• Like
  • Save
Pentesting with Metasploit
Upcoming SlideShare
Loading in...5
×
 

Pentesting with Metasploit

on

  • 1,187 views

Pentesting? What is Pentesting? Why Pentesting?

Pentesting? What is Pentesting? Why Pentesting?
Millions of dollars have been invested in security programs to protect critical infrastructure to prevent data breaches

Statistics

Views

Total Views
1,187
Views on SlideShare
1,092
Embed Views
95

Actions

Likes
1
Downloads
69
Comments
0

1 Embed 95

http://beaconedutech.com 95

Accessibility

Categories

Upload Details

Uploaded via as Adobe PDF

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

    Pentesting with Metasploit Pentesting with Metasploit Presentation Transcript

    • Information Security is our Forte… Phone: Email: Web: Address: +91-20-24333311 beaconedutech@gmail.com http://beaconedutech.com 303, Renata Chambers, 2145, Sadashiv Peth, Pune, Maharashtra, India – 411030 PenTesting with Metasploit Framework Presented by – Sudarshan Pawar Prakashchandra Suthar
    • Information Security is our Forte… “From 2008 Backtrack started giving machine guns to monkeys “
    • Beacon Edutech • What is PenTesting? • Why PenTesting? • Traditional Methodologies • Metasploit • Metasploit Terminologies • Demo • Is Metasploit the ans.? 12/7/2013 Agenda 2
    • Beacon Edutech • What is PenTesting? • Art or approach in an attempt to break-in into authorised digital environment. • Why PenTesting? • Explore your security & trying to patch them • Find vulnerabilities before others(bad guys) do •… 12/7/2013 Getting Started 3
    • Beacon Edutech • Millions of dollars have been invested in security programs to protect critical infrastructure to prevent data breaches. • Penetration Test is one of the most effective ways to identify weaknesses and deficiencies in these programs. 12/7/2013 Need of Pentesting -Metasploit –The Penetration Tester’s Guide by HD Moore 4
    • 12/7/2013 Pentesting Phases Beacon Edutech Reconnaissance Vulnerability Assessment & Analysis Exploitation Post Exploitation 5 Reporting
    • Beacon Edutech 12/7/2013 Traditional Pentesting 6
    • 12/7/2013 Traditional Pentesting Beacon Edutech Public Exploit Gathering Change Offset Replace Shellcode 7
    • Beacon Edutech • Not just a tool, but an entire framework • An Open source platform for writing security tools and exploits • Easily build attack vectors to add its exploits, payloads, encoders, • Create and execute more advanced attack • Built in RUBY 12/7/2013 What is Metasploit? 8
    • Beacon Edutech 12/7/2013 Architecture 9
    • Beacon Edutech • Easy to Use • 600+ Exploits • 200+ payloads • 25+ encoders • 300+ auxiliary 12/7/2013 Why use Metasploit? 10
    • Beacon Edutech 12/7/2013 Traditional Pentest Vs Metasploit 11
    • Load Metasploit Choose the target OS Change Offset Use exploit Beacon Edutech Public Exploit Gathering 12/7/2013 Traditional Pentest Vs Metasploit SET Payload Replace Shellcode Execute 12
    • Beacon Edutech • MSFconsole • MSFcli • Msfweb, msfgui ( discontinued) • Metasploit Pro • Armitage 12/7/2013 Metasploit Interface 13
    • Beacon Edutech • Exploit : The means by which a Pentester takes an advantages of a flaw within system, application, or service • Payload : Code that we want the target system to execute on our command • Shellcode : Set of instructions used as payload when exploitation occurs • Module : Support software that can be used by Metasploit • Listener : A component for waiting an incoming connection 12/7/2013 Metasploit Terminologies 14
    • 12/7/2013 Beacon Edutech Netapi exploit Vulnerability : NetAPI32.dll file that allows remote code execution Process name: Microsoft LAN Manager DLL Application using this process: Microsoft network 15
    • Beacon Edutech • A.k.a Meta Interpreter • Post exploitation payload(tool) • Uses in-memory DLL injection • Can be extended over the run time • Encrypted communication 12/7/2013 Meterpreter 16
    • Command execution File Upload/Download Process migration Log Deletion Privilege escalation Registry modification Deleting logs and killing antivirus Backdoors and Rootkits Pivoting …..etc. Beacon Edutech • • • • • • • • • • 12/7/2013 What can be done 17
    • Beacon Edutech Demo Meterpreter 18 12/7/2013
    • Beacon Edutech • BackTrack and Kali Linux • Metasploit Team (HD Moore & Rapid7) • Offensive Security 12/7/2013 Thanks To… 19
    • http://docs.kali.org/ http://www.metasploit.com http://www.offensive-security.com/metasploit-unleashed/ http://www.processlibrary.com/en/directory/files/netapi32/2 1334/ • http://support.microsoft.com/kb/958644 Beacon Edutech • • • • 12/7/2013 References 20
    • Beacon Edutech 12/7/2013 Discussion … 21
    • Beacon Edutech • Group Discussion about “Pentesting with Metasploit –Yes/No ” • Rules • Don’t Hesitate to raise a point (We all are learners) • No Rocket Science required. • Its not a debate, so chill. 12/7/2013 RULES… 22