Search icon CANCEL
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Conferences
Free Learning
Arrow right icon
Practical Web Penetration Testing
Practical Web Penetration Testing

Practical Web Penetration Testing: Secure web applications using Burp Suite, Nmap, Metasploit, and more

eBook
€17.99 €26.99
Paperback
€32.99
Subscription
Free Trial
Renews at €18.99p/m

What do you get with a Packt Subscription?

Free for first 7 days. $19.99 p/m after that. Cancel any time!
Product feature icon Unlimited ad-free access to the largest independent learning library in tech. Access this title and thousands more!
Product feature icon 50+ new titles added per month, including many first-to-market concepts and exclusive early access to books as they are being written.
Product feature icon Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.
Product feature icon Thousands of reference materials covering every tech concept you need to stay up to date.
Subscribe now
View plans & pricing
Table of content icon View table of contents Preview book icon Preview Book

Practical Web Penetration Testing

Kali Linux Installation

So, you are new to the Kali Linux world, right? (If you have ever installed Kali Linux before, you can skip this chapter.) Welcome to the toy of hackers: Kali Linux. Are you excited? You haven't seen anything yet! This amazing operating system will take you to a higher level of security achievements.

By the end of this chapter, you will know how to install Kali Linux; in the next chapter, you will delve deeply into using the operating system.

We have already created the victim machine (Mutillidae host), so now it's time to create the attacking machine. In this chapter, we will cover:

  • An introduction to Kali Linux
  • How to install Kali Linux from scratch
  • How to install Kali on VMware
  • How to install Kali on VirtualBox

Introducing Kali Linux

What exactly is Kali Linux?

Kali Linux (previously called BackTrack) is a free, open source, Debian-based Linux distribution. This operating system has hundreds of applications installed, which can help us to conduct a successful penetration test.

And, guess what? Kali Linux is used by bad hackers (also known as black hat hackers), too. This means that we (security professionals) will have more accurate results, because we are using the same tools that the bad guys use to compromise systems.

You can install this beast on any virtualization host (VMware, VirtualBox, or HyperV). Also, you can install it on an ARM processor-based computer, like the Raspberry Pi.

Finally, you need to know that Kali Linux is developed, funded, and maintained by Offensive Security, and you can visit their site at https://www.Kali.org.

...

Installing Kali Linux from scratch

Let's suppose that you have a laptop or a dedicated host, and you want to install Kali Linux. Follow the steps in this section, and you can install this monster on your machine. Also, you can install a fresh copy on a virtual machine (if you want to learn the details of the installation process yourself), but Kali Linux offers pre-built VMs, which we will learn about later in this chapter:

  1. First, you need to download Kali. Simply browse to https://www.kali.org/downloads, and you will land on the download page for this operating system (OS).
  2. I will choose the 2018.1 64 bit version, and will click on the HTTP link to download it directly to my machine. After the download has completed, you will need to copy the ISO file to a bootable USB drive. You're probably asking yourself this question: how do I make my USB bootable? There is a Windows...

Installing Kali on VMware

If you have VMware and you want to install Kali Linux on it, then this section is for you. In the previous section, you saw how to install Kali from scratch, but you don't need to do that if you have VMware. All you need to do is download the image file and import it into VMware, and you're good to go:

  1. To download the VMware image file, go to https://www.kali.org/downloads and scroll down a little bit, until you see the following section:
  1. Follow the link to the Offensive Security Download Page. On this page, you will see a table that contains the virtual image copies of VMware:
  1. Choose either the 32- or 64-bit version, and download it locally to your machine. Then, you will need to import it into VMware, so locate the File menu (click on it) and then click on Open:
  1. A dialog window will show up, and you should select your downloaded...

Installing Kali on VirtualBox

VirtualBox is a very popular virtualization product, because it's free and it offers professional features. You will probably use VirtualBox for your virtualization environment. My base machine is either Windows or macOS, and I have VirtualBox installed on top of it, so I can use Kali Linux for my penetration testing tasks.

Kali offers us pre-built images for VirtualBox, so all we need to do is import them and start using Kali right away. Amazing, right? See the following steps:

  1. To download the VirtualBox image file, go to https://www.kali.org/downloads and scroll down a little bit, until you see the following section:
  1. Follow the link to the Offensive Security Download page. On that page, you will see a table that contains the virtual image copies for VirtualBox:
  1. Choose either the 32- or the 64-bit version, and download it locally to your...

