101 labs CompTIA security+

The exponential growth in network security attacks has led to a huge demand for certified staff and there is currently a shortfall in qualified security engineers. The CompTIA Security+ Exam is used by many as a gateway to a career in IT Security. It lays the foundation for CyberOps, Ethical Hacking, Penetration Testing, Digital Forensics, Chief Information Security Officer (CISO) and more.If you have an interest in learning cybersecurity but are not sure where to start, then the CompTIA Security+ is the perfect choice.This is a brand new course for the latest SY0601 exam, which was recently launched. It covers all the latest topics, including security attacks, threat types, and protocols. Using free tools and software you configure:Kali LinuxSQL Injection AttacksImplement IPSEC SitetoSite VPNUsing ARP for Network ReconnaissanceSniffing Network Attacks Using WiresharkUsing Password Cracking ToolsScripting Using Bash and PythonFTP ExploitsFollow along with our instructor as he guides you through all the important commands, tools and utilities you need to know. We share our years of industry experience with you so you really feel prepared not only for the exams but the real world of system security administration.

Lab 5 Conducting a Cross Site Scripting (XXS) Attack

Lab 6 Automating SQL Injection Using SQLmap

Lab 7 How to Use Burp Suite to Intercept Client-side Requests

Lab 8 Information Gathering Using theHarvester

Lab 9 Evil Twin Attack with Airgeddon

Lab 10 Using Curl

Lab 11 Using Traceroute in Linux

Lab 12 Ping and Its Various Uses

Lab 13 How to SSH into a Server from a Windows Machine Using PuTTYLab 14 How to SSH into a Server from a Linux Machine

Lab 15 How to Setup Your Own Kali Linux Virtual Machine

Lab 25 Using Route to Display Network Information on Linux

Lab 26 Using Scanless for Easy Anonymous Port Scanning

Lab 27 Directory Traversal

Lab 28 Gathering DNS Information with Dnsenum

Lab 29 How to Connect to an Internal Network Using OpenVPN

Lab 30 How to Crack Passwords with Hashcat

Lab 31 Fuzzing with Spike

Lab 32 Spoofing your MAC Address with Macchanger

Lab 33 Perform a Network Vulnerability Scan with OpenVAS

Lab 34 Automate WordPress Scanning with Wpscan

Lab 35 Hack WPS with Reaver

Lab 36 Cross Site Request Forgery (CSRF)

Lab 37 Using Gobuster to Discover Directories

Lab 38 Using Burp Suite’s Intruder

Lab 39 Broken Access Control

Lab 40 Broken Access Control

Lab 41 Getting a Reverse Shell on a Server through a File Upload

Lab 42 Manual Privilege Escalation Using Python

Lab 43 Web Application Vulnerability Scanning with Nikto

Lab 44 Web Server Vulnerability Scanning with ZAP

Lab 45 Capturing Password Hashes with Responder

Lab 46 Monitoring Wi-Fi Signals with Kismet

Lab 47 Sn1per

Lab 48 Browser Exploitation Framework (BeEF)

Lab 49 Hacking WPS Networks with Wifite

Lab 50 Capturing Credentials Submitted through http with Wireshark

Lab 51 Packet Capture with Tcpdump

Lab 52 How to Discover Nearby Wi-Fi Networks with Airodump-ng

Lab 53 How to Capture a WPA Handshake File Using Airodump-ng andAireplay-ng

Lab 54 How to Crack WPA Handshake Files Using Aircrack-ng

Lab 55 Using Proxychains for Anonymous Hacking

Lab 56 How to Use MD5 Checksums to Determine if a File Contains

Lab 59 Linux Operations Advanced Linux Operations

Lab 60 Basic File Operations

Lab 61 Advanced File Operations

Lab 62 Cracking Basic Hashes with John the Ripper

Lab 63 Cracking Advanced Hashes with John the Ripper

Lab 64 More Advanced Uses of John the Ripper

Lab 65 Establishing a Reverse Shell with Netcat

Lab 66 Establishing a Bind Shell with Netcat

Lab 67 How to Stabilise Netcat Shells

Lab 68 Getting a Reverse Shell Using Socat

Lab 69 Establishing a Bind Shell Using Socat

Lab 70 Establishing a Stable Socat Shell

Lab 71 Upgrading a Limited Shell to Meterpreter Shell Using MetasploitLab 72 Exploiting a Vulnerable FTP Service to Gain a Shell Using

