PenTest (PTE) Report: Task 3 - Penetration Testing and Mitigation

This report details a penetration test (PenTest) conducted on a Linux machine, encompassing information gathering, scanning, and vulnerability exploitation and mitigation. The report begins with an introduction to the methodology, followed by an attacking narrative that outlines the steps taken to compromise the target system. It covers information gathering using tools like Nmap, scanning and enumeration techniques, and vulnerability scanning with Nessus. The analysis includes exploiting vulnerabilities, such as command injection through DHCP, and concludes with a discussion of mitigation strategies. The assignment explores various tools and techniques, including attempts to retrieve WEP keys, Hydra attacks, and the use of tools like Wireshark and vulnerability scanners. The report also discusses different vulnerability scanning tools like Nessus and Tripwire IP360. The report culminates in conclusions and reflections on the overall penetration testing process.

PenTest (PTE)

Table of Contents
Task – 3......................................................................................................................................2
3.1 Introduction.................................................................................................................2
3.2 Attacking Narrative.....................................................................................................2
3.3 Information Gathering...............................................................................................16
3.4 Scanning and Enumeration........................................................................................16
3.5 Nessus Vulnerability Scanning..................................................................................20
3.6 Vulnerability Exploiting............................................................................................22
3.7 Vulnerability Mitigation............................................................................................24
3.8 Conclusion.................................................................................................................27
Final conclusions and Reflections............................................................................................28
References................................................................................................................................30
Appendix..................................................................................................................................30
1

Task – 3
3.1 Introduction
In this task, we are analyzing the penetration testing on a Linux machine. Here, we are
required to do the information gathering, scanning enumeration, vulnerability scanning, and
vulnerability exploiting and vulnerability mitigation on the Target machine by using the
penetration tests methodology.
3.2 Attacking Narrative
First, we are adding the Kali Linux and Metasploit Virtual machine on VMware Workstation.
Then click the power on to open the kali Linux and it is illustrated as below.
2

And, also click the power on to open the Metasploit LUI and it is illustrated as below.
After, open the VMnet3 setup and select the Navigate from “Player”, to “Manage”, to
“Network Settings.” Then scroll down to “VMnet3” and select it. Apply this setting to both
Kali and Metasploit.
3

After, configuring the IP address in Kali Linux.
Also, configuring the IP address in Metasploit
4

Then, restarting network processes in Kali Linux.
After, Kali Linux output after issuing the network restart command.
5

Also, Restarting Metasploit Network processes. It is illustrated as below.
Then, confirming IP address after restarting network processes. Note that an IP address is
lacking in the field it should be in. Fix this by entering “sudo ifconfig eth0 192.168.0.1.”
6

ifconfig command to confirm that the IP configuration worked.
Kali Linux ping the newly configured Metasploit box.
7

NMAP command as it targets the Metasploit box and it is illustrated as below. And, output
also illustrated as below.
8

Command with a “-v” switch for verbose output and it is illustrated as below.
NMAP output is shown below.
9

Verbose NMAP output is illustrated as below.
Verbose output with the –O switch is shown below.
10

NMAP output from the –v switch and the -O switch is demonstrated as below.
11