Penetration testing (or pentesting) is a simulated cyber attack, where professional ethical hackers enter corporate networks to find their weaknesses before attackers do.
This is a simulated cyber attack, where the ethical hacker uses the tools and techniques available to malicious hackers.
The need for penetration testing
Pentesting shows where and how a malicious attacker can exploit your network. This allows you to mitigate any weaknesses before an actual attack occurs.
According to a recent study by Positive Technologies, almost every company has weaknesses that attackers can exploit. In 93% of cases, pentesters were able to breach the network and gain access to the network. The average time it took to do this was four days. In 71% of companies, an unskilled hacker could penetrate the internal network.
Top tools
In the past, hacking was difficult and required a lot of manual bit fiddling. Today, however, a full suite of automated penetration tools help hackers test networks faster and easier than ever before.
Here is a list of tools that make the work of a modern pentester faster, better, and smarter.
1.Kali Linux
If you're not using Kali as your primary operating system, you're either clueless or doing something wrong. Formerly known as BackTrack Linux, Kali is optimized in every way for aggressive use as a penetration tester.
Although you can run Kali on its own hardware, it is much more common to see pentesters using Kali virtual machines on OS X or Windows.
Kali comes with most of the tools you'll see below and is the default operating pentesting system for most situations. Be careful though – Kali is optimized for attack, not defense, and is easily exploited in turn. Don't store your top secret files in the Kali VM.
2. nmap
Nmap is a tried and true tool that once you try it, you can't live without it. What ports are open? What's running on those ports? This is essential information for the pentester during the recon phase, and nmap is often the best tool for the job.
Many legitimate organizations, such as insurance agencies, internet mappers like Shodan and Censys, and risk scorers like BitSight, regularly scan the entire IPv4 range with specialized port to map the public security posture of businesses.
3. Metasploit
Why exploit when you can meta-sploit? This meta-software is like a crossbow so you: Aim at your target, choose your exploit, choose your payload, and fire. A must-have for most pentesters, metasploit automates vast amounts of previously tedious effort and is truly “the world’s most widely used penetration testing framework.” An open source with commercial support from Rapid7, Metasploit is a must-have for those looking to protect their systems from attackers.
4. Wireshark
Wireshark is the ubiquitous tool for understanding the traffic passing through your network. Although it is commonly used to analyze everyday TCP/IP connection problems, Wireshark supports analysis of hundreds of protocols, including real-time analysis and decryption support for many of these protocols. If you are new to penetration testing, Wireshark is an indispensable tool.
5. John the Ripper
John the Ripper breaks encryption faster than you can imagine. This open-source designed to crack passwords offline. John can take a word list of possible passwords and mutate them to replace “a” with “@” and “s” with “5” and so on, or it can run for an infinite amount of time with hardware until a password is found. Considering that the vast majority of people use short passwords of low complexity, John often manages to break the encryption and in a short time.
6. Hashcat
The self-proclaimed “world’s fastest and most advanced password recovery utility” may not be perfect, but the folks at hashcat certainly know their stuff. Hashcat is the pentesting tool that cracks hashes, and hashcat supports many types of brute force attacks that guess passwords.
Pentesting usually involves dumping hashed passwords, and exploiting these credentials means running a program like hashcat offline in the hopes of guessing or brute-forcing at least some of those passwords.
Hashcat works best on a modern GPU. Legacy hashcat still supports hash cracking on the CPU, but warns users that it is significantly slower than utilizing the processing power of your graphics card.
7. Hydra
Hydra comes into play when you need to crack an online password, such as SSH or FTP login, IMAP, IRC, RDP and many more. Note Hydra as a very good and easy to use tool. Tools like Hydra are a reminder why efforts to limit the password rate and log out users after a few login attempts can be successful defensive mitigations against attackers.
8. Burp Suite
No discussion of pentesting tools is complete without mentioning the web vulnerability scanner Burp Suite, which, unlike other tools mentioned so far, is not free, but is an expensive tool used by professionals. There is a version of Burp Suite that lacks much of the functionality, and the enterprise version of Burp Suite costs €3,499 per year.
Burp Suite is a highly effective web vulnerability scanner. Place it on the website you want to test and fire it up when it's ready. Burp competitor Nessus offers a similarly effective product (and at a similar price).
9. Zed Attack Proxy
Those who don't have the cash to pay for a copy of Burp Suite should opt for Zed Attack Proxy (ZAP), which is offered for free. As the name suggests, ZAP sits between your browser and the website you're testing, allowing you to monitor traffic for inspection and modification. It doesn't have many of the features of Burp, but its open source license makes it easier and cheaper to deploy at scale, making it a great tool for beginners.
10. sqlmap
This incredibly effective SQL injection tool is open source and “automates the process of detecting and exploiting SQL injection flaws and recovering databases,” as it says on its website. Sqlmap supports all the usual targets, including MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase, SAP MaxDB, Informix, HSQLDB, and H2.
11. aircrack-ng
How secure is your client's Wi-Fi – or your home Wi-Fi? Find out with aircrack-ng. This Wi-Fi security checker is free. Cracking Wi-Fi today is often possible due to poor configuration, bad passwords, or outdated encryption protocols. Aircrack-ng is a great option.