Metasploit

Lab 73 Running a Vulnerability Scan with Nessus

Lab 74 Creating Metasploit Payloads with Msfvenom

Lab 75 Establishing a Reverse Shell on a Linux Target Using Msfvenom andMetasploit

Lab 76 Establishing a Bind Shell on a Linux Target Using Msfvenom andMetasploit

Lab 77 Basic Meterpreter Commands

Lab 78 More Advanced Meterpreter Commands

Lab 79 Introduction to Bash Scripting

Lab 80 More Bash Scripting

Lab 81 Advanced Bash Scripting

Lab 82 How to Establish a Meterpreter Shell on a Windows Target UsingSET

Lab 83 How to Migrate to a Different Process on the Target Machine afterEstablishing a Meterpreter Shell

Lab 84 How to Use Mimikatz to Extract all the Passwords from a WindowsMachine

Lab 85 How to Enumerate for Privilege Escalation on a Windows Targetwith WinPEAS

Lab 86 How to Enumerate for Privilege Escalation on a Linux Target withLinPEAS

Lab 87 OWASP A1—OS Command Injection

Lab 88 OWASP A2—Broken Authentication and Session Management:Username Enumeration Vulnerability

Lab 89 OWASP A3—Sensitive Information Disclosure

Lab 90 OWASP A4—EML External Entities (XXE)

Lab 91 OWASP A5—Broken Access Control

Lab 92 OWASP A6—Security Misconfiguration

Lab 93 OWASP A7—Cross Site Scripting (XSS)

Lab 94 OWASP A8—Insecure Deserialization

Lab 95 OWASP A9—Using Components with Known VulnerabilitiesLab 96 OWASP A10—Unvalidated Redirects and Forwards

Lab 97 Introduction to Python Scripting

Lab 98 More Python Scripting

Lab 99 More Advanced Python Scripting

Lab 100 Introduction to Scripting with PowerShell

Lab 101 More Advanced Scripting with PowerShell

The material entailed in this guide is not sponsored by, endorsed by, or

affiliated with CompTIA CompTIA and Security+ are both trademarks of theComputing Technology Industry Association, Inc (“CompTIA”) that is

based in the United States and also has presence in certain other countries.All other trademarks belong to their respective owners

101 Labs is a registered trademark

operations, it is advisable to seek the advice of experts

The practical scenarios in this book are meant only to illustrate technicalpoints and should be used only on privately owned equipment and never on alive network

About the Authors

Paul Browning

Paul Browning worked as a police officer in the UK for 12 years before

changing careers and becoming a helpdesk technician He acquired several ITcertifications and began working for Cisco Systems doing WAN support forlarge enterprise customers

He started an IT consulting company in 2002 and helped to design, install,configure, and troubleshoot global networks for small to large companies Hestarted teaching IT courses soon after that Through his classroom courses,online training, and study guides, Paul has helped tens of thousands of peoplepass their IT exams and enjoy successful careers in the IT industry

In 2006, Paul started the online IT training portal, www.howtonetwork.com,which has grown to become one of the leading IT certification websites

In 2013, Paul moved to Brisbane with his family In his spare time, he plays

the guitar, reads, drinks coffee, and practices Brazilian jiu-jitsu.

Mark Drinan

Mark is an avid Cyber Security enthusiast with experience working in theCyber Security department of a Big Four company Mark has obtained twoCyber Security certifications: the CompTIA PenTest+ Certification and theISC2 System Security Certified Practitioner (SSCP) Certification

Outside of work, Mark enjoys learning and participating in various hackingplatforms such as HackTheBox, TryHackMe, and CTF competitions HisLinkedIn profile can be found here: https://www.linkedin.com/in/mark-drinan/

Introduction—101 Labs

Welcome to your 101 Labs book

When I started teaching IT courses back in 2002, I was shocked to discoverthat most training manuals were almost exclusively dedicated to theoreticalknowledge Apart from a few examples of commands to use and

configuration guidelines, you were left to plow through without ever knowinghow to apply what you learned to live equipment or to the real world

