Linux black box penetration test.
Welcome to the Linux exploitation section
of this course, where we will be taking a look at a black box
penetration test on a Linux system.
So again, this is going to follow the same flow that we
had during the Windows exploitation,
where we took a look at a black box penetration test
on a Windows system, or rather how
to perform a black box penetration test on a Windows
system.
So again, this particular section
will follow the same flow in terms of structure.
So we're going to be utilizing one lab environment
for the entire section.
So, again, your job as a junior penetration tester
is to try and find a way to gain access to the target system.
And in this case, it is going to be a Linux target that
has been configured to run various services, most of which
are vulnerable, some of which are actually set up to actually
deceive you as being vulnerable, but they might not actually
be so.
It's an interesting mix of services
that, again, will help you understand how to structure
and perform a pain test on a Linux
system and the various services that you typically
expect to have running on a Linux system.
So I've already explained what a black box penetration test
is during the previous section.
So again, we're going to be using the same black box
methodology, where we'll perform a host discovery to discover
the target systems IP address.
Once we have obtained that, we will then
move over to port scanning and enumeration,
and we can then take a look at vulnerability, detection,
scanning, exploitation, et cetera.
We're not going to be taking a look at post exploitation
as that is something that we will
be covering in its own course.
So we are primarily interested in gaining access
to the Linux target system.
So in terms of the scenario and the scope, again,
we're just going to be using the same scenario, whereby you have
just begun your job as a junior penetration tester
and have been assigned to assist in performing a pen
test on a client's network.
The pen test lead was very pleased with your ability
to gain access to the Windows Server target
during our previous engagement in the previous section
and has assigned you to perform a pen test on a Linux server
on the client's network.
So your primary objectives are, you
need to identify the services that are running on the target
system, you then need to identify vulnerabilities
within the services, and exploit these vulnerabilities to gain
or obtain an initial foothold on the target system.
And as a side note, you are permitted
to use the Metasploit framework for exploitation,
although, again, you can actually deviate between manual
and automated exploitation.
With that being said, as I said, the lab environment
is exactly the same in terms of its structure,
the target will be different, it's
going to be a Linux target.
But remember that once you terminate a lab session,
then, the data that's stored within that lab session
will be wiped.
So if you want to go through the actual penetration
test in one go, then I would recommend
starting up the lab environment, trying it out for yourself,
trying to gain access, and you can use these videos
as a reference in regards to identifying services
that you can exploit, and, of course,
learning how to exploit them.
So again, if you want to follow along with the videos,
please do so, and you can go through this on a vulnerability
by vulnerability basis.
And, of course, we'll be exploring
how to target various services.
Now, I'm not going to be covering
the entire gamut of services that you can exploit
on the Linux system, and as we did during the Windows
exploitation section, we're only going
to be focusing on the exploits that are pretty much the most
straightforward to exploit, so your actual low hanging fruit.
And again, this will help you become
efficient in identifying services that really
can be exploited as opposed to prodding or banging
your head against the wall with services that are not
giving you anything feasible in regards
to potential exploitation.
With that being said, we can actually
move on to the next video, where we'll
be taking a look at out of a form port
scanning and enumeration on the Linux target system
in order to identify open ports, as well as the services that
are running on those open ports.
So I'll see you in the next video.