We will use Kali Linux and its tools to introduce some Vulnerability and Penetration Tests. All participants are required to download the pre-installed Kali VM from ​here and import it to your virtual box. Make sure to reinitialize your MAC address.

Once you imported go to settings and change the bridged interface to your connected physical interface.

After that switch on the vm and log in to GUI

Default user name passwords are root and toor.

Once logged in open your terminal and issue an apt-get update command

Using Open-VAS as Vulnerability Scanner

The Open Vulnerability Assessment System (OpenVAS) is a framework of several services and tools. The core of this SSL-secured service-oriented architecture is the OpenVAS Scanner. The scanner very efficiently executes the actual Network Vulnerability Tests (NVTs) which are served via the OpenVAS NVT Feed or via a commercial feed service. (more: www.openvas.org)

OpenVAS has tens of thousands of signatures and when installing if you do not give your system enough resources, particularly RAM, you will find yourself in a world of misery. For our purpose, Kali VM only has 2GB RAM and it will be more than enough to scan small websites. But if you need to scan websites like a main web of a University, then you might consider in increasing RAM and CPU.

Installation

• To install OpenVAS on kali,

  apt-get install openvas
  

• Once the installation is finished, type openvas-setup on terminal to do the initial setup. At the end of the setup it will give you a long password for the default user ‘admin’. Please note it somewhere.

• When the OpenVAS setup process is finished the OpenVAS manager, scanner and services are listening on port 9390, 9391, 9392 and on port 80. You can use the following netstat command to check if these services are listening:

  netstat –antp
  

• Netstat –antp command Explained

  -a all
  -n show ip instead of host names
  -t show only tcp connections
  -p show process id/name
  

• If the OpenVAS services are not running than use the following command to start these services:

  openvas-start
  

• Open ​https://127.0.0.1:9392 using your default browser.

• Log in to Greenbone Security Assistant using the username admin and the password from the previous step.

The default dashboard will show you a collection of scans, hosts etc.

Scanning

Let’s start a scan.

• Go to Scans -- > Tasks

• Click on the Purple wizard icon

• Enter your target host ( In this case IP of your test vm) and start scanning.

Please be patient as it may take some time to do the scanning. Therefore please do not try this on your actual live systems at this moment as it will create high traffic / slowness and you may slow all others in the lab as well.

• Once the scan is completed, go to Scans -- > Results and see what have detected.

OPENVAS is a whole set of tools in detecting vulnerabilities, reporting and scheduling tasks. Due to our limited environment, you may refer youtube and google for further usages.

• Use openvas-stop to terminate OpenVAS service.

Port Scanner – Zenmap

Zenmap is a nmap based port scanner. It has a basic GUI and will help testers to find open blocked or filtered ports of a target easily. In addition to showing Nmap's normal output, Zenmap can arrange its display to show all ports on a host or all hosts running a particular service. It summarizes details about a single host or a complete scan in a convenient display. Zenmap can even draw a topology map of discovered networks. The results of several scans may be combined together and viewed at once.

• Open Zenmap from Applications -- > Information Gathering zenmap.

• You can specify your Target and select a required profile and Scan.

• The Intense scan in profile list is just one of several scan profiles that come with Zenmap. Choose a profile by selecting it from the Profile combo box. Profiles exist for several common scans. After selecting a profile the Nmap command line associated with it is displayed on the screen. Of course, it is possible to edit these profiles or create new ones.

• Once a scan is finished you can check the results on,

  Nmap Output – which is the default view of all results
  Ports/ Hosts – All port statuses will be presented in a user friendly way
  Topology – This will show your target/s and the traceroutes 
  Host Details – All details on the target device
  Scans – this will list down the previous scans
  

In a controlled system if you find any unknown ports that are open, then it might be a potential risk or a vulnerability that target is having.

Distributed Denial of Service Pentest

Form Wikipedia

A denial-of-service attack (DoS attack) is a cyber-attack where the attacker looks for to make a machine or network resource unavailable to its deliberated users by temporarily or indefinitely services of disturbing a host connected to the Internet. Denial of service is usually accomplished by flooding the targeted machine or resource with excessive requests in an attempt to overload systems and prevent some or all legitimate requests from being fulfilled.

In a distributed denial-of-service attack (DDoS attack), the incoming traffic flooding the victim originates from many different sources. A DoS or DDoS attack is analogous to a group of people crowding the entry door or gate to a shop or business, and not letting legitimate parties enter into the shop or business, disrupting normal operations.

Before proceed make sure you do this tests on your own environment. DO NOT try this for your neighbor’s VM’s, otherwise it will damage whole lab network.

• As all our VM’s run http servers use following to do the testing.

  hping3 -F --flood -p 80 <your vm address>
  

• while the hping3 is running try to access your web server through a browser.

To detect these kind of attacks you should utilize an IDS or a packet analyzer like wireshark. (We will have a wireshark session on latter part of the workshop)

There are several ways of creating high traffic to servers and check their capability in surviving. Depending on your results, you can change application specific parameters to support your service.

Few example attacks,

• UDP flood

  hping3 --udp --flood -p 80 <your vm address>
  

• SYN-FIN flood

  hping3 --SF --flood -p 80 <your vm address>
  

• PUSH-ACK flood

  hping3 --PA --flood -p 80 <your vm address>
  

• Reset flood

  hping3 --R --flood -p 80 <your vm address>
  

• FIN flood

  hping3 --F --flood -p 80 <your vm address>
  

What are SYS, ACK, FIN, PUSH ? check them at ​https://en.wikipedia.org/wiki/Transmission_Control_Protocol