of reality, if you are available
contact with auditors, you will likely fail any audit if you utilize a default installation. To
assist directors in securing their services, you'll notice several third-party sites giving a
recommendation on securing the software system and also the services running thereon.
26

Lack of back up
Linux knowledge backup product square measure is giving support virtual machines.
They have the capability to extremely explode in several years as server virtualization has
started out on all types of servers, together with UNIX operating system servers. though
virtualized systems are often secured mistreatment as regards to any backup system including
shell scripts if you're thus inclined, there square measure specialized options of virtualized
systems that respond best to package designed for virtualized backup. Cloud backups have
become additional widespread, UNIX operating system backup vendors like Zmanda square
measure adding UNIX operating system cloud backup to their repertoires. Zmanda Enterprise
backup products permit backing up Amazon's S3 cloud from the previous UNIX operating
system device.
3.8 Conclusion
Linux may be a versatile, strong node software package for character machine clusters.
Stability and flexibility set it aside from the gift operative systems that dominate desktop
environments. Whereas not a "cancer" like some detractors have labeled UNIX operating
system, it unfolds quickly from its humble beginnings as a student's hobby project to a full-
featured server software package with advanced options and legendary stability. And whereas
nearly any UNIX operating system distribution can perform adequately as a character node
software package, a touch calibration and trimming can skinny down the already lean UNIX
operating system kernel, deed additional cypher resources for scientific applications. If this
27

chapter looks a touch overwhelming, we have a tendency to note that there are a unit firms
that may fully tack together and deliver character systems, as well as all the same tweaks and
modifications to the kernel. There also are revolutionary systems like the character package
from Computing Corporation.
We have adequately analyzed the penetration testing on a Linux machine. For the most
part, Penetration testing called the pen testing or ethical hacking is the work on testing a PC
structure, framework or web application to find security vulnerabilities that an assailant could
abuse. This task effectively did the information gathering, scanning enumeration,
vulnerability scanning, and vulnerability exploiting and vulnerability mitigation on the Target
machine by using the penetration tests methodology.
Final conclusions and Reflections
In task 1, Computer crime is the unapproved interruption of open or private PC
systems to take data, undermine the framework, or hold the data criminal. The extent of PC
crime includes all types of electronic gadgets that are utilized by means of the web to execute
different types of crimes. This task was effectively detailed the investigations of PC dangers
looked by people and corporate inside the advanced circle. The plan of the examination is
successful to discover how penetration tests can help support the security engineering in a
given system, particularly organization arrange frameworks. This assignment additionally
investigates the capacity to utilize ethical hacking as a structure for PC frameworks
solidifying.
In task 2, we effectively examined the Standard Operating Procedure and Attack Tree
for a Penetration Test. The principle goal of penetration testing is to feature potential security
shortcomings in an objective framework with the goal that vital measures can be set up to
address the shortcomings and limit introduction to security dangers. This undertaking
likewise reports portrays the techniques and the standard working strategy for directing
penetration testing. The strategies contain the fundamental stages pursued to attempt and
break into a data framework. The standard operating procedure, on the other hand, outlines
the course of action from one phase to another.
In Task 3, we have adequately dissected the penetration testing on a Linux machine.
For the most part, Penetration testing called the pen testing or ethical hacking is the work on
testing a PC structure, framework or web application to find security vulnerabilities that an
28

assailant could abuse. This task effectively did the information gathering, scanning
enumeration, vulnerability scanning, and vulnerability exploiting and vulnerability mitigation
on the Target machine by using the penetration tests methodology.
29

References
Ali, S., Allen, L. and Heriyanto, T. (n.d.). Kali Linux.
Sharma, H. (2017). Kali Linux - An Ethical Hacker's Cookbook. Packt Publishing.
Appendix
More Vulnerabilities Details
Discovering web server directories with Dirb
Click on User to access the User Credentials:
30

31