Fast forward another 17 years, and little has changed I still wonder how—when around 50% of your examination marks are based on hands-on skillsand knowledge—most books give little or no regard to equipping you withthe skills you need to both pass the exam and then make money in your

chosen career as a network, security, or cloud engineer (or whichever careerpath you choose)

101 Labs is NOT a theory book; it’s here to transform what you have

learned in your study guides into valuable and applicable skills you will beusing, from day one, on your job as a network engineer For example, Markand I won’t be teaching you about SSH per se; instead, we show you how toconfigure a SSH connection If the protocol isn’t working, we show you whatthe probable cause is Sound useful? We certainly hope so

We choose the most relevant parts of the exam syllabus and use free software

or free trials (whenever possible) to walk you through configuration and

troubleshooting commands step by step As we go along and your confidencegrows, we will also be increasing the difficulty level If you want to be anexceptional network security engineer, you can also make your own labs up,add other technologies, try to break them, fix them, and do it all over again

learning points behind each lab Every lab is designed to cover a particulartheoretical issue, such as the configuration requirements of SSH, for example.

If you want to become CompTIA Security+ certified, there’s one exam youmust first pass:

SY0-601

We’ve done our best to hit every topic mentioned in the exam syllabus on theCompTIA website However, please do check the syllabus on their website,for they may change as time goes on Their website also gives more details

on the weighting given to each subject area

It’s also worth noting, that once we show you how to configure a certainservice or protocol a few times, we stop walking you through the steps insubsequent labs—to save valuable space Anyway, in times of uncertainty,you can always flick back a few pages to see check how it’s done

We’ve done our best to keep the topology as simple as possible For thisreason, almost all labs have been configured on a virtual machine (with

internet access).

Please do check out our resource page, which will cover any additional

information you need, and other material that are bound to prove useful:

https://www.101labs.com/resources

Doing the Labs

Apart from a couple of research labs, all the labs are hands-on They havebeen checked by several students and a senior Linux security consultant, andshould be error-free Bear in mind that each machine will differ, so youroutput may vary from ours in certain instances

If you get stuck or things aren’t working, we recommend you take a breakand come back to the lab later with a clear mind There are many Linux andsecurity support forums out there where you can ask questions If you are amember of 101labs.net, you can, of course, also post any of your enquiries onour forum

Best of luck with your studies,

—Paul Browning, CCNP, MCSE, A+, Net+

—Mark Drinan, PenTest+, SSCP

101 Labs—Security+ Video Course

All of our 101 Labs books have a walkthrough video for each lab, hosted on

https://www.101labs.net We only mention this in case you want an extraboost We add a new certification every two months, and each course comeswith 200 exam-style questions Please use the below coupon code to get adiscount off your joining fee:

101secplus

Instructions

1 Please follow the labs from start to finish If you get stuck, dothe next lab and come back to the problematic lab later There is agood chance you will be able to work out the solution as you gainconfidence and experience in configuring the software and usingthe commands.

2 You can take the labs in any order, but we’ve done our best topresent them in increasing difficulty, to incrementally build upyour skill level as you go along For best results, do ALL the labsseveral times over before attempting the exam

3 There are resources as well as configuration files for all thelabs at www.101labs.net/resources

4 Please DO NOT configure these labs on a live network or onequipment belonging to private companies or individuals

5 Please DO NOT attempt to configure these labs on other Linuxdistros We’ve chosen Kali for the labs due to it being the mostpopular Linux distribution among security experts

6 You MUST be reading or have read a Security+ study guide, orwatched a theory video course Apart from some configurationtips and suggestions, we don’t explain much theory in this book;it’s all hands-on labs

7 It’s impossible for us to give individual support to thethousands of readers of this book (sorry!), so please don’t contact

us for tech support Each lab has already been tested by severaltech editors, of abilities ranging from beginner to expert

Also from Reality Press Ltd.

Cisco CCNA Simplified

Cisco CCNA in 60 Days

101 Labs—Linux LPI1 and Linux Essentials

Lab 1 Credential Harvesting Using

The first step is to boot your virtual machine and get Kali Linux up and

running Once this is complete, open a terminal and start the “SET: SocialEngineering Toolkit” by typing as “root” user:

setoolkit

When “Do you agree to the terms of service [y/n]” message appears, type “Y”

First, update SET utility to get latest features Choose option 5

Task 2:

From the main menu, choose option 1 for “Social-Engineering Attacks”, then

choose option 2 to select “Website Attack Vectors” You will then be presentedwith the following screen asking you which kind of website attack you want

to conduct Choose option 3, the “Credential Harvester Attack Method”

can find the desired one by opening a new terminal and typing “ifconfig”.

