“Georgia, Georgia…” The tune “Georgia on My Mind” was spinning through my head when I was given the chance to review “Penetration Testing: A Hands-On Introduction to Hacking,” a book by Georgia Weidman from No Starch Press. Having watched some of her conference presentations online and knowing the work she’s put into the Smartphone Pentest Framework (SPF), I’ve been looking forward to the opportunity to dive into the book for a while now, and her enthusiasm and efforts made it a worthwhile wait. Amazon’s book description includes the following:
“In Penetration Testing, security expert, researcher, and trainer Georgia Weidman introduces you to the core skills and techniques that every pentester needs. Using a virtual machine-based lab that includes Kali Linux and vulnerable operating systems, you’ll run through a series of practical lessons with tools like Wireshark, Nmap, and Burp Suite. As you follow along with the labs and launch attacks, you’ll experience the key stages of an actual assessment – including information gathering, finding exploitable vulnerabilities, gaining access to systems, post exploitation, and more.”
So with the new year upon us, this gives everyone the opportunity to dive into a topic whether it be for advancing your current career, jumping into a new one or simply to amaze your friends and families. Hacking news both good and bad are everywhere these days. It’s time for you to get into the game. Find out how Ms. Weidman can help.
If you’re doing any wireless penetration testing these days, odds are you have a WiFi Pineapple Mark IV from Hak5 in your toolkit. If you’re not a professional penetration tester or are just starting out with wireless hacking, the Pineapple is a device that will save you a considerable amount of headaches and is easily the best “all-in-one” tool for the job. This first article in a series of three tutorials is all about walking you through those first baby steps of configuration to get your new toy up and running. Part 1 starts with the Mark IV since many shops have this device already. Part 2 of this series covers the new Mark V, and Part 3 will show the device in action on a real pen test.
The first step to being successful in any endeavor is preparation, and the pineapple is no different. This tool packs a considerable amount of options into a small frame, and getting your new device up and running prior to “game time” is critical. We’ll show you how to set up your host computer’s network interfaces, the communication options to talk to the device, installing and configuring modules (known as Infusions), and more. So let’s get to it.
So, why write an article called “Cool and Illegal Wireless Hotspot Hacks” that details how to perform hotspot hacks? Some would say it is irresponsible and enables those with ill intent to hack unsuspecting victim’s machines. It really depends which way you look at it. Would you rather be left in the dark on what types of attacks can occur, how they are performed and not know how to protect yourself against them? Doing so would not make the threats go away; in part, you would simply be denying that they exist. Surely, it is safer to be open and honest about the threats, understand how they can occur then become educated on and implement the appropriate countermeasures. In large part, that is why my articles always detail not only how to perform the hacks, but really focus on how to protect against them. The purpose is not to teach people how to hack, but rather to educate on how to prevent systems from being exploited.
Now, on with the hacks/cracks/techniques that you will hopefully find to be “cool,” informative and which are most certainly illegal.
By Daniel V. Hoffman, CISSP, CWNA, CEH
Anyone interested in gaining a deeper knowledge of wireless security and exploiting vulnerabilities will need a good set of base tools with which to work. Fortunately, there are an abundance of free tools available on the Internet. This list is not meant to be comprehensive in nature but rather to provide some general guidance on recommended tools to build your toolkit. Please put these essential wireless hacking tools to safe, legal and ethical use. The rest is up to you.