We will use Kali Linux and its tools to introduce some Vulnerability and Penetration Tests. All participants are required to download the Kali live iso from ​here and import it to your virtual box (Use at least 4GB of RAM).

Change the bridged interface to your connected physical interface.

After that switch on the vm and log in to GUI

Default user name passwords are kali and kali or root and toor.

Once logged in open your terminal and issue an sudo apt-get update command

Using Open-VAS as Vulnerability Scanner

The Open Vulnerability Assessment System (OpenVAS) is a framework of several services and tools. The core of this SSL-secured service-oriented architecture is the OpenVAS Scanner. The scanner very efficiently executes the actual Network Vulnerability Tests (NVTs) which are served via the OpenVAS NVT Feed or via a commercial feed service. (more: www.openvas.org)

OpenVAS has tens of thousands of signatures and when installing if you do not give your system enough resources, particularly RAM, you will find yourself in a world of misery. For our purpose, Kali VM only has 2GB RAM and it will be more than enough to scan small websites. But if you need to scan websites like the main web of a University, then you might consider increasing RAM and CPU.

Installation

• To install OpenVAS on kali,

  sudo apt-get install openvas
  

• Once the installation is finished, type sudo gvm-setup on the terminal to do the initial setup. At the end of the setup, it will give you a long password for the default user ‘admin’. Please note it somewhere.

• When the OpenVAS setup process is finished the OpenVAS manager, scanner and services are listening on ports 9390, 9391, 9392, and on port 80. You can use the following netstat command to check if these services are listening:

  sudo netstat –antp
  

• Netstat –antp command Explained

  -a all
  -n show ip instead of hostnames
  -t show only tcp connections
  -p show process id/name
  

• If the OpenVAS services are not running then use the following command to start these services:

  sudo gvm-start
  

• Open ​https://127.0.0.1:9392 using your default browser.

• Log in to Greenbone Security Assistant using the username admin and the password from the previous step.

The default dashboard will show you a collection of scans, hosts, etc.

Scanning

Let’s start a scan.

• Go to Scans -- > Tasks

• Click on the Purple wizard icon

• Enter your target host ( In this case IP of your test vm) and start scanning.

Please be patient as it may take some time to do the scanning. Therefore please do not try this on your actual live systems at this moment as it will create high traffic/slowness and you may slow all others in the lab as well.

• Once the scan is completed, go to Scans -- > Results and see what has been detected.

OPENVAS is a whole set of tools in detecting vulnerabilities, reporting, and scheduling tasks. Due to our limited environment, you may refer youtube and google for further usages.

• Use gvm-stop to terminate OpenVAS service.

Distributed Denial of Service Pentest

From Wikipedia

A denial-of-service attack (DoS attack) is a cyber-attack where the attacker looks to make a machine or network resource unavailable to its deliberated users by temporarily or indefinitely services of disturbing a host connected to the Internet. Denial of service is usually accomplished by flooding the targeted machine or resource with excessive requests in an attempt to overload systems and prevent some or all legitimate requests from being fulfilled.

In a distributed denial-of-service attack (DDoS attack), the incoming traffic flooding the victim originates from many different sources. A DoS or DDoS attack is analogous to a group of people crowding the entry door or gate to a shop or business, and not letting legitimate parties enter into the shop or business, disrupting normal operations.

Before proceeding make sure you do these tests in your own environment. DO NOT try this for your neighbor’s VM’s, otherwise, it will damage the whole lab network.

• As all our VM’s run HTTP servers use the following to do the testing.

  hping3 -F --flood -p 80 <your vm address>
  

• while the hping3 is running try to access your web server through a browser.

To detect these kinds of attacks you should utilize an IDS or a packet analyzer like wireshark. (We will have a wireshark session on the latter part of the workshop)

There are several ways of creating high traffic to servers and check their capability in surviving. Depending on your results, you can change application-specific parameters to support your service.

Few example attacks,

• UDP flood

  hping3 --udp --flood -p 80 <your vm address>
  

• SYN-FIN flood

  hping3 --SF --flood -p 80 <your vm address>
  

• PUSH-ACK flood

  hping3 --PA --flood -p 80 <your vm address>
  

• Reset flood

  hping3 --R --flood -p 80 <your vm address>
  

• FIN flood

  hping3 --F --flood -p 80 <your vm address>
  

What are SYS, ACK, FIN, PUSH ? check them at ​https://en.wikipedia.org/wiki/Transmission_Control_Protocol