Bridged versus NAT versus Internal Network

People are totally confused regarding how the network configurations in VirtualBox and VMware work. The three most popular configurations are Bridged, NAT, and Internal Network.

Let's start with the easiest option, which is the Bridged network. This architecture will let your Kali Linux connect directly to your network (LAN), and will get an automatic IP address from your home router. So, if your network is 192.168.0.0, then your Kali IP address will be something like 192.168.0.x (for example, 192.168.0.101). Now, you can interact with the machines on your network by using Kali Linux:

Some people are afraid of connecting Kali to the network, because it's open to personal computers. If you're anxious about it, you can choose NAT or NAT Network (on VirtualBox). If you're using VirtualBox, then use an NAT Network instead...

Updating Kali Linux

Before you start using your Kali Linux machine, you need to make sure that you're up to date. The command to update Kali Linux is straightforward, and you will get used to it, since you will have to execute it at least once a week, or before installing any new application:

apt-get update
apt-get upgrade -y
reboot

The -y in the upgrade command will accept the prompts automatically. You will not need to press the letter Y every time the upgrade asks you a question.

You are probably curious to know where the configuration file for the update repositories is located in Kali. The path to the configuration file is /etc/apt/sources.list (the # at the beginning of a line means it's commented):

Summary

At this stage, you're ready to start using Kali Linux. In the next chapter, you will take your skills to the next level by starting to master the use of this operating system.

I like to keep the summary short and not bore you with useless details. I hope that you enjoyed this chapter, and that you learned how to download and install Kali Linux from scratch. I'm assuming that you learned how to install Kali on VMware, or VirtualBox; don't forget to install the additional tools for both.

As a final note, don't forget to update your Kali Linux host before moving onto the next chapter.

Left arrow icon Right arrow icon
Download code icon Download Code

Key benefits

  • •Build an end-to-end threat model landscape for web application security
  • •Learn both web application vulnerabilities and web intrusion testing
  • •Associate network vulnerabilities with a web application infrastructure

Description

Companies all over the world want to hire professionals dedicated to application security. Practical Web Penetration Testing focuses on this very trend, teaching you how to conduct application security testing using real-life scenarios. To start with, you’ll set up an environment to perform web application penetration testing. You will then explore different penetration testing concepts such as threat modeling, intrusion test, infrastructure security threat, and more, in combination with advanced concepts such as Python scripting for automation. Once you are done learning the basics, you will discover end-to-end implementation of tools such as Metasploit, Burp Suite, and Kali Linux. Many companies deliver projects into production by using either Agile or Waterfall methodology. This book shows you how to assist any company with their SDLC approach and helps you on your journey to becoming an application security specialist. By the end of this book, you will have hands-on knowledge of using different tools for penetration testing.

Who is this book for?

Practical Web Penetration Testing is for you if you are a security professional, penetration tester, or stakeholder who wants to execute penetration testing using the latest and most popular tools. Basic knowledge of ethical hacking would be an added advantage.

What you will learn

  • •Learn how to use Burp Suite effectively
  • •Use Nmap, Metasploit, and more tools for network infrastructure tests
  • •Practice using all web application hacking tools for intrusion tests using Kali Linux
  • •Learn how to analyze a web application using application threat modeling
  • •Know how to conduct web intrusion tests
  • •Understand how to execute network infrastructure tests
  • •Master automation of penetration testing functions for maximum efficiency using Python

Product Details

Country selected
Publication date, Length, Edition, Language, ISBN-13
Publication date : Jun 22, 2018
Length: 294 pages
Edition : 1st
Language : English
ISBN-13 : 9781788624039
Vendor :
Offensive Security
Category :
Languages :
Concepts :
Tools :

What do you get with a Packt Subscription?

