1: Lab 5: challenge your hacking skills 2: Planning, organizing and performing penetration testing To perform penetratio

1: Lab 5: challenge your hacking skills 2: Planning, organizing and performing penetration testing To perform penetration testing, I am required to download virtualization software such as oracle virtual box. After downloading the virtual box, we will need software or an operating system to test for vulnerabilities. For this presentation, we will be using Metasploit 2 After downloading both software, we will be required to start by installing oracle virtual box to our windows computer, followed by configuring and installing Metasploit 2, a Linux-based operating system. When configuring Metasploit 2, we will ensure that we have allocated more than 2 gigabytes of Random access memory and more than 10 gigabytes of storage. In the oracle virtual box, we will ensure that the network adapter is set to NAT network to provide that both machines are in the same network and can see one another. After installing Metasploit 2 in the same virtual box with kali Linux, we will launch Nmap in kali Linux to get the IP address to Metasploit 2 and test it. After finding its IP address, we can conduct many attacks, including SQL injection and brute forcing attacks. 3: Why penetration testing is valuable to an organization Penetration testing is an important security measure for organizations because it helps identify vulnerabilities in their systems and networks. Penetration testing allows the organization to simulate real-world attacks, thus fixing security weaknesses before cybercriminals can exploit them. Improving security can help avoid data breaches, which can be costly financially and might ruin an organization's reputation. Penetration testing is considered a part of compliance as it is a vital tool in maintaining security and integrity of an organization's information systems. 4: Handling failures in a procedural way. I would begin handling failures by ensuring hardware systems meets their minimum requirements. I would carry out this step to ensure that compliance is met within the systems I would ensure that the network has been well configured and protected to eliminate security threats. Configuring the network effectively ensures that all machines can communicate with one another, and cyber criminals have a hard time exploiting the vulnerabilities. The last strategy would be ensuring that all programs are up to date to ensure that the developers have fixed possible bugs and updated the system configurations. This would be a vital strategy to ensure I can get improved features from the programs and that they have been fully optimized to eliminate cybersecurity threats and meet my system requirements. Part B 5: Nmap Scan Nmap, also known as a network mapper, is used to discover hosts and services on a computer network, thus creating a map of the systems connected to the network. Before using Nmap, I will use the ifconfig command to get the IP address of the kali Linux operating system. Our kali Linux IP address was 192.168.15.4  After getting the IP address, I gave Nmap a range of networks to scan, starting from 192.168.15.1-255/This allowed Nmap to scan the IP addresses in the networks, and I was able to get 192.168.15.5 as the IP address to Metasploit To get a scan report of Metasploit 2, I used Nmap –O followed by the Metasploit IP address. I could identify several ports open tied to the operating system and other details such as the mac address of the operating system.  I used the Nmap –SV command to detect the version of the operating system   6: Scanning Metasploit 2 using Nikto To scan Metasploit 2 using Nikto, I started using the terminal and ran Nikto, followed by the IP address to Metasploit 2 to scan the operating system. Nikto gave me several details associated with Metasploit, including the Metasploit version, Metasploit directories that were found, and the port that was open in Metasploit, among others. 7: Scanning Metasploit 2 using OWASP To scan Metasploit using OWASP, we need to start OWASP in Kali Linux. After running OWASP, a dialogue box will pop up suggesting the scan type. Under the URL to attack the automated scan, we will write the IP address to Metasploit two. OWASP will take time to scan Metasploit two and bring detailed results regarding the attack. 8: Nessus scan Nesses can best be described as a vulnerability scanner developed by Tenable, Inc. Nesses scanner is used to identify vulnerabilities in operating systems networks and system applications. Nesses can be used in assessing security vulnerabilities in information technology assets such as workstations, servers, web applications, and networking devices.  To scan Metasploit 2 using Nessus, we need to open and write the IP address to Metasploit 2 under the host to check. After scanning the system, Nesses will arrange the vulnerabilities depending on their severity and the operating system's damage. Here is a screenshot that highlights Metasploit vulnerabilities that were identified using Nesses. 9: Gap analysis based on the vulnerabilities identified The GAP analysis focuses on the vulnerability's current state, target state, implication, and the action that can be used in mitigating the exposure. The second vulnerability identified in the systems was the X-XSS protection header was not identified. This means that webpages listed on the server were at risk of experiencing cross-site scripting(XSS) attacks. The cyber security experts of the organization would specialize in the parameters that the users would use and also use more robust firewalls and passwords to prevent cyber criminals from infiltrating the systems.   Port 80 was identified as open on Nikto Scan, and its target state was closed. Attackers would easily use this port to access the systems and the data. Since the port is often encrypted, cybercriminals can exploit it, thus accessing data stored in the servers. Although the port is open, cyber security experts can configure it to prevent indicating system files, thus preventing criminals from accessing data using it. Another vulnerability found in the systems was the directory indexing was found. This allowed the contents listed in the active directories to be recorded, and attackers could access the system files. This vulnerability would be solved by disabling the directory indexing command, thus preventing cyber criminals from accessing the indexed files. Another vulnerability was that Apache 2.2.2 was out of date. If the apache server is outdated, cybercriminals will likely find loopholes and make their way to the system. This vulnerability can be fixed by the information technology teams updating the system with the latest apache server eliminating the vulnerability. Another vulnerability identified in the systems was that the HTTP trace method was active. This vulnerability allowed unprivileged users to abuse HTTP tracing to access sensitive information stored in the HTTP headers. This vulnerability would be solved by updating the Apache method that supported disabling HTTP tracing via the Trace Enable directive.   Part D 10: Logging in to Metasploit 2 VM Logging in to Metasploit 2 allowed me access to the files and applications preconfigured on the Linux-based operating system. After logging in to the operating system, I could use the shell box and find more information about the operating system, such as the IP address of the virtual machine, apache version and others. 11) Implementing changes To implement changes, I began by updating Metasploit 2, which allowed me to update the firmware and I made other changes such as disabling directory indexing, upgrading to the latest apache version eliminating vulnerabilities and also disabling the CGI Generic remote file inclusion as they were not only the programs that were in the most vulnerable state and they would do a lot of damage in the system. their cost of patching was less compared to the damage they would have done if they would be exploited for vulnerabilities.   13) Lessons learned from hardening my system I generally learned two main reasons for hardening the system which included minimizing the surface of attack and reducing security risks that cyber criminals could exploit.