VULNIX PENTESTING 

౦ Network Penetration Testing: -

Network penetration testing is a security service that identifies security vulnerabilities in networks, systems, hosts and devices by purposefully using malicious techniques to test the network’s security responses.

    The object of network penetration testing is to identify security exploits that put your business at risk of a data breach before hackers can discover and exploit them.

    By using methods, a real hacker would use. Other thata cyber security audit, which should be performed before a network penetration test, network penetration testing provides one of the highest levels of security assurance a business can have. 

౦ How does network pen testing work: - 

A typical network pen testing approach involves the following steps: - 

i. Planning: - In the planning phase, ethical hackers discuss the scope and overall aim of the test with key stakeholders. Testing methods and success metrics are defined in this initial discussion phase. After a basic overview is decided upon, hackers start surveying all components of the businesses’ network. 

ii. Testing: - In this phase, hackers use either static or dynamic testing solutions to study and understand how the network responds to simulated attacks. 

iii. Accessing networks: - After testing the network to understand its behavior, ethical hackers will perform a variety of attacks on the network, including web application attacks, SQL injections, etc. These attacks will help identify the target network’s vulnerabilities. If the ethical hackers identify vulnerabilities, they will attempt to actually exploit them, from attempting to steal data to escalating privileges to intercepting traffic. The idea here is to determine how much damage they can cause. After successfully gaining access, another metric of interest is to see how long the tester can maintain their access within the system. If hackers can maintain access to a system for a long period of time, this lends them more opportunity to wreak havoc and collect valuable sensitive data. 

iv. Analysis: - After completing testing activities, pen testers will analyze their results and create a report showing their findings. This report will provide actionable insight into vulnerabilities, actual exploitability, and the chance for businesses to take necessary remediation action before a real hacker has the opportunity to exploit their system. 

౦ Benefits of network penetration testing: -

Network penetration testing offers several benefits to your business. Specially, the following are ways pen testing helps you understand and improve your overall security: - 

• Understanding your network benchmarks.
• Testing your security controls.
• Evaluating your security posture.
• Identifying security flaws.
• Assessing risk.
• Addressing and fixing identified network security flaws.
• Preventing network and data breaches.
• Ensuring network and system security. 

౦ Purpose of Network Pentest: -

1. Protect your data: - Single-handedly the most important reason, every organization must guard itself against data breaches. Pen testing networks often function like ethical hacks and simulate cyber-attacks as best as possible. A small weakness has the potential to let out sensitive information, affecting your customers’ trust and the more serious violation of various rules and regulations. Here, a helpful way to determine the level of possible intrusion is to identify the different levels of risk that you are exposed to.

2. Ensuring overall security: - Be it the structure of your business as a whole, sensitive data, or newly released applications, ensure that no overlooked flaw can compromise your integrity through network pentests. Security assessments and website security scans should be a part and parcel of any new initiatives, especially if there is the management of important data. Some examples of such flaws include SQL injections, weakly configured firewalls, outdated software, and traditional virus or malware.

3. Compliance requirements: - Certain regulations insist on penetration testing services, no matter the industry. For example, data security for the payment card industry ensures such tests for the protection of customers’ sensitive information (PCI DSS).

4. Continued maintenance: - Network pen tests require multiple runs through a continuous time period to ensure long-term security. Professionals hired for this purpose will also look over the security controls used for the business network such as firewall, layered security, encryption processes, etc. Proper penetration tests, keeping in mind the needs of the system, client, and overall security. 

౦ Tools to conduct Network Penetration Testing: - 

Here are a few network penetration testing tools you can use to conduct pentesting for your network systems. 

i. Nessus – vulnerability scanning tool used for vulnerability assessment (VA) process.

ii. Nmap – network discovery and security auditing tool. 

iii. NetCat – port scanning and listening tool used to read and write in a network. 

iv. Hydra – pentesting tool used for brute-forcing login and obtaining unauthorized access. 

v. Wireshark – packet sniffing and analysis tool used for monitoring network traffic and its behavior. 

vi. Nikto – vulnerability scanning tool used for scanning web-servers for security weaknesses. 

vii. Metasploit – pentesting tool used for probing vulnerabilities in networks and servers. 

viii. PRET – pentesting toil for checking printer security controls. 

ix. Burpsuite – vulnerability assessment and pentesting tool used for discovering vulnerabilities in web apps. 

౦ Importance of network penetration testing: - 

To understand more about how to secure networks and prevent data breaches, we’ve put some insights into the importance of network penetration testing through this article. Sometimes, companies who have put their systems through vulnerability scanning doubt the relevance of pen tests since both processes have the same goal. However, an internal or external network pen test is to follow vulnerability assessments. 

