Penetration Tester’s Open Source Toolkit This page intentionally left blank Penetration Tester’s Open Source Toolkit Third Edition Jeremy Faircloth Neil Fryer, Technical Editor AMSTERDAM BOSTON HEIDELBERG LONDON NEW YORK OXFORD PARIS SAN DIEGO SAN FRANCISCO SINGAPORE SYDNEY TOKYO Syngress is an imprint of Elsevier Acquiring Editor: Angelina Ward Development Editor: Matt Cater Project Manager: Paul Gottehrer Designer: Alisa Andreola Syngress is an imprint of Elsevier 225 Wyman Street, Waltham, MA 02451, USA Ó 2011 Elsevier Inc. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publisher’s permissions policies and our arrangements with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions. This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted herein). Notices Knowledge and best practice in this field are constantly changing. As new research and experience broaden our understanding, changes in research methods or professional practices, may become necessary. Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information or methods described herein. In using such information or methods they should be mindful of their own safety and the safety of others, including parties for whom they have a professional responsibility. To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the material herein. Library of Congress Cataloging-in-Publication Data Application submitted British Library Cataloguing-in-Publication Data A catalogue record for this book is available from the British Library. ISBN: 978-1-59749-627-8 For information on all Syngress publications visit our website at www.syngress.com Printed in the United States of America 11 12 13 14 15 10 9 8 7 6 5 4 3 2 1 Dedication To my Mother-in-Law, Susan Gonzales As an author, it is difficult to pick any one person to dedicate your work to as there are always so many people who have an impact on your life and deserve recognition. In my case, I’d like to dedicate this book to someone who was always able to see the future. I grew up in a small town in New Mexico where I attended school and became best friends with the girl who would later become my wife. Her mother was a teacher at our school and was always kind to the geeky kid hanging out with her daughter. I have many memories of catching a lift with my best friend Christina and her mom, Sue, when it was cold outside. Even then, Sue always told me that I should never give up on my dreams and never let anyone tell me that there is something that I can’t accomplish. She told me that in time, I would always succeed (prediction #1). Years later, I asked Christina if she would be my wife and she tearfully accepted my proposal. The next step, as it is for many engaged couples, is to tell our respective families about our decision. When we told my future mother-in-law Sue, she didn’t react with surprise or anger. Instead, she said to my newly betrothed, “I told you so.” Apparently she had predicted to my future bride far in advance that I was the one she was destined to marry (prediction #2). After our wedding, my mother-in-law continued to be a positive influence in our lives and was always a willing ear for my wife when I was working long hours or traveling for my job. She taught my wife independence when she was a child and as an adult helped her learn how to deal with the trials and tribulations of living with a professional geek. Without that, I don’t know that my wife would be able to handle the unique lifestyle that comes with this type of work. This week four years ago, my mother-in-law, Susan Gonzales passed away. She is no longer with us in body, but her legacy lives on in her daughter and through the lessons that she taught both of us. This book would not exist if Sue had not been in our lives, so I am proud to have this opportunity to dedicate it to her. Mom, we love you and miss you very much. Jeremy Faircloth This page intentionally left blank Contents Acknowledgments.................................................................................................. xiii Introduction..............................................................................................................xv About the Author....................................................................................................xxi About the Technical Editor ....................................................................................xxi CHAPTER 1 Tools of the Trade.................................................. 1 1.1 Objectives.......................................................................................1 1.2 Approach........................................................................................2 1.3 Core technologies ..........................................................................4 1.3.1 LiveCDs...............................................................................4 1.3.2 ISO images..........................................................................6 1.3.3 Bootable USB drives...........................................................6 1.3.4 Creating a persistent LiveCD..............................................8 1.4 Open source tools ..........................................................................9 1.4.1 Tools for building LiveCDs ................................................9 1.4.2 Penetration testing toolkits................................................12 1.4.3 Penetration testing targets.................................................20 1.5 Case study: the tools in action ....................................................23 1.6 Hands-on challenge .....................................................................27 Summary ......................................................................................27 Endnote ........................................................................................28 CHAPTER 2 Reconnaissance ...................................................29 2.1 Objective......................................................................................30 2.2 A methodology for reconnaissance.............................................32 2.3 Intelligence gathering ..................................................................33 2.3.1 Core technologies..............................................................34 2.3.2 Approach ...........................................................................36 2.3.3 Open source tools..............................................................40 2.3.4 Intelligence gathering summary........................................49 2.4 Footprinting..................................................................................49 2.4.1 Core technologies..............................................................49 2.4.2 Approach ...........................................................................55 2.4.3 Open source tools..............................................................59 2.4.4 Footprinting summary.......................................................67 2.5 Human recon................................................................................67 2.5.1 Core technologies..............................................................68 2.5.2 Open source tools..............................................................71 2.5.3 Human recon summary.....................................................74 vii viii Contents 2.6 Verification...................................................................................74 2.6.1 Core technologies..............................................................74 2.6.2 Approach ...........................................................................76 2.6.3 Open source tools..............................................................82 2.6.4 Verification summary ........................................................84 2.7 Case study: the tools in action ....................................................85 2.7.1 Intelligence gathering, footprinting, and verification of an Internet-connected network...........85 2.7.2 Case study summary .........................................................92 2.8 Hands-on challenge .....................................................................92 Summary ......................................................................................93 Endnotes.......................................................................................93 CHAPTER 3 Scanning and Enumeration....................................95 3.1 Objectives.....................................................................................95 3.1.1 Before you start.................................................................96 3.1.2 Why do scanning and enumeration? ................................96 3.2 Scanning.......................................................................................97