Once you tell SET that you would like to clone a website, it will then ask youfor the URL of the site you wish to clone You can enter any site you like.For this lab, I will be using https://www.facebook.com

Task 5:

Once the URL is entered, SET will clone the site and display all the POSTrequests of the site back to this terminal It is now time to navigate to thecloned site

Task 6:

To get to the cloned site, open Firefox in your Kali machine and enter yourlocal IP address into the browser You will then be able to view the clonedlogin page for Facebook Enter a random username and password into the

fields and press Log In.

Task 7:

Finally, go back to the terminal where SET is running You will see lots oftext from the numerous POST requests being sent from the cloned site Scrolldown until you see the values “username” and “password” You should beable to see the username and password you entered into the cloned site incleartext

protecting the device, among others.

Lab Walkthrough:

Task 1:

Nmap comes pre-installed in Kali Linux Just open a terminal, type “nmapscanme.nmap.org” without the inverted commas This will initiate a scan ofthe target and will attempt to determine which ports are open and what

services are open on these ports.

As we can see from the scan results, there are 4 ports open, and there aredifferent services running on each port The scan we just performed,

however, is a very basic scan and will only scan the top 1000 ports for basicinformation In the next step, we will run a more advanced scan

Task 2:

In this step, we will be scanning the same target, scanme.nmap.org, but with

a more advanced scan Let’s say we want to determine the versions for theservices running on each port, so that we can determine if they are out of dateand potentially vulnerable to exploitation We also want to determine theoperating system of the webserver running the target site We will run thefollowing scan to determine this information:

Oops! You must be root before doing this type of scan Type “sudo” and enter nmap command with desired parameters The line in the terminal will

re-be like the following:

sudo nmap -v -sT -sV -O scanme.nmap.org

When asked for the password, type “kali” without inverted commas

The results from our scan show us the exact versions of software running oneach open port Note, if there was a firewall protecting this webserver, wemay be unable to see this information We can also determine with relativelyhigh accuracy the version of the operating system running on the web server.

An easier way to perform a full scan on a target is to use the -A flag, whichwill scan a target using the -sS, -sV, and -O flags

Task 3:

Try scanning the same target with a number of different flags Visit the

following site to see the different scans you can run against targets, as well asthe different outputs different flags will provide

https://nmap.org/book/port-scanning-options.html

Task 2:

recon-ng offers the opportunity for users to create different workstationsbased on their project needs For this lab, we will be gathering WHOIS

information So, create a new lab by typing the following:

workspaces create whois_recon

Task 3:

We will begin by gathering WHOIS information about a target domain-name.Since WHOIS information is available to anyone, it is ok to do this for anydomain The domain we will be targeting is, once again, “facebook.com”, butyou can do this lab for any other domain you wish

We will need to install modules from the marketplace to search for WHOISinformation We will begin by searching WHOIS for all related informationregarding a target site To do this, we first need to install the WHOIS searchmodule To do this, type:

marketplace search whois

We want to install the fourth option, which is

“recon/domains-contacts/whois_pocs” To do this, type:

marketplace install recon/domains-contacts/whois_pocs

To begin searching, we first need to set the source by typing:

options set SOURCE facebook.com

To load the module for use, type:

modules load recon/domains-contacts/whois_pocs

Then, to see information about this module and how it is used, type “info” andhit enter

We are now ready to search WHOIS for information regarding

“facebook.com” Simply type “run” and hit enter to begin the search

As you will see, various contact and location information will show up forfacebook.com This information will be automatically saved in our

workstation

Task 4:

We will now attempt to discover as many subdomains as possible, with theirIPv4 address for facebook.com, using HackerTarget.com API We will need

to import the “hackertarget” module, as we did previously for whois_pocs

Before we do this, you should first type “back” and press enter to quit out ofthe whois_pocs module We will begin by searching the marketplace for

“hackertarget” modules using:

marketplace search hackertarget

Only one option should show, which is “recon/domains-hosts/hackertarget”.You can highlight this option and press ctrl + shift + c to copy the path to themodule You can paste using ctrl + shift + v To install the module use:

marketplace install recon/domains-hosts/hackertarget

We then want to load the module using:

modules load recon/domains-hosts/hackertarget

We are now ready to begin searching HackerTarget for subdomain

information regarding Facebook First, set the source by typing:

options set SOURCE facebook.com

If you want to see some information around what this module is used for andhow, simply type “info” and hit enter.