౦ Vulnix Pen Testing: - 

Vulnix is a boot to root virtual machine which is hosted on Vulnhub. Download vulnix from this link https://download.vulnhub.com/hacklab/Vulnix.7z and install it. Now, we need to found the id and password of vulnix. 

Now, follow the below steps – 

i. At first, we need to identify the IP address of vulnix machine. So, we use these two tools – a) netdiscover, b) nmap. 

a) netdiscover: - The netdiscover is a tool which is used to gather all the important information about the network. It gathers information about the connected clients and the router. As for the connected clients, we'll be able to know their IP, MAC address and the operating system, as well as the ports that they have open in their devices. As for the router, it will help us to know the manufacturer of the router. Then we'll be able to look for vulnerabilities that we can use against the clients or against the router if we are trying to hack them. 

b) nmap: - Nmap is short for Network Mapper. It is an open-source Linux command-line tool that is used to scan IP addresses and ports in a network and to detect installed applications. 

    Nmap allows network admins to find which devices are running on their network, discover open ports and services, and detect vulnerabilities. 

Now, open terminal on Kali Linux and use these two commands to identify the IP address of vulnix machine – 

౦ netdiscover -S -r 192.168.29.0/24 and press enter. 

Where, -S = enable sleep time suppression between each request (hardcore mode). 

           -r = range: scan a given range instead of auto scan. 192.168.6.0/24, /16, /8. 

౦ nmap -sn 192.168.29.0/24 and press enter. 

ii. Now, we will find an IP, which is running on the VMware – 192.168.29.56. 

iii. Now we need to know which ports are open and what services are running on the IP – 192.168.29.56, so we use this command - nmap -O -sV -T4 -p- 192.168.29.56 and press enter. 

Where, -O = Operating System detection.

            -sV = Probe open ports to determine service/version info. 

            -T = Threads. 

            -p- = show all ports. 

iv. Now, we got many services running on ports, notables are: 

• Port 22: ssh. 
• Port 25: smtp. 
• Port 79: finger. 

v. Here, smtp service is running on port no. 25. So, we need to download smtp-user-enum from github. Now, go to google and search – smtp-user-enum github and go to this link - https://github.com/pentestmonkey/smtp-user-enum. Now, click on code and copy the HTTPS code. 

vi. Now, open terminal on kali linux and use this command to download smtp-user-enum - git clone https://github.com/pentestmonkey/smtp-user-enum.git and press enter. 

vii. Now, we need to know smtp unix_users name, so, search in google unix_users.txt github and go to this link- https://github.com/rapid7/metasploit-framework/blob/master/data/wordlists/unix_users.txt. Now, click on Raw and copy all names. 

viii. Now, open terminal on kali linux and use this command to save users names in a text file – nano unix_users.txt and press enter. 

ix. After that, we can use the smtp-user-enum to find out which smtp users are exists from the unix_users. 

x. Now, go to the smtp-user-enum directory and we can find out which users are existing in smtp by using this command - smtp-user-enum -M VRFY -U /home/kali/project/unix_users.txt -t 192.168.29.56 and press enter. 

Where, -M = mode: Method to use for username guessing EXPN, VRFY or RCPT. 

            -U = File of usernames to check via smtp service. 

            -t = Server host running smtp service. 

xi. Now, we need to find out the active user (home/user) of IP 192.168.29.56. 

xii. Here finger service running on port no. 79. Now, using finger service, we need to check which is the active user (home/user) of IP 192.168.29.56 from exists user. So open terminal and use this command - 

• finger backup@192.168.29.56 
• finger bin@192.168.29.56 
• finger user@192.168.29.56

xiii. Now, we need to do SSH Brute forcing. Running Hydra against either user or vulnix is an option with rockyou wordlist, although this will take a very long time, so we use user user first. 

xiv. For SSH brute forcing we use hydra tool and find out password using rockyou.txt wordlist. So, open terminal on kali linux and at first locate rockyou.txt and we use this file - /usr/share/wordlists/rockyou.txt. 

    Now, use this command to find out password of IP 192.168.29.56 – hydra -l user -P /usr/share/wordlists/rockyou.txt 192.168.29.56 ssh and press enter. 

Where, -l = LOGIN (user name). 

            -P = Password file with location (/usr/share/wordlists/rockyou.txt). 

Now, this is login id: user and password: letmein. 

xv. Here, ssh service running on port no. 22. So, we enter vulnix through ssh port from kali linux. Now use this command - ssh user@192.168.29.56 and enter password: letmein and now we enter vulnix machine. 

xvi. Now check IP address use this command – ifconfig. 

xvii. Finally, open vulnix machine put login id: user and password: letmein and check IP – ifconfig.