P

P0f tool, enumeration

111 , 118–121

Packet filtering firewall, definition

265

Packetforge-ng, basic function

347 , 351

Page ranking, Google

35

Pair-wise Master Key (PMK), WPA2

322

PANs

seePersonal area networks (PANs)

Parameter passing attacks, web application assessment

233

Passive methods

enumeration

111

fingerprinting

112–113 , 118–120

Passive scanners, WLAN discovery

325

Password cracking

database hacking hands-on challenge

215–216

Finger enumeration

276

Live Hacking CD

15

mssql_login

197

network device case study

285

network device hands-on challenge

290

wireless penetration testing

320

WPA2

322

Password creation

databases

192 , 215–216

Microsoft SQL Server

194–195

Oracle databases

208

Payloads

custom malware deployment

175 , 175f

msfencode, to encoded executable

179f

Payment card industry (PCI), WLAN vulnerabilities

323

PBXs, as targets

266

PCI

seePayment card industry (PCI)

PDF files

custom malware

175

human recon

68–69

human weakness case study

183

intelligence gathering

41

malicious, generation

185f

personal phishing

144

spear-phishing attack

152

Trojan horses

150

PEAP

seeProtected Extensible Authentication Protocol (PEAP)

Peer-to-peer applications, Arudius

17–18

Penetration testing frameworks

implementation consistency

390

OSSTMM

389

pen-test labs

389

SP 800-115

390

VulnerabilityAssessment.co.uk

390

Penetration testing targets

basic considerations

20–21

Damn Vulnerable Web Application

22

De-ICE.net PenTest disks

22

efficient time use

98

Mutillidae

22

OldApps.com

23

test failure advice

138

WebGoat

23

Penetration testing toolkit creation

BackTrack toolkit creation case study

24 , 23–27

basic approach

2–3

bootable USB drives

6–8

with Linux

7–8

with Windows 7/Vista

6–7

core technologies

4–9

hands-on challenge

27

ISO images

6

LiveCD creation

4–5

BartPE Builder

10f

BartPE Builder Plugins

11f

LiveCD modification

5

LiveCDs

4

LiveCD tools

9

BartPE Builder

9–10

UNetbootin

11–12 , 11f

UNetbootin Ophcrack Install

12f

UNetbootin risks

12

objectives

1–2

open source tools

9

operating system

2

persistent LiveCD creation

8–9

private vs. public considerations

2

toolkit execution considerations

3

Penetration testing toolkit examples

Arudius

17–19 , 18f

BackTrack Linux

13 , 13f

BackTrack Linux GUI

14f

Katana

19–20

Katana boot menu

20f

Katana Portable Applications

21f

Live Hacking CD

14–15

Network Security Toolkit

16–17 , 18f

Operator

19 , 19f

OSWA-Assistant

16 , 17f

overview

12–13

Samurai Web Testing Framework

15 , 16f

Penetration test labs

ad hoc lab

384–385

basic approach

372

building

385–388

case study

397–400 , 398f , 399f

client hardware matching

386

commercial tools

388

common hardware

385

core technologies

390–394

design

372–373 , 374f

dual-use equipment

386–387

Dynagen

395–396

Dynamips

395–396

external lab

383–384

GNS3

395–396

hands-on challenge

400–401 , 400f

hardware selection

385

install procedure documentation

388–389

internal lab

382–383

objectives

372

open source tools

overview

394–397

usage

387

VirtualBox

395

Xen

394–395

project-specific lab

384

results documentation

389

running the lab

388–390

safety considerations

basic considerations

381

CD labeling

378–379

data transfer

378

destruction and sanitization

379–380

documentation

380–381

install disk security

377–378

network configuration

376–377

network isolation

374–376

overview

373–374

software selection

387

software tool considerations

396–397

SP 800-115

390

testing frameworks

389

types

381–382

virtualization

architecture

392 , 393f

definition

391

role

391–392

virtual networks

393–394

virtual lab

382

VulnerabilityAssessment.co.uk

390

Perl script usage examples

BiLE.pl

45

BiLE-Weigh.pl

46

dnsenum.pl

64

nikto.pl

238

snmpenum.pl

126

SQLiX.pl

244

tld-expand.pl

48

Permissions

database installation

192

