Najera-Gutierrez - Kali Linux Web Penetration Testing Cookbook

Gilberto Njera-Gutirrez leads the Security Testing Team (STT) at Sm4rt Security Services, one of the top security firms in Mexico.

He is also an Offensive Security Certified Professional (OSCP), an EC-Council Certified Security Administrator (ECSA), and holds a master's degree in computer science with specialization in artificial intelligence.

He has been working as a Penetration Tester since 2013 and has been a security enthusiast since high school; he has successfully conducted penetration tests on networks and applications of some of the biggest corporations in Mexico, such as government agencies and financial institutions.

To Leticia, thanks for your love, support and encouragement; this wouldn't have been possible without you. Love you Mi Reina!

To my team: Daniel, Vanessa, Rafael, Fernando, Carlos, Karen, Juan Carlos, Uriel, Ivn, and Aldo. Your talent and passion inspire me to do things like this and to always look for new challenges. Thank you guys, keep it going!

Gregory Douglas Hill is an ethical hacking student from Abertay University, Scotland, who also works for an independent web application developer focusing on security. From several years of programming and problem solving experience, along with the invaluable level of specialized training that Abertay delivers to their students, security has become an integral part of his life. He has written several white papers ranging from IDS evasion to automated XSS fuzzing and presented talks on SQL injection and social engineering to the local ethical hacking society.

I would like to thank my friends and family for the inspiration I needed to help produce this book, especially with my increasing academic workload.

Nikunj Jadawala is a security consultant at Cigital. He has over 2 years of experience in the security industry in a variety of roles, including network and web application penetration testing and also computer forensics.

At Cigital, he works with a number of Fortune 250 companies on compliance, governance, forensics projects, conducting security assessments, and audits. He is a dedicated security evangelist, providing constant security support to businesses, educational institutions, and governmental agencies, globally.

I would like to thank my family for supporting me throughout the book-writing process. I'd also like to thank my friends who have guided me in the InfoSec field and my colleagues at Cigital for being there when I needed help and support.

Abhinav Rai has been associated with information security, and has experience of application security and network security as well. He has performed security assessments on various applications built on different platforms. He is currently working as an information security analyst.

He has completed his degree in Computer Science and his post-graduate diploma in IT Infrastructure System and Security. He also holds a certificate in communication protocol design and testing.

He can be reached at <>.

eBooks, discount offers, and more

Did you know that Packt offers eBook versions of every book published, with PDF and ePub files available? You can upgrade to the eBook version at > for more details.

At www.PacktPub.com, you can also read a collection of free technical articles, sign up for a range of free newsletters and receive exclusive discounts and offers on Packt books and eBooks.

https://www2.packtpub.com/books/subscription/packtlib

Do you need instant solutions to your IT questions? PacktLib is Packt's online digital book library. Here, you can search, access, and read Packt's entire library of books.

Why subscribe?

• Fully searchable across every book published by Packt
• Copy and paste, print, and bookmark content
• On demand and accessible via a web browser

Preface

Nowadays, information security is a hot topic all over the news and the Internet; we hear almost every day about web page defacements, data leaks of millions of user accounts and passwords or credit card numbers from websites, and identity theft on social networks; terms such as cyber attack, cybercrime, hacker, and even cyberwar are becoming a part of the daily lexicon in the media.

All this exposition to information security subjects and the real need to protect sensitive data and their reputation have made organizations more aware of the need to know where their systems are vulnerable; especially, for the ones that are accessible to the world through the Internet, how could they be attacked, and what will be the consequences, in terms of information lost or system compromise if an attack was successful. And more importantly, how to fix those vulnerabilities and minimize the risk.

This task of detecting vulnerabilities and discovering their impact on organizations is the one that is addressed through penetration testing. A penetration test is an attack or attacks made by a trained security professional who is using the same techniques and tools that real hackers use in order to discover all the possible weak spots in the organization's systems. These weak spots are exploited and their impact is measured. When the test is finished, the penetration tester informs all their findings and tells how they can be fixed to prevent future damage.