Task 5:

Once this is done, type “run” and hit enter You will notice a list of varioussubdomains associated with facebook.com appearing

This information can be useful for an attacker who may be targeting

Facebook They can use this information to attack the various subdomainsand their IP addresses associated with Facebook, as they may not all beequally secure, to find a way through their security

Lab 4 Conducting a Dictionary

Attack to Crack Online Passwords Using Hydra

Lab Objective:

Learn how to conduct a dictionary attack to crack passwords online, usingHydra

Lab Purpose:

Hydra is an advanced password cracker which can be used to crack

passwords for online pages, such as the login page of a website This is useful

as we don’t need to capture a hash and attempt to crack it offline; we cansimply target the login page itself, with any username and password

You can use Kali Linux in a virtual machine for this lab

Note: This site has been developed for the purpose of specific types of

hacking Never use hydra on any site, system, or network without prior

permission from the owner

For this lab, I will be focusing on the command line interface version of

Hydra, but you can also access the GUI version of hydra using the followingcommand as “root” user:

To use Hydra against an online target such as this one, we need to capture thepost-form parameters Hydra will use these parameters to send its variousrequests to the correct target To capture this information, open target sitewith web browser in Kali Then, press ctrl + shift + I to open the browserdeveloper tools panel.

Navigate to the tab called “Network” When you are there, reload the page bypressing ctrl + F5 You should see several GET requests This is our machinerequesting data from the server so that we can see the login form

Now enter a random username and password into the login page and clicklogin You should see a new POST request pop up in the Network tab This isour machine sending the data to the server This request contains the

parameters we need

Task 3:

Right click on the POST request and select “Edit and Resend” A page willopen to the right of the Network header, with information regarding thePOST request Scroll down to the Request Body section and copy the

tfUName and tfUPass Parameters Hydra will need this information

If the rockyou.txt wordlist file has a gz extension on it, we will first need toextract the file To do this, change directory to the wordlist directory usingthe following command:

Task 5:

Let’s begin the attack by submitting the following command to hydra:

hydra -l admin -P /usr/share/wordlists/rockyou.txt testasp.vulnweb.com http-post-form

“/Login.asp?RetURL=/Default.asp?:tfUName=^USER^&tfUPass=^PASS^:S=logout” -vV -f

Once you press enter, the attack will begin and Hydra will start guessing a lot

of passwords for the username admin in an attempt to login

Ok, this may be a lot to take in; let’s break it down with ctrl + C

-l is the username we will be logging in as-P is the wordlist we will be using to guess the password forthis user

http-post-form is the type of request hydra will be sending tothe server in order for us to login

“/Login.asp?

RetURL=/Default.asp?:tfUName=^USER^&tfUPass=^PASS^:S=logout”– This is the actual request hydra is sending to the server, it will

replace USER and PASS with the -l and -P values we specifiedearlier

-vV will show us each of the username and password loginattempts

-f will finish that attack when the correct username andpassword combination is entered

Task 6:

Note that hydra will probably not be able to guess the password, so you can

end the attack at any point by pressing ctrl + c This is an example of Hydraattempting a dictionary attack for a POST request Hydra can also be used toattack usernames and passwords of different services—such as SSH, FTP,telnet, proxy, etc.—making it an extremely powerful and useful tool to have

in your arsenal

Lab 5 Conducting a Cross Site

Scripting (XXS) Attack

Lab Objective:

Learn how to test a website for an XXS vulnerability

Lab Purpose:

XXS is a common vulnerability in web applications and is frequently listed

as a top vulnerability in the OWASP top ten XXS occurs when web

applications execute JavaScript, which is input into the form sections of aweb application The applications perform no security checks on the entereddata It simply passes it straight to the server, causing inputted JavaScript toexecute

The site has several levels of XXS which vary in difficulty It also offers youseveral hints on how to proceed if stuck on a level This is a great way toadvance your knowledge of this type of web application attack