Free for first 7 days. $19.99 p/m after that. Cancel any time!
Product feature icon Unlimited ad-free access to the largest independent learning library in tech. Access this title and thousands more!
Product feature icon 50+ new titles added per month, including many first-to-market concepts and exclusive early access to books as they are being written.
Product feature icon Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.
Product feature icon Thousands of reference materials covering every tech concept you need to stay up to date.
Subscribe now
View plans & pricing

Product Details

Publication date : Jun 22, 2018
Length: 294 pages
Edition : 1st
Language : English
ISBN-13 : 9781788624039
Vendor :
Offensive Security
Category :
Languages :
Concepts :
Tools :

Packt Subscriptions

See our plans and pricing
Modal Close icon
€18.99 billed monthly
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Simple pricing, no contract
€189.99 billed annually
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Choose a DRM-free eBook or Video every month to keep
Feature tick icon PLUS own as many other DRM-free eBooks or Videos as you like for just €5 each
Feature tick icon Exclusive print discounts
€264.99 billed in 18 months
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Choose a DRM-free eBook or Video every month to keep
Feature tick icon PLUS own as many other DRM-free eBooks or Videos as you like for just €5 each
Feature tick icon Exclusive print discounts

Frequently bought together


Stars icon
Total 111.97
Web Penetration Testing with Kali Linux
€41.99
Advanced Infrastructure Penetration Testing
€36.99
Practical Web Penetration Testing
€32.99
Total 111.97 Stars icon

Table of Contents

17 Chapters
Building a Vulnerable Web Application Lab Chevron down icon Chevron up icon
Kali Linux Installation Chevron down icon Chevron up icon
Delving Deep into the Usage of Kali Linux Chevron down icon Chevron up icon
All About Using Burp Suite Chevron down icon Chevron up icon
Understanding Web Application Vulnerabilities Chevron down icon Chevron up icon
Application Security Pre-Engagement Chevron down icon Chevron up icon
Application Threat Modeling Chevron down icon Chevron up icon
Source Code Review Chevron down icon Chevron up icon
Network Penetration Testing Chevron down icon Chevron up icon
Web Intrusion Tests Chevron down icon Chevron up icon
Pentest Automation Using Python Chevron down icon Chevron up icon
Nmap Cheat Sheet Chevron down icon Chevron up icon
Metasploit Cheat Sheet Chevron down icon Chevron up icon
Netcat Cheat Sheet Chevron down icon Chevron up icon
Networking Reference Section Chevron down icon Chevron up icon
Python Quick Reference Chevron down icon Chevron up icon
Other Books You May Enjoy Chevron down icon Chevron up icon

Customer reviews

Rating distribution
Full star icon Full star icon Full star icon Full star icon Half star icon 4.2
(5 Ratings)
5 star 80%
4 star 0%
3 star 0%
2 star 0%
1 star 20%
Sebastien Oct 24, 2019
Full star icon Full star icon Full star icon Full star icon Full star icon 5
It is a great book for learning and improving in Web application Pentesting!Great reference for the Web Application challenges on the Internet. I also use it as a reference for the University web application security class.Highly recommended!
Amazon Verified review Amazon
Kartik Sep 30, 2018
Full star icon Full star icon Full star icon Full star icon Full star icon 5
Coool books for newbies who are new to this area
Amazon Verified review Amazon
Ernesto Guevara Gonzaga Jul 08, 2019
Full star icon Full star icon Full star icon Full star icon Full star icon 5
Es un buen libro para comenzar
Amazon Verified review Amazon
Hudney Piquant Aug 01, 2018
Full star icon Full star icon Full star icon Full star icon Full star icon 5
This book is truly practical. Gus is a great teacher and is very detailed as well. One of my favorite chapter is his break down of how to use Burp Suite. With this book I was able to implement many things for my current project at work. Thanks again Gus.
Amazon Verified review Amazon
D. Garland Mar 05, 2020
Full star icon Empty star icon Empty star icon Empty star icon Empty star icon 1
For those who want a TL:DR - waste of money, filled with information that can be found freely on the internet, provides tutorials on licensed ($400 USD) Burp Suite (not the free version), the last 15% of the book is nothing but cheat sheets for common pen-testing tools (again, free on the internet).Most of the work is a compilation of information that can be freely found using any search engine. I bought this primarily as a beginners introduction to pen-testing websites using Burp Suite. Obviously, the author has a licensed version of Burp Suite and if you want to follow along with the book you'll need to shell out $400 for a Burp Suite license. Otherwise, you aren't going to get much out of that section.There a few examples of how to exploit the OWASP Mutillidae website that the book has you setup. Again, information you can get for free on the internet and even directly from the Mutillidae website itself.
Amazon Verified review Amazon
Get free access to Packt library with over 7500+ books and video courses for 7 days!
Start Free Trial