Microsoft SQL Server

195

Persistent LiveCD, creation

8–9

Persistent Live USB, toolkit booting

3

Personal area networks (PANs), 802.15.1 standard

321

Personal phishing

basic considerations

143–144

example

143

PHF bug, web server history

220–221

Phishing

basic approach

142–143

basic considerations

142–156

browser exploitation

150

case study

181–187

core technologies

146–150

generally targeted phishing

145–146 , 145b–146b

hands-on challenge

187

individually targeted phishing

example

143b

overview

143

personal phishing

143–144

professional phishing

144–145 , 144b

malware

149–150

Metasploit

157f , 158f , 155–156

Social-Engineer Toolkit

153f , 151

email example

155f

main menu screenshot

152f

spear-phishing attack

151–153

transmission options

154f

web attack options

156t

web attacks

154

social networks

157–159

tools overview

150–151

Trojan horses

150

web applications

148f , 149f , 147–149

web forms

148f , 146–147

Photographs, social network attacks

162

PHP

DVWA

22

Mutillidae

22

Nmap banner grabbing

115–116

phpMyAdmin, web server testing case study

249 , 251f

Physical Address Extension (PAE), Xen

395

Ping methods

Httprint fingerprinting

121

noisy (IDS) testing case study

136–137

p0f passive OS fingerprinting

118

Ping.eu sample data

62f

router configuration

260–261

scanning process

98

verification, network boundary exploration

78

web server testing case study

248f

Plaintext

Kismet

336

network device case study

286

Nmap output options

104

PL/SQL, Oracle stored procedures

204

PMK

seePair-wise Master Key (PMK)

POC

seePoints of contact (POC)

Points of contact (POC), verification

76

POP3 server, Nmap banner grabbing

115–116 , 117

POP command, web server stack-based overflows

225 , 226f , 227f

Port 31337, Nmap port-scanning options

105–106

Port scanning

see alsoScanning (vulnerability assessment)

basic approach

97–98

enumeration timing

114

Nmap options

105–106

process

99

router identification

261

SMB considerations

127

stealthy penetration test case study

134

Unicornscan

108 , 109f

Pre-coded stored procedures, SQL Server

195–196

Prepended payload, custom malware

174 , 175f

Pre-production applications, enterprise application case study

313–314

Pre-Shared Keys (PSK)

see alsoWi-Fi Protected Access-Pre-Shared Key (WPA-PSK)

ike-scan

123

VPN device footprinting

271

PRGA

seePseudo Random Generation Algorithm (PRGA)

Primary domain name system (DNS) server, network device footprinting

268

Primary key, database definition

190

Privileges

database installation

192

Oracle databases

204

PRNG

seePseudo Random Number Generator (PRNG)

Production enterprise applications

case study

313–314

security

299

Professional phishing

basic considerations

144–145

example

144b

Project-specific penetration test lab, basic considerations

384

Protected Extensible Authentication Protocol (PEAP)

EAP encryption

328

WLAN vulnerabilities

324

Proxy methods

enumeration

111

fimap web application testing

241–242

Proxy servers

data capture

240

Nmap network device scanning

272

Pseudo Random Generation Algorithm (PRGA)

Aircrack-ng

347–348

Aireplay-ng

350

basic considerations

352

Pseudo Random Number Generator (PRNG), WEP attacks

329

PSK

seePre-Shared Keys (PSK)

Psychological considerations

commiseration in email

144

social network status udpates

164

PTW attacks

seePychkine-Tews-Weinmann (PTW) attacks

“Pull” real-time integration, enterprise applications

295

PUSH C command, web server stack-based overflows

225 , 226f

PUSH D command, web server stack-based overflows

225 , 226f

PUSH flag, port scanning

99

“Push” real-time integration, enterprise applications

295

Pychkine-Tews-Weinmann (PTW) attacks

Aircrack-ng

347 , 355 , 356

WEP attacks

328

Python script usage examples

dnsreverse.py

66

EXIF.py

168

fimap.py

242

forcedns.py

66

metagoofil.py

73

netxml2kml.py

341

theharvester.py

71

wafw00f.py

234