Table Of ContentBuilding a Pentesting Lab for
Wireless Networks
Build your own secure enterprise or home penetration
testing lab to dig into the various hacking techniques
Vyacheslav Fadyushin
Andrey Popov
BIRMINGHAM - MUMBAI
Building a Pentesting Lab for Wireless Networks
Copyright © 2016 Packt Publishing
All rights reserved. No part of this book may be reproduced, stored in a retrieval
system, or transmitted in any form or by any means, without the prior written
permission of the publisher, except in the case of brief quotations embedded in
critical articles or reviews.
Every effort has been made in the preparation of this book to ensure the accuracy
of the information presented. However, the information contained in this book is
sold without warranty, either express or implied. Neither the authors, nor Packt
Publishing, and its dealers and distributors will be held liable for any damages
caused or alleged to be caused directly or indirectly by this book.
Packt Publishing has endeavored to provide trademark information about all of the
companies and products mentioned in this book by the appropriate use of capitals.
However, Packt Publishing cannot guarantee the accuracy of this information.
First published: March 2016
Production reference: 1180316
Published by Packt Publishing Ltd.
Livery Place
35 Livery Street
Birmingham B3 2PB, UK.
ISBN 978-1-78528-315-4
www.packtpub.com
Credits
Authors Project Coordinator
Vyacheslav Fadyushin Izzat Contractor
Andrey Popov
Proofreader
Safis Editing
Reviewers
Edward Frye
Borja Merino Indexer
Hemangini Bari
Acquisition Editor
Reshma Raman Graphics
Kirk D'Penha
Disha Haria
Content Development Editor
Priyanka Mehta
Production Coordinator
Shantanu N. Zagade
Technical Editor
Siddhi Rane
Cover Work
Shantanu N. Zagade
Copy Editor
Roshni Banerjee
About the Authors
Vyacheslav Fadyushin (CISA, CEH, PCI ASV) is a security consultant and a
penetration tester with more than 9 years of professional experience and a diverse
background in various aspects of information security.
His main points of interest and fields of expertise are ethical hacking and penetration
testing, infrastructure and application security, mobile security, and information
security management.
He is also an author of the book, Penetration Testing: Setting Up a Test Lab How-to,
published by Packt Publishing in 2013.
I'd like to thank Vladimir Kozerovsky (CCNA) for his advice and
Olesya Sergeeva for her support. I also want to thank our content
development editors Aparna Mitra and Priyanka Mehta, who helped
us stick to the schedule.
Andrey Popov is a security consultant and penetration tester with rich professional
experience and a diverse background in infrastructure and application security,
information security management, and ethical hacking. He has been working for a
market-leading company along with another security professional since 2007.
About the Reviewers
Edward Frye is an information security professional with over 20 years of
experience in network engineering, systems administration, risk management, and
security and compliance across many industries, including the financial sector,
healthcare, and software/platform/infrastructure as a service (XaaS) industries.
He has focused primarily on security engineering and risk management since 2002.
He has a masters of science in information security and assurance, as well as many
industry certifications including CISSP, CCNA-Security, CEH, CHFI, and GIAC Web
Application Penetration Tester.
Borja Merino is a Spanish security researcher certified in OSCP, OSWP, OSCE,
Cisco CCSP, and SANS GREM. He has published several papers about pentesting
and exploiting and he is the author of the book, Instant Traffic Analysis with Tshark
How-to, Packt Publishing. He is a Metasploit community contributor and the
owner of http://www.shelliscoming.com/. You can follow him on Twitter
at @BorjaMerino.
www.PacktPub.com
eBooks, discount offers, and more
Did you know that Packt offers eBook versions of every book published, with PDF
and ePub files available? You can upgrade to the eBook version at www.PacktPub.com
and as a print book customer, you are entitled to a discount on the eBook copy. Get in
touch with us at [email protected] for more details.
At www.PacktPub.com, you can also read a collection of free technical articles, sign
up for a range of free newsletters and receive exclusive discounts and offers on Packt
books and eBooks.
TM
https://www2.packtpub.com/books/subscription/packtlib
Do you need instant solutions to your IT questions? PacktLib is Packt's online digital
book library. Here, you can search, access, and read Packt's entire library of books.
Why subscribe?
• Fully searchable across every book published by Packt
• Copy and paste, print, and bookmark content
• On demand and accessible via a web browser
Table of Contents
Preface vii
Chapter 1: Understanding Wireless Network Security and Risks 1
Understanding wireless environment and threats 1
An overview of wireless technologies 2
An overview of wireless threats 6
Wi-Fi media specifics 8
Common WLAN protection mechanisms and their flaws 11
Hiding SSID 11
MAC filtering 12
WEP 13
WPA/WPA2 15
Pre-shared key mode 16
Enterprise mode 18
WPS 19
Getting familiar with the Wi-Fi attack workflow 20
General Wi-Fi attack methodology 20
The active attacking phase 21
WPA-PSK attacks 22
Enterprise WLAN attacks 22
Summary 23
Chapter 2: Planning Your Lab Environment 25
Understanding what tasks your lab should fulfill 26
Objectives of a lab 26
Lab tasks 27
Network reconnaissance 28
Web application hacking 29
Hacking and researching network services 29
AD hacking 29
DBMS hacking 30
Network layer attacks 30
[ i ]
Table of Contents
Wi-Fi penetration testing 30
Planning the network topology 31
Choosing appropriate components 34
Network devices 35
Server and workstation components 37
Planning lab security 38
Access control 38
Integrated security mechanisms 39
Security solutions 41
Security hints 42
Summary 43
Chapter 3: Configuring Networking Lab Components 45
General lab network communication rules 45
Configuring hardware wired devices 47
Preparing the console connection on Windows 49
Core switch 51
Initial configuration 52
Configuring interfaces and VLANs 53
Hardening the core switch 58
Configuring subinterfaces and subnets 58
Configuring auxiliary services 60
Basic gateway hardening 62
Configuring virtual wired network devices 62
Network virtualization platform 63
Software installation 64
Initial configuration 65
Network topology implementation 68
Switch 69
Gateway 72
Virtual host emulation 73
Wireless hardware devices 74
Configuring WLANs 76
Guest WLAN 76
Preparing the hardware access point 77
Summary 78
Chapter 4: Designing Application Lab Components 79
Planning services 80
Creating virtual servers and workstations 82
VirtualBox overview and installation 82
Creating virtual machines 83
Configuring network settings of lab components 84
[ ii ]
Table of Contents
Installing and configuring domain services 86
Creating a domain 87
Creating users 89
Adding hosts to the domain 90
Certification authority services 92
Creating a root certificate 92
Creating a working certificate 93
Installing a root certificate 94
Installing a remote management service 94
Corporative e-mail service 96
Configuring a DNS server 96
Installing and configuring hMailServer 98
Installing vulnerable services 100
Installing web applications 100
Preparing a web server 101
WebGoat 103
DVWA 104
Liferay Portal 106
Metasploitable 109
Vulnerable VoIP server 111
Summary 112
Chapter 5: Implementing Security 113
Network-based security solutions 113
Configuring network access control 114
Isolating external and guest networks 114
Isolating internal VLANs 116
Securing wireless access 117
Preparing the RADIUS server 118
Preparing the certificates 119
Configuring RADIUS 120
Configuring the access point 121
Configuring the WLAN client 123
Installing a network intrusion detection system 124
Activating SPAN 124
Snort 125
Host-based security solutions 129
Workstation security 129
EMET 130
HIPS 133
Web application firewall 137
ClamAV 141
Installing 142
Configuring 142
[ iii ]