FAQs

What is included in a Packt subscription? Chevron down icon Chevron up icon

A subscription provides you with full access to view all Packt and licnesed content online, this includes exclusive access to Early Access titles. Depending on the tier chosen you can also earn credits and discounts to use for owning content

How can I cancel my subscription? Chevron down icon Chevron up icon

To cancel your subscription with us simply go to the account page - found in the top right of the page or at https://subscription.packtpub.com/my-account/subscription - From here you will see the ‘cancel subscription’ button in the grey box with your subscription information in.

What are credits? Chevron down icon Chevron up icon

Credits can be earned from reading 40 section of any title within the payment cycle - a month starting from the day of subscription payment. You also earn a Credit every month if you subscribe to our annual or 18 month plans. Credits can be used to buy books DRM free, the same way that you would pay for a book. Your credits can be found in the subscription homepage - subscription.packtpub.com - clicking on ‘the my’ library dropdown and selecting ‘credits’.

What happens if an Early Access Course is cancelled? Chevron down icon Chevron up icon

Projects are rarely cancelled, but sometimes it's unavoidable. If an Early Access course is cancelled or excessively delayed, you can exchange your purchase for another course. For further details, please contact us here.

Where can I send feedback about an Early Access title? Chevron down icon Chevron up icon

If you have any feedback about the product you're reading, or Early Access in general, then please fill out a contact form here and we'll make sure the feedback gets to the right team. 

Can I download the code files for Early Access titles? Chevron down icon Chevron up icon

We try to ensure that all books in Early Access have code available to use, download, and fork on GitHub. This helps us be more agile in the development of the book, and helps keep the often changing code base of new versions and new technologies as up to date as possible. Unfortunately, however, there will be rare cases when it is not possible for us to have downloadable code samples available until publication.

When we publish the book, the code files will also be available to download from the Packt website.

How accurate is the publication date? Chevron down icon Chevron up icon

The publication date is as accurate as we can be at any point in the project. Unfortunately, delays can happen. Often those delays are out of our control, such as changes to the technology code base or delays in the tech release. We do our best to give you an accurate estimate of the publication date at any given time, and as more chapters are delivered, the more accurate the delivery date will become.

How will I know when new chapters are ready? Chevron down icon Chevron up icon

We'll let you know every time there has been an update to a course that you've bought in Early Access. You'll get an email to let you know there has been a new chapter, or a change to a previous chapter. The new chapters are automatically added to your account, so you can also check back there any time you're ready and download or read them online.

I am a Packt subscriber, do I get Early Access? Chevron down icon Chevron up icon

Yes, all Early Access content is fully available through your subscription. You will need to have a paid for or active trial subscription in order to access all titles.

How is Early Access delivered? Chevron down icon Chevron up icon

Early Access is currently only available as a PDF or through our online reader. As we make changes or add new chapters, the files in your Packt account will be updated so you can download them again or view them online immediately.

How do I buy Early Access content? Chevron down icon Chevron up icon

Early Access is a way of us getting our content to you quicker, but the method of buying the Early Access course is still the same. Just find the course you want to buy, go through the check-out steps, and you’ll get a confirmation email from us with information and a link to the relevant Early Access courses.

What is Early Access? Chevron down icon Chevron up icon

Keeping up to date with the latest technology is difficult; new versions, new frameworks, new techniques. This feature gives you a head-start to our content, as it's being created. With Early Access you'll receive each chapter as it's written, and get regular updates throughout the product's development, as well as the final course as soon as it's ready.We created Early Access as a means of giving you the information you need, as soon as it's available. As we go through the process of developing a course, 99% of it can be ready but we can't publish until that last 1% falls in to place. Early Access helps to unlock the potential of our content early, to help you start your learning when you need it most. You not only get access to every chapter as it's delivered, edited, and updated, but you'll also get the finalized, DRM-free product to download in any format you want when it's published. As a member of Packt, you'll also be eligible for our exclusive offers, including a free course every day, and discounts on new and popular titles.