SlideServe
Télécharger Obtenir Pro
Menu
Accueil Pro
Préférences
ApparenceLight Aide et commentaires
© SlideServe · v2026

Web Application Security Testing using Kali Linux

claudia-mullen avatar
claudia-mullen
15 diapositives · 1.1K Views · Nov 29, 2014

Gene Gotimer, Senior Architect gene.gotimer@coveros.com. Web Application Security Testing using Kali Linux. About Coveros. Coveros helps organizations accelerate the delivery of business value through secure, reliable software. Kali Linux.

Web Application Security Testing using Kali Linux - slide 1
01 / 15Web Application Security Testing using Kali Linux
1 / 17

Télécharger la présentation

Web Application Security Testing using Kali Linux
Une image / un lien ci-dessous est fourni (tel quel) pour télécharger la présentation

Politique de téléchargement : le contenu du site vous est fourni TEL QUEL pour votre information et votre usage personnel ; il ne peut être vendu, concédé sous licence ni partagé sur d’autres sites sans l’accord de son auteur.Le contenu vous est fourni TEL QUEL, pour votre information et votre usage personnel uniquement. Téléchargez la présentation en cliquant sur ce lien. Lors du téléchargement, si vous ne parvenez pas à télécharger une présentation, l’éditeur a peut-être supprimé le fichier de son serveur.Pendant le téléchargement, si vous ne parvenez pas à obtenir une présentation, le fichier a peut-être été supprimé par l’éditeur.

F I N

Plus de contenu associé

Transcription de la présentation

  1. Gene Gotimer, Senior Architect gene.gotimer@coveros.com Web Application Security Testing using Kali Linux

  2. About Coveros • Coveros helps organizations accelerate the delivery of business value through secure, reliable software

  3. Kali Linux • Penetration Testing and Security Auditing Linux distribution • New generation of BackTrack Linux • Debian-based (“Wheezy”) • Many install options: • i386, x86_64, ARM • Android devices • ISO and VMWare image • Installed, virtual, dual boot, live USB • PXE, mini ISO • www.kali.org

  4. Not for general use! • Single user • Default user is root • Many of the tools need root anyway • Live images use toor as default root password • Not recommended for Linux beginners • It is a pentesting and security auditing tool • Easy to mess up the system as root • Easy to attack your organization from within

  5. Tool Categories • Information Gathering • Vulnerability Analysis • Web Applications • Password Attacks • Wireless Attacks • Exploitation Tools • Sniffing/Spoofing • Maintaining Access • Reverse Engineering • Stress Testing • Hardware Hacking • Forensics • Reporting Tools

  6. Top 10 Security Tools • Aircrack-ng • wireless password cracking • Burp Suite • web application proxy and security testing • THC-Hydra • network password cracker • John the Ripper • Unix and Windows password cracker • Maltego • intelligence and forensics

  7. Top 10 Security Tools • Metasploit Framework • pentesting and exploitation tool • Nmap • network discovery • OWASP Zed Attack Proxy • web application scanner and proxy • sqlmap • SQL injection detection and exploitation • Wireshark • network protocol analyzer

  8. Many more tools • Hundreds of tools • Supporting software • GUI front ends • Greenbone for OpenVAS • Armitage for Metaploit • Zenmap for Nmap • updaters • Metasploit • OpenVAS • Tools are integrated • OpenVAS runs Nikto2, Wapiti, Nmap, Arachni • Metasploit can run OpenVAS

  9. Ways to Use Kali Linux • Professional Penetration Testing • Pentest Tool Suite • Install on a USB drive • Carry to the client site • All tools you need are available • Forensic Information Gathering • Live boot into forensic mode • Doesn’t touch internal hard drive • No auto mount of removable media • Password Recovery

  10. Ways for non-Pentesters to Use Kali Linux • Tool catalog • Browse menus to find tools in any category • Pre-installed tools • Try a tool to see if it meets your needs • Compare tools • Occasional security tests • Don’t have time/resources to maintain security testing environment • Exploitation software • Demonstrate vulnerabilities

  11. OpenVAS • Open-source fork of Nessus • System vulnerability scanner and manager • Daily feeds of Network Vulnerability Tests (NVTs) • Scans scheduled or on-demand • View results • by host • by scan • deltas • Overrides • false positives • backported fixes

  12. Nikto2 • Web server scanner • Not a web application scanner • Looks at Apache • command-line tool • nikto –h 192.168.56.101 • Runs in seconds -> minutes • Report is text-only to the screen

  13. Wapiti • Web application scanner • Fuzzer • command-line tool • wapiti http://192.168.56.101/ • Runs in minutes -> hours • Report is text-only to the screen

  14. skipfish • Web application scanner • Fuzzer, very fast with dictionaries • command-line tool • touch wordlist.wl • skipfish –o /root/sf-20131205 \–S /usr/share/skipfish/dictionaries/minimal.wl \–W wordlist.wl http://192.168.56.101/ • Runs in minutes -> hours • Can be timeboxed (-k duration) • Report is HTML

  15. OWASP Zed Attack Proxy • Web application scanner and proxy • Proxy, fuzzers, scanners, spiders • GUI interface • Can generate XML and HTML reports