International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056 Volume: 06 Issue: 08 | Aug 2019 www.irjet.net p-ISSN: 2395-0072 PENETRATION TESTING USING METASPLOIT FRAMEWORK: AN ETHICAL APPROACH Seema Rani1, Ritu Nagpal2 1M.Tech Scholar, Computer Science & Engineering, GJUS&T, Hisar, India 2Associate Professor, Computer Science & Engineering, GJUS&T, Hisar, India ---------------------------------------------------------------------***---------------------------------------------------------------------- Abstract-Security is an essential concern for the internet describe the installation and lists of tools provided by since nowadays almost all communication occurs via the Kali Linux 2017.3 and uses preconfigured and internet. The motive of performing penetration testing is preinstalled tools for laboratory project using VMware to ensure that system and network have no security hole (virtual machine framework). Matthew Denis et al [2] that allows an unauthorized access to system and in this paper titled "Penetration testing: Concepts, attack network. One possible and appropriate way to avoid methods, and defense strategies" examines the distinct hacking of system and network is penetration testing. This penetration testing tools of Kali Linux: Metasploit, paper summarily describe some basics of penetration Wireshark, JohnThe Ripper, BeEF, Nmap, Nessus and testing, evaluation of existing exploits and tools and use Dradisare to study attack methodologies and defense Metasploit framework for penetration testing and to run strategies. Himanshu Gupta and Rohit Kumar [4] In exploits in this framework. We describe penetration this paper titled “Protection against penetration attacks testing techniques: information gathering, vulnerability using Metasploit” discusses the script based attacks, analysis, vulnerability exploitation, post exploitation and using Metasploit built-in module to exploit the target report generation using Metasploit framework’s existing system, implements Metasploit attacks and analyze modules, exploits and tools. scripts and payloads to prepare a defense script. Fabián Cuzme-Rodríguez et al. [5] In this paper titled Keywords: Penetration testing, vulnerabilities, security, “Offensive Security: Ethical Hacking Methodology on the exploit, Metasploit framework. Web” The objective is to plan methodology, generate policies for security assurance and ISO 2007 attacks, risk 1. INTRODUCTION analysis using MSAT 4.0 tool based on ISO standard . Ömer Aslan and Refik Samet [7] in this paper titled Nowadays people are getting more dependent on "Mitigating Cyber Security Attacks by Being Aware of computer and information technology and security Vulnerabilities and Bugs" how to handle cyber security information on the internet is an important concern for attacks by spreading awareness about vulnerabilities IT society and industry. The rapidly increasing number and threats, Attacks methodology, defense strategies of of connections of computers to the internet, extensibility vulnerabilities. Section-I introduces penetration testing of system over network is growing day by day and is and its terminology. Section-II includes conceptual increasing the complexity of systems and security framework of penetration testing and section-III software and infrastructure is a major concern for IT explains phases of penetration testing and then it World. In this era even small details are stored on contains review of phases using Metasploit exploits and internet in database of computer systems on internet. To tools of kali Linux. Finally we conclude with giving the ensure that information is secure and not vulnerable and pros and cons of penetration testing. adhere with the assigned security regulations, security experts have designed various powerful security 2. PENETRATION TESTING AND TERMINOLOGY assurance approaches including layered design, guarantee or proof of correctness, environment of The vulnerability is a security hole, a flaw in the code or software engineering and penetration testing. design that makes the computer system at risk. A Penetration testing is an essential technique to test the number of Vulnerabilities exist such as buffer overflow, complete, operational, integrated and trusted computing race condition, formal string value, null pointer etc. base which consists of software, hardware and people. Security loopholes are detected or observed by Pen testing using an open source framework such as vulnerability assessment and penetration testing. With Metasploit for exploit generation contains more than the help of vulnerability assessment, pen tester scans the 1600 exploits and 495 payloads to attack the network loophole and after scanning penetration testing is and computer systems. Penetration testing is done by performed against the detrimental vulnerabilities which simulating the unauthorized access to the system either exposes the risks to the system. Trojanhorse, email by using manual method or automated tools or by bombing, data stealing, SQL injection, password cracking, combination of both methods. Ahmad Ghafarian [1] in Denial of Service, SQL injection, cross-site scripting are this paper titled ”Using Kali Linux Security Tools to some types of attacks. It is essential for organizations to Create Laboratory Projects for Cybersecurity Education” consider methodologies like Open Web Application © 2019, IRJET | Impact Factor value: 7.34 | ISO 9001:2008 Certified Journal | Page 538 International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056 Volume: 06 Issue: 08 | Aug 2019 www.irjet.net p-ISSN: 2395-0072 Security Project (OWASP), Offensive Security (OS), There are plethora of tools used for penetration testing Certified Ethical Hacking (CEH) and Information Systems to a distinct type of device and manage different types of Security Assessment Framework (ISSAF) against attacks attacks. Toolset used for pen testing is Backtrack, Kali [5]. Linux suite using a virtual box or VMware. Kali Linux consists of a wide range of penetration testing tools and Various penetration testing methodologies are available framework. Metasploit framework is used for generating and it is challenging to use the legitimate methodology exploits into the systems. We shall take steps to secure for testing. The methodology for penetration testing is our resources from such exploits. white box penetration testing, black box penetration testing and grey box penetration testing. In black box 4. PHASES IN PENETRATION TESTING penetration testing pen tester act as hacker and target the system without having any idea about the system. Information Gathering: The first step of penetration Gray box penetration testing, tester have the access, testing is to gather all information about the system or privilege and partial information of system. It is more machine. Depending upon gathered information tester efficient then black box testing and considered as ethical can examine that vulnerabilities exist in target system, hacking where by the hacker who have legitimate access network, hosts and application .Information like domain to an organization network. White box penetration name, database name and its version, how many ports testing is considered as open box, clear box and logic are open, firewall is on or not. In our research gathering driven testing and have full knowledge of the target of information is done by using NMAP tool. system like network, source code, OS version, server type, IP address etc... It provides the comprehensive Vulnerabilities analysis: After gathering of the assessment of both external and internal vulnerabilities. information, vulnerabilities of system are obtained by It is most time consuming technique. We shall use white further scanning the network or computer system. In box methodologies or ethical hacking techniques for this scanning phase, tester analyses the vulnerabilities penetration testing. Penetration testing is used to like which type pf service is running, version of mitigate the attacks. The tester uses penetration-testing particular service which port number is running this tools to examine the security vulnerabilities and the service, operating system etc. For commonly scanning security holes through which an attacker can intrude used tools are NMAP, Nessus, Nikto. Huge number of into the systems. Kali Linux is used to exploit vulnerabilities are found that can be exploited .The vulnerabilities. tester use the most descriptive vulnerabilities to exploit the system or hosts. 3. CONCEPTUAL FRAMEWORK OF PENETRATION TESTING Vulnerability exploitation: After finding particular vulnerability for exploitation pen tester’s main motive is Pen testing or penetration testing is a way of testing a to breach all type of security and take over the remote system against the detrimental vulnerabilities which access of network, application or system. We are using exposes the risks to the system. The steps in penetration METASPLOIT framework for exploiting the testing include information gathering, vulnerability vulnerabilities. Through exploitation, pen tester can get analysis, vulnerability exploitation, post exploitation and remote access of the system. The goal of pen tester is report generation. Avoid and clear away the how far it get into the infrastructure to identify valued vulnerability that can damage the system [7]. Many tools targets and avoid detection. can be used for penetration testing. The main motive of penetration testing is to find out the security